Commit graph

1668 commits

Author SHA1 Message Date
Maxim Cournoyer
419445fac9 fix: return the correct agit type in ssh_info (#8025)
The git-repo-go tool doesn't understand 'gitea'; it should be 'agit',
currently at version 1.

Relates-to: <https://github.com/go-gitea/gitea/pull/27014>
Fixes: forgejo/forgejo#8024
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8025
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Co-committed-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
2025-06-02 14:13:28 +02:00
Gusted
3a0f06800e fix: aggregate deleted team as ghost team (#7987)
- If a review was requested from a deleted team, use the ghost team for the comment aggregator.
- Resolves Codeberg/Community#1952
- Unit test added.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7987
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:27 +02:00
chavacava
e1753c413b chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994)
This PR replaces unnecessary calls to formatting functions (`fmt.Printf`, `fmt.Errorf`, ...) by non-formatting equivalents.
Resolves #7967

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7994
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: chavacava <chavacava@noreply.codeberg.org>
Co-committed-by: chavacava <chavacava@noreply.codeberg.org>
2025-06-02 14:13:27 +02:00
Gusted
14cac526af feat: add validating user password as trace region (#7981)
- Password hashing can take a measurable amount of time, make this more visible in the trace by capturing the computations done in the password hash in their own region.
- Ref: forgejo/forgejo#6470

## Screenshot

![image](/attachments/9834b094-a78f-4ac2-847e-91f221a84833)

The upper part are where the tasks are shown (and nothing else). The bottom part is where the interesting execution tracing happens and the part where the user password hashing happens is now properly indicated/highlighted and does not need to be inferred by looking at the stack traces.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7981
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:27 +02:00
0ko
1218d97c07 chore(ui): clean up hashbox CSS, small design changes (#7822)
Co-authored-by: Beowulf <beowulf@beocode.eu>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7822
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-06-02 14:13:26 +02:00
0ko
29e84bdc11 feat(ui): messages for empty usercards (#7947)
Show a message about list being empty, so the page doesn't look broken-ish empty.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7947
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2025-06-02 14:13:26 +02:00
famfo
36d17fd0f7 feat: relax email requirements (#7829)
The current email restrictions were put in place because of a security issue with sendmail (https://github.com/go-gitea/gitea/pull/17688). Remove this restriction and instead ensure that this security issue cannot happen with sendmail.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7829
Reviewed-by: Ellen Εμιλία Άννα Zscheile <fogti@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: famfo <famfo@famfo.xyz>
Co-committed-by: famfo <famfo@famfo.xyz>
2025-06-02 14:13:25 +02:00
Shiny Nematoda
e0edf60558 feat(ui): allow admins to reindex issues per repo (#7896)
Added a new option to reindex only a select repository.

The option is present under `[REPO_LINK]/settings` > Administrator Settings

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7896
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Lucas <sclu1034@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
Co-committed-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
2025-06-02 14:13:25 +02:00
Gusted
71cf4695c0 chore: QoL improvements to tests (#7917)
- Use mock helper functions, instead of home-brew solutions.
- Disable cron jobs that are not important to be run during integration tests and might even interfere.
- Avoid sleeping unnecessary, if there's some requirement then sleep or retry until that requirement is met.
- Avoid trying to deliver webhooks that will always result in a failure.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7917
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:25 +02:00
floss4good
0bc641e53d feat!: Abusive content reporting (#6977)
This implements milestones 1. and 4. from **Task F. Moderation features: Reporting** (part of [amendment of the workplan](https://codeberg.org/forgejo/sustainability/src/branch/main/2022-12-01-nlnet/2025-02-07-extended-workplan.md#task-f-moderation-features-reporting) for NLnet 2022-12-035):

> 1. A reporting feature is implemented in the database. It ensures that content remains available for review, even if a user deletes it after a report was sent.

