Gitea

Recent Commits

• Giteabot(17 Aug 26)

  chore(deps): update dependencies (#38947)

• Mitrahsoft(17 Aug 26)

  fix(indexer): correct bleve indexer token filters (#38853) * fix #36228 * fix #37221 --------- Co-authored-by: wxiaoguang <[email protected]>

• GiteaBot(17 Aug 26)

  [skip ci] Updated translations via Crowdin

• wxiaoguang(16 Aug 26)

  fix: make "login_name" field optional for API edit user (#38917)

• wxiaoguang(16 Aug 26)

  chore: fix repo watch (#38921)

• GiteaBot(16 Aug 26)

  [skip ci] Updated translations via Crowdin

• Giteabot(15 Aug 26)

  fix(deps): update module golang.org/x/image to v0.45.0 [security] (#38930) Co-authored-by: bircni <[email protected]>

• bircni(15 Aug 26)

  fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#38935) The dashboard activity feed was paginated with `[ui.user] REPO_PAGING_NUM` instead of `[ui] FEED_PAGING_NUM`. The wrong setting was picked up when the page size was hoisted into a local variable in https://github.com/go-gitea/gitea/pull/34994, most likely copied from the `dashboardRepoList` block a few lines above. `REPO_PAGING_NUM` should only control repository lists. Fixes https://github.com/go-gitea/gitea/issues/38925

• GiteaBot(15 Aug 26)

  [skip ci] Updated translations via Crowdin

• bircni(14 Aug 26)

  docs: Update CHANGELOG for version 1.27.2 (#38923) Signed-off-by: bircni <[email protected]>

• Lunny Xiao(14 Aug 26)

  ci: remove AWS S3 uploads from release workflows (#38928) Release binaries and downloads have been served from Cloudflare R2 for a while now, so the AWS S3 upload is redundant. This removes the `configure aws` and `upload binaries to s3` steps from the nightly, RC and version release workflows. Since `configure-aws-credentials` no longer runs in those jobs, the `AWS_REGION: auto` workaround in the R2 step can be dropped as well. The `AWS_*` secrets for S3 can be removed from the repository settings afterwards.

• Giteabot(14 Aug 26)

  chore(deps): update dependency go to v1.26.6 (#38912)

• bircni(14 Aug 26)

  enhance(admin): show impersonation banner and keep password change with the user (#38924) Follow-up to https://github.com/go-gitea/gitea/pull/38614 --------- Co-authored-by: wxiaoguang <[email protected]>

• wxiaoguang(14 Aug 26)

  refactor: wiki edit form (#38918) 1. the fragile `document.querySelector('.repository.wiki.new .ui.form')!` is broken (again), rewrite to "data-global-init" * regression from #37571 because a new form was added 3. use "form-fetch-action" and JSON response instead of "RenderWithErrDeprecated"

• Mitrahsoft(14 Aug 26)

  docs(api): document 401/403 responses for user key endpoints (#38711)

• wxiaoguang(14 Aug 26)

  refactor: clean up form binding & validation (#38873) Clarify the "validation" and "error display" logic. All the copied&pasted `Validate` functions are removed.

• GiteaBot(14 Aug 26)

  [skip ci] Updated translations via Crowdin

• Ban Yongping(13 Aug 26)

  fix(migrations): use all configured GitHub tokens (#38841) GitHub migrations accept multiple comma-separated OAuth tokens, but clients with unknown rate data are never selected. After the first client is used, every later token stays unknown and can never participate in quota-aware selection. Select each client with unknown rate data once before falling back to the existing highest-remaining-rate choice. The regression test covers initial probing of all clients and then selection by remaining quota. Fixes https://github.com/go-gitea/gitea/issues/34342 Assisted-by: Codex:GPT-5 --------- Co-authored-by: silverwind <[email protected]>

• wxiaoguang(13 Aug 26)

  fix: update collaborator access mode (#38894) There is already AddOrUpdateCollaborator, don't duplicate the code.

• bircni(13 Aug 26)

  fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) `github.event.inputs` must mirror the raw `workflow_dispatch` payload, where GitHub keeps every input as a string. Only the separate `inputs` context preserves declared types, e.g. booleans. A previous fix coerced boolean inputs in the single map that fed both contexts, so `github.event.inputs.someBool` became a real boolean and comparisons like `== 'true'` stopped matching. `github.event.inputs` now stays string-only again. The `inputs` context used for server-side `if:` evaluation of needs-gated/matrix-deferred jobs re-coerces booleans independently, from the job's own workflow declaration, so that path keeps working correctly. Fixes https://github.com/go-gitea/gitea/issues/38896 --------- Co-authored-by: Zettat123 <[email protected]> Co-authored-by: silverwind <[email protected]>

