fix: add missing checks to several handlers and models (#39839) (#39847)

Backport https://github.com/go-gitea/gitea/pull/39839 by @silverwind

Several handlers and model helpers skipped checks that their siblings
already perform.

- Only match principal keys when looking up SSH certificate principals
- Return no attachments for an unsaved issue instead of every issue-less
one
- Reject issue and comment attachments when adding release attachments
- Share one permission check for editing, deleting and reacting to issue
content and for comment attachments between the web UI and the API,
refusing them on locked issues for users who can't write
- Reject issue edits, deletion and label changes in archived
repositories via the API
- Apply cross-origin protection to the repository topics endpoint
- Return 404 for the repositories tab of individual users and respect
profile visibility for the heatmap

* Fixes: https://github.com/go-gitea/gitea/issues/39226

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: bircni <bircni@icloud.com>

.changelog.yml

@@ -1,59 +0,0 @@
-# The full repository name
-repo: go-gitea/gitea
-
-# Service type (gitea or github)
-service: github
-
-# Base URL for Gitea instance if using gitea service type (optional)
-# Default: https://gitea.com
-base-url:
-
-# Changelog groups and which labeled PRs to add to each group
-groups:
-  -
-    name: BREAKING
-    labels:
-      - pr/breaking
-  -
-    name: SECURITY
-    labels:
-      - topic/security
-  -
-    name: FEATURES
-    labels:
-      - type/feature
-  -
-    name: ENHANCEMENTS
-    labels:
-      - type/enhancement
-  -
-    name: PERFORMANCE
-    labels:
-      - performance/memory
-      - performance/speed
-      - performance/bigrepo
-      - performance/cpu
-  -
-    name: BUGFIXES
-    labels:
-      - type/bug
-
-  -
-    name: TESTING
-    labels:
-      - type/testing
-  -
-    name: BUILD
-    labels:
-      - topic/build
-      - topic/code-linting
-  -
-    name: DOCS
-    labels:
-      - type/docs
-  -
-    name: MISC
-    default: true
-
-# regex indicating which labels to skip for the changelog
-skip-labels: skip-changelog|backport\/.+

.github/ISSUE_TEMPLATE/release.yaml

@@ -0,0 +1,59 @@
+name: Release
+description: Track a Gitea release (for release managers).
+title: "Release Gitea "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Follow the [release management guide](https://github.com/go-gitea/gitea/blob/main/docs/release-management.md).
+        Set the issue title and milestone to the version being released. Replace the examples below and mark inapplicable tasks as such.
+        CI signs the tag, generates release notes, and publishes binaries and containers. Track verification here; no manual changelog PR or release upload is needed.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      placeholder: "28.0.1"
+    validations:
+      required: true
+  - type: input
+    id: branch
+    attributes:
+      label: Release branch
+      placeholder: "release/v28"
+    validations:
+      required: true
+  - type: textarea
+    id: checklist
+    attributes:
+      label: Release checklist
+      description: Keep workflow runs, release URLs, and follow-up PRs alongside the relevant tasks.
+      value: |
+        ### Preparation
+
+        - [ ] Resolve release blockers and confirm milestone issues and PRs are resolved or deferred.
+        - [ ] Confirm required backports are merged and release branch CI passes.
+        - [ ] For a new release line, create the release branch and tag its fork point on main with the next version's -dev tag.
+
+        ### Release
+
+        - [ ] Run https://github.com/go-gitea/gitea/actions/workflows/release-create-tag.yml on the release branch with the selected version and obtain maintainer approval.
+        - [ ] Confirm https://github.com/go-gitea/gitea/actions/workflows/release-tag-version.yml succeeds for the new tag (binaries and containers).
+        - [ ] Verify the public GitHub release, generated notes, binary attachments, and signatures at https://github.com/go-gitea/gitea/releases.
+        - [ ] Verify binaries and signatures at https://dl.gitea.com/gitea/ for this version.
+        - [ ] Verify versioned regular and rootless images on Docker Hub and GHCR, and smoke-test the release.
+
+        ### Follow-up
+
+        - [ ] Verify the automated https://dl.gitea.com/gitea/version.json update, where applicable to this release line.
+        - [ ] Verify automated Helm chart and Terraform provider update PRs and follow up if needed.
+        - [ ] Check Homebrew and Snap availability; record any outstanding packaging follow-up.
+        - [ ] Confirm documentation reflects the release, where applicable.
+        - [ ] Confirm and merge the release blog post, if planned: https://gitea.com/gitea/blog.
+        - [ ] Announce the release in Discord #announcements.
+    validations:
+      required: true
+  - type: textarea
+    id: notes
+    attributes:
+      label: Blockers and notes
+      description: Link outstanding work or release-specific checks using full URLs. Do not include undisclosed security details.

.github/workflows/giteabot-backport.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: go-gitea/giteabot@4c9d4d3fd913b5c35f59dcc0b004a3d11d5b22bf # v1.0.7
+      - uses: go-gitea/giteabot@f48c6a15e0d384f037aea19cc05ff5e9551096b9 # v1.1.0
         with:
           github_token: ${{ secrets.GITEABOT_TOKEN }}
           gitea_fork: giteabot/gitea

.github/workflows/giteabot-review.yml

@@ -0,0 +1,19 @@
+name: giteabot-review
+
+# Relays PR reviews to giteabot.yml through its workflow_run trigger, because review
+# runs on fork PRs get no secrets and a read-only token. The job itself does nothing.
+
+on:
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+      - dismissed
+
+permissions: {}
+
+jobs:
+  relay:
+    runs-on: ubuntu-latest
+    steps:
+      - run: "true"

.github/workflows/giteabot.yml

@@ -20,13 +20,12 @@ on:
       - closed
       - review_requested
       - review_request_removed
-  # Review events keep review-derived state such as lgtm labels and status checks
+  # Reviews arrive through giteabot-review because fork PR review runs get no secrets
-  # in sync after approvals, edits, or dismissals.
+  workflow_run:
-  pull_request_review:
+    workflows:
+      - giteabot-review
     types:
-      - submitted
+      - requested
-      - edited
-      - dismissed
   # Periodic maintenance is still useful as a backstop for queue cleanup and
   # other housekeeping, even though main pushes now trigger it promptly.
   schedule:
@@ -43,12 +42,12 @@ on:
 permissions: {}
 
 concurrency:
-  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
+  group: ${{ format('{0}-{1}', github.workflow, github.event_name == 'pull_request_target' && format('pr-{0}', github.event.pull_request.number) || github.event_name == 'workflow_run' && format('review-{0}', github.event.workflow_run.head_sha) || 'maintenance') }}
   cancel-in-progress: false
 
 jobs:
   giteabot:
-    if: github.repository == 'go-gitea/gitea'
+    if: github.repository == 'go-gitea/gitea' && (github.event_name != 'workflow_run' || github.event.workflow_run.event == 'pull_request_review')
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -57,9 +56,7 @@ jobs:
       pull-requests: write
       statuses: write
     steps:
-      # pull_request_review runs without repository secrets on fork PRs, so fall
+      - uses: go-gitea/giteabot@8033358e118c0bd97f5e9902dc5d6633eadc6aeb # v1.2.1
-      # back to the workflow token for the non-backport checks handled here.
-      - uses: go-gitea/giteabot@4c9d4d3fd913b5c35f59dcc0b004a3d11d5b22bf # v1.0.7
         with:
-          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
+          github_token: ${{ secrets.GITEABOT_TOKEN }}
           checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}

.github/workflows/release-create-tag.yml

@@ -0,0 +1,32 @@
+name: release-create-tag
+run-name: Release v${{ inputs.version }} from ${{ github.ref_name }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to release, for example 28.0.1
+        required: true
+
+permissions: {}
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    environment: release-signing
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          token: ${{ secrets.RELEASE_TOKEN }}
+      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
+          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
+          git_user_signingkey: true
+          git_committer_email: teabot@gitea.io
+      - env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          git tag -s -m "v$VERSION" "v$VERSION"
+          git push origin tag "v$VERSION"

.github/workflows/release-nightly-snapcraft.yml

@@ -37,8 +37,15 @@ jobs:
       # retry snapcraft uploads which can be flaky
       - name: Publish snap
         run: |
+          # part-gitea-pull.sh decides what is built, see the comments there:
+          # * grade devel (main or a prerelease tag) goes to latest/edge
+          # * grade stable (a new release tag) goes to latest/stable, and to latest/candidate which marks it as released
+          channel=latest/edge
+          if unsquashfs -cat "$SNAP" meta/snap.yaml | grep -qx 'grade: stable'; then
+            channel=latest/stable,latest/candidate
+          fi
           for attempt in 1 2 3 4 5; do
-            snapcraft upload "$SNAP" --release latest/edge && exit 0
+            snapcraft upload "$SNAP" --release "$channel" && exit 0
             echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
             sleep 15
           done

.github/workflows/release-tag-rc.yml

@@ -1,149 +0,0 @@
-name: release-tag-rc
-
-on:
-  push:
-    tags:
-      - "v1*-rc*"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  binary:
-    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/node-setup
-      - run: make deps-frontend deps-backend
-      - run: make release
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
-      - name: import gpg key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
-        with:
-          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
-          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
-      - name: sign binaries
-        env:
-          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
-        run: |
-          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
-            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
-          done
-      # clean branch name to get the folder name in the object storage
-      - name: Get cleaned branch name
-        id: clean_name
-        env:
-          REF: ${{ github.ref }}
-        run: |
-          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
-          echo "Cleaned name is ${REF_NAME}"
-          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
-      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
-        with:
-          gh-cli-version: 2.39.1
-      - name: create github release
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          gh release create "$TAG" --title "$TAG" --draft --notes-from-tag dist/release/*
-
-  container:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      contents: read
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
-        with:
-          cache-image: false
-      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          flavor: |
-            latest=false
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            latest=false
-            suffix=-rootless
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}

.github/workflows/release-tag-version.yml

@@ -3,9 +3,8 @@ name: release-tag-version
 on:
   push:
     tags:
-      - "v1.*"
+      - "v[0-9]*"
-      - "!v1*-rc*"
+      - "!v[0-9]*-*"
-      - "!v1*-dev"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -73,12 +72,23 @@ jobs:
         uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
         with:
           gh-cli-version: 2.39.1
+      - id: range
+        run: |
+          previous=$(git tag --list --sort=-v:refname | grep -xE 'v[0-9]+\.[0-9]+\.[0-9]+' | grep -A1 -xF "$GITHUB_REF_NAME" | tail -1) # highest stable version below this one
+          echo "range=$previous..$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+      - name: skip reverts and reverted commits in changelog
+        env:
+          RANGE: ${{ steps.range.outputs.range }}
+        run: ./tools/generate-cliffignore.sh "$RANGE" | sort -u > .cliffignore
+      - uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1
+        with:
+          args: --tag ${{ github.ref_name }} ${{ steps.range.outputs.range }}
       - name: create github release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           TAG: ${{ github.ref_name }}
         run: |
-          gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*
+          gh release create "$TAG" --title "$TAG" --notes-file git-cliff/CHANGELOG.md dist/release/*
 
   container:
     runs-on: namespace-profile-gitea-release-docker

CONTRIBUTING.md

@@ -169,7 +169,7 @@ In the PR title, describe the problem you are fixing, not how you are fixing it.
 Use the first comment as a summary of your PR. \
 In the PR summary, you can describe exactly how you are fixing this problem.
 
-PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message:
+PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message and release notes entry:
 
 ```text
 type(scope)!: subject

Makefile

@@ -6,7 +6,7 @@ SHASUM ?= shasum -a 256
 
 AIR_PACKAGE ?= github.com/air-verse/air@v1.67.4 # renovate: datasource=go
 EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v4/cmd/editorconfig-checker@v4.0.2 # renovate: datasource=go
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.17 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
 SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.36.6 # renovate: datasource=go
@@ -136,7 +136,7 @@ WEB_DIRS := web_src/js web_src/css
 
 ESLINT_FILES := web_src/js tools *.ts tests/e2e
 STYLELINT_FILES := web_src/css web_src/js/components/*.vue
-SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(filter-out CHANGELOG.md, $(wildcard *.go *.md *.yml *.yaml *.toml))
+SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(wildcard *.go *.md *.yml *.yaml *.toml)
 EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.json
 
 GO_SOURCES := $(wildcard *.go)

README.md

@@ -120,7 +120,7 @@ See [app.example.ini](https://github.com/go-gitea/gitea/blob/main/custom/conf/ap
 
 **Where can I find the security patches?**
 
-In the [release log](https://github.com/go-gitea/gitea/releases) or the [change log](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md), search for the keyword `SECURITY` to find the security patches.
+Check the [release notes](https://github.com/go-gitea/gitea/releases) and [security advisories](https://github.com/go-gitea/gitea/security/advisories) for security patches.
 
 (more FAQs are listed in [FAQ documentation](https://docs.gitea.com/help/faq))
 

README.zh-cn.md

@@ -125,7 +125,7 @@ Gitea 的发音是 [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY)，就像 "gi-tea
 
 **在哪里可以找到安全补丁？**
 
-在 [发布日志](https://github.com/go-gitea/gitea/releases) 或 [变更日志](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md) 中，搜索关键词 `SECURITY` 以找到安全补丁。
+在 [发布日志](https://github.com/go-gitea/gitea/releases) 中，搜索关键词 `SECURITY` 以找到安全补丁。
 
 ## 许可证
 

README.zh-tw.md

@@ -125,7 +125,7 @@ Gitea 的發音是 [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY)，就像 "gi-tea
 
 **在哪裡可以找到安全補丁？**
 
-在 [發佈日誌](https://github.com/go-gitea/gitea/releases) 或 [變更日誌](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md) 中，搜索關鍵詞 `SECURITY` 以找到安全補丁。
+在 [發佈日誌](https://github.com/go-gitea/gitea/releases) 中，搜索關鍵詞 `SECURITY` 以找到安全補丁。
 
 ## 許可證
 

cliff.toml

@@ -0,0 +1,10 @@
+[git]
+commit_parsers = [
+  { message = "^(chore|ci)(\\([\\w/.-]+\\))?!?: ", skip = true },
+  { message = "^feat", group = "Features" },
+  { message = "^enhance", group = "Enhancements" },
+  { message = "^perf", group = "Performance" },
+  { message = "^fix", group = "Bug Fixes" },
+  { message = "^docs", group = "Documentation" },
+  { message = ".*", group = "Miscellaneous" },
+]

contrib/upgrade.sh

@@ -87,7 +87,7 @@ echo "Checking currently installed version..."
 current=$(giteacmd --version | cut -d ' ' -f 3)
 [[ "$current" == "$giteaversion" ]] && echo "$current is already installed, stopping." && exit 0
 if [[ -z "${no_confirm:-}"  ]]; then
-  echo "Make sure to read the changelog first: https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md"
+  echo "Make sure to read the changelog first: https://github.com/go-gitea/gitea/releases"
   echo "Are you ready to update Gitea from ${current} to ${giteaversion}? (y/N)"
   read -r confirm
   [[ "$confirm" == "y" ]] || [[ "$confirm" == "Y" ]] || exit 1

custom/conf/app.example.ini

@@ -536,7 +536,7 @@ INTERNAL_TOKEN =
 ;CONTENT_SECURITY_POLICY_GENERAL =
 ;;
 ;; Egress mode toggles between strictness of outgoing requests:
-;; Lax requires addresses to be allowed only if they are in private ranges, it allows all public ones
+;; Lax requires non-public targets (private, loopback, link-local, CGNAT and special-use ranges) to be allowed, it allows all public ones
 ;; Strict requires an explicit allow of all addresses
 ; EGRESS_MODE = lax
 ;;
@@ -551,10 +551,12 @@ INTERNAL_TOKEN =
 ;; a bracketed set of ports and ranges, | separated: *.mydomain.com:[80|443|3000-3010]
 ;; all ports: *.mydomain.com:*
 ;; A portless entry covers all ports in Lax mode, only 80 and 443 in Strict mode
-;; Port specs apply only where the list is consulted: in Lax mode that is private, loopback and CGNAT
+;; Port specs apply only where the list is consulted: in Lax mode that is non-public targets alone,
-;; targets alone, public targets are allowed on every port whatever the list says. In Strict mode every
+;; public targets are allowed on every port whatever the list says. In Strict mode every
 ;; target is checked, so ports restrict public hosts too.
-;; Reserved addresses like link-local and cloud metadata are denied
+;; Non-public targets need an IP or built-in entry, a host name entry alone never covers them.
+;; Reserved addresses (the IPv4-embedding NAT64, Teredo and 6to4 ranges, this-network, multicast and
+;; broadcast) are denied whatever the list says. To reach them configure an HTTP proxy
 ;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
 ;ALLOWED_HOST_LIST =
 
@@ -636,7 +638,8 @@ ENABLED = true
 ;; * https://github.com/git-ecosystem/git-credential-manager
 ;; * https://gitea.com/gitea/tea
 ;; * Gitea App (the official Gitea mobile app)
-;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app
+;; * https://gitea.com/gitea/gitea-vscode
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app, gitea-vscode
 ;;
 ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes.
 ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list.
@@ -808,7 +811,6 @@ LEVEL = Info
 ;[git.config]
 ;diff.algorithm = histogram
 ;core.logAllRefUpdates = true
-;gc.reflogExpire = 90
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1096,8 +1098,9 @@ LEVEL = Info
 ;; Force ssh:// clone url instead of scp-style uri when default SSH port is used
 ;USE_COMPAT_SSH_URI = false
 ;;
-;; Value for the "go get" request returns the repository url as https or ssh, default is https
+;; Scheme of the returned URL for the "go get" response.
-;GO_GET_CLONE_URL_PROTOCOL = https
+;; Default is "https" if DISABLE_HTTP_GIT=false or SSH is disabled, otherwise "ssh".
+;GO_GET_CLONE_URL_PROTOCOL =
 ;;
 ;; Close issues as long as a commit on any branch marks it as fixed
 ;DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH = false

docs/guidelines-backend.md

@@ -62,6 +62,10 @@ Operations that must roll back together should run inside `db.WithTx()` (or
 Functions that participate in a transaction take a `context.Context` as their first
 parameter so the transaction can be propagated.
 
+PostgreSQL, MySQL and MSSQL (via `READ_COMMITTED_SNAPSHOT`) read the last committed
+row version, so reads never wait for writers. Guard read-then-write logic with a
+conditional `UPDATE` or a lock.
+
 ### XORM gotchas
 
 - Never call `x.Update(exemplar)` without an explicit `WHERE` clause — it updates

docs/release-management.md

@@ -8,10 +8,9 @@ This document describes the release cycle, backports, versioning, and the releas
 
 We backport PRs given the following circumstances:
 
-1. Feature freeze is active, but `<version>-rc0` has not been released yet. Here, we backport as much as possible. <!-- TODO: Is that our definition with the new backport bot? -->
+1. We backport bug- and security-fixes and small enhancements. Large changes such as refactors are not backported.
-2. `rc0` has been released. Here, we only backport bug- and security-fixes, and small enhancements. Large PRs such as refactors are not backported anymore. <!-- TODO: Is that our definition with the new backport bot? -->
+2. We never backport new features.
-3. We never backport new features.
+3. We never backport breaking changes except when
-4. We never backport breaking changes except when
     1. The breaking change has no effect on the vast majority of users
     2. The component triggering the breaking change is marked as experimental
 
@@ -53,7 +52,6 @@ We use a release schedule so work, stabilization, and releases stay predictable.
 ### Cadence
 
 - Aim for a major release about every three or four months.
-- Roughly two or three months of general development, then about one month of testing and polish called the **release freeze**.
 - *Starting with v1.26 the release cycle will be more predictable and follow a more regular schedule.*
 
 ### Release schedule
@@ -65,16 +63,6 @@ We will try to publish a new major version every three months:
 - v1.28.0 in September 2026
 - v1.29.0 in December 2026
 
-#### How is the release handled?
-- The release manager will tag the release candidate (e.g. `v1.26.0-rc0`) and publish it for testing in the **first week of the release month**.
-- If there are no major issues, the release manager will check with the other maintainers and then tag the final release (e.g. `v1.26.0`) in the **one or two weeks following the release candidate**.
-
-### Feature freeze
-
-- Merge feature PRs before the freeze when you can.
-- Feature PRs still open at the freeze move to the next milestone. Watch Discord for the freeze announcement.
-- During the freeze, a **release branch** takes fixes backported from `main`. Release candidates ship for testing; the final release for that line is maintained from that branch.
-
 ### Patch releases
 
 During a cycle we may ship patch releases for an older line. For example, if the latest release is v1.2, we can still publish v1.1.1 after v1.1.0.
@@ -99,17 +87,13 @@ be reviewed by two maintainers and must pass the automatic tests.
 
 ## Releasing Gitea
 
-- Let MAJOR, MINOR and PATCH be Major, Minor and Patch version numbers, PATCH should be rc1, rc2, 0, 1, ...... MAJOR.MINOR will be kept the same as milestones on github or gitea in future.
+Track each release using the [release issue template](https://github.com/go-gitea/gitea/issues/new?template=release.yaml).
-- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
+
-- If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
+- Before releasing, confirm all the version's milestone issues or PRs have been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
-  - Create `-dev` tag as `git tag -s -F release.notes vMAJOR.MINOR.0-dev` and push the tag as `git push origin vMAJOR.MINOR.0-dev`.
+- When creating a release branch, tag its fork point on `main` as the next version's `-dev` tag, e.g. `v30.0.0-dev` for `release/v29`.
-  - When CI has finished building tag then you have to create a new branch named `release/vMAJOR.MINOR`
+- In the GitHub Actions tab, open the `release-create-tag` workflow, click "Run workflow", select the release branch and enter a version such as `28.0.1`. After maintainer approval, it pushes a signed tag and CI publishes the release with generated notes.
-- If it is bugfix version create PR for changelog on branch `release/vMAJOR.MINOR` and wait till it is reviewed and merged.
+- Optionally send a PR to the [blog repository](https://gitea.com/gitea/blog) announcing the release.
-- Add a tag as `git tag -s -F release.notes vMAJOR.MINOR.PATCH`, release.notes file could be a temporary file to only include the changelog this version which you added to `CHANGELOG.md`.
-- And then push the tag as `git push origin vMAJOR.MINOR.$`. CI will automatically create a release and upload all the compiled binary. (But currently it doesn't add the release notes automatically. Maybe we should fix that.)
-- If needed send a frontport PR for the changelog to branch `main` and update the version in `docs/config.yaml` to refer to the new version.
-- Send PR to [blog repository](https://gitea.com/gitea/blog) announcing the release.
 - Verify all release assets were correctly published through CI on dl.gitea.com and GitHub releases. Once ACKed:
-  - bump the version of https://dl.gitea.com/gitea/version.json
+  - verify the automated update of https://dl.gitea.com/gitea/version.json, where applicable to the release line
   - merge the blog post PR
   - announce the release in discord `#announcements`

go.mod

@@ -2,7 +2,7 @@ module gitea.dev
 
 go 1.27
 
-toolchain go1.27.1
+toolchain go1.27.2
 
 require (
 	connectrpc.com/connect v1.21.0
@@ -94,11 +94,11 @@ require (
 	github.com/yuin/goldmark v1.8.6
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/gitlab-org/api/client-go/v3 v3.13.0
-	go.yaml.in/yaml/v4 v4.0.0-rc.6
+	go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525
 	golang.org/x/crypto v0.57.0
 	golang.org/x/image v0.46.0
 	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.59.0
+	golang.org/x/net v0.60.0
 	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sync v0.23.0
 	golang.org/x/sys v0.48.0
@@ -109,7 +109,7 @@ require (
 	modernc.org/sqlite v1.59.0
 	mvdan.cc/xurls/v2 v2.6.0
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.4.1
+	xorm.io/xorm v1.4.3
 )
 
 require (

go.sum

@@ -672,8 +672,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525 h1:FtzHH3s777Nx50YcPAcodAPm1mNakc228nMYbr3f+90=
-go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 go4.org v0.0.0-20260112195520-a5071408f32f h1:ziUVAjmTPwQMBmYR1tbdRFJPtTcQUI12fH9QQjfb0Sw=
 go4.org v0.0.0-20260112195520-a5071408f32f/go.mod h1:ZRJnO5ZI4zAwMFp+dS1+V6J6MSyAowhRqAE+DPa1Xp0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -714,8 +714,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
-golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -862,5 +862,5 @@ pgregory.net/rapid v0.4.2 h1:lsi9jhvZTYvzVpeG93WWgimPRmiJQfGFRNTEZh1dtY0=
 pgregory.net/rapid v0.4.2/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
+xorm.io/xorm v1.4.3 h1:MwWFWzVr+/6D07qGCDhBAfABcuT0gvqY3XmTy1215BM=
-xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.4.3/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=

modelmigration/migrations.go

@@ -33,6 +33,7 @@ import (
 	"gitea.dev/modelmigration/v1_8"
 	"gitea.dev/modelmigration/v1_9"
 	"gitea.dev/modelmigration/v28"
+	"gitea.dev/modelmigration/v29"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -429,6 +430,10 @@ func prepareMigrationTasks() []*migration {
 		newMigration(353, "Add audit event table", v28.AddAuditEventTable),
 		newMigration(354, "Add Actions job queue indexes", v28.AddActionQueueIndexes),
 		newMigration(355, "Add AutoMerge merged_commit_id column", v28.AddAutoMergeMergedCommitID),
+		// Gitea 28.0.0 ends at migration ID number 355 (database version 356)
+		// HERE: 2 migrations from 29 are added since they don't change database structure
+		newMigration(356, "Add index on action_run commit_sha", v29.AddActionRunCommitSHAIndex),
+		newMigration(357, "Normalize legacy team authorize values", v29.NormalizeLegacyTeamAuthorize),
 	}
 	return preparedMigrations
 }

modelmigration/v29/main_test.go

@@ -0,0 +1,14 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"testing"
+
+	"gitea.dev/modelmigration/migrationtest"
+)
+
+func TestMain(m *testing.M) {
+	migrationtest.MainTest(m)
+}

modelmigration/v29/v356.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+
+	"xorm.io/xorm"
+)
+
+// AddActionRunCommitSHAIndex indexes the runs lookup by commit, which the API `head_sha` filter uses.
+func AddActionRunCommitSHAIndex(_ context.Context, x base.EngineMigration) error {
+	type ActionRun struct {
+		CommitSHA string `xorm:"index"`
+	}
+
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreDropIndices: true,
+		IgnoreConstrains:  true,
+	}, new(ActionRun))
+	return err
+}

modelmigration/v29/v357.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+)
+
+// NormalizeLegacyTeamAuthorize sets leftover read/write authorize values to none.
+// https://github.com/go-gitea/gitea/pull/34128 made non-admin teams use team_unit (authorize=none).
+// authorize>=write now means blanket access on every unit; migrating legacy read/write
+// to none preserves their existing team_unit-scoped access.
+func NormalizeLegacyTeamAuthorize(_ context.Context, x base.EngineMigration) error {
+	// AccessModeNone=0, AccessModeRead=1, AccessModeWrite=2, AccessModeAdmin=3
+	_, err := x.Exec(`
+UPDATE team SET authorize = 0
+WHERE authorize > 0 AND authorize < 3
+	AND EXISTS (
+		SELECT 1 FROM team_unit WHERE team_unit.team_id = team.id
+  );`)
+	return err
+}

modelmigration/v29/v357_test.go

@@ -0,0 +1,55 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"testing"
+
+	"gitea.dev/modelmigration/migrationtest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeLegacyTeamAuthorize(t *testing.T) {
+	type Team struct {
+		ID        int64 `xorm:"pk"`
+		Authorize int
+	}
+	type TeamUnit struct {
+		ID     int64 `xorm:"pk"`
+		TeamID int64 `xorm:"INDEX"`
+	}
+
+	x, deferrable := migrationtest.PrepareTestEnv(t, 0, new(Team), new(TeamUnit))
+	defer deferrable()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	_, err := x.Insert(
+		&Team{ID: 1, Authorize: 4},
+		&Team{ID: 2, Authorize: 3},
+		&Team{ID: 3, Authorize: 2},
+		&Team{ID: 4, Authorize: 1},
+		&Team{ID: 5, Authorize: 0},
+
+		&TeamUnit{TeamID: 3},
+	)
+	require.NoError(t, err)
+	require.NoError(t, NormalizeLegacyTeamAuthorize(t.Context(), x))
+
+	get := func(id int64) int {
+		tBean := &Team{ID: id}
+		has, err := x.Get(tBean)
+		require.NoError(t, err)
+		require.True(t, has)
+		return tBean.Authorize
+	}
+	assert.Equal(t, 4, get(1))
+	assert.Equal(t, 3, get(2))
+	assert.Equal(t, 0, get(3)) // has team unit, reset to none
+	assert.Equal(t, 1, get(4)) // no team unit, kept
+	assert.Equal(t, 0, get(5))
+}

models/actions/run.go

@@ -39,9 +39,9 @@ type ActionRun struct {
 	TriggerUserID     int64                  `xorm:"index"`
 	TriggerUser       *user_model.User       `xorm:"-"`
 	ScheduleID        int64
-	Ref               string `xorm:"index"` // the commit/tag/… that caused the run
+	Ref               string                       `xorm:"index"` // the commit/tag/… that caused the run
-	IsRefDeleted      bool   `xorm:"-"`
+	IsRefDeleted      bool                         `xorm:"-"`
-	CommitSHA         string
+	CommitSHA         string                       `xorm:"index"`
 	IsForkPullRequest bool                         // If this is triggered by a PR from a forked repository or an untrusted user, we need to check if it is approved and limit permissions when running the workflow.
 	NeedApproval      bool                         // may need approval if it's a fork pull request
 	ApprovedBy        int64                        `xorm:"index"` // who approved