> 4. Users can report the most relevant content types (at least: issue comments, repositories, users)

### See also:
- forgejo/discussions#291
- forgejo/discussions#304
- forgejo/design#30

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6977
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: floss4good <floss4good@disroot.org>
Co-committed-by: floss4good <floss4good@disroot.org>
2025-06-02 14:13:24 +02:00
Gusted
ab7bd68306 fix: remove artificial delay for PR update (#7773)
- I was not able to find a reasoning in the pull request (https://github.com/go-gitea/gitea/pull/9784) for the existence of this `time.Sleep`. The best I could come up with during manual testing is that there's a brief moment where 'this pull request is missing fork information' is shown, this was caused by an incorrect condition.
- Added integration test.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7773
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:22 +02:00
Beowulf
27520faf17 Show if commit is signed in activity feed and unify sha box (#6933)
Old activities are shown like before, new commits are displayed like commits in e.g. the commits list. _(Second commit)_

| New signed commits | Old (signed) commits |
|:--:|:--:|
| ![image](/attachments/cd81c761-eda6-44bf-8c43-ac3b7e6f16eb) | ![image](/attachments/243080f3-1b77-4ca7-bc03-bbf855c39c99) |

Additionally the sha box was moved in an own component to unify the usage. _(First commit)_

Closes #1824

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- User Interface features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/6933): <!--number 6933 --><!--line 0 --><!--description U2hvdyBpZiBjb21taXQgaXMgdmVyaWZpZWQgaW4gYWN0aXZpdHkgZmVlZCBvZiBhbiB1c2VyIG9yIGFuIG9yZ2FuaXphdGlvbiBmb3IgbmV3IGFjdGl2aXR5-->Show if commit is verified in activity feed of an user or an organization for new activity<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6933
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Beowulf <beowulf@beocode.eu>
Co-committed-by: Beowulf <beowulf@beocode.eu>
2025-06-02 14:13:22 +02:00
wxiaoguang
82f1661296 Fix some trivial problems (#34237)
1. Using existing "content" variable in `swift.go`
2. Do not report 500 server error in `GetPullDiffStats` middleware,
otherwise a PR missing ref won't be able to view.
3. Fix the abused "label button" when listing commits, there was too
much padding space, see the screenshot below.

(cherry picked from commit ba0deab6167236db89c975123570089452776599)
2025-06-02 14:13:22 +02:00
bytedream
d93e4aa100 Restore form inputs on organization create error (#34201)
Keeps the entered inputs when the "organization create" request
returns an error.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 18a673bad1d036502baca4491a16679692c42320)
2025-06-02 14:13:22 +02:00
Gabriel Bjørnager Jensen
7687684573 fix(ui): Improve chronological sorting of user (#7596)
This PR changes `newest` and `oldest` sorting under *Explore/User* and *Explore/Organization* to refer to the `created_unix` column rather than `id`.

Fixes: #7595

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7596
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Gabriel Bjørnager Jensen <gabriel@achernar.io>
Co-committed-by: Gabriel Bjørnager Jensen <gabriel@achernar.io>
2025-06-02 14:13:22 +02:00
0ko
0e9eed0425 fix(ui): multiple fixes of sync fork UI (#7740)
Followup to https://codeberg.org/forgejo/forgejo/pulls/2364
Replaces https://codeberg.org/forgejo/forgejo/pulls/7666

Fix multiple issues with the original implementation:
* `SyncFork` web handler used `{branch}` as a parameter, so it failed for branches with `/` in names
    * Originally I switched it to use `*` like other branch web handlers, but I found that it was easier to move it out from URL to POST request values
* Security: `SyncFork` web handler was using GET method, so just visiting the link was enough to execute the action
    * It was switched to POST done via form with CSRF, which also allowed to put branch name in it's values
* Security: in template, branch name was not escaped but rendered with `SafeHTML`, allowing for rendering fun characters like `&amp;` and for script execution. Also the link was not escaped correctly and would be leading to 404
    * To avoid having to change all translations, only the branch name+link part was changed and is now escaped with `HTMLFormat` before being passed to TrN

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7740
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2025-06-02 14:13:21 +02:00
Gusted
79becbb010 feat: consider WebAuthn & SSH for instance signing (#7693)
- Currently the options `pubkey` and `twofa` only consider TOTP and GPG keys respectively. Adjust the code to also consider WebAuthn credentials and SSH keys.
- While adding the new unified functions I noticed that certain places also benefited from using these unified functions and took the liberty (where it was either a trivial translation or it was covered under testing) to use the new unified functions.
- Resolves forgejo/forgejo#7658
- Adds unit and integration tests.

