fix(actions): restore pushes to protected branches (#39564) (#39567)

Backport #39564 by @bircni

Use the Actions token's loaded write permission when checking
protected-branch pushes. Preserve push and force-push allowlists and add
regression coverage.

Fixes: https://github.com/go-gitea/gitea/issues/39563
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
This commit is contained in:
authored and GitHub committed 2026-10-03 18:12:17 +00:00
1 parent 7440f1e452
commit 1856fef7a8
9 files changed
+76 -25

No files matched your search

+2 -2
View File
@@ -123,8 +123,8 @@ func isUserAllowedToPushOrForcePushInRepoBranch(ctx context.Context, user *user_
}
if pb != nil { // override previous results if there is a branch protection rule
pb.Repo = repo
pushAllowed = pb.CanUserPush(ctx, user)
forcePushAllowed = pb.CanUserForcePush(ctx, user)
pushAllowed = pb.CanUserPush(ctx, user, repoPerm)
forcePushAllowed = pb.CanUserForcePush(ctx, user, repoPerm)
}
return pushAllowed, forcePushAllowed, nil
}