fix(actions): restore pushes to protected branches (#39564)

Use the Actions token's loaded write permission when checking
protected-branch pushes. Preserve push and force-push allowlists and add
regression coverage.

Fixes https://github.com/go-gitea/gitea/issues/39563
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Giteabot <teabot@gitea.io>
This commit is contained in:
bircni authored and GitHub committed 2026-10-03 19:54:55 +02:00
1 parent cca466caae
commit 7641fc3a8c
9 files changed
+76 -25

No files matched your search

+2 -2
View File
@@ -123,8 +123,8 @@ func isUserAllowedToPushOrForcePushInRepoBranch(ctx context.Context, user *user_
}
if pb != nil { // override previous results if there is a branch protection rule
pb.Repo = repo
pushAllowed = pb.CanUserPush(ctx, user)
forcePushAllowed = pb.CanUserForcePush(ctx, user)
pushAllowed = pb.CanUserPush(ctx, user, repoPerm)
forcePushAllowed = pb.CanUserForcePush(ctx, user, repoPerm)
}
return pushAllowed, forcePushAllowed, nil
}