feat: Add audit logging (#38189)

Co-authored-by: bircni <bircni@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modelmigration/v28/v353.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v28
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+	"gitea.dev/modules/timeutil"
+)
+
+type AuditEvent struct {
+	ID               int64  `xorm:"pk autoincr"`
+	Action           string `xorm:"INDEX NOT NULL"`
+	ActorID          int64  `xorm:"INDEX NOT NULL"`
+	ActorName        string
+	ActorCredential  string
+	ImpersonatorID   int64 `xorm:"INDEX"`
+	ImpersonatorName string
+	ScopeID          int64  `xorm:"INDEX(scope) NOT NULL"`
+	ScopeType        string `xorm:"INDEX INDEX(scope) NOT NULL"`
+	ScopeName        string
+	Origin           string `xorm:"INDEX NOT NULL"`
+	Message          string
+	Metadata         string `xorm:"LONGTEXT JSON"`
+	IPAddress        string
+	TimestampUnix    timeutil.TimeStamp `xorm:"INDEX NOT NULL"`
+}
+
+func (*AuditEvent) TableName() string {
+	return "audit_event"
+}
+
+func AddAuditEventTable(_ context.Context, x base.EngineMigration) error {
+	return x.Sync(new(AuditEvent))
+}

modelmigration/v28/v353_test.go

@@ -0,0 +1,48 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v28
+
+import (
+	"context"
+	"slices"
+	"testing"
+
+	"gitea.dev/modelmigration/migrationtest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"xorm.io/xorm/schemas"
+)
+
+func TestAddAuditEventTable(t *testing.T) {
+	x, deferable := migrationtest.PrepareTestEnv(t, 0)
+	defer deferable()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	require.NoError(t, AddAuditEventTable(t.Context(), x))
+
+	indexes, err := x.Dialect().GetIndexes(x.DB(), context.Background(), "audit_event")
+	require.NoError(t, err)
+	for _, columns := range [][]string{
+		{"action"},
+		{"actor_id"},
+		{"scope_id", "scope_type"},
+		{"scope_type"},
+		{"origin"},
+		{"timestamp_unix"},
+	} {
+		assert.True(t, hasAuditIndexWithColumns(indexes, columns), "missing index on %v", columns)
+	}
+}
+
+func hasAuditIndexWithColumns(indexes map[string]*schemas.Index, columns []string) bool {
+	for _, index := range indexes {
+		if slices.Equal(index.Cols, columns) {
+			return true
+		}
+	}
+	return false
+}