Documentation PR: https://codeberg.org/forgejo/docs/pulls/1166

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7693
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:20 +02:00
Gusted
b8d2bde7d9 fix: set default restricted for OAuth2 user (#7683)
- The OAuthCallback code that is responsible for creating a new user, if one does not exist yet, did not use `[service].ALLOW_ONLY_EXTERNAL_REGISTRATION` as default value for the restricted field of a user.
- Resolves forgejo/forgejo#7681
- Add integration test.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7683
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:20 +02:00
Gusted
6c1dc2ca0f chore: simplify GetDiff (#7682)
- Split `GetDiff` into two functions, `GetDiffSimple` and `GetDiffFull`. The former will do the bare minimum and really only get a Git diff while the latter does some extra stuff that's relevant for the frontend to show extra relevant.
- Use `GetDiffSimple` for API related calls, as they do not benefit nor are returning the extra information that `GetDiffFull` provides, this should show a measurable performance increase for API calls that returns commits and `/repos/{owner}/{repo}/pulls/{index}/files`.
- `GetDiffSimple` contains extra code comments about its interesting way to determine the before commit.
- Add unit tests to demonstrates that the logic for determining the before commit didn't change and the function still yields correct information.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7682
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:19 +02:00
Earl Warren
0f71d71806 fix: display the list of tasks in the runner edit page (#7650)
A regression was introduced in Forgejo v11.0 that caused the edit page of a runner (e.g. https://example.org/admin/actions/runners/434) to no longer display the tasks associated with the runner.

Fixes https://codeberg.org/forgejo/forgejo/issues/7643

---

When the fix is absent, the tests fail like so:

```
--- FAIL: TestRunnerDetails (0.03s)
    --- FAIL: TestRunnerDetails/first_page (0.00s)
        runners_test.go:36:
            	Error Trace:	/home/earl-warren/software/forgejo/routers/web/shared/actions/runners_test.go:36
            	Error:      	"[]" should have 30 item(s), but has 0
            	Test:       	TestRunnerDetails/first_page
    --- FAIL: TestRunnerDetails/second_and_last_page (0.00s)
        runners_test.go:43:
            	Error Trace:	/home/earl-warren/software/forgejo/routers/web/shared/actions/runners_test.go:43
            	Error:      	"[]" should have 10 item(s), but has 0
            	Test:       	TestRunnerDetails/second_and_last_page
FAIL
FAIL	forgejo.org/routers/web/shared/actions	0.170s
```

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- User Interface bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7650): <!--number 7650 --><!--line 0 --><!--description ZGlzcGxheSB0aGUgbGlzdCBvZiB0YXNrcyBpbiB0aGUgcnVubmVyIGVkaXQgcGFnZQ==-->display the list of tasks in the runner edit page<!--description-->
<!--end release-notes-assistant-->

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- User Interface bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7650): <!--number 7650 --><!--line 0 --><!--description ZGlzcGxheSB0aGUgbGlzdCBvZiB0YXNrcyBpbiB0aGUgcnVubmVyIGVkaXQgcGFnZQ==-->display the list of tasks in the runner edit page<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7650
Reviewed-by: cobak78 <cobak78@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-06-02 14:13:19 +02:00
christopher-besch
ba73e8123c Actions Done Notification (#7491)
This PR depends on https://codeberg.org/forgejo/forgejo/pulls/7510

This PR renames UpdateRunJob to UpdateRunJobWithoutNotification and UpdateRun to  UpdateRunWithoutNotification and implements wrapper functions that also call the new ActionRunNowDone notification when needed.

This PR can be reviewed commit-by-commit.