• GiteaBot(13 Aug 26)

  [skip ci] Updated translations via Crowdin

• Zettat123(12 Aug 26)

  fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) Fixes #38773 ## Background Artifacts became attempt-scoped in #37119, and the runner-facing artifact APIs filter strictly by the attempt of the running job. "Re-run failed jobs" creates a new attempt whose passed-through jobs never upload their artifacts again, so a re-run job that downloads one of them fails with "artifact not found". ## Fix The read paths (v3 and v4 list and download) now resolve artifacts across the running job's attempt plus the attempts it inherits from, and an inherited artifact is shadowed by a same-named one from a newer attempt. ## Note GitHub's documentation does not document these behaviors. The conclusions below are based on manual testing, so consistency with GitHub cannot be guaranteed. - In a "partial re-run", a job can download artifacts uploaded by an earlier attempt, every attempt keeps its own copy of a name, and a lookup by name resolves to the newest one. - A full "Re-run all jobs" never downloads artifacts from earlier attempts. --------- Co-authored-by: bircni <[email protected]>

• wxiaoguang(12 Aug 26)

  refactor: external render (#38885) make the "command variable replacement" more accurate and OS-independent, add a test for it.

• bircni(12 Aug 26)

  fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) For a `pull_request_target` (PRT) run, Gitea loads the top-level workflow from the trusted base branch, but any local reusable workflow it calls (`uses: ./...`) was read from the PR **head** commit, which the fork author controls. ## Fix **Record the source commit where the content is read.** `DetectedWorkflow` now carries a `SourceCommitSHA` filled in next to `Content`, so the PRT detection pass at the base commit records the base SHA automatically. **Defense in depth.** `loadReusableWorkflowSource` pins the PR base commit for a PRT run's local `uses: ./...` rather than trusting the stored SHA. This also covers runs recorded before this change, whose rows still hold the head SHA and would otherwise resolve from the fork on rerun. Existing run rows are not migrated. --------- Co-authored-by: Zettat <[email protected]>

• bircni(12 Aug 26)

  enhance(repo): add default object format setting (#38877) Adds `[repository] DEFAULT_OBJECT_FORMAT` to default new repositories to `sha1` or `sha256`. Applies the setting to repository creation defaults in the UI and API, reducing repeated manual selection. Docs: https://gitea.com/gitea/docs/pulls/504 Fixes https://github.com/go-gitea/gitea/issues/38854 --------- Co-authored-by: wxiaoguang <[email protected]>

• Lunny Xiao(12 Aug 26)

  chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#38880) This is a prepare and required step for upcoming Gitea Official Mobile APP which supports login with OAuth2. The official Gitea mobile app needs the same mechanism. This adds a builtin application for it: | | | |---|---| | client ID | `b757811a-05c8-4c76-8d74-a5ee3d2073f2` | | config name | `gitea-app` | | display name | `Gitea App` | | redirect URI | `com.gitea.app://oauth/callback` | Unlike the existing entries, which are CLIs and can therefore use a loopback `http://127.0.0.1` redirect, a mobile app authorises through a system browser session (`ASWebAuthenticationSession` on iOS, Custom Tabs on Android) that can only receive a custom-scheme callback, hence the custom scheme here.

• bircni(12 Aug 26)

  docs: Adjust Changelog to include all Security relevant details (#38876) Signed-off-by: bircni <[email protected]>

• silverwind(12 Aug 26)

  fix(server): set `ReadHeaderTimeout` on HTTP servers (#38878) Add `ReadHeaderTimeout` which limits how long a client can take to send HTTP headers.

• GiteaBot(12 Aug 26)

  [skip ci] Updated translations via Crowdin

• somaz(11 Aug 26)

  fix(repo): avoid a repo-sized temp file for every bundle download (#38863) Bundle downloads run `git bundle create` into a temp file under `data/tmp/git-repo-content` and copy it to the response, so every download puts a second, repo-sized copy on disk before the first byte is sent. If the process dies mid-request that copy is stranded: the startup sweep only drops files older than 3 days, and cannot remove a directory that still holds a newer file. Streaming `git bundle create -` to the response removes that copy. `CreateArchive` above already uses the same gitcmd pattern, and the bundle bytes are unchanged (existing integration assertions on the exact length still pass). One consequence: git can now fail after output starts, so a mid-stream failure truncates the body instead of returning an error. I did not act on the TODO. A temp ref only works under `refs/heads/*`; with `refs/bundle/temp-*` the bundle carries no branch and clones empty, so I noted that on the TODO. Fixes https://github.com/go-gitea/gitea/issues/38447 --------- Co-authored-by: silverwind <[email protected]>