@@ -295,9 +295,8 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }
 
-func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) (runs []*ActionRun, err error) {
-	var runs []*ActionRun
+	err = db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).OrderBy("id").Find(&runs)
-	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
 	return runs, err
 }
 

models/actions/run_job.go

@@ -853,25 +853,34 @@ func cancelReusableCaller(ctx context.Context, caller *ActionRunJob, force bool)
 	}
 
 	// Cancel descendants deepest-first, then the caller: a caller's status is aggregated from its children,
-	// so each child must reach its final state before its parent caller is re-aggregated.
+	// so each child must be cancelled before its parent caller is re-read.
 	// A child's ID always exceeds its parent's, so descending ID is a valid deepest-first order.
 	descendants := CollectAllDescendantJobs(caller, attemptJobs)
 	slices.SortFunc(descendants, func(a, b *ActionRunJob) int { return cmp.Compare(b.ID, a.ID) })
+	callersWithChildren := make(container.Set[int64])
+	for _, d := range descendants {
+		callersWithChildren.Add(d.ParentJobID)
+	}
 
-	for _, c := range descendants {
+	for _, job := range append(descendants, caller) {
-		cancelled, err := cancelOneJob(ctx, c, force)
+		if !callersWithChildren.Contains(job.ID) {
+			cancelled, err := cancelOneJob(ctx, job, force)
+			if err != nil {
+				return cancelledJobs, err
+			}
+			if cancelled != nil {
+				cancelledJobs = append(cancelledJobs, cancelled)
+			}
+			continue
+		}
+		// the job is a caller and its children's cascade already re-aggregated it
+		reloaded, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
 		if err != nil {
 			return cancelledJobs, err
 		}
-		if cancelled != nil {
+		if reloaded.Status != job.Status {
-			cancelledJobs = append(cancelledJobs, cancelled)
+			cancelledJobs = append(cancelledJobs, reloaded)
 		}
 	}
-
-	if c, err := cancelOneJob(ctx, caller, force); err != nil {
-		return cancelledJobs, err
-	} else if c != nil {
-		cancelledJobs = append(cancelledJobs, c)
-	}
 	return cancelledJobs, nil
 }

models/actions/run_job_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"testing"
 
+	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/timeutil"
@@ -397,3 +398,72 @@ func TestForceCancelJobs(t *testing.T) {
 		assert.Equal(t, StatusCancelled, callerAfter.Status)
 	})
 }
+
+func TestCancelJobs_CallerWaitsForCancellingChild(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	run := &ActionRun{
+		Title:         "caller-cancelling-child",
+		RepoID:        4,
+		Index:         9811,
+		OwnerID:       1,
+		WorkflowID:    "test.yaml",
+		TriggerUserID: 1,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		EventPayload:  "{}",
+		Status:        StatusRunning,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+	attempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1, Status: StatusRunning}
+	require.NoError(t, db.Insert(ctx, attempt))
+	run.LatestAttemptID = attempt.ID
+	require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
+
+	newJob := func(name string, parentID int64, isCaller bool) *ActionRunJob {
+		job := &ActionRunJob{
+			RunID:            run.ID,
+			RunAttemptID:     attempt.ID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             name,
+			JobID:            name,
+			Attempt:          1,
+			Status:           StatusRunning,
+			ParentJobID:      parentID,
+			IsReusableCaller: isCaller,
+			IsExpanded:       isCaller,
+		}
+		require.NoError(t, db.Insert(ctx, job))
+		return job
+	}
+	outer := newJob("outer", 0, true)
+	inner := newJob("inner", outer.ID, true)
+	child := newJob("child", inner.ID, false)
+
+	runner := &ActionRunner{UUID: "caller-cancelling-child", Name: "caller-cancelling-child", HasCancellingSupport: true}
+	require.NoError(t, db.Insert(ctx, runner))
+	task := &ActionTask{JobID: child.ID, Attempt: 1, RunnerID: runner.ID, Status: StatusRunning, Started: timeutil.TimeStampNow(), RepoID: run.RepoID, OwnerID: run.OwnerID, CommitSHA: run.CommitSHA}
+	require.NoError(t, db.Insert(ctx, task))
+	child.TaskID = task.ID
+	_, err := UpdateRunJob(ctx, child, nil, "task_id")
+	require.NoError(t, err)
+
+	cancelled, err := CancelJobs(ctx, []*ActionRunJob{outer}, false)
+	require.NoError(t, err)
+	assert.Len(t, cancelled, 3)
+	for _, job := range []*ActionRunJob{outer, inner, child} {
+		assert.Equal(t, StatusCancelling, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status, job.Name)
+	}
+
+	_, err = UpdateTaskByState(ctx, runner.ID, &runnerv1.TaskState{Id: task.ID, Result: runnerv1.Result_RESULT_CANCELLED})
+	require.NoError(t, err)
+	for _, job := range []*ActionRunJob{outer, inner, child} {
+		assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status, job.Name)
+	}
+	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID}).Status)
+}

models/actions/schedule.go

@@ -11,6 +11,7 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
 	webhook_module "gitea.dev/modules/webhook"
@@ -110,7 +111,7 @@ func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository) ([
 	jobs, err := CancelPreviousJobs(
 		ctx,
 		repo.ID,
-		repo.DefaultBranch,
+		git.RefNameFromBranch(repo.DefaultBranch).String(),
 		"",
 		webhook_module.HookEventSchedule,
 	)

models/actions/task.go

@@ -236,13 +236,13 @@ func GetRunningTaskByToken(ctx context.Context, token string) (*ActionTask, erro
 
 func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
 	if step.Name != "" {
-		name = string(step.Name) // the step has an explicit name
+		name = step.Name // the step has an explicit name
 	} else {
 		// for unnamed step, its "String()" method tries to get a display name by its "name", "uses",
 		// "run" or "id" (last fallback), we add the "Run " prefix for unnamed steps for better display
 		// for multi-line "run" scripts, only use the first line to match GitHub's behavior
 		// https://github.com/actions/runner/blob/66800900843747f37591b077091dd2c8cf2c1796/src/Runner.Worker/Handlers/ScriptHandler.cs#L45-L58
-		runStr, _, _ := strings.Cut(strings.TrimSpace(string(step.Run)), "\n")
+		runStr, _, _ := strings.Cut(strings.TrimSpace(step.Run), "\n")
 		name = "Run " + util.IfZero(strings.TrimSpace(runStr), step.String())
 	}
 	return util.EllipsisDisplayString(name, limit) // database column has a length limit
@@ -298,6 +298,12 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
 			return nil, false, err
 		}
+		// A short page means no waiting jobs remain beyond it.
+		isLastPage := len(jobs) < pickTaskBatchSize
+		if !isLastPage {
+			last := jobs[len(jobs)-1] // read before a lost claim bumps Updated
+			cursorUpdated, cursorID = last.Updated, last.ID
+		}
 
 		for _, v := range jobs {
 			if !runner.CanMatchLabels(v.RunsOn) {
@@ -313,12 +319,9 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 			// Another runner claimed this job concurrently; try the next one.
 		}
 
-		// A short page means no waiting jobs remain beyond it.
+		if isLastPage {
-		if len(jobs) < pickTaskBatchSize {
 			return nil, false, nil
 		}
-		last := jobs[len(jobs)-1]
-		cursorUpdated, cursorID = last.Updated, last.ID
 	}
 }
 

models/actions/task_test.go

@@ -94,14 +94,14 @@ func TestMakeTaskStepDisplayName(t *testing.T) {
 		{
 			name: "very long name truncated",
 			jobStep: &jobparser.Step{
-				Name: jobparser.BlockSafeString(strings.Repeat("a", 300)),
+				Name: strings.Repeat("a", 300),
 			},
 			expected: strings.Repeat("a", 252) + "…",
 		},
 		{
 			name: "very long run truncated",
 			jobStep: &jobparser.Step{
-				Run: jobparser.BlockSafeString(strings.Repeat("a", 300)),
+				Run: strings.Repeat("a", 300),
 			},
 			expected: "Run " + strings.Repeat("a", 248) + "…",
 		},

models/asymkey/ssh_key.go

@@ -199,7 +199,7 @@ func SearchPrincipalKey(ctx context.Context, principalKey string) (*PublicKey, e
 	// In the future, the existing principal keys should be migrated to use the fingerprint ("principal:{name}") instead of the content
 	key := new(PublicKey)
 	has, err := db.GetEngine(ctx).
-		Where("content = ?", principalKey).
+		Where("content = ? AND type = ?", principalKey, KeyTypePrincipal).
 		Get(key)
 	if err != nil {
 		return nil, err

models/asymkey/ssh_key_test.go

@@ -12,11 +12,13 @@ import (
 	"strings"
 	"testing"
 
+	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/setting"
 
 	"github.com/42wim/sshsig"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func Test_SSHParsePublicKey(t *testing.T) {
@@ -481,6 +483,20 @@ func TestPublicKeysAreExternallyManaged(t *testing.T) {
 	assert.False(t, externals[0])
 }
 
+func TestSearchPrincipalKeyIgnoresOtherKeyTypes(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	userKey := unittest.AssertExistsAndLoadBean(t, &PublicKey{ID: 1})
+
+	_, err := SearchPrincipalKey(t.Context(), userKey.Content)
+	assert.True(t, IsErrKeyNotExist(err))
+
+	principal := &PublicKey{OwnerID: 1, Name: userKey.Content, Content: userKey.Content, Type: KeyTypePrincipal}
+	require.NoError(t, db.Insert(t.Context(), principal))
+	key, err := SearchPrincipalKey(t.Context(), userKey.Content)
+	require.NoError(t, err)
+	assert.Equal(t, principal.ID, key.ID)
+}
+
 // TestCheckPublicKeyStringOversized tests if oversized SSH2 public key strings are rejected before triggering costly operations.
 func TestCheckPublicKeyStringOversized(t *testing.T) {
 	_, err := parseKeyString(strings.Repeat("a", maxKeyContentBytes+1))

models/auth/auth_token.go

@@ -44,9 +44,10 @@ func GetAuthTokenByID(ctx context.Context, id string) (*AuthToken, error) {
 	return at, nil
 }
 
-func UpdateAuthTokenByID(ctx context.Context, t *AuthToken) error {
+func UpdateAuthTokenByID(ctx context.Context, t *AuthToken, oldHash string) (bool, error) {
-	_, err := db.GetEngine(ctx).ID(t.ID).Cols("token_hash", "expires_unix").Update(t)
+	affected, err := db.GetEngine(ctx).ID(t.ID).Where("token_hash = ?", oldHash).
-	return err
+		Cols("token_hash", "expires_unix").Update(t)
+	return affected == 1, err
 }
 
 func DeleteAuthTokenByID(ctx context.Context, id string) error {

models/auth/oauth2.go

@@ -88,6 +88,16 @@ func BuiltinApplications() map[string]*BuiltinOAuth2Application {
 		DisplayName:  "Gitea App",
 		RedirectURIs: []string{"com.gitea.app://oauth/callback"},
 	}
+	m["75a9ec3e-42b5-40cb-9144-9ea96ecd56a6"] = &BuiltinOAuth2Application{
+		ConfigName:  "gitea-vscode",
+		DisplayName: "gitea-vscode",
+		RedirectURIs: []string{
+			"http://127.0.0.1",
+			"https://127.0.0.1",
+			"vscode://gitea.gitea-for-vscode/auth/callback",
+			"vscode-insiders://gitea.gitea-for-vscode/auth/callback",
+		},
+	}
 	return m
 }
 
@@ -564,6 +574,12 @@ func (grant *OAuth2Grant) SetNonce(ctx context.Context, nonce string) error {
 	return nil
 }
 
+func UpdateGrantScope(ctx context.Context, grant *OAuth2Grant, newScope string) error {
+	grant.Scope = newScope
+	_, err := db.GetEngine(ctx).ID(grant.ID).Cols("scope").Update(grant)
+	return err
+}
+
 // GetOAuth2GrantByID returns the grant with the given ID
 func GetOAuth2GrantByID(ctx context.Context, id int64) (grant *OAuth2Grant, err error) {
 	grant = new(OAuth2Grant)

models/db/engine_init.go

@@ -5,7 +5,9 @@ package db
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
+	"time"
 
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -59,6 +61,11 @@ func InitEngine(ctx context.Context) error {
 	xe.SetMaxIdleConns(setting.Database.MaxIdleConns)
 	xe.SetConnMaxLifetime(setting.Database.ConnMaxLifetime)
 
+	if setting.Database.Type.IsMySQL() {
+		// like PostgreSQL and MSSQL, avoids MariaDB snapshot isolation errors
+		xe.SetDefaultTxOptions(&sql.TxOptions{Isolation: sql.LevelReadCommitted})
+	}
+
 	if setting.Database.SlowQueryThreshold > 0 {
 		xe.AddHook(&EngineHook{
 			Threshold: setting.Database.SlowQueryThreshold,
@@ -103,6 +110,10 @@ func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Conte
 
 	preprocessDatabaseCollation(xormEngine)
 
+	if setting.Database.Type.IsMSSQL() {
+		enableMSSQLReadCommittedSnapshot(ctx, xormEngine)
+	}
+
 	// We have to run migrateFunc here in case the user is re-running installation on a previously created DB.
 	// If we do not then table schemas will be changed and there will be conflicts when the migrations run properly.
 	//
@@ -125,3 +136,12 @@ func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Conte
 
 	return nil
 }
+
+// enableMSSQLReadCommittedSnapshot stops MSSQL reads waiting on writers, like PostgreSQL and MySQL
+func enableMSSQLReadCommittedSnapshot(ctx context.Context, engine EngineMigration) {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second) // ALTER waits for all other connections to close
+	defer cancel()
+	if _, err := engine.Context(ctx).Exec("IF (SELECT is_read_committed_snapshot_on FROM sys.databases WHERE database_id = DB_ID()) = 0 ALTER DATABASE CURRENT SET READ_COMMITTED_SNAPSHOT ON"); err != nil {
+		log.Error("Unable to set READ_COMMITTED_SNAPSHOT=ON: %v", err)
+	}
+}

models/git/commit_status.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"net/url"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -35,11 +36,11 @@ import (
 // CommitStatus holds a single Status of a single Commit
 type CommitStatus struct {
 	ID     int64                          `xorm:"pk autoincr"`
+	RepoID int64                          `xorm:"UNIQUE(repo_sha_index)"`
+	SHA    string                         `xorm:"VARCHAR(64) NOT NULL INDEX UNIQUE(repo_sha_index)"`
 	Index  int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
-	RepoID int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
 	Repo   *repo_model.Repository         `xorm:"-"`
 	State  commitstatus.CommitStatusState `xorm:"VARCHAR(7) NOT NULL"`
-	SHA    string                         `xorm:"VARCHAR(64) NOT NULL INDEX UNIQUE(repo_sha_index)"`
 
 	// TargetURL points to the commit status page reported by a CI system
 	// If Gitea Actions is used, it is a relative link like "{RepoLink}/actions/runs/{RunID}/jobs{JobID}"
@@ -311,17 +312,17 @@ func (opts *CommitStatusOptions) ToConds() builder.Cond {
 func (opts *CommitStatusOptions) ToOrders() string {
 	switch opts.SortType {
 	case "oldest":
-		return "created_unix ASC"
+		return "created_unix ASC, `index` ASC"
 	case "recentupdate":
-		return "updated_unix DESC"
+		return "updated_unix DESC, `index` DESC"
 	case "leastupdate":
-		return "updated_unix ASC"
+		return "updated_unix ASC, `index` ASC"
 	case "leastindex":
 		return "`index` DESC"
 	case "highestindex":
 		return "`index` ASC"
 	default:
-		return "created_unix DESC"
+		return "created_unix DESC, `index` DESC" // timestamps have 1s resolution, `index` keeps paging stable
 	}
 }
 
@@ -420,46 +421,48 @@ func GetLatestCommitStatusForPairs(ctx context.Context, repoSHAs []RepoSHA) (map
 	return repoStatuses, nil
 }
 
-// GetLatestCommitStatusForRepoCommitIDs returns all statuses with a unique context for a given list of repo-sha pairs
+// GetLatestCommitStatusForRepoCommitIDs returns the commit statuses with a unique context for a given list of repo-sha pairs
-func GetLatestCommitStatusForRepoCommitIDs(ctx context.Context, repoID int64, commitIDs []string) (map[string][]*CommitStatus, error) {
+// If the provided commit IDs are too many, only the first part and the last part of the commit IDs will be queried.
-	type result struct {
+func GetLatestCommitStatusForRepoCommitIDs(ctx context.Context, repoID int64, allCommitIDs []string) (map[string][]*CommitStatus, error) {
+	const maxCommitIDs = 500
+	const maxBatchSize = 200
+	queryCommitIDs := allCommitIDs
+	if len(allCommitIDs) > maxCommitIDs {
+		// The commit IDs are usually from "commits list" or "compare" page (create a PR or compare commits), nobody can read so many commits at once.
+		// The commit IDs are usually sorted by time, so we can take the first half and the last half of the commit IDs to get the latest statuses.
+		log.Warn("GetLatestCommitStatusForRepoCommitIDs: too many commit IDs (%d) for repo %d, truncating to %d", len(allCommitIDs), repoID, maxCommitIDs)
+		queryCommitIDs = allCommitIDs[:maxCommitIDs/2]
+		queryCommitIDs = append(queryCommitIDs, allCommitIDs[len(allCommitIDs)-maxCommitIDs/2:]...)
+	}
+
+	baseSql := func() db.Session {
+		return db.GetEngine(ctx).Table(&CommitStatus{}).Where("repo_id = ?", repoID)
+	}
+
+	type shaMaxIndexResult struct {
 		Index int64
 		SHA   string
 	}
-
+	shaMaxIndexResults := make([]*shaMaxIndexResult, 0, len(allCommitIDs))
-	getBase := func() db.Session {
+	err := baseSql().And(builder.In("sha", queryCommitIDs)).
-		return db.GetEngine(ctx).Table(&CommitStatus{}).Where("repo_id = ?", repoID)
+		Select("max(`index`) as `index`, sha").
-	}
+		GroupBy("context_hash, sha").
-	results := make([]result, 0, len(commitIDs))
+		Find(&shaMaxIndexResults)
-
-	conds := make([]builder.Cond, 0, len(commitIDs))
-	for _, sha := range commitIDs {
-		conds = append(conds, builder.Eq{"sha": sha})
-	}
-	sess := getBase().And(builder.Or(conds...)).
-		Select("max( `index` ) as `index`, sha").
-		GroupBy("context_hash, sha").OrderBy("max( `index` ) desc")
-
-	err := sess.Find(&results)
 	if err != nil {
 		return nil, err
 	}
 
 	repoStatuses := make(map[string][]*CommitStatus)
-
+	for chunk := range slices.Chunk(shaMaxIndexResults, maxBatchSize) {
-	if len(results) > 0 {
+		statuses := make([]*CommitStatus, 0, len(chunk))
-		statuses := make([]*CommitStatus, 0, len(results))
+		condIndexSha := make([]builder.Cond, 0, len(chunk))
-
+		for _, res := range chunk {
-		conds = make([]builder.Cond, 0, len(results))
+			condIndexSha = append(condIndexSha, builder.Eq{"`index`": res.Index, "sha": res.SHA})
-		for _, result := range results {
-			conds = append(conds, builder.Eq{"`index`": result.Index, "sha": result.SHA})
 		}
-		err = getBase().And(builder.Or(conds...)).Find(&statuses)
+		err = baseSql().And(builder.Or(condIndexSha...)).Find(&statuses)
 		if err != nil {
 			return nil, err
 		}
-
-		// Group the statuses by commit
 		for _, status := range statuses {
 			repoStatuses[status.SHA] = append(repoStatuses[status.SHA], status)
 		}

models/git/commit_status_test.go

@@ -4,6 +4,7 @@
 package git_test
 
 import (
+	"fmt"
 	"testing"
 	"time"
 
@@ -22,46 +23,71 @@ func TestGetCommitStatuses(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
 	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-
 	sha1 := "1234123412341234123412341234123412341234" // the mocked commit ID in test fixtures
 