# Things to Test
- [x] GetRunBefore
- [ ] integration test for sendActionRunNowDoneNotificationIfNeeded, UpdateRun and UpdateRunJob

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Co-authored-by: nobody <nobody@example.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7491
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: christopher-besch <mail@chris-besch.com>
Co-committed-by: christopher-besch <mail@chris-besch.com>
2025-06-02 14:13:19 +02:00
Gusted
8b8df09907 fix: delay-write trace.dat for forgejo diagnosis (#7597)
- Delay the writing of `trace.dat` to the forgejo diagnosis zip file. It's not possible to write `cpu-profile.dat` and `trace.dat` at the same time. This caused the implemention to prematurely close `cpu-profile.dat` and leave it as an empty file.
- Regression of forgejo/forgejo#6470

## Testing
1. Go to `/admin/monitor`
2. Click on "Download diagnosis report"
3. Open the zip file and check that all files are non-empty.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7597
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:18 +02:00
Stefan
0aaf58fe32 fix: allow user with actions write permission to run a workflow from the web UI (#7245)
Users with permissions actions write can reschedule a workflow or start a new one over the API. But if the user try to use workflow dispatch on the web GUI it fails with 404 error.

Debug log says
```
router: completed POST /<owner>/<repo>/actions/manual for <client ip>, 404 Not Found in 21.6ms @ context/permission.go:17(web.registerRoutes.RequireRepoAdmin)
```

I think this is not correct, users with permissons action write should also be able to run a new workflow over the GUI. This can be fixed with this little change.

## Testing

- Create a repository in an organization with [a manual workflow](https://forgejo.org/docs/next/user/actions/#onworkflow_dispatch)
- Create a user and assign it action write permissions for this repository in a team
- Login as the user and verify they are allowed to run the workflow via the web UI

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- User Interface bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7245): <!--number 7245 --><!--line 0 --><!--description YWxsb3cgdXNlciB3aXRoIGFjdGlvbnMgd3JpdGUgcGVybWlzc2lvbiB0byBydW4gYSB3b3JrZmxvdyBmcm9tIHRoZSB3ZWIgVUk=-->allow user with actions write permission to run a workflow from the web UI<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7245
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Stefan <stku@noreply.codeberg.org>
Co-committed-by: Stefan <stku@noreply.codeberg.org>
2025-06-02 14:13:17 +02:00
Kemal Zebari
788d0d705f Add new CLI flags to set name and scopes when creating a user with access token (#34080)
Resolves #33474.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 55a69ae4c63ee8551eadb161cb901ba0a2a2e194)
2025-06-02 14:13:15 +02:00
christopher-besch
7819d9120f feat: move StopTask, CancelPreviousJobs and CleanRepoScheduleTasks to services/actions
This enables all action run state changes (from a not done to a done
state) to also send a notification.

Moved these:

- models/actions/task.go|423 col 6| func StopTask(ctx context.Context, taskID int64, status Status) error {
- models/actions/run.go|190 col 6| func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) error {
- models/actions/schedule.go|122 col 6| func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository, cancelPreviousJobs bool) error {
2025-06-02 14:13:15 +02:00
JakobDev
61ad6d5bc0 feat: sync forks (#2364)
This allows syncing a branch of a fork with a branch of the base repo. It looks like this:
![grafik](/attachments/4508920c-7d0b-4330-9083-e3048733e38d)
This is only possible, if the fork don't have commits that are not in the main repo.

