5671 Commits

Author	SHA1	Message	Date
jmiller	e98fca780e	fix: address org-governance release review (#727, #733) + dev deploy targeting ... Code-review findings on the org-governance release: - Fail closed on org-rule lookup error: getFirstMatchProtectedBranchRule swallowed FindOrgBranchRuleForBranch errors (returned nil,nil), silently dropping the org floor and falling back to the repo rule on a transient DB error. Propagate the error so the org rule stays enforced. - Stop the org rule locking out deploy-key and Actions-bot pushes: OrgProtectedBranch is team-only, so mergeMostRestrictive was ANDing the repo's WhitelistDeployKeys / WhitelistActionsUser (and the force-push, delete and merge counterparts) against the org side's always-false zero value, blocking every deploy-key and Actions push in any org with a matching branch rule. Carry those org-unmanaged fields through from the repo rule unchanged. - Org push-policy max-file-size now inspects only the pushed delta (diff-tree + cat-file --batch-check) instead of the full tip tree via ls-tree, so a pre-existing oversized file can no longer permanently block unrelated pushes. New branches (no base commit) still scan the full tree. Dev deploy targeting: - deploy-dev.yml drove the dev container image via `sed` on the SHARED compose file, but the pattern matched the *prod* service line (container_name: mokogitea) — leaving the dev service pinned to a stale image (so every "green" deploy recreated old code) while corrupting the prod image pin. Drive the dev service image from ${MOKOGITEA_DEV_TAG} instead; the env-var only affects the dev service. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 14:46:01 -05:00
jmiller	93365cdd95	docs(api): swagger annotations + response models for org-governance endpoints (#727, #738) ... Annotate the four previously undocumented org-governance API handlers (tag_protection, push_policy, repo_defaults, email_domain) with swagger:operation blocks, and register the swagger:response models the branch_protection operations already referenced. Register the org option DTOs in the parameterBodies hack so their definitions are emitted. Also fix pre-existing spec-generation blockers surfaced once the spec became regenerable: a stray comment glued to the repoUpdateManifest swagger block (broke YAML parsing), missing owner/repo path params on the manifest operations, a Manifest response registration, and missing definitions for EditAccessTokenOption, the IssueBulk* options, and the Issue{Priority,Status,Type}Def types. Regenerated v1_json.tmpl and v1_openapi3_json.tmpl; spec now validates cleanly against Swagger 2.0. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:58:08 -05:00
jmiller	5d797431f0	fix: repair pre-existing test-suite compile/vet failures ... `go vet ./...` (finally runnable with a local Go toolchain) surfaced three pre-existing failures that prevented the whole test tree from compiling — which is very likely why the "Project CI / Tests" job never went green. None relate to #727; all pre-existing on main. - modules/util/util_test.go: CryptoRandomInt/String/Bytes now return (value, error); the tests used single-value assignment. Updated to capture + assert the error (and dropped a now-redundant `var err error`). - tests/integration/auth_oauth2_test.go: `newFakeOIDCServer` was declared twice with different signatures (redeclaration = build failure). Renamed the config-struct variant to `newFakeOIDCServerWithConfig` and updated its caller; the (sub, oid) variant keeps the original name for its caller. - routers/web/repo/issue_comment.go: removed a redundant `&& statusIDStr != ""` duplicate condition (vet: redundant and). Verified: `go vet ./modules/util` clean; full `go vet ./...` re-run. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:23:04 -05:00
jmiller	125eefc650	fix: repair build (renamed org-visibility helper) + gofmt ... Two pre-existing issues surfaced when the org-governance series was compiled locally with a real Go toolchain (go1.26.3) for the first time: - routers/api/v1/api.go:519 called organization.HasOrgOrUserVisible, which no longer exists — it was renamed to IsOwnerVisibleToDoer (models/organization/ org.go:548, identical signature). This one missed call site meant the whole routers/api/v1 package (and therefore the server binary) failed `go build`. With the rename, `go build ./...` is clean. - gofmt: api.go (a mis-indented commented-out /projects route block) and release.go (import sort: repo before updateserver) were gofmt-dirty. Fixed with gofmt -w on the two files this change already touches. Not part of #727, but blocks building/releasing the fork; found while validating the dev -> main promotion (#733). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:06:48 -05:00