-	statuses, maxResults, err := db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
+	t.Run("CommitStatusOptions", func(t *testing.T) {
-		ListOptions: db.ListOptions{Page: 1, PageSize: 50},
+		statuses, maxResults, err := db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
-		RepoID:      repo1.ID,
+			ListOptions: db.ListOptions{Page: 1, PageSize: 50},
-		SHA:         sha1,
+			RepoID:      repo1.ID,
+			SHA:         sha1,
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, 5, int(maxResults))
+		var indexes []int64
+		for _, status := range statuses {
+			indexes = append(indexes, status.Index)
+		}
+		assert.Equal(t, []int64{5, 4, 3, 2, 1}, indexes)
+		assert.Equal(t, "deploy/awesomeness", statuses[0].Context)
+		assert.Equal(t, commitstatus.CommitStatusError, statuses[0].State)
+		assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[0].APIURL(t.Context()))
+
+		statuses, maxResults, err = db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
+			ListOptions: db.ListOptions{Page: 2, PageSize: 50},
+			RepoID:      repo1.ID,
+			SHA:         sha1,
+		})
+		assert.NoError(t, err)
+		assert.Equal(t, 5, int(maxResults))
+		assert.Empty(t, statuses)
 	})
-	assert.NoError(t, err)
-	assert.Equal(t, 5, int(maxResults))
-	assert.Len(t, statuses, 5)
 
-	assert.Equal(t, "ci/awesomeness", statuses[0].Context)
+	t.Run("GetCountLatestCommitStatus", func(t *testing.T) {
-	assert.Equal(t, commitstatus.CommitStatusPending, statuses[0].State)
+		commitStatuses, err := git_model.GetLatestCommitStatus(t.Context(), repo1.ID, sha1, db.ListOptions{
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[0].APIURL(t.Context()))
+			Page:     1,
+			PageSize: 2,
+		})
+		assert.NoError(t, err)
+		assert.Len(t, commitStatuses, 2)
+		assert.Equal(t, commitstatus.CommitStatusFailure, commitStatuses[0].State)
+		assert.Equal(t, "ci/awesomeness", commitStatuses[0].Context)
+		assert.Equal(t, commitstatus.CommitStatusError, commitStatuses[1].State)
+		assert.Equal(t, "deploy/awesomeness", commitStatuses[1].Context)
 
-	assert.Equal(t, "cov/awesomeness", statuses[1].Context)
+		count, err := git_model.CountLatestCommitStatus(t.Context(), repo1.ID, sha1)
-	assert.Equal(t, commitstatus.CommitStatusWarning, statuses[1].State)
+		assert.NoError(t, err)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[1].APIURL(t.Context()))
+		assert.EqualValues(t, 3, count)
-
+	})
-	assert.Equal(t, "cov/awesomeness", statuses[2].Context)
+
-	assert.Equal(t, commitstatus.CommitStatusSuccess, statuses[2].State)
+	t.Run("GetLatestCommitStatusForRepoCommitIDs", func(t *testing.T) {
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[2].APIURL(t.Context()))
+		commitIDs := []string{sha1}
-
+		// SQLite has a limit of 1000 for WHERE expression variables per query, use a larger slice to test
-	assert.Equal(t, "ci/awesomeness", statuses[3].Context)
+		for i := range 2000 {
-	assert.Equal(t, commitstatus.CommitStatusFailure, statuses[3].State)
+			commitIDs = append(commitIDs, fmt.Sprintf("%040x", i+1))
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[3].APIURL(t.Context()))
+		}
-
+		statuses, err := git_model.GetLatestCommitStatusForRepoCommitIDs(t.Context(), repo1.ID, commitIDs)
-	assert.Equal(t, "deploy/awesomeness", statuses[4].Context)
+		assert.NoError(t, err)
-	assert.Equal(t, commitstatus.CommitStatusError, statuses[4].State)
+		assert.Len(t, statuses[sha1], 3)
-	assert.Equal(t, "https://try.gitea.io/api/v1/repos/user2/repo1/statuses/1234123412341234123412341234123412341234", statuses[4].APIURL(t.Context()))
+		latestIndexes := make(map[string]int64)
-
+		for _, status := range statuses[sha1] {
-	statuses, maxResults, err = db.FindAndCount[git_model.CommitStatus](t.Context(), &git_model.CommitStatusOptions{
+			latestIndexes[status.Context] = status.Index
-		ListOptions: db.ListOptions{Page: 2, PageSize: 50},
+		}
-		RepoID:      repo1.ID,
+		assert.Equal(t, map[string]int64{
-		SHA:         sha1,
+			"ci/awesomeness":     4,
+			"cov/awesomeness":    3,
+			"deploy/awesomeness": 5,
+		}, latestIndexes)
 	})
-	assert.NoError(t, err)
-	assert.Equal(t, 5, int(maxResults))
-	assert.Empty(t, statuses)
 }
 
 func Test_CalcCommitStatus(t *testing.T) {
@@ -260,26 +286,3 @@ func TestCommitStatusesApplyDoerPermission(t *testing.T) {
 	assert.Empty(t, statuses[1].TargetURL)
 	assert.Equal(t, "https://mycicd.org/1", statuses[2].TargetURL)
 }
-
-func TestGetCountLatestCommitStatus(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-
-	sha1 := "1234123412341234123412341234123412341234" // the mocked commit ID in test fixtures
-
-	commitStatuses, err := git_model.GetLatestCommitStatus(t.Context(), repo1.ID, sha1, db.ListOptions{
-		Page:     1,
-		PageSize: 2,
-	})
-	assert.NoError(t, err)
-	assert.Len(t, commitStatuses, 2)
-	assert.Equal(t, commitstatus.CommitStatusFailure, commitStatuses[0].State)
-	assert.Equal(t, "ci/awesomeness", commitStatuses[0].Context)
-	assert.Equal(t, commitstatus.CommitStatusError, commitStatuses[1].State)
-	assert.Equal(t, "deploy/awesomeness", commitStatuses[1].Context)
-
-	count, err := git_model.CountLatestCommitStatus(t.Context(), repo1.ID, sha1)
-	assert.NoError(t, err)
-	assert.EqualValues(t, 3, count)
-}

models/git/protected_branch.go

@@ -99,8 +99,8 @@ func (protectBranch *ProtectedBranch) loadGlob() {
 	var err error
 	protectBranch.globRule, err = glob.Compile(protectBranch.RuleName, '/')
 	if err != nil {
-		log.Warn("Invalid glob rule for ProtectedBranch[%d]: %s %v", protectBranch.ID, protectBranch.RuleName, err)
+		log.Debug("Invalid glob rule for ProtectedBranch[%d]: %s %v", protectBranch.ID, protectBranch.RuleName, err)
-		protectBranch.globRule = glob.MustCompile(glob.QuoteMeta(protectBranch.RuleName), '/')
+		protectBranch.globRule, _ = glob.Compile(glob.QuoteMeta(protectBranch.RuleName), '/')
 	}
 }
 
@@ -110,7 +110,9 @@ func (protectBranch *ProtectedBranch) Match(branchName string) bool {
 	if protectBranch.isPlainName {
 		return strings.EqualFold(protectBranch.RuleName, branchName)
 	}
-
+	if protectBranch.globRule == nil {
+		return false // in case of invalid glob rule, we don't match anything
+	}
 	return protectBranch.globRule.Match(branchName)
 }
 
@@ -123,23 +125,13 @@ func (protectBranch *ProtectedBranch) LoadRepo(ctx context.Context) (err error)
 }
 
 // CanUserPush returns if some user could push to this protected branch
-func (protectBranch *ProtectedBranch) CanUserPush(ctx context.Context, user *user_model.User) bool {
+func (protectBranch *ProtectedBranch) CanUserPush(ctx context.Context, user *user_model.User, permissionInRepo access_model.Permission) bool {
 	if !protectBranch.CanPush {
 		return false
 	}
 
 	if !protectBranch.EnableWhitelist {
-		if err := protectBranch.LoadRepo(ctx); err != nil {
+		return permissionInRepo.CanWrite(unit.TypeCode)
-			log.Error("LoadRepo: %v", err)
-			return false
-		}
-
-		writeAccess, err := access_model.HasAccessUnit(ctx, user, protectBranch.Repo, unit.TypeCode, perm.AccessModeWrite)
-		if err != nil {
-			log.Error("HasAccessUnit: %v", err)
-			return false
-		}
-		return writeAccess
 	}
 
 	if slices.Contains(protectBranch.WhitelistUserIDs, user.ID) {
@@ -160,17 +152,17 @@ func (protectBranch *ProtectedBranch) CanUserPush(ctx context.Context, user *use
 
 // CanUserForcePush returns if some user could force push to this protected branch
 // Since force-push extends normal push, we also check if user has regular push access
-func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user *user_model.User) bool {
+func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user *user_model.User, permissionInRepo access_model.Permission) bool {
 	if !protectBranch.CanForcePush {
 		return false
 	}
 
 	if !protectBranch.EnableForcePushAllowlist {
-		return protectBranch.CanUserPush(ctx, user)
+		return protectBranch.CanUserPush(ctx, user, permissionInRepo)
 	}
 
 	if slices.Contains(protectBranch.ForcePushAllowlistUserIDs, user.ID) {
-		return protectBranch.CanUserPush(ctx, user)
+		return protectBranch.CanUserPush(ctx, user, permissionInRepo)
 	}
 
 	if len(protectBranch.ForcePushAllowlistTeamIDs) == 0 {
@@ -182,7 +174,7 @@ func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user
 		log.Error("IsUserInTeams: %v", err)
 		return false
 	}
-	return in && protectBranch.CanUserPush(ctx, user)
+	return in && protectBranch.CanUserPush(ctx, user, permissionInRepo)
 }
 
 // IsUserMergeWhitelisted checks if some user is whitelisted to merge to this branch

models/git/protected_branch_list.go

@@ -9,6 +9,7 @@ import (
 
 	"gitea.dev/models/db"
 	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
 	"gitea.dev/modules/optional"
 )
 
@@ -55,10 +56,17 @@ func FindRepoProtectedBranchRules(ctx context.Context, repoID int64) (ProtectedB
 // FindAllMatchedBranches find all matched branches
 func FindAllMatchedBranches(ctx context.Context, repoID int64, ruleName string) ([]string, error) {
 	results := make([]string, 0, 10)
+	rule, err := glob.Compile(ruleName)
+	if err != nil {
+		log.Debug("Failed to compile rule %s: %v", ruleName, err)
+		return results, nil
+	}
+
+	const pageSize = 100
 	for page := 1; ; page++ {
-		brancheNames, err := FindBranchNames(ctx, FindBranchOptions{
+		branchNames, err := FindBranchNames(ctx, FindBranchOptions{
 			ListOptions: db.ListOptions{
-				PageSize: 100,
+				PageSize: pageSize,
 				Page:     page,
 			},
 			RepoID:          repoID,
@@ -67,14 +75,12 @@ func FindAllMatchedBranches(ctx context.Context, repoID int64, ruleName string)
 		if err != nil {
 			return nil, err
 		}
-		rule := glob.MustCompile(ruleName)
+		for _, branch := range branchNames {
-
-		for _, branch := range brancheNames {
 			if rule.Match(branch) {
 				results = append(results, branch)
 			}
 		}
-		if len(brancheNames) < 100 {
+		if len(branchNames) < pageSize {
 			break
 		}
 	}

models/issues/issue.go

@@ -81,7 +81,7 @@ type Issue struct {
 	PullRequest       *PullRequest     `xorm:"-"`
 	NumComments       int
 
-	// TODO: RemoveIssueRef: see "repo/issue/branch_selector_field.tmpl"
+	// TODO: ISSUE-SIDEBAR-REF-SELECTOR: see "repo/issue/branch_selector_field.tmpl"
 	Ref string
 
 	PinOrder int `xorm:"-"` // 0 means not loaded, -1 means loaded but not pinned

models/issues/issue_search.go

@@ -477,7 +477,7 @@ func applySubscribedCondition(sess db.Session, subscriberID int64) {
 				Select("repo_id").
 				From("watch").
 				Where(builder.And(builder.Eq{"user_id": subscriberID},
-					builder.In("mode", repo_model.WatchModeNormal, repo_model.WatchModeAuto))),
+					builder.In("mode", repo_model.WatchModeNormal, repo_model.WatchModeAuto, repo_model.WatchModeCustom))),
 			),
 		),
 	)

models/issues/label.go

@@ -269,27 +269,23 @@ func UpdateLabel(ctx context.Context, l *Label) error {
 	return updateLabelCols(ctx, l, "name", "description", "color", "exclusive", "exclusive_order", "archived_unix")
 }
 
-// DeleteLabel delete a label
+// DeleteRepoLabel deletes a repository label.
-func DeleteLabel(ctx context.Context, id, labelID int64) error {
+func DeleteRepoLabel(ctx context.Context, repoID, labelID int64) error {
-	l, err := GetLabelByID(ctx, labelID)
+	return deleteLabel(ctx, labelID, builder.Eq{"repo_id": repoID, "org_id": 0})
-	if err != nil {
+}
-		if IsErrLabelNotExist(err) {
-			return nil
-		}
-		return err
-	}
 
+// DeleteOrgLabel deletes an organization label.
+func DeleteOrgLabel(ctx context.Context, orgID, labelID int64) error {
+	return deleteLabel(ctx, labelID, builder.Eq{"org_id": orgID, "repo_id": 0})
+}
+
+func deleteLabel(ctx context.Context, labelID int64, ownerCond builder.Cond) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		if l.BelongsToOrg() && l.OrgID != id {
+		deleted, err := db.GetEngine(ctx).ID(labelID).Where(ownerCond).Delete(new(Label))
-			return nil
+		if err != nil || deleted == 0 {
-		}
-		if l.BelongsToRepo() && l.RepoID != id {
-			return nil
-		}
-
-		if _, err = db.DeleteByID[Label](ctx, labelID); err != nil {
 			return err
-		} else if _, err = db.GetEngine(ctx).
+		}
+		if _, err = db.GetEngine(ctx).
 			Where("label_id = ?", labelID).
 			Delete(new(IssueLabel)); err != nil {
 			return err

models/issues/label_test.go

@@ -320,13 +320,29 @@ func TestUpdateLabel(t *testing.T) {
 func TestDeleteLabel(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	label := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 1})
-	assert.NoError(t, issues_model.DeleteLabel(t.Context(), label.RepoID, label.ID))
+	orgLabel := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 3})
+	repoLabel := unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: 10, RepoID: orgLabel.OrgID})
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), repoLabel.RepoID, repoLabel.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: repoLabel.ID})
+
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), orgLabel.OrgID, orgLabel.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: orgLabel.ID})
+
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), unittest.NonexistentID, orgLabel.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: orgLabel.ID})
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), orgLabel.OrgID, orgLabel.ID))
+	unittest.AssertNotExistsBean(t, &issues_model.Label{ID: orgLabel.ID})
+
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), unittest.NonexistentID, label.ID))
+	unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: label.ID})
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), label.RepoID, label.ID))
 	unittest.AssertNotExistsBean(t, &issues_model.Label{ID: label.ID, RepoID: label.RepoID})
 
-	assert.NoError(t, issues_model.DeleteLabel(t.Context(), label.RepoID, label.ID))
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), label.RepoID, label.ID))
 	unittest.AssertNotExistsBean(t, &issues_model.Label{ID: label.ID})
 
-	assert.NoError(t, issues_model.DeleteLabel(t.Context(), unittest.NonexistentID, unittest.NonexistentID))
+	assert.NoError(t, issues_model.DeleteRepoLabel(t.Context(), unittest.NonexistentID, unittest.NonexistentID))
+	assert.NoError(t, issues_model.DeleteOrgLabel(t.Context(), unittest.NonexistentID, unittest.NonexistentID))
 	unittest.CheckConsistencyFor(t, &issues_model.Label{}, &repo_model.Repository{})
 }
 

models/issues/pull.go

@@ -407,6 +407,21 @@ func (pr *PullRequest) GetGitHeadRefName() string { // TODO: make it return RefN
 	return git.RefNameFromPullIndex(pr.Index).String()
 }
 
+func (pr *PullRequest) GetInstructionsCliArgs() (ret struct {
+	BaseBranchArg  string
+	HeadBranchArg  string
+	LocalBranchArg string
+},
+) {
+	ret.BaseBranchArg = util.ShellEscape(pr.BaseBranch)
+	ret.HeadBranchArg = util.ShellEscape(pr.HeadBranch)
+	ret.LocalBranchArg = ret.HeadBranchArg
+	if pr.HeadRepo != nil && pr.HeadRepoID != pr.BaseRepoID {
+		ret.LocalBranchArg = util.ShellEscape(pr.HeadRepo.OwnerName) + "-" + ret.HeadBranchArg
+	}
+	return ret
+}
+
 // GetReviewCommentsCount returns the number of review comments made on the diff of a PR review (not including comments on commits or issues in a PR)
 func (pr *PullRequest) GetReviewCommentsCount(ctx context.Context) int {
 	opts := FindCommentsOptions{

models/renderhelper/repo_file_test.go

@@ -9,6 +9,7 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/test"
 
 	_ "gitea.dev/modules/markup/orgmode"
 
@@ -80,6 +81,23 @@ func TestRepoFile(t *testing.T) {
 <video src="/user2/repo1/media/commit/1234/my%20dir/LINK">
 </video>`, rendered)
 	})
+
+	t.Run("PictureSource", func(t *testing.T) {
+		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{CurrentRefSubURL: "branch/main"}).
+			WithMarkupType(markdown.MarkupName)
+		rendered, err := testRenderString(rctx, `<picture><source media="(prefers-color-scheme: dark)" srcset="dark.svg"><img src="light.svg"></picture>`)
+		assert.NoError(t, err)
+		assert.Equal(t, test.NormalizeHTMLSpaces(`
+<p>
+	<a href="/user2/repo1/src/branch/main/light.svg" target="_blank" rel="nofollow noopener">
+		<picture>
+			<source media="(prefers-color-scheme: dark)" srcset="/user2/repo1/media/branch/main/dark.svg"/>
+			<img src="/user2/repo1/media/branch/main/light.svg"/>
+		</picture>
+	</a>
+</p>
+`), test.NormalizeHTMLSpaces(rendered))
+	})
 }
 
 func TestRepoFileOrgMode(t *testing.T) {

models/repo/attachment.go

@@ -133,6 +133,9 @@ func ExistAttachmentsByUUID(ctx context.Context, uuid string) (bool, error) {
 
 // GetAttachmentsByIssueID returns all attachments of an issue.
 func GetAttachmentsByIssueID(ctx context.Context, issueID int64) ([]*Attachment, error) {
+	if issueID == 0 { // unsaved issue, would match every issue-less attachment
+		return []*Attachment{}, nil
+	}
 	attachments := make([]*Attachment, 0, 10)
 	return attachments, db.GetEngine(ctx).Where("issue_id = ? AND comment_id = 0", issueID).Find(&attachments)
 }

models/repo/attachment_test.go

@@ -36,6 +36,10 @@ func TestGetByCommentOrIssueID(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Len(t, attachments, 1)
 
+	attachments, err = repo_model.GetAttachmentsByIssueID(t.Context(), 0)
+	assert.NoError(t, err)
+	assert.Empty(t, attachments)
+
 	attachments, err = repo_model.GetAttachmentsByCommentID(t.Context(), 1)
 	assert.NoError(t, err)
 	assert.Len(t, attachments, 2)

models/repo/release.go

@@ -191,6 +191,10 @@ func AddReleaseAttachments(ctx context.Context, releaseID int64, attachmentUUIDs
 	}
 
 	for i := range attachments {
+		if attachments[i].IssueID != 0 || attachments[i].CommentID != 0 || attachments[i].ReleaseID != 0 {
+			return util.NewPermissionDeniedErrorf("attachment is already linked")
+		}
+
 		if attachments[i].RepoID == 0 && attachments[i].CreatedUnix < LegacyAttachmentMissingRepoIDCutoff {
 			attachments[i].RepoID = rel.RepoID
 			if _, err = db.GetEngine(ctx).ID(attachments[i].ID).Cols("repo_id").Update(attachments[i]); err != nil {
@@ -201,10 +205,6 @@ func AddReleaseAttachments(ctx context.Context, releaseID int64, attachmentUUIDs
 		if attachments[i].RepoID != rel.RepoID {
 			return util.NewPermissionDeniedErrorf("attachment belongs to different repository")
 		}
-
-		if attachments[i].ReleaseID != 0 {
-			return util.NewPermissionDeniedErrorf("release permission denied")
-		}
 		attachments[i].ReleaseID = releaseID
 		// No assign value could be 0, so ignore AllCols().
 		if _, err = db.GetEngine(ctx).ID(attachments[i].ID).Cols("release_id").Update(attachments[i]); err != nil {