The feature is already working, but it is missing Finetuning, a better API, translations and tests, so this is currently WIP. It is also not tested with go-git.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/2364): <!--number 2364 --><!--line 0 --><!--description c3luYyBmb3Jrcw==-->sync forks<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2364
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: JakobDev <jakobdev@gmx.de>
Co-committed-by: JakobDev <jakobdev@gmx.de>
2025-06-02 14:13:14 +02:00
Mathieu Fenniak
d27de9edff feat(ui): Automatically refresh workflows in the "Actions" list (#7361)
- Make the "Actions" list (for example, https://codeberg.org/forgejo/forgejo/actions) dynamically refresh using htmx and partial page reloading. This addresses a pet peeve of mine, I find it common to end up on this page and have workflows in-progress, but not be able to monitor the workflows to success or failure from the page as it currently doesn't do any data refreshing.
- There are a few major risks involves with this change.
  - Increased server-side load & network utilization.  In order to mitigate this risk, I have configured the refresh to occur every 30 seconds **only** when the Page Visibility API indicates that the web page is currently visible to the end-user. It is still reasonable to assume this change will increase server-side load though.
  - UI interactions on the page, such as the "Actor" and "Status" dropdown and the workflow dispatch form, would be replaced from the server with non-expanded UI during the refresh. This problem is prevented by stopping the refresh while these UIs are in their expanded states.
- E2E tests added.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7361
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-06-02 14:13:13 +02:00
Gusted
9b1b487292 chore(sec): unify usage of crypto/rand.Read (#7453)
- Unify the usage of [`crypto/rand.Read`](https://pkg.go.dev/crypto/rand#Read) to `util.CryptoRandomBytes`.
- Refactor `util.CryptoRandomBytes` to never return an error. It is documented by Go, https://go.dev/issue/66821, to always succeed. So if we still receive a error or if the returned bytes read is not equal to the expected bytes to be read we panic (just to be on the safe side).
- This simplifies a lot of code to no longer care about error handling.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7453
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:13 +02:00
Gusted
504b668e81 chore(i18n): cleanup settings.adopt string (#7451)
The translation of `settings.adopt` is not actually used, it is set as the title for a POST handler that does not actually render any template. It does render the the 'Internal server error' template, however for safety reasons it does not use the set context data.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7451
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:13 +02:00
Gnarwhal
3e38236e7a fix: handle viewing a submodule entry (#7261)
- When trying to view a submodule directory via the normal `/src/branch/` path, generate a redirect link to the submodule location.
- Resolves forgejo/forgejo#5267

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7261
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Gnarwhal <git.aspect893@passmail.net>
Co-committed-by: Gnarwhal <git.aspect893@passmail.net>
2025-06-02 14:13:13 +02:00
famfo
4c18778bbf feat(activitiypub): enable HTTP signatures on all ActivityPub endpoints (#7035)
- Set the right keyID and use the right signing keys for outgoing requests.
- Verify the HTTP signature of all incoming requests, except for the server actor.
- Caches keys of incoming requests for users and servers actors.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7035
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: famfo <famfo@famfo.xyz>
Co-committed-by: famfo <famfo@famfo.xyz>
2025-06-02 14:13:13 +02:00
Gusted
94b5daaf26 fix(i18n): fix several usages of i18n (#7422)
- Add new translations, if an existing one couldn't be used.
- Use existing translations, if one existed and fit the purpose.
- Spotted by the lint-locale-usage tooling by @fogti.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7422
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:12 +02:00
Lunny Xiao
ff2aee109a Hide activity contributors, recent commits and code frequrency left tabs if there is no code permission (#34053)
When a team have no code unit permission of a repository, the member of
the team should not view activity contributors, recent commits and code
frequrency.

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
(cherry picked from commit 49899070cd600e7b7bd31a750f4d49de1722db23)
2025-06-02 14:13:11 +02:00
Lunny Xiao
aeb72a289d Move ParseBool to optional (#33979)
(cherry picked from commit 25b6f388651c893ecafce918f27bef7e4ae9a967)
2025-06-02 14:13:11 +02:00
Gusted
877e358f53 fix: validate input for default_{merge,update}_style (#7395)
- Add `binding:"In(...)"` to the `default_merge_style` and `default_update_style` fields to only accept recognized merge and update styles.
- Resolves https://codeberg.org/forgejo/forgejo/issues/7389
- Added integration test for the API (`binding` works in the exact same way for the API and web routes).

