feat: Add audit logging (#38189)

Co-authored-by: bircni <bircni@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

cmd/admin.go

@@ -54,6 +54,9 @@ func newAuthCommand() *cli.Command {
 	return &cli.Command{
 		Name:  "auth",
 		Usage: "Modify external auth providers",
+		Before: func(ctx context.Context, _ *cli.Command) (context.Context, error) {
+			return cliAuditContext(ctx), nil
+		},
 		Commands: []*cli.Command{
 			microcmdAuthAddOauth(),
 			microcmdAuthUpdateOauth(),

cmd/admin_auth_ldap.go

@@ -10,6 +10,7 @@ import (
 
 	"gitea.dev/models/auth"
 	"gitea.dev/modules/util"
+	auth_service "gitea.dev/services/auth"
 	"gitea.dev/services/auth/source/ldap"
 
 	"github.com/urfave/cli/v3"
@@ -221,8 +222,8 @@ func microcmdAuthUpdateLdapSimpleAuth() *cli.Command {
 func newAuthService() *authService {
 	return &authService{
 		initDB:            initDB,
-		createAuthSource:  auth.CreateSource,
-		updateAuthSource:  auth.UpdateSource,
+		createAuthSource:  auth_service.CreateSource,
+		updateAuthSource:  auth_service.UpdateSource,
 		getAuthSourceByID: auth.GetSourceByID,
 	}
 }

cmd/admin_user.go

@@ -4,6 +4,8 @@
 package cmd
 
 import (
+	"context"
+
 	"github.com/urfave/cli/v3"
 )
 
@@ -11,6 +13,9 @@ func newUserCommand() *cli.Command {
 	return &cli.Command{
 		Name:  "user",
 		Usage: "Modify users",
+		Before: func(ctx context.Context, _ *cli.Command) (context.Context, error) {
+			return cliAuditContext(ctx), nil
+		},
 		Commands: []*cli.Command{
 			microcmdUserCreate(),
 			newUserListCommand(),

cmd/audit.go

@@ -0,0 +1,17 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+
+	audit_model "gitea.dev/models/audit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/audit"
+)
+
+func cliAuditContext(ctx context.Context) context.Context {
+	ctx = audit.WithOrigin(ctx, audit_model.OriginCLI)
+	return audit.WithDoer(ctx, user_model.NewCLIUser())
+}

cmd/web.go

@@ -15,6 +15,7 @@ import (
 	"strings"
 	"time"
 
+	audit_model "gitea.dev/models/audit"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/gtprof"
@@ -26,6 +27,7 @@ import (
 	"gitea.dev/modules/util"
 	"gitea.dev/routers"
 	"gitea.dev/routers/install"
+	"gitea.dev/services/audit"
 
 	"github.com/felixge/fgprof"
 	"github.com/urfave/cli/v3"
@@ -226,7 +228,14 @@ func serveInstalled(c *cli.Command) error {
 
 	// Set up Chi routes
 	webRoutes := routers.NormalRoutes()
+
+	auditCtx := cliAuditContext(context.Background())
+	log.Info("Audit record output: %s", setting.Audit.RecordOutput)
+	audit.Record(auditCtx, audit_model.SystemStartup, nil, "version", setting.AppVer)
+
 	err := listen(webRoutes, true)
+
+	audit.Record(auditCtx, audit_model.SystemShutdown, nil)
 	<-graceful.GetManager().Done()
 	log.Info("PID: %d Gitea Web Finished", os.Getpid())
 	return err