@@ -357,21 +357,21 @@ func GetLatestReleaseByRepoID(ctx context.Context, repoID int64) (*Release, erro
 }
 
 type releaseMetaSearch struct {
-	ID  []int64
+	IDs      []int64
-	Rel []*Release
+	Releases []*Release
 }
 
 func (s releaseMetaSearch) Len() int {
-	return len(s.ID)
+	return len(s.IDs)
 }
 
 func (s releaseMetaSearch) Swap(i, j int) {
-	s.ID[i], s.ID[j] = s.ID[j], s.ID[i]
+	s.IDs[i], s.IDs[j] = s.IDs[j], s.IDs[i]
-	s.Rel[i], s.Rel[j] = s.Rel[j], s.Rel[i]
+	s.Releases[i], s.Releases[j] = s.Releases[j], s.Releases[i]
 }
 
 func (s releaseMetaSearch) Less(i, j int) bool {
-	return s.ID[i] < s.ID[j]
+	return s.IDs[i] < s.IDs[j]
 }
 
 func hasDuplicateName(attaches []*Attachment) bool {
@@ -396,19 +396,26 @@ func GetReleaseAttachments(ctx context.Context, rels ...*Release) (err error) {
 	//    then merge join them
 
 	// Sort
-	sortedRels := releaseMetaSearch{ID: make([]int64, len(rels)), Rel: make([]*Release, len(rels))}
+	sortedRels := releaseMetaSearch{IDs: make([]int64, 0, len(rels)), Releases: make([]*Release, 0, len(rels))}
 	var attachments []*Attachment
-	for index, element := range rels {
+	for _, rel := range rels {
-		element.Attachments = []*Attachment{}
+		// if a provided "Release" has no ID, don't query it, otherwise, the "IN" query will return all other attachments for the repo
-		sortedRels.ID[index] = element.ID
+		if rel.ID == 0 {
-		sortedRels.Rel[index] = element
+			continue
+		}
+		rel.Attachments = []*Attachment{}
+		sortedRels.IDs = append(sortedRels.IDs, rel.ID)
+		sortedRels.Releases = append(sortedRels.Releases, rel)
+	}
+	if len(sortedRels.IDs) == 0 {
+		return nil
 	}
 	sort.Sort(sortedRels)
 
 	// Select attachments
 	err = db.GetEngine(ctx).
 		Asc("release_id", "name").
-		In("release_id", sortedRels.ID).
+		In("release_id", sortedRels.IDs).
 		Find(&attachments)
 	if err != nil {
 		return err
@@ -417,14 +424,14 @@ func GetReleaseAttachments(ctx context.Context, rels ...*Release) (err error) {
 	// merge join
 	currentIndex := 0
 	for _, attachment := range attachments {
-		for sortedRels.ID[currentIndex] < attachment.ReleaseID {
+		for sortedRels.IDs[currentIndex] < attachment.ReleaseID {
 			currentIndex++
 		}
-		sortedRels.Rel[currentIndex].Attachments = append(sortedRels.Rel[currentIndex].Attachments, attachment)
+		sortedRels.Releases[currentIndex].Attachments = append(sortedRels.Releases[currentIndex].Attachments, attachment)
 	}
 
 	// Makes URL's predictable
-	for _, release := range rels {
+	for _, release := range sortedRels.Releases {
 		// If we have no Repo, we don't need to execute this loop
 		if release.Repo == nil {
 			continue

models/repo/release_test.go

@@ -53,6 +53,18 @@ func TestAddReleaseAttachmentsRejectsDifferentRepo(t *testing.T) {
 	assert.Zero(t, attach.ReleaseID, "attachment should not be linked to release on failure")
 }
 
+func TestAddReleaseAttachmentsRejectsIssueAttachment(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	uuid := "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11"
+	err := AddReleaseAttachments(t.Context(), 1, []string{uuid})
+	assert.ErrorIs(t, err, util.ErrPermissionDenied)
+
+	attach, err := GetAttachmentByUUID(t.Context(), uuid)
+	assert.NoError(t, err)
+	assert.Zero(t, attach.ReleaseID)
+}
+
 func TestAddReleaseAttachmentsAllowsLegacyMissingRepoID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 

models/repo/repo.go

@@ -616,6 +616,15 @@ func ComposeHTTPSCloneURL(ctx context.Context, owner, repo string) string {
 
 // ComposeSSHCloneURL returns SSH clone URL based on the given owner and repository name.
 func ComposeSSHCloneURL(doer *user_model.User, ownerName, repoName string) string {
+	return composeSSHCloneURL(doer, ownerName, repoName, setting.Repository.UseCompatSSHURI)
+}
+
+// ComposeSSHCloneURI is like ComposeSSHCloneURL but always returns the "ssh://" form, because "go get" rejects scp-style addresses
+func ComposeSSHCloneURI(doer *user_model.User, ownerName, repoName string) string {
+	return composeSSHCloneURL(doer, ownerName, repoName, true)
+}
+
+func composeSSHCloneURL(doer *user_model.User, ownerName, repoName string, useURI bool) string {
 	sshUser := setting.SSH.User
 	sshDomain := setting.SSH.Domain
 
@@ -642,7 +651,7 @@ func ComposeSSHCloneURL(doer *user_model.User, ownerName, repoName string) strin
 	if ip := net.ParseIP(sshHost); ip != nil && ip.To4() == nil {
 		sshHost = "[" + sshHost + "]" // for IPv6 address, wrap it with brackets
 	}
-	if setting.Repository.UseCompatSSHURI {
+	if useURI {
 		return fmt.Sprintf("ssh://%s@%s/%s/%s.git", sshUser, sshHost, url.PathEscape(ownerName), url.PathEscape(repoName))
 	}
 	return fmt.Sprintf("%s@%s:%s/%s.git", sshUser, sshHost, url.PathEscape(ownerName), url.PathEscape(repoName))

models/repo/repo_test.go

@@ -185,6 +185,8 @@ func TestComposeSSHCloneURL(t *testing.T) {
 	assert.Equal(t, "git@domain:user/repo.git", ComposeSSHCloneURL(&user_model.User{Name: "doer"}, "user", "repo"))
 	setting.Repository.UseCompatSSHURI = true
 	assert.Equal(t, "ssh://git@domain/user/repo.git", ComposeSSHCloneURL(&user_model.User{Name: "doer"}, "user", "repo"))
+	setting.Repository.UseCompatSSHURI = false
+	assert.Equal(t, "ssh://git@domain/user/repo.git", ComposeSSHCloneURI(nil, "user", "repo"))
 	// test SSH_DOMAIN while use non-standard SSH port
 	setting.SSH.Port = 123
 	setting.Repository.UseCompatSSHURI = false

models/repo/watch.go

@@ -20,9 +20,10 @@ type WatchMode int8
 const (
 	WatchModeNone WatchMode = iota // 0 watch nothing unless mentioned
 
-	WatchModeNormal // 1 proactively watching (all or custom)
+	WatchModeNormal // 1 proactively watching (all, or custom before WatchModeCustom)
 	WatchModeDont   // 2 ignore the repo
 	WatchModeAuto   // 3 automatically watching (from AutoWatchOnChanges)
+	WatchModeCustom // 4 watching the events picked in the custom watch options
 )
 
 // WatchType is the `watch` column gating one kind of notification
@@ -79,7 +80,7 @@ func (w *Watch) IsWatching() bool {
 
 // IsWatchingAll reports whether every event is enabled, which is the "all activity" mode
 func (w *Watch) IsWatchingAll() bool {
-	return w.IncludePullRequests && w.IncludeIssues && w.IncludeReleases
+	return w.Mode != WatchModeCustom && w.IncludePullRequests && w.IncludeIssues && w.IncludeReleases
 }
 
 func (w *Watch) IsWatchingAny() bool {
@@ -166,6 +167,9 @@ func WatchRepoAuto(ctx context.Context, doer *user_model.User, repo *Repository,
 	if user_model.IsUserBlockedBy(ctx, doer, repo.OwnerID) {
 		return user_model.ErrBlockedUser
 	}
+	if watch.Mode == WatchModeCustom { // keep the events the user picked
+		return nil
+	}
 
 	return watchRepoByMode(ctx, watch, WatchModeNormal)
 }
@@ -189,7 +193,7 @@ func WatchRepoWithOptions(ctx context.Context, doer *user_model.User, repo *Repo
 		if err != nil {
 			return err
 		}
-		if opts.Mode == WatchModeNormal {
+		if opts.Mode == WatchModeNormal || opts.Mode == WatchModeCustom {
 			_, err = db.GetEngine(ctx).Where("user_id=? AND repo_id=?", doer.ID, repo.ID).
 				Cols("include_pull_requests", "include_issues", "include_releases").
 				Update(&Watch{IncludePullRequests: opts.WatchPullRequests, IncludeIssues: opts.WatchIssues, IncludeReleases: opts.WatchReleases})
@@ -247,6 +251,16 @@ func GetRepoIgnorersIDs(ctx context.Context, repoID int64) ([]int64, error) {
 // but avoids joining with `user` for performance reasons
 // User permissions must be verified elsewhere if required
 func GetRepoWatchersIDs(ctx context.Context, repoID int64, watchType WatchType) ([]int64, error) {
+	return getRepoWatchersIDs(ctx, repoID, watchType, false)
+}
+
+// GetRepoCustomWatchersIDs is GetRepoWatchersIDs limited to custom watches, which unlike
+// watching all activity are never set up automatically (e.g. by AutoWatchNewRepos)
+func GetRepoCustomWatchersIDs(ctx context.Context, repoID int64, watchType WatchType) ([]int64, error) {
+	return getRepoWatchersIDs(ctx, repoID, watchType, true)
+}
+
+func getRepoWatchersIDs(ctx context.Context, repoID int64, watchType WatchType, customOnly bool) ([]int64, error) {
 	ids := make([]int64, 0, 64)
 	var watchColName string
 	switch watchType {
@@ -259,12 +273,19 @@ func GetRepoWatchersIDs(ctx context.Context, repoID int64, watchType WatchType)
 	default:
 		panic("invalid WatchType")
 	}
-	return ids, db.GetEngine(ctx).Table("watch").
+	sess := db.GetEngine(ctx).Table("watch").
 		Where("watch.repo_id=?", repoID).
 		And("watch.mode<>?", WatchModeDont).
-		And(builder.Eq{watchColName: true}).
+		And(builder.Eq{watchColName: true})
-		Select("user_id").
+	if customOnly { // matches SelectedMode() == "custom"
-		Find(&ids)
+		sess = sess.And(builder.Or(
+			builder.Eq{"watch.mode": WatchModeCustom},
+			builder.Eq{"watch.include_pull_requests": false},
+			builder.Eq{"watch.include_issues": false},
+			builder.Eq{"watch.include_releases": false},
+		))
+	}
+	return ids, sess.Select("user_id").Find(&ids)
 }
 
 // GetRepoWatchers returns range of users watching given repository.

models/repo/watch_test.go

@@ -145,7 +145,7 @@ func TestWatchOptions(t *testing.T) {
 	// repo 1 is watched by users 1, 4, 9 and 11, all with every event enabled
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	assert.NoError(t, repo_model.WatchRepoWithOptions(t.Context(), user, repo, repo_model.WatchOptions{Mode: repo_model.WatchModeNormal, WatchPullRequests: true}))
+	assert.NoError(t, repo_model.WatchRepoWithOptions(t.Context(), user, repo, repo_model.WatchOptions{Mode: repo_model.WatchModeNormal, WatchPullRequests: true})) // custom watches were stored like this before WatchModeCustom
 
 	for watchType, expected := range map[repo_model.WatchType][]int64{
 		repo_model.WatchPullRequests: {1, 4, 9, 11},
@@ -157,6 +157,20 @@ func TestWatchOptions(t *testing.T) {
 		assert.ElementsMatch(t, expected, ids, watchType)
 	}
 
+	// a custom watch picking every event differs from all activity, which can be set up automatically
+	customUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+	assert.NoError(t, repo_model.WatchRepoWithOptions(t.Context(), customUser, repo, repo_model.WatchOptions{Mode: repo_model.WatchModeCustom, WatchPullRequests: true, WatchIssues: true, WatchReleases: true}))
+	assert.NoError(t, repo_model.WatchRepoAuto(t.Context(), customUser, repo, true)) // must keep the custom watch
+	for watchType, expected := range map[repo_model.WatchType][]int64{
+		repo_model.WatchPullRequests: {1, 4},
+		repo_model.WatchIssues:       {4},
+		repo_model.WatchReleases:     {4},
+	} {
+		ids, err := repo_model.GetRepoCustomWatchersIDs(t.Context(), repo.ID, watchType)
+		assert.NoError(t, err)
+		assert.ElementsMatch(t, expected, ids, watchType)
+	}
+
 	// the options of one user must not show up for another
 	watches, err := repo_model.GetUserWatches(t.Context(), 4, []int64{repo.ID})
 	assert.NoError(t, err)
@@ -176,5 +190,6 @@ func TestWatchSelectedMode(t *testing.T) {
 	assert.Equal(t, "participate", (&repo_model.Watch{Mode: repo_model.WatchModeNormal}).SelectedMode())
 	assert.Equal(t, "ignore", (&repo_model.Watch{Mode: repo_model.WatchModeDont}).SelectedMode())
 	assert.Equal(t, "custom", (&repo_model.Watch{Mode: repo_model.WatchModeNormal, IncludeIssues: true}).SelectedMode())
+	assert.Equal(t, "custom", (&repo_model.Watch{Mode: repo_model.WatchModeCustom, IncludePullRequests: true, IncludeIssues: true, IncludeReleases: true}).SelectedMode())
 	assert.Equal(t, "all", (&repo_model.Watch{Mode: repo_model.WatchModeAuto, IncludePullRequests: true, IncludeIssues: true, IncludeReleases: true}).SelectedMode())
 }

models/user/email_address_test.go

@@ -151,16 +151,28 @@ func TestListEmails(t *testing.T) {
 
 func TestEmailAddressValidate(t *testing.T) {
 	cases := map[string]bool{
-		"":                   false,
+		"":   false,
-		"root@localhost":     true,
+		"@a": false,
-		"user@[192.168.1.2]": true,
+
-		"@a":                 false,
+		// "_" shouldn't appear in domain but can appear in hostname, since we can't stop site admins from doing so, just accept it
-		"abc@gmail.com":      true,
+		"root@local_host": true,
-		"abc@gmail.com\n":    false,
+		"root@localhost":  true,
+		"root@LOCALHOST":  true,
+
+		"user@[192.168.1.2]":  true,
+		"user@[IPv6:FFff::1]": true,
+
+		"abc@gmail.com":   true,
+		"abc@gmail.com.":  false,
+		"abc@gmail.com-":  false,
+		"abc@gmail.com\n": false,
+		"abc@gmail..com":  false,
+		"abc@gmail com":   false,
+		"abc@gmail*com":   false,
+
 		"Foo <foo@bar.com>":  false,
 		"abc@gmail.com (x)":  false,
-		"jürgen@example.com": false,
+		"jürgen@example.com": false, // utf8 address is not supported yet
-		"a@foo_bar.com":      false,
 	}
 	for tc, isValid := range cases {
 		t.Run(tc, func(t *testing.T) {

models/user/user.go

@@ -1021,7 +1021,8 @@ func GetInactiveUsers(ctx context.Context, olderThan time.Duration) ([]*User, er
 		Find(&users)
 }
 
-// GetUserByID returns the user object by given ID if exists.
+// GetUserByID returns the user object by given ID if exists. TODO: for most cases, this function should be avoided.
+// Use correct GetXxxUser functions instead to handle user types & states correctly.
 func GetUserByID(ctx context.Context, id int64) (*User, error) {
 	u := new(User)
 	has, err := db.GetEngine(ctx).ID(id).Get(u)
@@ -1033,7 +1034,8 @@ func GetUserByID(ctx context.Context, id int64) (*User, error) {
 	return u, nil
 }
 
-// GetUserByIDs returns the user objects by given IDs if exists.
+// GetUserByIDs returns the user objects by given IDs if exists. TODO: for most cases, this function should be avoided.
+// Use correct GetXxxUser functions instead to handle user types & states correctly.
 func GetUserByIDs(ctx context.Context, ids []int64) ([]*User, error) {
 	if len(ids) == 0 {
 		return nil, nil
@@ -1046,6 +1048,13 @@ func GetUserByIDs(ctx context.Context, ids []int64) ([]*User, error) {
 	return users, err
 }
 
+// Glossaries for XxxUser:
+// * Possible: The user may or may not exist in the database, but we can still return a valid user object (e.g. Ghost user) for the given ID.
+// * Individual: The user is a real person, not an organization or a bot.
+// * Doer: The user is the one performing an action
+// * Valid: The user is an active user and not prohibited from signing in
+// * System: Negative ID (e.g. Ghost, Actions, DeployKey, etc.) and not a real person, Ghost is not included if there is no "Possible" keyword
+
 // GetPossibleUserByID returns the possible user and its ID. If the user doesn't exist, it returns Ghost user
 func GetPossibleUserByID(ctx context.Context, id int64) (_ int64, u *User, err error) {
 	if id < 0 {
@@ -1082,6 +1091,23 @@ func GetPossibleUserByIDs(ctx context.Context, ids []int64) ([]*User, error) {
 	return users, nil
 }
 
+func GetValidDoerUserByID(ctx context.Context, id int64) (*User, error) {
+	u, err := GetUserByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if !u.IsIndividual() && !u.IsTypeBot() {
+		return nil, util.NewNotExistErrorf("user %d is not a doer", id)
+	}
+	if !u.IsActive {
+		return nil, util.NewPermissionDeniedErrorf("user %d is inactive", id)
+	}
+	if u.ProhibitLogin {
+		return nil, util.NewPermissionDeniedErrorf("user %d is prohibited from login", id)
+	}
+	return u, nil
+}
+
 func getUserByNameWithTypes(ctx context.Context, name string, types ...UserType) (*User, error) {
 	u := &User{}
 	sess := db.GetEngine(ctx).Where(builder.Eq{"lower_name": strings.ToLower(name)})
@@ -1201,6 +1227,9 @@ func GetUsersByEmails(ctx context.Context, emails []string) (*EmailUserMap, erro
 	noReplyAddressSuffix := "@" + strings.ToLower(setting.Service.NoReplyAddress)
 	for _, email := range emails {
 		emailLower := strings.ToLower(email)
+		if emailLower == "" {
+			continue // a commit without an author email names no user
+		}
 		needCheckEmails.Add(emailLower)
 		if localPart, ok := strings.CutSuffix(emailLower, noReplyAddressSuffix); ok {
 			name, id := parseLocalPartToNameID(localPart)

models/user/user_test.go

@@ -95,6 +95,12 @@ func TestUserEmails(t *testing.T) {
 			setting.Service.NoReplyAddress = "example.com"
 			testGetUserByEmail(t, "user1-2@example.COM", 1)
 		})
+
+		t.Run("EmptyEmail", func(t *testing.T) {
+			// A user whose email address is empty must not own commits that have no author email.
+			require.NoError(t, db.Insert(t.Context(), &user_model.EmailAddress{UID: 2, Email: "", LowerEmail: "", IsActivated: true}))
+			testGetUserByEmail(t, "", 0)
+		})
 	})
 	t.Run("GetUserByEmail", func(t *testing.T) {
 		testGetUserByEmail := func(t *testing.T, email string, uid int64) {

modules/actions/jobparser/model.go

@@ -4,7 +4,6 @@
 package jobparser
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
 	"strings"
@@ -65,44 +64,31 @@ func (w *SingleWorkflow) SetJob(id string, job *Job) error {
 	m := map[string]*Job{
 		id: job,
 	}
-	var buf bytes.Buffer
+	out, err := marshalYAML(m)
-	encoder := yaml.NewEncoder(&buf)
+	if err != nil {
-	encoder.SetIndent(2)
-	if err := encoder.Encode(m); err != nil {
 		return err
 	}
-	encoder.Close()
 
 	node := yaml.Node{}
-	if err := yaml.Unmarshal(buf.Bytes(), &node); err != nil {
+	if err := yaml.Unmarshal(out, &node); err != nil {
 		return err
 	}
 	if len(node.Content) != 1 || node.Content[0].Kind != yaml.MappingNode {
-		return fmt.Errorf("can not set job: %s", buf.String())
+		return fmt.Errorf("can not set job: %s", out)
 	}
 	w.RawJobs = *node.Content[0]
 	return nil
 }
 
 func (w *SingleWorkflow) Marshal() ([]byte, error) {
-	// Encode with the same indentation SetJob uses (2). yaml.Marshal's default
-	// indentation (4) makes the encoder emit multi-line block scalars (e.g. a
-	// `run:` step that begins with blank lines) with a wrong explicit indentation
-	// indicator (`run: |4`) that then fails to re-parse, which silently strands
-	// the job during concurrency evaluation. Keeping both encoders at indent 2
-	// makes the serialized single workflow round-trip.
-	var buf bytes.Buffer
-	enc := yaml.NewEncoder(&buf)
-	enc.SetIndent(2)
 	payload := *w
 	payload.RunName = "" // already interpolated into the run title, a runner would parse it as a template again
-	if err := enc.Encode(&payload); err != nil {
+	return marshalYAML(&payload)
-		return nil, err
+}
-	}
+
-	if err := enc.Close(); err != nil {
+// marshalYAML never wraps lines, go-yaml wraps more-indented lines of folded scalars until https://github.com/yaml/go-yaml/pull/441 is released.
-		return nil, err
+func marshalYAML(v any) ([]byte, error) {