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7395
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:11 +02:00
Ellen Emilia Anna Zscheile
85b49cde54 feat(repo,locale): merge PR/issues cases for some repo/issue strings (#7092)
- Merge `archive.nocomment` and `comment.blocked_by_user`'s variants for issue and pull request to a unified string and no longer have a issue and pull request variant.
- Fixes #6443

Signed-off-by: Ellen Emilia Anna Zscheile <fogti+devel@ytrizja.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7092
Reviewed-by: Panagiotis "Ivory" Vasilopoulos <git@n0toose.net>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Ellen Emilia Anna Zscheile <fogti+devel@ytrizja.de>
Co-committed-by: Ellen Emilia Anna Zscheile <fogti+devel@ytrizja.de>
2025-06-02 14:13:11 +02:00
Gusted
59381e63b9 feat: include a default robots.txt to reduce the impact of crawlers (#7387)
- Add a strong strict default robots.txt, if one is not provided by the instance administrators.
- Remove code for the legacy public asset path, the error has been logged for a few releases already (existed since v1.21).
- Resolves forgejo/forgejo#923

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7387
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:10 +02:00
Renovate Bot
7ba6d1698e Update module github.com/golangci/golangci-lint/cmd/golangci-lint to v2 (forgejo) (#7367)
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
2025-06-02 14:13:09 +02:00
0ko
0a1083b0bb ui: improve error pages (#7274)
* add testing
* make each page accessible via `/devtest/error`
* allow translating the `Page not found` part of the title
* code: improve consistency, remove unused
* devtest: put index page in a container to fix alignment
* 500: make navbar more like the real one, remove fake menu button
* deadcode: remove unused `func NotFound`: it was added in bdd32f152d and the only usage was removed in 1bfb0a24d8

Preview:
https://codeberg.org/attachments/1b75afb3-e898-410f-be02-f036a5400143

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7274
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-06-02 14:13:09 +02:00
Gusted
4e5e6f0553 chore: branding import path (#7337)
- Massive replacement of changing `code.gitea.io/gitea` to `forgejo.org`.
- Resolves forgejo/discussions#258

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7337
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Panagiotis "Ivory" Vasilopoulos <git@n0toose.net>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:08 +02:00
Gusted
242b080aac perf: optimize converting releases to feed items (#7221)
- `releasesToFeedItems` is called to convert release structs to feed items, which is then used to render RSS or Atom feeds.
- Optimize the loading of attributes for the releases, introduce `ReleaseList` type which uses caching to load repository and publishers. It also no longer loads release attachments and downloads counts as that is not used in feed items.
- Optimize the composing of meta by introducing caching, this operation is especially slow when the owner is an organization.
- Add unit test (ensures new `LoadAttributes` works correctly).
- Add integration test (ensures that feed output is still as expected).

Loading https://codeberg.org/forgejo/forgejo/releases.rss reduced from ~15s to ~1s. (It is currently is deployed on codeberg.org)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7221
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:03 +02:00
markturney
5ce5fbeeee feat(api): return run info for dispatched workflows (#7193)
- When the API endpoint `/repos/{owner}/{repo}/actions/workflows/{workflowname}/dispatches` is used to launch a workflow, it currently returns no data; `/repos/{owner}/{repo}/actions/tasks` can be used to track the progress of a workflow, but you need at least that workflow's run_id and the quantity of its child jobs. Tracking workflow progress is especially important if you want to chain together multiple workflows that exist within different repositories, which is desired for https://codeberg.org/forgejo/forgejo/issues/6312.
- Make it possible to track the progress of manually triggered workflows by modifying the `/repos/{owner}/{repo}/actions/workflows/{workflowname}/dispatches` to return a JSON object containing the triggered workflow's id and a list of its child job names.

Co-authored-by: Andrii Chyrva <achyrva@amcbridge.com>
Co-authored-by: Andrii Chyrva <andrii.s.chyrva@hotmail.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7193
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: markturney <markturney@gmail.com>
Co-committed-by: markturney <markturney@gmail.com>
2025-06-02 14:13:02 +02:00
Shiny Nematoda
8deae8406d feat(code search): replace fuzzy search with union search for indexer (#6947)
Fuzzy searching for code has been known to be problematic #5264 and in my personal opinion isn't very useful.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6947
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
Co-committed-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
2025-06-02 14:13:02 +02:00
0ko
540474b649 feat(ui): localize theme names (#7168)
Allow translating theme names. Not even for i18n reasons but because this way the menu is clearer and cleaner.