jmiller	6a3db171c1	feat(org): org-level email domain policy for members (#727) ... Restricts which email domains an organization's members may have. When a policy is configured, a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership choke point services/org.AddTeamMember, which every add path (API, web, group-sync) funnels through — so one check covers them all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add handler maps it to 422. - models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed (domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366. - API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy. - Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go. An empty policy imposes no restriction. This is the one bounded piece of the "access/security" tier; org 2FA-required and IP allowlists were deliberately NOT built here — they are cross-cutting enforcement (auth gating / request middleware) that needs a compiler + tests, not a blind stacked PR. Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the api team handler, gci order), typed-error detection, migration contiguous (366). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:23:11 -05:00
jmiller	d3134b1c53	feat(org): org-level repository defaults applied on repo create/transfer (#727) ... Adds a single per-org repository-defaults config, applied to a repo when it is created in or transferred into the org via a notifier (services/org): - ForcePrivate — force new/transferred repos private (Repository.IsPrivate). - PR defaults (when ApplyPRDefaults) — allowed merge styles, default merge style, and auto-delete-branch-after-merge, written to the repo's pull-requests unit config via repo_service.UpdateRepositoryUnits. Best-effort: the notifier logs and swallows errors, so a defaults bug can never break repository creation or transfer. - models/git/org_repo_defaults.go: OrgRepoDefaults model + CRUD + migration 365. - API: GET/PATCH/DELETE /orgs/{org}/repo_defaults. - services/org/notifier.go: CreateRepository/TransferRepository -> apply defaults; registered from routers/init.go (org_service.Init()). Stacked on #730/#729/#728 for migration ordering (this = 365). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct/DTO alignment), imports used, no Init() collision in services/org, migration contiguous (365), notifier signatures match the Notifier interface. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:22:38 -05:00
jmiller	3aac1b456c	feat(org): org-level push policy enforced in the pre-receive hook (#727) ... Adds a single per-org push policy that cascades to every repo of the org and is enforced in the pre-receive hook: - Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed. - Mandatory secret-scanning block-on-push — org can force secret blocking that a repo cannot disable (overrides the per-repo scanner config in the orchestrator). - Max pushed-file size — rejects a tip tree containing a blob over the limit. - Blocked file-path patterns — rejects pushes changing matching paths (reuses pull_service.CheckFileProtection). The two content checks (blocked paths, max size) FAIL OPEN on any error so a policy/parsing bug can never wedge all pushes; naming is fail-closed. - models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers + GetOrgPushPolicyForRepo. Migration 364. - API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go, DTOs in modules/structs/org_push_policy.go, wired in api.go). - Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths + max size; tag: naming) and services/security/orchestrator.go (secret mandate). Deferred: a repo-facing read-only view of the org push policy (it is an org-wide config, not per-repo overlay rules; readable via the API for now). Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations omitted (can't regenerate without the toolchain). Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree parser, imports used, migration contiguous (364), fail-open on content checks. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:20:39 -05:00
jmiller	b31336d1fe	feat(org): org-level tag protection, layered with per-repo protected tags (#727) ... Adds org-level tag protection as a parallel to org-level branch protection. An org tag rule is {NamePattern, AllowlistTeamIDs}; it cascades to every repo in the org and layers on top of the repo's own protected tags — a tag is controllable (push/delete) only if allowed at BOTH levels (fail-closed). - models/git/org_protected_tag.go: OrgProtectedTag model + CRUD + ToProtectedTag() (reuses the ProtectedTag matcher/allowlist logic) + IsUserAllowedToControlTagInRepo() which ANDs the repo decision with the org decision. Migration 363. - API: /orgs/{org}/tag_protections CRUD (routers/api/v1/org/tag_protection.go, DTOs in modules/structs/org_tag.go, wired in api.go). - Enforcement: the git push/delete hook (hook_pre_receive.go) and the two release paths (release.go create/delete) now call the layered check, so no per-site tag logic changes beyond swapping the helper. - View: the repo Tag settings page lists inherited org tag rules read-only. Stacked on #728 (branch-protection PR) for migration ordering — merge #728 first. Swagger annotations omitted (can't regenerate the swagger JSON without the toolchain); routes still register. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct alignment), template nesting balances, all .Rule fields exist on OrgProtectedTag, all locale keys defined, JSON valid, migration contiguous (363). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:37:18 -05:00