-	}
+	return yaml.Dump(v, yaml.WithV3Defaults(), yaml.WithIndent(2), yaml.WithLineWidth(-1))
-	return buf.Bytes(), nil
 }
 
 type Job struct {
@@ -188,29 +174,18 @@ func (j *Job) DisplayName() string {
 	return util.EllipsisDisplayString(unescapeExpressions(j.Name), 255)
 }
 
-// BlockSafeString works around https://github.com/yaml/go-yaml/issues/399, quoting a value whose
-// leading newline would cost a literal block scalar its indentation indicator.
-type BlockSafeString string
-
-func (s BlockSafeString) MarshalYAML() (any, error) {
-	if !strings.HasPrefix(string(s), "\n") {
-		return string(s), nil
-	}
-	return &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Style: yaml.DoubleQuotedStyle, Value: string(s)}, nil
-}
-
 type Step struct {
-	ID                 string          `yaml:"id,omitempty"`
+	ID                 string    `yaml:"id,omitempty"`
-	If                 yaml.Node       `yaml:"if,omitempty"`
+	If                 yaml.Node `yaml:"if,omitempty"`
-	Name               BlockSafeString `yaml:"name,omitempty"`
+	Name               string    `yaml:"name,omitempty"`
-	Uses               string          `yaml:"uses,omitempty"`
+	Uses               string    `yaml:"uses,omitempty"`
-	Run                BlockSafeString `yaml:"run,omitempty"`
+	Run                string    `yaml:"run,omitempty"`
-	WorkingDirectory   string          `yaml:"working-directory,omitempty"`
+	WorkingDirectory   string    `yaml:"working-directory,omitempty"`
-	Shell              string          `yaml:"shell,omitempty"`
+	Shell              string    `yaml:"shell,omitempty"`
-	Env                yaml.Node       `yaml:"env,omitempty"`
+	Env                yaml.Node `yaml:"env,omitempty"`
-	With               yaml.Node       `yaml:"with,omitempty"`
+	With               yaml.Node `yaml:"with,omitempty"`
-	RawContinueOnError yaml.Node       `yaml:"continue-on-error,omitempty"` // raw: the runner evaluates it with the steps context
+	RawContinueOnError yaml.Node `yaml:"continue-on-error,omitempty"` // raw: the runner evaluates it with the steps context
-	TimeoutMinutes     string          `yaml:"timeout-minutes,omitempty"`
+	TimeoutMinutes     string    `yaml:"timeout-minutes,omitempty"`
 }
 
 // UnmarshalYAML canonicalizes booleans like continue-on-error
@@ -232,9 +207,9 @@ func (s *Step) String() string {
 	}
 	return (&model.Step{
 		ID:   s.ID,
-		Name: string(s.Name),
+		Name: s.Name,
 		Uses: s.Uses,
-		Run:  string(s.Run),
+		Run:  s.Run,
 	}).String()
 }
 

modules/actions/jobparser/roundtrip_test.go

@@ -48,7 +48,7 @@ jobs:
 	_, origJob := sws[0].Job()
 	require.Len(t, origJob.Steps, 1)
 	const wantRun = "\n\necho start\necho done\n"
-	require.Equal(t, wantRun, string(origJob.Steps[0].Run))
+	require.Equal(t, wantRun, origJob.Steps[0].Run)
 
 	payload, err := sws[0].Marshal()
 	require.NoError(t, err)
@@ -63,7 +63,7 @@ jobs:
 	// the round-trip must preserve the run block byte-for-byte
 	_, gotJob := roundTripped[0].Job()
 	require.Len(t, gotJob.Steps, 1)
-	require.Equal(t, wantRun, string(gotJob.Steps[0].Run), "round-trip must preserve run content; got payload:\n%s", payload)
+	require.Equal(t, wantRun, gotJob.Steps[0].Run, "round-trip must preserve run content; got payload:\n%s", payload)
 }
 
 // Typing a step's continue-on-error as a bool used to reject the whole `jobs:` node.
@@ -104,3 +104,37 @@ jobs:
 		require.Equal(t, w, steps[i].RawContinueOnError, "step %d, payload:\n%s", i, payload)
 	}
 }
+
+// Folded (`>`) scalars in with/env used to gain blank lines and have spaces turned into newlines
+// on every Marshal -> Parse cycle.
+func TestSingleWorkflowRoundTripFoldedScalar(t *testing.T) {
+	const wf = `name: demo
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ./.github/actions/build
+        with:
+          cfg: >
+            begin
+              first "indented" line with path dir/Installer Scripts/some long path/another long path/some file name.xzy,
+              second "indented" line
+            end
+`
+	const want = "begin\n  first \"indented\" line with path dir/Installer Scripts/some long path/another long path/some file name.xzy,\n  second \"indented\" line\nend\n"
+	sws, err := Parse([]byte(wf))
+	require.NoError(t, err)
+	require.Len(t, sws, 1)
+	for range 3 {
+		payload, err := sws[0].Marshal()
+		require.NoError(t, err)
+		sws, err = Parse(payload)
+		require.NoError(t, err)
+		require.Len(t, sws, 1)
+	}
+	_, job := sws[0].Job()
+	var with map[string]string
+	require.NoError(t, job.Steps[0].With.Decode(&with))
+	require.Equal(t, want, with["cfg"])
+}

modules/actions/jobparser/testdata/prefixed_newline.out.yaml

@@ -7,5 +7,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: extract_tag
-        name: "\nExtract tag for variant"
+        name: |-
-        run: "\necho Test\n"
+
+          Extract tag for variant
+        run: |
+
+          echo Test

modules/actions/workflows.go

@@ -532,7 +532,7 @@ func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool
 			}
 
 			for _, val := range vals {
-				if slices.ContainsFunc(actions, glob.MustCompile(val, '/').Match) {
+				if matchActivityType(val, actions...) {
 					matchTimes++
 					break
 				}
@@ -575,7 +575,7 @@ func matchPullRequestEvent(ctx context.Context, gitRepo *git.Repository, commit
 		}
 		log.Trace("matching pull_request %s with %v", action, vals)
 		for _, val := range vals {
-			if glob.MustCompile(val, '/').Match(string(action)) {
+			if matchActivityType(val, string(action)) {
 				activityTypeMatched = true
 				matchTimes++
 				break
@@ -678,7 +678,7 @@ func matchIssueCommentEvent(issueCommentPayload *api.IssueCommentPayload, evt *j
 			// NONE
 
 			for _, val := range vals {
-				if glob.MustCompile(val, '/').Match(string(issueCommentPayload.Action)) {
+				if matchActivityType(val, string(issueCommentPayload.Action)) {
 					matchTimes++
 					break
 				}
@@ -718,7 +718,7 @@ func matchPullRequestReviewEvent(prPayload *api.PullRequestPayload, evt *jobpars
 			}
 
 			for _, val := range vals {
-				if slices.ContainsFunc(actions, glob.MustCompile(val, '/').Match) {
+				if matchActivityType(val, actions...) {
 					matchTimes++
 					break
 				}
@@ -758,7 +758,7 @@ func matchPullRequestReviewCommentEvent(prPayload *api.PullRequestPayload, evt *
 			}
 
 			for _, val := range vals {
-				if slices.ContainsFunc(actions, glob.MustCompile(val, '/').Match) {
+				if matchActivityType(val, actions...) {
 					matchTimes++
 					break
 				}
@@ -795,7 +795,7 @@ func matchReleaseEvent(payload *api.ReleasePayload, evt *jobparser.Event) bool {
 				action = "edited"
 			}
 			for _, val := range vals {
-				if glob.MustCompile(val, '/').Match(string(action)) {
+				if matchActivityType(val, string(action)) {
 					matchTimes++
 					break
 				}
@@ -832,7 +832,7 @@ func matchPackageEvent(payload *api.PackagePayload, evt *jobparser.Event) bool {
 				action = "published"
 			}
 			for _, val := range vals {
-				if glob.MustCompile(val, '/').Match(string(action)) {
+				if matchActivityType(val, string(action)) {
 					matchTimes++
 					break
 				}
@@ -857,7 +857,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 		case "types":
 			action := payload.Action
 			for _, val := range vals {
-				if glob.MustCompile(val, '/').Match(action) {
+				if matchActivityType(val, action) {
 					matchTimes++
 					break
 				}
@@ -893,3 +893,13 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 	}
 	return matchTimes == len(evt.Acts())
 }
+
+// matchActivityType treats an invalid user-provided pattern as no match instead of panicking
+func matchActivityType(pattern string, actions ...string) bool {
+	g, err := glob.Compile(pattern, '/')
+	if err != nil {
+		log.Debug("invalid activity type pattern %q: %v", pattern, err)
+		return false
+	}
+	return slices.ContainsFunc(actions, g.Match)
+}

modules/actions/workflows_test.go

@@ -205,6 +205,13 @@ func TestDetectMatched(t *testing.T) {
 			yamlOn:       "on:\n  release:\n    types: [published]",
 			expected:     detectMatched,
 		},
+		{
+			desc:         "HookEventRelease(release) doesn't match an invalid activity type pattern",
+			triggedEvent: webhook_module.HookEventRelease,
+			payload:      &api.ReleasePayload{Action: api.HookReleasePublished},
+			yamlOn:       "on:\n  release:\n    types: [\"[\"]",
+			expected:     detectNotApplicable,
+		},
 		{
 			desc:         "HookEventPackage(package) `created` action doesn't match GithubEventRegistryPackage(registry_package) with `updated` activity type",
 			triggedEvent: webhook_module.HookEventPackage,

modules/assetfs/embed.go

@@ -102,11 +102,11 @@ func NewEmbeddedFS(data []byte) fs.ReadDirFS {
 	efs := &embeddedFS{data: data, files: make(map[string]*embeddedFileInfo)}
 	efs.meta = sync.OnceValue(func() *EmbeddedMeta {
 		var meta EmbeddedMeta
-		p := bytes.LastIndexByte(data, '\n')
+		_, metaJSON, ok := bytes.CutLast(data, []byte{'\n'})
-		if p < 0 {
+		if !ok {
 			return &meta
 		}
-		if err := json.Unmarshal(data[p+1:], &meta); err != nil {
+		if err := json.Unmarshal(metaJSON, &meta); err != nil {
 			panic("embedded file is not valid")
 		}
 		return &meta

modules/auth/webauthn/webauthn.go

@@ -32,6 +32,14 @@ func Init() {
 			RPID:                  setting.AppDomain,
 			RPOrigins:             []string{appURL},
 			AttestationPreference: protocol.PreferNoAttestation, // Gitea never verifies attestation
+			// WebKit (Safari on iOS and macOS) returns an unsolicited "appid" client
+			// extension output even when the relying party did not request it. Since the
+			// webauthn library upgrade to v0.18, the default policy fails such ceremonies
+			// ('Client returned the appid extension output which was not requested'), breaking
+			// every passkey and security-key login from Safari on iOS. Ignore unsolicited
+			// extension outputs, the same policy other relying parties adopted for the
+			// same WebKit behavior.
+			ExtensionsUnsolicitedOutputPolicy: protocol.UnsolicitedOutputPolicyIgnore,
 		},
 	}
 }

modules/auth/webauthn/webauthn_test.go

@@ -8,6 +8,7 @@ import (
 
 	"gitea.dev/modules/setting"
 
+	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -22,4 +23,5 @@ func TestInit(t *testing.T) {
 	assert.Equal(t, setting.AppDomain, WebAuthn.Config.RPID)
 	assert.Equal(t, setting.AppName, WebAuthn.Config.RPDisplayName)
 	assert.Equal(t, rpOrigin, WebAuthn.Config.RPOrigins)
+	assert.Equal(t, protocol.UnsolicitedOutputPolicyIgnore, WebAuthn.Config.ExtensionsUnsolicitedOutputPolicy)
 }

modules/charset/escape_stream.go

@@ -8,11 +8,13 @@ import (
 	"fmt"
 	"html"
 	"io"
+	"strings"
 	"unicode"
 	"unicode/utf8"
 
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 )
 
 type htmlChunkReader struct {
@@ -30,6 +32,10 @@ type escapeStreamer struct {
 	ambiguousTables []*AmbiguousTable
 	allowed         map[rune]bool
 
+	tagPartial []byte // partial tag content, used to detect if we are in some tags
+
+	inTagMath bool // MathML operators like U+2212 are intended and wrapping them breaks the math layout
+
 	out io.Writer
 }
 
@@ -62,6 +68,7 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 		for i, part := range parts {
 			if partInTag[i] {
 				lastIsTag = true
+				es.trackHtmlTag(part)
 				if _, err := out.Write(part); err != nil {
 					return nil, err
 				}
@@ -75,7 +82,11 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 						return nil, err
 					}
 				}
-				if err = es.detectAndWriteRunes(part); err != nil {
+				if es.inTagMath {
+					if _, err := out.Write(part); err != nil {
+						return nil, err
+					}
+				} else if err = es.detectAndWriteRunes(part); err != nil {
 					return nil, err
 				}
 			}
@@ -83,6 +94,34 @@ func escapeStream(locale translation.Locale, in io.Reader, out io.Writer, opts .
 	}
 }
 
+// trackHtmlTag receives tag parts, a tag might be split into multiple parts
+func (e *escapeStreamer) trackHtmlTag(part []byte) {
+	const maxHeadLen = 100 // only read the first N bytes of the tag for detection purpose
+	if part[0] == '<' {
+		// start a new tag
+		e.tagPartial = e.tagPartial[:0]
+	}
+	if len(e.tagPartial) >= maxHeadLen {
+		return
+	}
+	e.tagPartial = append(e.tagPartial, part[:min(len(part), maxHeadLen-len(e.tagPartial))]...)
+
+	isTag := func(prefix string) bool {
+		if len(e.tagPartial) < len(prefix)+1 {
+			return false
+		}
+		if !util.AsciiEqualFold(e.tagPartial[:len(prefix)], []byte(prefix)) {
+			return false
+		}
+		return strings.IndexByte(" \t\n\r\f>", e.tagPartial[len(prefix)]) != -1
+	}
+	if isTag("<math") {
+		e.inTagMath = true
+	} else if isTag("</math") {
+		e.inTagMath = false
+	}
+}
+
 func (e *escapeStreamer) trimAndWriteBom(part []byte) ([]byte, error) {
 	remaining, ok := bytes.CutPrefix(part, globalVars().utf8Bom)
 	if ok {

modules/charset/escape_test.go

@@ -141,6 +141,12 @@ then resh (ר), and finally heh (ה) (which should appear leftmost).`,
 		result: `O<span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:𝐾 [U+1D43E],K [U+004B]"><span class="char">𝐾</span></span>`,
 		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
 	},
+	{
+		name:   "ambiguous in math",
+		text:   "<math><mo>−</mo><mi>b</mi></math> −",
+		result: `<math><mo>−</mo><mi>b</mi></math> <span class="ambiguous-code-point" data-tooltip-content="repo.ambiguous_character:− [U+2212],- [U+002D]"><span class="char">−</span></span>`,
+		status: EscapeStatus{Escaped: true, HasAmbiguous: true},
+	},
 }
 
 func TestEscapeControlReader(t *testing.T) {
@@ -156,6 +162,24 @@ func TestEscapeControlReader(t *testing.T) {
 	}
 }
 
+func TestTrackHtmlTag(t *testing.T) {
+	e := &escapeStreamer{}
+	for _, tt := range []struct {
+		parts  []string
+		inMath bool
+	}{
+		{[]string{"<ma", `TH display="block">`}, true},
+		{[]string{"<mo>"}, true},
+		{[]string{"</MA", "th>"}, false},
+		{[]string{"<mathx>"}, false},
+	} {
+		for _, part := range tt.parts {
+			e.trackHtmlTag([]byte(part))
+		}
+		assert.Equal(t, tt.inMath, e.inTagMath, "%v", tt.parts)
+	}
+}
+
 func TestSettingAmbiguousUnicodeDetection(t *testing.T) {
 	defer test.MockVariableValue(&setting.UI.AmbiguousUnicodeDetection, true)()
 	_, out := EscapeControlHTML("a test", &translation.MockLocale{})

modules/egress/policies.go

@@ -98,6 +98,7 @@ func NewWebhookPolicy() *policy.Policy {
 	}
 	p = policy.NewPolicy("webhook", policyMode(setting.Security.EgressMode),
 		policy.WithAllow(setting.Webhook.AllowedHostList, "security.ALLOWED_HOST_LIST"),
+		policy.WithLocalNeedsIPAllow(),
 		policy.WithProxy(selectProxy))
 
 	return p
@@ -106,6 +107,7 @@ func NewWebhookPolicy() *policy.Policy {
 func NewSecurityPolicy(usage string) *policy.Policy {
 	return policy.NewPolicy(usage, policyMode(setting.Security.EgressMode),
 		policy.WithAllow(setting.Security.AllowedHostList, "security.ALLOWED_HOST_LIST"),
+		policy.WithLocalNeedsIPAllow(),
 		policy.WithProxy(proxy.Proxy()))
 }
 

modules/egress/policies_test.go

@@ -4,10 +4,13 @@
 package egress
 
 import (
+	"net"
 	"net/http"
 	"net/url"
+	"strconv"
 	"testing"
 
+	"gitea.dev/modules/egress/policy"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 
@@ -70,6 +73,27 @@ func TestWebhookPolicyProxy(t *testing.T) {
 	}
 }
 
+func TestWebhookPolicyNeedsIPAllow(t *testing.T) {
+	defer test.MockVariableValue(&setting.Webhook.AllowedHostList, "localhost")()
+	defer test.MockVariableValue(&setting.Security.EgressMode, "lax")()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = ln.Close() })
+	dial := func() error {
+		tcpAddr, ok := ln.Addr().(*net.TCPAddr)
+		require.True(t, ok)
+		target := net.JoinHostPort("localhost", strconv.Itoa(tcpAddr.Port))
+		conn, err := NewWebhookPolicy().NewDialContext()(t.Context(), "tcp", target)
+		if err == nil {
+			_ = conn.Close()
+		}
+		return err
+	}
+	assert.ErrorIs(t, dial(), policy.ErrDenied) // a host name entry doesn't cover the loopback address
+	setting.Webhook.AllowedHostList = "loopback"
+	assert.NoError(t, dial()) // an IP entry does
+}
+
 func TestSecurityPolicy(t *testing.T) {
 	defer test.MockVariableValue(&setting.Security.AllowedHostList, "avatars.example.com")()
 	defer test.MockVariableValue(&setting.Security.EgressMode, "lax")()

modules/egress/policy/matchlist.go

@@ -411,37 +411,43 @@ var cgnatRange = netip.MustParsePrefix("100.64.0.0/10") // RFC 6598
 // reservedRanges are never dialable, based on https://microsoft.github.io/AntiSSRF/ipaddressranges.html
 var reservedRanges = func() (ranges []netip.Prefix) {
 	for _, cidr := range []string{
-		"0.0.0.0/8",          // "this network"
+		"0.0.0.0/8",        // "this network"
-		"100.100.100.200/32", // Alibaba Cloud metadata
+		"168.63.129.16/32", // Azure WireServer
-		"168.63.129.16/32",   // Azure WireServer
+		"192.88.99.0/24",   // 6to4 relay anycast
-		"169.254.0.0/16",     // link-local, cloud metadata endpoints
+		"224.0.0.0/4",      // multicast
-		"192.0.0.0/24",       // IETF protocol assignments
+		"240.0.0.0/4",      // reserved, incl. limited broadcast
-		"192.0.2.0/24",       // TEST-NET-1
+		"::/96",            // IPv4-compatible, embeds IPv4
-		"192.31.196.0/24",    // AS112
+		"::ffff:0:0:0/96",  // IPv4-translated, embeds IPv4
-		"192.52.193.0/24",    // AMT
+		"64:ff9b::/96",     // wkp NAT64
-		"192.88.99.0/24",     // 6to4 relay anycast
+		"64:ff9b:1::/48",   // local-use NAT64
-		"192.175.48.0/24",    // AS112
+		"2001::/32",        // Teredo, embeds IPv4
-		"198.18.0.0/15",      // benchmarking
+		"2002::/16",        // 6to4, embeds IPv4
-		"198.51.100.0/24",    // TEST-NET-2
+		"ff00::/8",         // multicast
-		"203.0.113.0/24",     // TEST-NET-3
+	} {
-		"224.0.0.0/4",        // multicast
+		ranges = append(ranges, netip.MustParsePrefix(cidr))
-		"240.0.0.0/4",        // reserved, incl. limited broadcast
+	}
-		"::/96",              // IPv4-compatible, embeds IPv4
+	return ranges
-		"::ffff:0:0:0/96",    // IPv4-translated, embeds IPv4
+}()
-		"64:ff9b::/96",       // wkp NAT64
+
-		"64:ff9b:1::/48",     // local-use NAT64
+// restrictedRanges are dialable if they have been explicitly allowed.
-		"100::/64",           // discard-only
+var restrictedRanges = func() (ranges []netip.Prefix) {
-		"100:0:0:1::/64",     // dummy
+	for _, cidr := range []string{
-		"2001::/23",          // IETF protocol assignments, incl. Teredo and ORCHID
+		"192.0.0.0/24",      // IETF protocol assignments
-		"2001:db8::/32",      // documentation
+		"192.0.2.0/24",      // TEST-NET-1
-		"2002::/16",          // 6to4, embeds IPv4
