fix(actions): restore pushes to protected branches (#39564) (#39567)

Backport #39564 by @bircni

Use the Actions token's loaded write permission when checking
protected-branch pushes. Preserve push and force-push allowlists and add
regression coverage.

Fixes: https://github.com/go-gitea/gitea/issues/39563
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>

services/context/repo.go

@@ -190,7 +190,7 @@ func PrepareCommitFormOptions(ctx *Context, doer *user_model.User, targetRepo *r
 	protectionRequireSigned := false
 	if protectedBranch != nil {
 		protectedBranch.Repo = targetRepo
-		canPushWithProtection = protectedBranch.CanUserPush(ctx, doer)
+		canPushWithProtection = protectedBranch.CanUserPush(ctx, doer, doerRepoPerm)
 		protectionRequireSigned = protectedBranch.RequireSignedCommits
 		// If branch-wide push is restricted, allow direct commit when the
 		// URL-derived tree path matches an unprotected file pattern. The

services/convert/convert.go

@@ -113,7 +113,7 @@ func ToBranch(ctx context.Context, repo *repo_model.Repository, branchName strin
 			return nil, err
 		}
 		bp.Repo = repo
-		branch.UserCanPush = bp.CanUserPush(ctx, user)
+		branch.UserCanPush = bp.CanUserPush(ctx, user, permission)
 		branch.UserCanMerge = git_model.IsUserMergeWhitelisted(ctx, bp, user.ID, permission)
 	}
 

services/pull/update.go

@@ -123,8 +123,8 @@ func isUserAllowedToPushOrForcePushInRepoBranch(ctx context.Context, user *user_
 	}
 	if pb != nil { // override previous results if there is a branch protection rule
 		pb.Repo = repo
-		pushAllowed = pb.CanUserPush(ctx, user)
-		forcePushAllowed = pb.CanUserForcePush(ctx, user)
+		pushAllowed = pb.CanUserPush(ctx, user, repoPerm)
+		forcePushAllowed = pb.CanUserForcePush(ctx, user, repoPerm)
 	}
 	return pushAllowed, forcePushAllowed, nil
 }

services/repository/branch.go

@@ -447,7 +447,7 @@ func RenameBranch(ctx context.Context, repo *repo_model.Repository, doer *user_m
 	if err != nil {
 		return "", err
 	}
-	if rule != nil && !rule.CanUserPush(ctx, doer) {
+	if rule != nil && !rule.CanUserPush(ctx, doer, perm) {
 		return "", git_model.ErrBranchIsProtected
 	}
 

services/repository/files/patch.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/git"
@@ -88,7 +89,11 @@ func (opts *ApplyDiffPatchOptions) Validate(ctx context.Context, repo *repo_mode
 		}
 		if protectedBranch != nil {
 			protectedBranch.Repo = repo
-			if !protectedBranch.CanUserPush(ctx, doer) {
+			perm, err := access.GetDoerRepoPermission(ctx, repo, doer)
+			if err != nil {
+				return err
+			}
+			if !protectedBranch.CanUserPush(ctx, doer, perm) {
 				return ErrUserCannotCommit{
 					UserName: doer.LowerName,
 				}

services/repository/files/update.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	git_model "gitea.dev/models/git"
+	"gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/git"
@@ -667,7 +668,11 @@ func VerifyBranchProtection(ctx context.Context, repo *repo_model.Repository, gi
 		protectedBranch.Repo = repo
 		globUnprotected := protectedBranch.GetUnprotectedFilePatterns()
 		globProtected := protectedBranch.GetProtectedFilePatterns()
-		canUserPush := protectedBranch.CanUserPush(ctx, doer)
+		perm, err := access.GetDoerRepoPermission(ctx, repo, doer)
+		if err != nil {
+			return err
+		}
+		canUserPush := protectedBranch.CanUserPush(ctx, doer, perm)
 		for _, treePath := range treePaths {
 			isUnprotectedFile := false
 			if len(globUnprotected) != 0 {