jmiller	4b68853f08	feat(org): add branch-deletion protection + expandable inherited-rule view (#727) ... Two related additions: 1. Branch deletion as an org-level ability. OrgProtectedBranch gained CanDelete / EnableDeleteAllowlist / DeleteAllowlistTeamIDs (migration 362), ToProtectedBranch maps them, and the API (create/edit/response DTOs + handlers) exposes enable_delete / enable_delete_allowlist / delete_allowlist_teams. The layering merge already combined delete fields, so org delete-protection now enforces once ToProtectedBranch populates them. 2. The repo Branch Protection view now renders each inherited org rule as an expandable detail (direct push, force-push, branch deletion, merge, required approvals, status checks, protected files) with team names resolved, instead of three headline badges. Still read-only. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Verified by hand: struct-field gofmt alignment, template block nesting balances, every .Rule field exists on OrgProtectedBranch, and all locale keys referenced in the template are defined. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:16:24 -05:00
jmiller	86bd8a2cad	feat(org): show inherited org branch-protection rules in repo settings (#727) ... The org "floor" is enforced implicitly at the choke point, so a repo admin couldn't see which org-level rules apply to their repo. Surface them in the repo's Branch Protection settings page (read-only), the way GitHub shows organization rulesets in a repository. - ProtectedBranchRules handler: when the owner is an org, load FindOrgProtectedBranchRules and expose them as OrgProtectedBranches. - branches.tmpl: new read-only "Organization Branch Protection" section listing each org rule with an "Organization" badge, a lock/read-only marker, and compact indicators (required approvals, signed commits, status checks). No edit/delete controls — these are managed at the org level. - en-US locale strings. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 20:25:24 -05:00
jmiller	0cc569aef6	fix: render org teams list and make issue type editable (#720, #721) ... #720: org Teams page wrote ctx.Data["OrgListTeams"] but the template iterates .Teams, so no teams rendered. Use the canonical Teams key (matches org/home.go). #721: issue type sidebar gated editing on a FieldEditFlags data key that no handler sets (always nil -> always read-only). Use HasIssuesOrPullsWritePermission like the priority field; the /custom-type endpoint is already protected by reqRepoIssuesOrPullsWriter.	2026-07-04 16:27:32 -05:00
jmiller	7c75133ef1	feat: code security scanner with OWASP pattern detection (#552) ... Implements the code analysis scanner module that detects insecure patterns across Go, PHP, Python, JavaScript, and TypeScript: - SQL injection (CWE-89): string concat in queries across 4 languages - XSS (CWE-79): innerHTML, document.write, unescaped output, dangerouslySetInnerHTML - Command injection (CWE-78): exec with variables, shell=True, os.system - Path traversal (CWE-22): unsanitized path joins, file open with user input - Insecure deserialization (CWE-502): unserialize(), yaml.load() - Hardcoded credentials (CWE-798): password assignments in source - Weak cryptography (CWE-327): MD5/SHA-1 usage 22 rules total, language-filtered by file extension. Wired into the existing scanner orchestrator via the CodeScanner config toggle. API updated to expose code_scanner in GET/PATCH security config. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 08:15:34 -05:00
jmiller	23bb025700	merge: incorporate main into dev for release PR #714 ... Resolve CHANGELOG conflict — deduplicate feature entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 04:35:52 -05:00
jmiller	98301bc92b	merge: incorporate latest dev (post status-presets merge) into cascade-merge ... Resolve CHANGELOG conflict, restore issue_metadata.go from dev. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:51:37 -05:00
jmiller	5a25068d81	merge: incorporate dev changes into feature/cascade-merge ... Resolve CHANGELOG.md and api.go conflicts — keep both cascade_rules and security route groups. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:48:52 -05:00
jmiller	57894e25fd	merge: incorporate dev changes into feature/status-presets ... Resolve CHANGELOG.md conflict — keep both status presets and default teams entries. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:47:37 -05:00
jmiller	cf25eef480	fix: distinguish unknown preset from DB errors in ApplyIssueStatusPreset ... db.ErrNotExist returns 404, other errors return 500 instead of masking all errors as 404. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:34:07 -05:00