+		"192.31.196.0/24",   // AS112
-		"2620:4f:8000::/48",  // AS112
+		"192.52.193.0/24",   // AMT
-		"3fff::/20",          // documentation
+		"192.175.48.0/24",   // AS112
-		"5f00::/16",          // SRv6 SIDs
+		"198.18.0.0/15",     // benchmarking
-		"fd00:ec2::254/128",  // AWS IMDS
+		"198.51.100.0/24",   // TEST-NET-2
-		"fe80::/10",          // link-local
+		"203.0.113.0/24",    // TEST-NET-3
-		"fec0::/10",          // site-local
+		"100::/64",          // discard-only
-		"ff00::/8",           // multicast
+		"100:0:0:1::/64",    // dummy
+		"2001::/23",         // IETF protocol assignments
+		"2001:db8::/32",     // documentation
+		"2620:4f:8000::/48", // AS112
+		"3fff::/20",         // documentation
+		"5f00::/16",         // SRv6 SIDs
+		"fec0::/10",         // site-local
 	} {
 		ranges = append(ranges, netip.MustParsePrefix(cidr))
 	}
@@ -451,10 +457,14 @@ var reservedRanges = func() (ranges []netip.Prefix) {
 // classifyAddr reports the class of a canonical address.
 func classifyAddr(ip netip.Addr) addrClass {
 	switch {
-	case ip.Zone() != "" || !ip.IsLoopback() && slices.ContainsFunc(reservedRanges, func(p netip.Prefix) bool { return p.Contains(ip) }):
+	case ip.Zone() != "" || !ip.IsLoopback() && inRange(reservedRanges, ip):
 		return classReserved
-	case ip.IsPrivate() || ip.IsLoopback() || cgnatRange.Contains(ip):
+	case ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast() || cgnatRange.Contains(ip) || inRange(restrictedRanges, ip):
 		return classRestricted
 	}
 	return classPublic
 }
+
+func inRange(p []netip.Prefix, ip netip.Addr) bool {
+	return slices.ContainsFunc(p, func(p netip.Prefix) bool { return p.Contains(ip) })
+}

modules/egress/policy/policy.go

@@ -56,7 +56,7 @@ func WithBlock(hostList, key string) Option {
 	}
 }
 
-// WithLocalNeedsIPAllow requires private, loopback and CGNAT targets to match an IP allow entry (CIDR or named range), a host name match is not enough.
+// WithLocalNeedsIPAllow requires non-public targets (private, loopback, link-local, CGNAT and special-use ranges) to match an IP allow entry (CIDR or named range), a host name match is not enough.
 func WithLocalNeedsIPAllow() Option {
 	return func(p *Policy) {
 		p.localNeedsIPAllow = true
@@ -140,9 +140,9 @@ func (p *Policy) allowCheck(host string, ip netip.AddrPort, class addrClass) err
 		return p.notAllowedError(denyTarget(host, ip))
 	}
 	if !hostnameOk {
-		return fmt.Errorf("%s needs an explicit IP allow entry (private/loopback/CGNAT)", denyTarget(host, ip))
+		return fmt.Errorf("%s needs an explicit IP allow entry (non-public address)", denyTarget(host, ip))
 	}
-	return fmt.Errorf("%s needs an explicit allow entry (private/loopback/CGNAT)", denyTarget(host, ip))
+	return fmt.Errorf("%s needs an explicit allow entry (non-public address)", denyTarget(host, ip))
 }
 
 func (p *Policy) blockReason(host string, ip netip.AddrPort) error {

modules/egress/policy/policy_test.go

@@ -33,8 +33,16 @@ func TestCheckAddr(t *testing.T) {
 		{name: "allow host", allow: "example.com", host: "example.com", ip: "8.8.8.8", want: true},
 		{name: "allow cidr", allow: "10.0.0.0/8", ip: "10.0.0.5", want: true},
 		{name: "block overrides allow", allow: "10.0.0.0/8", block: "10.0.0.5/32", ip: "10.0.0.5"},
-		{name: "reserved denied by cidr", allow: "169.254.0.0/16", ip: "169.254.169.254"},
+		{name: "non cloud link-local is default denied", ip: "::ffff:169.254.1.2"},
-		{name: "reserved denied ipv4-mapped", allow: "169.254.0.0/16", ip: "::ffff:169.254.169.254"},
+		{name: "link-local allowed by cidr", allow: "169.254.0.0/16", ip: "169.254.169.254", want: true},
+		{name: "link-local allowed ipv4-mapped", allow: "169.254.0.0/16", ip: "::ffff:169.254.169.254", want: true},
+		{name: "restricted range allowed by cidr", allow: "192.0.2.0/24", ip: "192.0.2.1", want: true},
+		{name: "ula metadata allowed by private", allow: "private", ip: "fd00:ec2::254", want: true},
+		{name: "reserved denied despite allow", allow: "168.63.129.16/32", ip: "168.63.129.16"},
+		{name: "reserved denied ipv4-mapped", allow: "168.63.129.16/32", ip: "::ffff:168.63.129.16"},
+		{name: "nat64 reserved denied despite allow", allow: "64:ff9b::/96", ip: "64:ff9b::a9fe:a9fe"},
+		{name: "teredo reserved denied despite allow", allow: "2001::/23", ip: "2001::1"},
+		{name: "protocol assignment allowed by cidr", allow: "2001::/23", ip: "2001:3::1", want: true},
 		{name: "local gate ignores host", allow: "example.com", host: "example.com", ip: "10.0.0.5", localNeedsIPAllow: true},
 		{name: "local gate accepts builtin", allow: "private", ip: "100.64.0.1", localNeedsIPAllow: true, want: true},
 		{name: "local gate accepts cidr", allow: "10.0.0.0/24", ip: "10.0.0.5", localNeedsIPAllow: true, want: true},
@@ -46,7 +54,8 @@ func TestCheckAddr(t *testing.T) {
 		{name: "strict rejects unmatched host", allow: "example.com", host: "other.com", ip: "8.8.8.8", strict: true},
 		{name: "strict allows matched host", allow: "example.com", host: "example.com", ip: "8.8.8.8", strict: true, want: true},
 		{name: "strict block overrides allow", allow: "10.0.0.0/8", block: "10.0.0.5/32", ip: "10.0.0.5", strict: true},
-		{name: "strict reserved denied by cidr", allow: "169.254.0.0/16", ip: "169.254.169.254", strict: true},
+		{name: "strict reserved denied despite allow", allow: "168.63.129.16/32", ip: "168.63.129.16", strict: true},
+		{name: "strict link-local allowed by cidr", allow: "169.254.0.0/16", ip: "169.254.169.254", strict: true, want: true},
 		{name: "strict local gate ignores host", allow: "example.com", host: "example.com", ip: "10.0.0.5", localNeedsIPAllow: true, strict: true},
 		{name: "strict local gate accepts builtin", allow: "private", ip: "100.64.0.1", localNeedsIPAllow: true, strict: true, want: true},
 	} {
@@ -63,7 +72,7 @@ func TestCheckAddr(t *testing.T) {
 			mode = Strict
 		}
 		err := NewPolicy("test", mode, opts...).checkAddr(tc.host, netip.AddrPortFrom(addr, 80))
-		assert.Equal(t, tc.want, err == nil, "%s: %v", tc.name, err)
+		assert.Equal(t, tc.want, err == nil, "%s (%s): %v", tc.name, tc.ip, err)
 	}
 }
 
@@ -115,8 +124,9 @@ func TestCheckHostIPs(t *testing.T) {
 
 	builtins := NewPolicy("test", Lax, WithAllow("private, loopback", ""))
 	assert.NoError(t, builtins.checkHostIPs(hostURL(t, "http://example.com"), ips("8.8.8.8", "100.64.0.1", "::1")))
+	assert.NoError(t, builtins.checkHostIPs(hostURL(t, "http://example.com"), ips("100.100.100.200"))) // cloud metadata is opt-in with its containing range
 	for _, ip := range []string{
-		"0.1.2.3", "100.100.100.200", "168.63.129.16", "169.254.169.254", "192.0.2.1", "192.88.99.1", "198.18.0.1",
+		"0.1.2.3", "168.63.129.16", "169.254.169.254", "192.0.2.1", "192.88.99.1", "198.18.0.1",
 		"198.51.100.1", "203.0.113.1", "::7f00:1", "::ffff:0:a00:5", "64:ff9b::a9fe:a9fe", "64:ff9b::808:808", "2001::1", "2001:db8::1",
 		"2002::1", "fe80::1",
 	} {

modules/git/attribute/batch.go

@@ -13,6 +13,7 @@ import (
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/git/gitcmd"
 	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // BatchChecker provides a reader for check-attribute content that can be long running
@@ -120,12 +121,17 @@ func (c *BatchChecker) CheckPath(path string) (rs *Attributes, err error) {
 		return fmt.Errorf("CheckPath timeout: %s", debugMsg)
 	}
 
+	timeout := time.NewTimer(5 * time.Second)
+	defer timeout.Stop()
+
 	rs = NewAttributes()
 	for i := 0; i < c.attributesNum; i++ {
 		select {
-		case <-time.After(5 * time.Second):
+		case <-timeout.C:
 			// there is no "hang" problem now. This code is just used to catch other potential problems.
-			return nil, reportTimeout()
+			err = reportTimeout()
+			setting.PanicInDevOrTesting("Unexpected timeout, need to investigate: %v", err)
+			return nil, err
 		case attr, ok := <-c.stdOut.ReadAttribute():
 			if !ok {
 				return nil, c.ctx.Err()

modules/git/commit_submodule_file.go

@@ -46,11 +46,11 @@ func (sf *CommitSubmoduleFile) getWebLinkInTargetRepo(ctx context.Context, moreL
 		return &SubmoduleWebLink{RepoWebLink: targetLink, CommitWebLink: targetLink + moreLinkPath}
 	}
 	if !sf.parsed {
-		sf.parsed = true
 		parsedURL, err := giturl.ParseRepositoryURL(ctx, sf.refURL)
 		if err != nil {
-			return nil
+			return nil // do not mark as parsed, otherwise later calls would return a link with an empty target
 		}
+		sf.parsed = true
 		sf.parsedTargetLink = giturl.MakeRepositoryWebLink(parsedURL)
 	}
 	return &SubmoduleWebLink{RepoWebLink: sf.parsedTargetLink, CommitWebLink: sf.parsedTargetLink + moreLinkPath}

modules/git/commit_submodule_file_test.go

@@ -37,4 +37,11 @@ func TestCommitSubmoduleLink(t *testing.T) {
 		assert.Equal(t, "/subpath/user/repo", wl.RepoWebLink)
 		assert.Equal(t, "/subpath/user/repo/compare/1111...2222", wl.CommitWebLink)
 	})
+
+	t.Run("UnparsableURL", func(t *testing.T) {
+		// both calls share one instance on purpose: the second one used to see the cached parse result
+		sf := NewCommitSubmoduleFile("/any/repo-link", "full-path", "git@github.com:", "aaaa")
+		assert.Nil(t, sf.SubmoduleWebLinkTree(t.Context()))
+		assert.Nil(t, sf.SubmoduleWebLinkCompare(t.Context(), "1111", "2222"))
+	})
 }

modules/git/config.go

@@ -125,6 +125,11 @@ func syncGitConfig(ctx context.Context) (err error) {
 		return err
 	}
 
+	// Gitea used to write "90", which git reads as a date in 1990
+	if err := configUnsetAll(ctx, "gc.reflogExpire", "90"); err != nil {
+		return err
+	}
+
 	// Apply user's git config options last so they take precedence over builtin defaults
 	for k, v := range setting.GitConfig.Options {
 		if err = configSet(ctx, strings.ToLower(k), v); err != nil {
@@ -162,7 +167,7 @@ func configSet(ctx context.Context, key, value string) error {
 		return nil
 	}
 
-	if _, _, err = gitcmd.NewCommand("config", "--global").
+	if _, _, err = gitcmd.NewCommand("config", "--global", "--replace-all").
 		AddDynamicArguments(key, value).
 		RunStdString(ctx); err != nil {
 		return fmt.Errorf("failed to set git global config %s, err: %w", key, err)
@@ -190,7 +195,7 @@ func configSetNonExist(ctx context.Context, key, value string) error {
 }
 
 func configAddNonExist(ctx context.Context, key, value string) error {
-	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key, regexp.QuoteMeta(value)).RunStdString(ctx)
+	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key, "^"+regexp.QuoteMeta(value)+"$").RunStdString(ctx)
 	if err == nil {
 		// already exist
 		return nil
@@ -207,18 +212,9 @@ func configAddNonExist(ctx context.Context, key, value string) error {
 }
 
 func configUnsetAll(ctx context.Context, key, value string) error {
-	_, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx)
+	_, _, err := gitcmd.NewCommand("config", "--global", "--unset-all").AddDynamicArguments(key, "^"+regexp.QuoteMeta(value)+"$").RunStdString(ctx)
-	if err == nil {
+	if err != nil && !gitcmd.IsErrorExitCode(err, 5) { // 5: no such key or no matching value
-		// exist, need to remove
+		return fmt.Errorf("failed to unset git global config %s, err: %w", key, err)
-		_, _, err = gitcmd.NewCommand("config", "--global", "--unset-all").AddDynamicArguments(key, regexp.QuoteMeta(value)).RunStdString(ctx)
-		if err != nil {
-			return fmt.Errorf("failed to unset git global config %s, err: %w", key, err)
-		}
-		return nil
 	}
-	if gitcmd.IsErrorExitCode(err, 1) {
+	return nil
-		// not exist
-		return nil
-	}
-	return fmt.Errorf("failed to get git config %s, err: %w", key, err)
 }

modules/git/config_test.go

@@ -32,7 +32,9 @@ func TestGitConfig(t *testing.T) {
 	assert.NoError(t, configSetNonExist(ctx, "test.key-a", "val-a-changed"))
 	assert.False(t, gitConfigContains("key-a = val-a-changed"))
 
+	assert.NoError(t, configAddNonExist(ctx, "test.key-a", "val-a2"))
 	assert.NoError(t, configSet(ctx, "test.key-a", "val-a-changed"))
+	assert.NoError(t, configUnsetAll(ctx, "test.key-a", "val-a"))
 	assert.True(t, gitConfigContains("key-a = val-a-changed"))
 
 	assert.NoError(t, configAddNonExist(ctx, "test.key-b", "val-b"))
@@ -41,6 +43,8 @@ func TestGitConfig(t *testing.T) {
 	assert.NoError(t, configAddNonExist(ctx, "test.key-b", "val-2b"))
 	assert.True(t, gitConfigContains("key-b = val-b"))
 	assert.True(t, gitConfigContains("key-b = val-2b"))
+	assert.NoError(t, configAddNonExist(ctx, "test.key-b", "val"))
+	assert.True(t, gitConfigContains("key-b = val\n"))
 
 	assert.NoError(t, configUnsetAll(ctx, "test.key-b", "val-b"))
 	assert.False(t, gitConfigContains("key-b = val-b"))
@@ -60,8 +64,10 @@ func TestSyncGitConfig(t *testing.T) {
 	defer test.MockVariableValue(&setting.GitConfig)()
 
 	assert.Empty(t, setting.GitConfig.Options)
+	assert.NoError(t, configSet(t.Context(), "gc.reflogExpire", "90"))
 	assert.NoError(t, syncGitConfig(t.Context()))
 	assert.True(t, gitConfigContains("commitGraph = true")) // builtin default config
+	assert.False(t, gitConfigContains("reflogExpire"))
 
 	setting.GitConfig.Options["sync-test.cfg-key-a"] = "CfgValA"
 	setting.GitConfig.Options["core.commitgraph"] = "false"

modules/git/fastimport.go

@@ -27,6 +27,7 @@ type FastImportFile struct {
 
 type FastImportCommit struct {
 	Ref     string
+	Parent  string
 	Message string
 	Files   []FastImportFile
 
@@ -72,6 +73,9 @@ func ForceFastImport(ctx context.Context, repo RepositoryFacade, commits []FastI
 
 		msg := util.IfZero(c.Message, fmt.Sprintf("test commit %d", i+1))
 		_, _ = fmt.Fprintf(buf, "data %d\n%s\n", len(msg), msg)
+		if c.Parent != "" {
+			_, _ = fmt.Fprintf(buf, "from %s\n", c.Parent)
+		}
 
 		for _, f := range c.Files {
 			mode := util.IfZero(f.Mode, EntryModeBlob)

modules/git/fetch.go

@@ -21,7 +21,7 @@ import (
 // merge base between commits.
 func FetchRemoteCommit(ctx context.Context, repo, remoteRepo RepositoryFacade, commitID string) error {
 	return LockWriteAndDo(ctx, repo, func(ctx context.Context) error {
-		return gitcmd.NewCommand("fetch", "--no-tags").
+		return gitcmd.NewCommand("fetch", "--no-tags", "--no-write-commit-graph").
 			AddDynamicArguments(gitrepo.RepoLocalPath(remoteRepo)).
 			AddDynamicArguments(commitID).
 			WithRepo(repo).Run(ctx)

modules/git/gitcmd/command.go

@@ -49,8 +49,8 @@ type Command struct {
 	cmd *process.Cmd
 
 	cmdCtx       context.Context
-	cmdCancel    process.CancelCauseFunc
+	cmdCtxCancel process.CancelCauseFunc
-	cmdFinished  process.FinishedFunc
+	cmdFinished  func()
 	cmdStartTime time.Time
 
 	pipelineFunc func(Context) error
@@ -428,19 +428,24 @@ func (c *Command) Start(ctx context.Context) (retErr error) {
 	if c.callerInfo == "" {
 		c.WithParentCallerInfo()
 	}
+
 	// these logs are for debugging purposes only, so no guarantee of correctness or stability
 	desc := fmt.Sprintf("git.Run(by:%s, repo:%s): %s", c.callerInfo, logArgSanitize(c.gitDir), cmdLogString)
 	log.Debug("git.Command: %s", desc)
 
 	_, span := gtprof.GetTracer().Start(ctx, gtprof.TraceSpanGitRun)
-	defer span.End()
 	span.SetAttributeString(gtprof.TraceAttrFuncCaller, c.callerInfo)
 	span.SetAttributeString(gtprof.TraceAttrGitCommand, cmdLogString)
 
+	var cmdCtxFinished func()
 	if c.cmdTimeout <= 0 {
-		c.cmdCtx, c.cmdCancel, c.cmdFinished = process.GetManager().AddContext(ctx, desc)
+		c.cmdCtx, c.cmdCtxCancel, cmdCtxFinished = process.GetManager().AddContext(ctx, desc)
 	} else {
-		c.cmdCtx, c.cmdCancel, c.cmdFinished = process.GetManager().AddContextTimeout(ctx, c.cmdTimeout, desc)
+		c.cmdCtx, c.cmdCtxCancel, cmdCtxFinished = process.GetManager().AddContextTimeout(ctx, c.cmdTimeout, desc)
+	}
+	c.cmdFinished = func() {
+		cmdCtxFinished()
+		span.End()
 	}
 
 	c.cmdStartTime = time.Now()

modules/git/gitcmd/context.go

@@ -27,6 +27,6 @@ func (c *cmdContext) CancelPipeline(err error) error {
 	// * context canceled by pipeline caller with/without error (normal cancellation)
 	// * context canceled by parent context (still context.Canceled error)
 	// * other causes
-	c.cmd.cmdCancel(pipelineError{err})
+	c.cmd.cmdCtxCancel(pipelineError{err})
 	return err
 }

modules/git/parse.go

@@ -56,13 +56,17 @@ func parseLsTreeLine(line []byte) (*LsTreeEntry, error) {
 		return nil, fmt.Errorf("invalid ls-tree output (invalid object id): %q, err: %w", line, err)
 	}
 
-	if len(entryName) > 0 && entryName[0] == '"' {
+	entry.Name, err = UnquoteDiffFilePath(string(entryName))
-		entry.Name, err = strconv.Unquote(string(entryName))
+	if err != nil {
-		if err != nil {
+		return nil, fmt.Errorf("invalid ls-tree output (invalid name): %q, err: %w", line, err)
-			return nil, fmt.Errorf("invalid ls-tree output (invalid name): %q, err: %w", line, err)
-		}
-	} else {
-		entry.Name = string(entryName)
 	}
 	return entry, nil
 }
+
+func UnquoteDiffFilePath(path string) (string, error) {
+	// ref: see the document of git config's "core.quotepath"
+	if !strings.HasPrefix(path, `"`) {
+		return path, nil
+	}
+	return strconv.Unquote(path)
+}

modules/git/repo_base_gogit.go

@@ -8,9 +8,13 @@ package git
 
 import (
 	"errors"
+	"io"
+	"os"
 	"path/filepath"
 	"slices"
+	"strings"
 
+	"gitea.dev/modules/container"
 	"gitea.dev/modules/git/gitrepo"
 	"gitea.dev/modules/setting"
 
@@ -20,6 +24,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/cache"
 	"github.com/go-git/go-git/v5/storage/filesystem"
+	"github.com/go-git/go-git/v5/storage/filesystem/dotgit"
 )
 
 const isGogit = true
@@ -31,25 +36,98 @@ type Repository struct {
 	gogitStorage *reindexingStorage
 }
 
-// reindexingStorage picks up packs that git wrote after go-git loaded its index
+// reindexingStorage reloads the pack index when git added or removed packs after go-git loaded it
-// https://github.com/go-git/go-git/issues/2439
+// https://github.com/go-git/go-git/issues/2439 https://github.com/go-git/go-git/issues/1623
+// FIXME: gogit workaround, remove with the gogit build
 type reindexingStorage struct {
 	*filesystem.Storage
 	packs []plumbing.Hash
 }
 
-func (s *reindexingStorage) EncodedObject(t plumbing.ObjectType, h plumbing.Hash) (plumbing.EncodedObject, error) {
+func isRepackError(err error) bool {
-	obj, err := s.Storage.EncodedObject(t, h)
+	return errors.Is(err, plumbing.ErrObjectNotFound) || errors.Is(err, dotgit.ErrPackfileNotFound) || errors.Is(err, os.ErrNotExist)
-	if !errors.Is(err, plumbing.ErrObjectNotFound) {
+}
-		return obj, err
+
+// retry reruns fn while a concurrent repack keeps changing the packs
+func (s *reindexingStorage) retry(fn func() error) error {