The number of translated entries is kept minimal for now. It is easy to pollute locales with these names otherwise.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7168
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2025-06-02 14:13:01 +02:00
Gusted
2108fdadfd fix: no notification for replies to pending comments (#7167)
- Replies to pending review comments no longer generate a notification, this was caused by an incomplete determination if the comment was part of the pending review or not.
- The logic was reworked to do the following if it's part of a pending review: It is not a single review and if it's a reply then the comment it is replying to is part of a pending review.
- Added integration test.
- Resolves forgejo/forgejo#7151

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7167
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-06-02 14:13:01 +02:00
0ko
99a6b13973 feat(ui themes): better place for theme list ctx, testing (#7163)
`AllThemes` is only used by `user/settings/appearance.tmpl`, not by all settings pages.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7163
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2025-06-02 14:13:00 +02:00
Dmitrii Sharshakov
89c3888b5e feat(auth): add ability to regenerate access tokens (#6963)
- Add the ability to regenerate existing access tokens in the UI. This preserves the ID of the access token, but generates a new salt and token contents.
- Integration test added.
- Unit test added.
- Resolves #6880

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6963
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Dmitrii Sharshakov <d3dx12.xx@gmail.com>
Co-committed-by: Dmitrii Sharshakov <d3dx12.xx@gmail.com>
2025-06-02 14:13:00 +02:00
Otto Richter
52422bff27 Drop SSPI auth support and more Windows files (#7148)
## Dropping SSPI auth support

SSPI authentication relied on Microsoft Windows support, removal started in https://codeberg.org/forgejo/forgejo/pulls/5353, because it was broken anyway. We have no knowledge of any users using SSPI authentication. However, if you somehow managed to run Forgejo on Windows, or want to upgrade from a Gitea version which does, please ensure that you do not use SSPI as an authentication mechanism for user accounts. Feel free to reach out if you need assistance.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7148
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Otto Richter <otto@codeberg.org>
Co-committed-by: Otto Richter <otto@codeberg.org>
2025-06-02 14:13:00 +02:00
Gusted
e138458de8 feat: improve error handling of commit rendering
- Simplify if-else expression to `NotFoundOrServerError`.
- I cannot find an existing scenario where `Getdiff` returns an error
and where it therefore should show a 404 error in the context of
rendering a diff of a commit. So simply return it as an Internal Server
Error, this also helps with debugging if an actual error occurs
here (404 errors are only logged at the DEBUG level).
- The first change is already covered under existing testing, the second
change is not trivial to test.
2025-06-02 14:12:59 +02:00
Litchi Pi
24d77dc5ae feat(ui): create a comment aggregator to reduce noise in issues (#6523)
Closes: https://codeberg.org/forgejo/forgejo/issues/6042
Continuation of: https://codeberg.org/forgejo/forgejo/pulls/6284
Replaces: https://codeberg.org/forgejo/forgejo/pulls/6285
Context: https://codeberg.org/forgejo/forgejo/pulls/6284#issuecomment-2518599

Create a new type of comment: `CommentTypeAggregator`

Replaces the grouping of labels and review request in a single place: the comment aggregator

The whole list of comments is "scanned", if they can get aggregated (diff of time < 60secs, same poster, open / close issue, add / del labels, add /del review req), they are added to the aggregator.
Once needed, the list of all the aggregated comments are replaced with a single aggregated comment containing all the data required.

In templates, have a specific HTML rendering part for the comment aggregator, reuse the same rendering as with the other types of comments.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6523
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Litchi Pi <litchi.pi@proton.me>
Co-committed-by: Litchi Pi <litchi.pi@proton.me>
2025-06-02 14:12:59 +02:00