jmiller	5da6a40f10	fix: resolve merge conflict marker and fix import paths in cherry-picked tests ... - Remove residual <<<<<<< HEAD marker from api_org_test.go - Convert code.gitea.io/gitea to mokoconsulting paths in 5 new test files: cmd/serv_test.go, models/auth/twofactor_test.go, modules/git/commit_info_nogogit_test.go, routers/private/hook_pre_receive_test.go, services/actions/notifier_helper_test.go - Add changelog entries for new features (#460, #507, #513) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 03:31:44 -05:00
jmiller	4e5aa5f3ce	fix: revert accidental secret scanning code from security fix branch ... The pre-receive hook had security scanning code from the wrong feature branch (feature/secret-scanning-clean). Restoring to the correct state with only upstream security cherry-picks. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:37:49 -05:00
jmiller	9a4aa0fafb	fix: log error when pre-receive secret scan cannot read commit ... Previously, GetCommit failures were silently swallowed, allowing pushes to proceed without scanning. Now logs the error so admins can diagnose issues while still allowing the push. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:35:50 -05:00
jmiller	e947600ea7	fix: log error when pre-receive secret scan cannot read commit ... Previously, GetCommit failures were silently swallowed, allowing pushes to proceed without scanning. Now logs the error so admins can diagnose issues while still allowing the push. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:35:11 -05:00
jmiller	b0bbaab621	docs: add security section to changelog for upstream v1.26.3/v1.26.4 fixes ... Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:35:07 -05:00
jmiller	84df5d7932	feat: register security scanning API routes in router ... Adds /repos/{owner}/{repo}/security/* route group for security alert management, scanning, and configuration endpoints. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:33:29 -05:00
jmiller	7b334f94c0	feat: security scanning API endpoints + pre-receive hook blocking (#692) ... Add REST API for security alerts (list, get, update status, trigger scan) and scanner config (get, update). Wire block_on_push into the pre-receive hook so pushes containing detected secrets are rejected with details. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:30:04 -05:00
jmiller	805c566615	fix: remove leaked security scanning routes from cascade-merge branch ... The security route group belongs to feature/secret-scanning (#692) and was accidentally committed here during parallel agent work. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:29:27 -05:00
jmiller	f53bc895ba	fix: prevent IDOR in CopyStatusesFromOrg endpoint ... Add source org visibility + membership check before copying statuses. Non-public source orgs now require the doer to be a member or site admin, preventing unauthorized enumeration of private org statuses. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:26:23 -05:00
bircni	c0f89a373d	fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183) ... Backport #38009 The OAuth2 sign-in callback unconditionally set IsActive=true on the local user row whenever the IdP authenticated them, silently undoing an administrator's "Disable Account" action and granting the user a fresh session in the same response. Treat the local IsActive flag as an authoritative admin override: inactive users get a session and are routed through the existing activate / prohibit-login pages by verifyAuthWithOptions, matching the local-credentials sign-in path. Adds an integration regression test that disables a linked local user and asserts the row stays IsActive=false after a full OIDC callback. Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:24:00 -05:00
bircni	94590bc834	fix: allow git clone of private repos with anonymous code access (#38074) (#38146) ... Backport #38074 Fixes #38062. Private repositories with a code unit configured for **anonymous read access** (Settings → Public Access → Code: anonymous view) could not be cloned without credentials. The git HTTP auth gate (`httpBase`) only bypassed authentication for non-private repos, ignoring the per-unit anonymous access setting entirely. - Check anonymous permissions via `access_model.GetDoerRepoPermission(ctx, repo, nil)` + `CanAccess` before requiring auth on pull operations, so the per-unit `AnonymousAccessMode` is respected through the existing permission model - This also correctly handles `setting.Repository.ForcePrivate` (which the naive direct-field check would have missed) - Push (receive-pack) and `RequireSignInViewStrict` continue to require credentials as before Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:23:33 -05:00
bircni	cbf34fb987	fix: Various security fixes (#38103) (#38151) ... Backport #38103 - Enforce org visibility on organization label read endpoints (private org labels no longer leak to non-members). - Block fork sync (`merge-upstream`) when the base repo is no longer readable (stops pulling commits after a parent goes private). - Remove `REVERSE_PROXY_LIMIT` / `REVERSE_PROXY_TRUSTED_PROXIES` from the Docker `app.ini` templates (the `= *` default allowed `X-WEBAUTH-USER` impersonation; reverse-proxy auth is now opt-in and admin-configured). - Enforce single-use TOTP passcodes across web login, password-reset, and Basic-Auth `X-Gitea-OTP` (fixes a TOCTOU race and a stateless replay). - Re-check branch write permission for every ref in a push (the pre-receive hook cached the first ref's result, letting a per-branch maintainer-edit grant escalate to full repo write). --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-28 02:22:18 -05:00
Lunny Xiao	26ad4fd03f	fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141) ... Backport #37875 This fixes an OIDC sign-in edge case where a stale `external_login_user` record can still point to an organization or a deleted user. In that situation, Gitea may keep resolving the external login to the wrong account during sign-in. For affected instances, this matches the behavior reported in #36439 and #37812, where a user signing in with OIDC/Entra ID could appear as an organization, or hit a 404 after that organization was removed. - validate the user resolved from `external_login_user` during OAuth2/OIDC login - ignore stale links when the linked user no longer exists - ignore stale links when the linked user is not an individual user - remove the stale external login row so the sign-in flow can relink the external account to the correct user - Fixes #37812 - Related to #36439 Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com> Co-authored-by: bircni <bircni@icloud.com>	2026-06-28 02:20:21 -05:00
bircni	bc578b7eba	fix: Various sec fixes (#38108) (#38147) ... Backport #38108 - Enforce repository token scope on RSS/Atom feed endpoints so a PAT without repo scope can no longer read private repo commit data. - Block HTTP redirects during repository migration clones to prevent SSRF reaching internal addresses via an attacker-controlled redirect. - Redact the notification subject after repo access is revoked so private issue/PR metadata is no longer leaked through the notification API. Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2026-06-28 02:18:12 -05:00
jmiller	f627219ca8	feat: cascade merge — auto-create PRs to downstream branches after merge (#460) ... Adds configurable cascade rules per repo. When a PR merges into a source branch, the system auto-creates PRs to each configured target branch. Skips if a matching PR already exists. - Model: CascadeMergeRule (repo_id, source, target, enabled, auto_merge) - Migration v362 creates cascade_merge_rule table - Notifier hooks into MergePullRequest/AutoMergePullRequest events - API: CRUD at /repos/{owner}/{repo}/cascade_rules (admin only) Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:06:42 -05:00
jmiller	df9305758f	feat: add issue status presets and cross-org migration (#507) ... 4 built-in presets: default, software-development, support-tickets, bug-tracking. API endpoints to list presets, apply to org, and copy statuses between orgs. Web UI dropdown on org settings page. Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-28 02:05:14 -05:00
jmiller	4178e7f23e	feat: add delete allowlist for branch protection rules (#696) ... Add configurable per-user/team/deploy-key allowlist for deleting protected branches. Previously, protected branches could never be deleted via git push. Now admins can configure deletion permissions with the same granularity as force-push allowlists. - 6 new model fields: CanDelete, EnableDeleteAllowlist, DeleteAllowlistUserIDs/TeamIDs, DeleteAllowlistDeployKeys, DeleteAllowlistActionsUser - CanUserDelete() method with admin-level default (higher than push) - Migration v361 adds columns to protected_branch table - Pre-receive hook checks delete allowlist instead of unconditional block - CanDeleteBranch service uses CanUserDelete instead of IsBranchProtected - API create/edit endpoints support delete allowlist fields - Web UI settings page with radio buttons and user/team dropdowns - 12 new locale strings for the delete allowlist UI Claude-Session: https://claude.ai/code/session_011AAFzotGMf3ayvXhEmStCd	2026-06-27 15:35:13 -05:00
Giteabot	9db67cd554	fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895) ... Backport #37660 by @jorgeortiz85 ## Summary Fixes #37528 This PR makes the workflow dispatch API reject workflows that do not declare `workflow_dispatch`. Previously, `POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches` could create an `ActionRun` for a workflow that only declared another event such as `push`. The service now validates that the target workflow has a `workflow_dispatch` trigger before inserting the run. The API maps that validation failure to `422 Unprocessable Entity`, matching existing validation failures in this handler. The regression test creates a push-only workflow, dispatches it through the public API, asserts the `workflow_dispatch` validation message, and verifies that no run was inserted. ## Testing - `go test ./services/actions` - `TAGS="sqlite sqlite_unlock_notify" make test-integration#TestWorkflowDispatchPublicApiRequiresWorkflowDispatchTrigger` - `TAGS="sqlite sqlite_unlock_notify" make test-integration#TestWorkflowDispatchPublicApi` ## Disclosure Developed with assistance from OpenAI Codex. Co-authored-by: Jorge Ortiz <jorge.ortiz@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-06-26 21:40:12 -05:00
Giteabot	a063c3b2e4	fix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892) ... Backport #37885 by @silverwind Fixes https://github.com/go-gitea/gitea/issues/37871, full backwards and forwards compatible with runners. Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2026-06-26 21:40:01 -05:00
Nicolas	ad06fa7bec	fix(pull): handle empty pull request files view to allow reviews (#37783) (#37785) ... Backport #37783 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-26 21:36:28 -05:00
jmiller	f7c2b205c5	fix: reject empty token update requests with 400	2026-06-25 09:58:00 -05:00
jmiller	d2d7c0a762	feat: add ability to edit API token scopes (#697) ... Add PATCH /users/{username}/tokens/{id} API endpoint and web UI edit button so token scopes can be modified after creation without having to delete and recreate the token.	2026-06-25 09:57:59 -05:00
jmiller	49f6380fa4	feat: add licensing API token scope (#697) ... Add read:licensing / write:licensing token scope category so licensing endpoints are guarded by the same permission system as all other API endpoints. Public-only tokens are rejected for licensing endpoints.	2026-06-25 09:22:15 -05:00
Jonathan Miller	5c43cf1f02	fix(metadata): support partial updates — only sent fields are changed ... Previously PUT /metadata replaced all fields, wiping any not included in the request. Now loads existing metadata first and merges only the fields present in the JSON body.	2026-06-23 17:28:40 -05:00
Jonathan Miller	c8c74c7afe	fix: handle DB errors in licensing API, fix wiki API URL-decode fallback ... - licensing/manage.go: capture Update/Delete errors instead of silently discarding them (UpdateLicense, UpdateTier, DeleteTier) - wiki.go API: fix findEntryForFile to allow URL-decode fallback for non-ASCII page names (was returning on ErrNotExist instead of falling through)	2026-06-23 17:25:47 -05:00
Jonathan Miller	7b68963b67	feat(metadata): add deploy fields to repo metadata API (#692) ... - Migration v360: adds deploy_host, deploy_port, deploy_user, deploy_path, docker_image, docker_registry, container_name, health_url to repo_manifest - API: GET/PUT /metadata now includes deploy fields - Settings: preserve deploy fields on web UI save - Remove 4 unneeded workflows (gitleaks, npm-publish, notify, workflow-sync) - gitleaks will become built-in (#692) - npm-publish/notify not applicable to Go repo - workflow-sync moving to MokoCLI	2026-06-23 14:32:31 -05:00
Jonathan Miller	1178975be3	feat(wiki): full-text search across wiki pages (#550) ... - Web: WikiSearch handler with case-insensitive search of titles and content - Web: search.tmpl with search form and results display - Web: "Search wiki" link added to wiki dropdown menu - API: GET /wiki/search?q=term endpoint with pagination - Recursive traversal handles nested folder wikis	2026-06-23 12:05:48 -05:00
Jonathan Miller	4d1be56bad	fix: move CategoryPage type to package level to fix compile error ... CategoryPage was defined inside WikiCategory() but referenced by scanCategoryEntries() which is a top-level function. Renamed to wikiCategoryPage and moved to package scope.	2026-06-23 07:40:19 -05:00
Jonathan Miller	2dc745c5fa	feat(wiki): print view, ZIP export, and folder access control (#674, #675) ... Print view: clean rendering without navigation chrome for printing. ZIP export: download entire wiki as ZIP archive of markdown files. Folder ACL: _access.yml per-folder write protection with role checks. Resolve merge conflicts between #674 and #675 implementations.	2026-06-22 08:51:58 -05:00
jmiller	6ceef765eb	feat(wiki): per-folder access control via _access.yml (#674)	2026-06-22 01:12:47 +00:00
jmiller	249b639c70	feat(wiki): per-folder access control via _access.yml (#674)	2026-06-22 01:05:43 +00:00
Jonathan Miller	827025bd17	feat(wiki): enhanced ToC — collapsible, inline, sticky, frontmatter control (#673) ... ToC can be controlled via frontmatter: toc=false disables, toc=inline shows at top of content instead of sidebar. Sidebar ToC is now collapsible via <details> and sticky on scroll. Inline ToC also uses collapsible <details> with "Contents" header.	2026-06-21 19:33:57 -05:00
Jonathan Miller	98da1644be	feat(wiki): template transclusion — reusable content blocks (#671) ... Add {{template:Name|key=val}} syntax for embedding reusable content. Templates stored as _Template/Name.md with {{{key}}} parameter substitution. Recursive with depth limit of 5. _Template folder hidden from sidebar tree.	2026-06-21 19:05:12 -05:00