+	for {
+		err := fn()
+		if !isRepackError(err) {
+			return err
+		}
+		packs, _ := s.ObjectPacks()
+		if slices.Equal(packs, s.packs) {
+			return err
+		}
+		s.packs = packs
+		s.Reindex()
 	}
-	packs, _ := s.ObjectPacks()
+}
-	if slices.Equal(packs, s.packs) {
+
-		return obj, err
+func (s *reindexingStorage) EncodedObject(t plumbing.ObjectType, h plumbing.Hash) (obj plumbing.EncodedObject, err error) {
+	err = s.retry(func() (err error) {
+		obj, err = s.Storage.EncodedObject(t, h)
+		return err
+	})
+	if err != nil {
+		return nil, err
 	}
-	s.packs = packs
+	if _, ok := obj.(*plumbing.MemoryObject); ok {
-	s.Reindex()
+		return obj, nil
-	return s.Storage.EncodedObject(t, h)
+	}
+	return &lazyObject{EncodedObject: obj, storage: s}, nil
+}
+
+// lazyObject looks up a large object again when its file got removed before Reader reopened it
+// FIXME: gogit workaround, remove with the gogit build
+type lazyObject struct {
+	plumbing.EncodedObject
+	storage *reindexingStorage
+}
+
+func (o *lazyObject) Reader() (rc io.ReadCloser, err error) {
+	rc, err = o.EncodedObject.Reader()
+	if !isRepackError(err) {
+		return rc, err
+	}
+	err = o.storage.retry(func() error {
+		obj, err := o.storage.Storage.EncodedObject(o.Type(), o.Hash())
+		if err == nil {
+			o.EncodedObject = obj
+			rc, err = obj.Reader()
+		}
+		return err
+	})
+	return rc, err
+}
+
+// packIdxFS lists packs like git, only while their .idx exists
+// FIXME: gogit workaround, remove with the gogit build
+type packIdxFS struct {
+	billy.Filesystem
+}
+
+func (f packIdxFS) ReadDir(dir string) ([]os.FileInfo, error) {
+	if dir != f.Join("objects", "pack") {
+		return f.Filesystem.ReadDir(dir)
+	}
+	dirFile, err := os.Open(filepath.Join(f.Root(), dir))
+	if err != nil {
+		return nil, err
+	}
+	defer dirFile.Close()
+	infos, err := dirFile.Readdir(-1) // skips files removed before their lstat, unlike billy's ReadDir
+	if err != nil {
+		return nil, err
+	}
+	names := make(container.Set[string], len(infos))
+	for _, info := range infos {
+		names.Add(info.Name())
+	}
+	return slices.DeleteFunc(infos, func(info os.FileInfo) bool {
+		base, isPack := strings.CutSuffix(info.Name(), ".pack")
+		return isPack && !names.Contains(base+".idx")
+	}), nil
 }
 
 func openRepositoryInternal(gitRepo *Repository) error {
@@ -71,7 +149,7 @@ func openRepositoryInternal(gitRepo *Repository) error {
 		altFs = osfs.New("/")
 	}
 	gitRepo.objectFormatCache = ParseGogitHash(plumbing.ZeroHash).Type()
-	storage := filesystem.NewStorageWithOptions(fs, cache.NewObjectLRUDefault(), filesystem.Options{KeepDescriptors: true, LargeObjectThreshold: setting.Git.LargeObjectThreshold, AlternatesFS: altFs})
+	storage := filesystem.NewStorageWithOptions(packIdxFS{fs}, cache.NewObjectLRUDefault(), filesystem.Options{KeepDescriptors: true, LargeObjectThreshold: setting.Git.LargeObjectThreshold, AlternatesFS: altFs})
 	packs, _ := storage.ObjectPacks()
 	gitRepo.gogitStorage = &reindexingStorage{Storage: storage, packs: packs}
 	gitRepo.gogitRepo, err = gogit.Open(gitRepo.gogitStorage, fs)

modules/git/repo_branch_test.go

@@ -4,9 +4,15 @@
 package git
 
 import (
+	"fmt"
+	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -39,6 +45,41 @@ func TestRepository_GetBranches(t *testing.T) {
 	assert.ElementsMatch(t, []string{}, branches)
 }
 
+// FIXME: covers the gogit workarounds in repo_base_gogit.go, remove with the gogit build
+func TestReadsAfterConcurrentRepack(t *testing.T) {
+	repoDir := t.TempDir()
+	require.NoError(t, gitcmd.NewCommand("init", "--bare").AddDynamicArguments(repoDir).Run(t.Context()))
+	content := strings.Repeat("a", int(setting.Git.LargeObjectThreshold)+1)
+	for _, from := range []string{"", "from refs/heads/main^0\n"} {
+		stdin := fmt.Sprintf("commit refs/heads/main\ncommitter a <a@a> 0 +0000\ndata 0\n%sM 100644 inline f\ndata %d\n%s\n", from, len(content), content)
+		require.NoError(t, gitcmd.NewCommand("fast-import").WithDir(repoDir).WithStdinBytes([]byte(stdin)).Run(t.Context()))
+		require.NoError(t, gitcmd.NewCommand("repack", "-d").WithDir(repoDir).Run(t.Context()))
+	}
+
+	repo, err := OpenRepositoryLocal(t.Context(), repoDir)
+	require.NoError(t, err)
+	defer repo.Close()
+	require.False(t, repo.IsObjectExist(t.Context(), "0000000000000000000000000000000000000001"))
+	blobRepo, err := OpenRepositoryLocal(t.Context(), repoDir)
+	require.NoError(t, err)
+	defer blobRepo.Close()
+	commit, err := blobRepo.GetBranchCommit(t.Context(), "main")
+	require.NoError(t, err)
+	readBlob := func() string {
+		data, err := commit.GetFileContent(t.Context(), blobRepo, "f", len(content))
+		require.NoError(t, err)
+		return data
+	}
+	require.Equal(t, content, readBlob())
+	require.NoError(t, gitcmd.NewCommand("repack", "-a", "-d").WithDir(repoDir).Run(t.Context()))
+	require.NoError(t, os.WriteFile(filepath.Join(repoDir, "objects", "pack", "pack-"+strings.Repeat("1", 40)+".pack"), nil, 0o644))
+
+	branches, _, err := repo.GetBranchNames(t.Context(), 0, 0)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"main"}, branches)
+	assert.Equal(t, content, readBlob())
+}
+
 func BenchmarkRepository_GetBranches(b *testing.B) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 	bareRepo1, err := OpenRepositoryLocal(b.Context(), bareRepo1Path)

modules/git/repo_commit.go

@@ -415,8 +415,26 @@ func (repo *Repository) GetCommitsFromIDs(ctx context.Context, commitIDs []strin
 	return commits
 }
 
-// IsCommitInBranch check if the commit is on the branch
+// IsCommitInRepo checks if the commit exists in the repository.
+func IsCommitInRepo(ctx context.Context, repo gitrepo.RepositoryFacade, commitID string) (bool, error) {
+	// "--quiet" makes it exit with 1 and no output if the commit doesn't exist
+	_, _, err := gitcmd.NewCommand("rev-parse", "--verify", "--quiet").
+		AddDynamicArguments(commitID + "^{commit}").
+		WithRepo(repo).
+		RunStdString(ctx)
+	if gitcmd.IsErrorExitCode(err, 1) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+// IsCommitInBranch checks if the commit is on the branch.
+// It returns false (no error) if the commit doesn't exist or isn't on the branch.
 func IsCommitInBranch(ctx context.Context, repo gitrepo.RepositoryFacade, commitID, branch string) (r bool, err error) {
+	if exist, err := IsCommitInRepo(ctx, repo, commitID); err != nil || !exist {
+		return false, err
+	}
+
 	stdout, _, err := gitcmd.NewCommand("branch", "--contains").
 		AddDynamicArguments(commitID, branch).
 		WithRepo(repo).
@@ -424,7 +442,7 @@ func IsCommitInBranch(ctx context.Context, repo gitrepo.RepositoryFacade, commit
 	if err != nil {
 		return false, err
 	}
-	return len(stdout) > 0, err
+	return len(stdout) > 0, nil
 }
 
 // GetCommitBranchStart returns the commit where the branch diverged

modules/git/repo_commit_test.go

@@ -70,6 +70,20 @@ func TestGetCommitWithBadCommitID(t *testing.T) {
 	assert.True(t, IsErrNotExist(err))
 }
 
+func TestIsCommitInRepo(t *testing.T) {
+	bareRepo1, err := OpenRepositoryLocal(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
+	assert.NoError(t, err)
+	defer bareRepo1.Close()
+
+	exist, err := IsCommitInRepo(t.Context(), bareRepo1, "2839944139e0de9737a044f78b0e4b40d989a9e3")
+	assert.NoError(t, err)
+	assert.True(t, exist)
+
+	exist, err = IsCommitInRepo(t.Context(), bareRepo1, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+	assert.NoError(t, err)
+	assert.False(t, exist)
+}
+
 func TestIsCommitInBranch(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 	bareRepo1, err := OpenRepositoryLocal(t.Context(), bareRepo1Path)
@@ -83,6 +97,10 @@ func TestIsCommitInBranch(t *testing.T) {
 	result, err = IsCommitInBranch(t.Context(), bareRepo1, "2839944139e0de9737a044f78b0e4b40d989a9e3", "branch2")
 	assert.NoError(t, err)
 	assert.False(t, result)
+
+	result, err = IsCommitInBranch(t.Context(), bareRepo1, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "branch1")
+	assert.NoError(t, err)
+	assert.False(t, result)
 }
 
 func TestRepository_CommitsBetween(t *testing.T) {

modules/glob/glob.go

@@ -177,7 +177,7 @@ func initGlobCompiler(g *globCompiler, pattern string, separators []rune) (Glob,
 
 	regex, err := regexp.Compile(g.regexpPattern)
 	if err != nil {
-		return nil, fmt.Errorf("failed to compile regexp: %w", err)
+		return nil, fmt.Errorf("failed to compile glob regexp: %w", err)
 	}
 
 	g.regexp = regex

modules/gtprof/trace.go

@@ -122,6 +122,8 @@ func (t *Tracer) Start(ctx context.Context, spanName string) (context.Context, *
 		ts.parent = parentSpan
 	}
 
+	// FIXME: this ctx handling is not right. The returned ctx should inherit the ctx passed in, but not from span's internal contexts
+	// The returned ctx only needs to inherit the values of the internal contexts of spans
 	parentCtx := ctx
 	for internalSpanIdx, tsp := range starters {
 		var internalSpan traceSpanInternal

modules/gtprof/trace_const.go

@@ -6,14 +6,17 @@ package gtprof
 // Some interesting names could be found in https://github.com/open-telemetry/opentelemetry-go/tree/main/semconv
 
 const (
+	TraceSpanContext  = "context"
 	TraceSpanHTTP     = "http"
 	TraceSpanGitRun   = "git-run"
 	TraceSpanDatabase = "database"
 )
 
 const (
-	TraceAttrFuncCaller = "func.caller"
+	TraceAttrGeneralName = "general.name"
-	TraceAttrDbSQL      = "db.sql"
+	TraceAttrGeneralDesc = "general.desc"
-	TraceAttrGitCommand = "git.command"
+	TraceAttrFuncCaller  = "func.caller"
-	TraceAttrHTTPRoute  = "http.route"
+	TraceAttrDbSQL       = "db.sql"
+	TraceAttrGitCommand  = "git.command"
+	TraceAttrHTTPRoute   = "http.route"
 )

modules/htmlutil/html_srcset.go

@@ -0,0 +1,105 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package htmlutil
+
+import (
+	"strings"
+)
+
+type SrcSetCandidate struct {
+	SrcLink string
+	SrcDesc []string
+}
+
+const (
+	asciiSpaces         = " \t\n\r\f"
+	asciiSpacesAndComma = " \t\n\r\f,"
+)
+
+func ParseSrcset(srcset string) (candidates []SrcSetCandidate) {
+	// ref: https://html.spec.whatwg.org/multipage/images.html#parse-a-srcset-attribute
+	// It can't simply use "split" because comma can appear in URLs and descriptors can be parenthesized and contain commas.
+	extractLink := func() (string, bool) {
+		srcset = strings.TrimLeft(srcset, asciiSpacesAndComma)
+		if srcset == "" {
+			return "", false
+		}
+		end := strings.IndexAny(srcset, asciiSpaces)
+		if end == -1 {
+			end = len(srcset)
+		}
+		link := srcset[:end]
+		srcset = srcset[end:]
+		if strings.HasSuffix(link, ",") {
+			return strings.TrimRight(link, ","), false
+		}
+		return link, true
+	}
+	extractDesc := func() (string, bool) {
+		srcset = strings.TrimLeft(srcset, asciiSpaces)
+		if srcset == "" {
+			return "", false
+		}
+		inParentheses := false
+		for i := range len(srcset) {
+			c := srcset[i]
+			if inParentheses {
+				inParentheses = c != ')'
+				continue
+			}
+			if c == '(' {
+				inParentheses = true
+				continue
+			}
+			if strings.IndexByte(asciiSpacesAndComma, c) != -1 {
+				desc := srcset[:i]
+				srcset = srcset[i+1:]
+				return desc, c != ','
+			}
+		}
+		desc := srcset
+		srcset = ""
+		return desc, false
+	}
+
+	for {
+		link, hasDesc := extractLink()
+		if link == "" {
+			break
+		}
+		var descriptors []string
+		if hasDesc {
+			for {
+				desc, hasMoreDesc := extractDesc()
+				if desc != "" {
+					descriptors = append(descriptors, desc)
+				}
+				if !hasMoreDesc {
+					break
+				}
+			}
+		}
+		candidates = append(candidates, SrcSetCandidate{SrcLink: link, SrcDesc: descriptors})
+	}
+	return candidates
+}
+
+func EncodeSrcset(candidates []SrcSetCandidate) string {
+	var sb strings.Builder
+	for i, c := range candidates {
+		if i != 0 {
+			sb.WriteString(", ")
+		}
+		link := c.SrcLink
+		if prefix, ok := strings.CutSuffix(link, ","); ok {
+			link = prefix + "%2C"
+		}
+		sb.WriteString(link)
+		for _, d := range c.SrcDesc {
+			sb.WriteByte(' ')
+			sb.WriteString(d)
+		}
+	}
+	return sb.String()
+}

modules/htmlutil/html_srcset_test.go

@@ -0,0 +1,81 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package htmlutil
+
+import (
+	"testing"
+
+	"gitea.dev/modules/util"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSrcset(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		input      string
+		candidates []SrcSetCandidate
+		encoded    string
+	}{
+		{
+			name:       "bare URL",
+			input:      "image.png",
+			candidates: []SrcSetCandidate{{SrcLink: "image.png"}},
+		},
+		{
+			name:       "bare URLs",
+			input:      "a.png, b.png , c.png,",
+			candidates: []SrcSetCandidate{{SrcLink: "a.png"}, {SrcLink: "b.png"}, {SrcLink: "c.png"}},
+			encoded:    "a.png, b.png, c.png",
+		},
+		{
+			name:       "empty candidates",
+			input:      ", ,\ta.png 1x,, ,b.png 2x, ,",
+			candidates: []SrcSetCandidate{{SrcLink: "a.png", SrcDesc: []string{"1x"}}, {SrcLink: "b.png", SrcDesc: []string{"2x"}}},
+			encoded:    "a.png 1x, b.png 2x",
+		},
+		{
+			name:       "trailing commas in URL",
+			input:      "a.png,, b.png 2x",
+			candidates: []SrcSetCandidate{{SrcLink: "a.png"}, {SrcLink: "b.png", SrcDesc: []string{"2x"}}},
+			encoded:    "a.png, b.png 2x",
+		},
+		{
+			name:       "comma in URL",
+			input:      "comma,in,url.png",
+			candidates: []SrcSetCandidate{{SrcLink: "comma,in,url.png"}},
+		},
+		{
+			name:       "embedded data URL",
+			input:      "data:image/png;base64,abcd 1x, image.png 2x",
+			candidates: []SrcSetCandidate{{SrcLink: "data:image/png;base64,abcd", SrcDesc: []string{"1x"}}, {SrcLink: "image.png", SrcDesc: []string{"2x"}}},
+		},
+		{
+			name:       "parenthesized descriptor",
+			input:      "a.png (x,y) 1x, b.png 2x",
+			candidates: []SrcSetCandidate{{SrcLink: "a.png", SrcDesc: []string{"(x,y)", "1x"}}, {SrcLink: "b.png", SrcDesc: []string{"2x"}}},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			candidates := ParseSrcset(test.input)
+			assert.Equal(t, test.candidates, candidates)
+			encoded := EncodeSrcset(candidates)
+			assert.Equal(t, util.IfZero(test.encoded, test.input), encoded)
+		})
+	}
+
+	t.Run("encode trailing commas", func(t *testing.T) {
+		encoded := EncodeSrcset([]SrcSetCandidate{
+			{SrcLink: "image,"},
+			{SrcLink: "image,,", SrcDesc: []string{"2x"}},
+			{SrcLink: "image.svg?variant=light,", SrcDesc: []string{"3x"}},
+		})
+		assert.Equal(t, "image%2C, image,%2C 2x, image.svg?variant=light%2C 3x", encoded)
+		assert.Equal(t, []SrcSetCandidate{
+			{SrcLink: "image%2C"},
+			{SrcLink: "image,%2C", SrcDesc: []string{"2x"}},
+			{SrcLink: "image.svg?variant=light%2C", SrcDesc: []string{"3x"}},
+		}, ParseSrcset(encoded))
+	})
+}

modules/httpcache/httpcache.go

@@ -99,7 +99,9 @@ func handleGenericETagTimeCache(req *http.Request, w http.ResponseWriter, etag s
 			return true
 		}
 	}
-	if lastModified != nil && !lastModified.IsZero() {
+	// https://www.rfc-editor.org/rfc/rfc9110#section-13.1.3
+	// A recipient MUST ignore If-Modified-Since if the request contains an If-None-Match header field
+	if lastModified != nil && !lastModified.IsZero() && req.Header.Get("If-None-Match") == "" {
 		ifModifiedSince := req.Header.Get("If-Modified-Since")
 		if ifModifiedSince != "" {
 			t, err := time.Parse(http.TimeFormat, ifModifiedSince)

modules/httpcache/httpcache_test.go

@@ -76,6 +76,19 @@ func TestHandleGenericETagCache(t *testing.T) {
 			wantHeaders: map[string]string{"Last-Modified": lastModified, "Cache-Control": "", "Etag": weakEtag},
 			wantStatus:  http.StatusNotModified,
 		},
+		{
+			name:        "If-Modified-Since without If-None-Match",
+			reqHeaders:  map[string]string{"If-Modified-Since": lastModified},
+			wantHandled: true,
+			wantHeaders: map[string]string{"Last-Modified": lastModified, "Cache-Control": "", "Etag": matchedEtag},
+			wantStatus:  http.StatusNotModified,
+		},
+		{
+			name:        "Mismatched If-None-Match takes precedence over If-Modified-Since",
+			reqHeaders:  map[string]string{"If-None-Match": `"mismatched-etag"`, "If-Modified-Since": lastModified},
+			wantHandled: false,
+			wantHeaders: map[string]string{"Last-Modified": lastModified, "Cache-Control": cacheControl, "Etag": matchedEtag},
+		},
 		{
 			name:        "Multiple Matched If-None-Match",
 			reqHeaders:  map[string]string{"If-None-Match": `"mismatched-etag", ` + matchedEtag},

modules/json/jsonv2.go

@@ -45,6 +45,10 @@ func MarshalKeepOptionalEmpty(v any) ([]byte, error) {
 	return jsonv2.Marshal(v, jsonV2.marshalKeepOptionalEmptyOptions)
 }
 
+func MarshalDeterministic(v any) ([]byte, error) {
+	return jsonv2.Marshal(v, jsonV2.marshalOptions, jsonv2.Deterministic(true))
+}
+
 func (j *JSONv2) Marshal(v any) ([]byte, error) {
 	return jsonv2.Marshal(v, j.marshalOptions)
 }

modules/lfs/client_test.go

@@ -8,12 +8,16 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestNewClient(t *testing.T) {
 	u, _ := url.Parse("file:///test")
 	c := newClient(u, nil)
-	assert.IsType(t, &FilesystemClient{}, c)
+	require.IsType(t, &FilesystemClient{}, c)
+	localPath, err := c.(*FilesystemClient).objectPath("invalid") //nolint:forcetypeassert // type is expected
+	assert.Empty(t, localPath)
+	assert.ErrorIs(t, err, ErrInvalidOIDFormat)
 
 	u, _ = url.Parse("https://test.com/lfs")
 	c = newClient(u, nil)

modules/lfs/filesystem_client.go

@@ -18,7 +18,7 @@ type FilesystemClient struct {
 	lfsDir string
 }
 
-// BatchSize returns the preferred size of batchs to process
+// BatchSize returns the preferred size of batches to process
 func (c *FilesystemClient) BatchSize() int {
 	return 1
 }
@@ -29,8 +29,12 @@ func newFilesystemClient(endpoint *url.URL) *FilesystemClient {
 	return &FilesystemClient{lfsDir}
 }
 
-func (c *FilesystemClient) objectPath(oid string) string {
+func (c *FilesystemClient) objectPath(oid string) (string, error) {
-	return filepath.Join(c.lfsDir, oid[0:2], oid[2:4], oid)
+	if !isValidOid(oid) {
+		return "", ErrInvalidOIDFormat
+	}
+	// HINT: LFS-INTERNAL-PATH-PATTERN
+	return filepath.Join(c.lfsDir, oid[0:2], oid[2:4], oid), nil
 }
 
 // Download reads the specific LFS object from the target path
@@ -38,8 +42,10 @@ func (c *FilesystemClient) Download(ctx context.Context, objects []Pointer, call
 	for _, object := range objects {
 		p := Pointer{object.Oid, object.Size}
 
-		objectPath := c.objectPath(p.Oid)
+		objectPath, err := c.objectPath(p.Oid)
-
+		if err != nil {
+			return err
+		}
 		f, err := os.Open(objectPath)
 		if err != nil {
 			return err
@@ -57,8 +63,10 @@ func (c *FilesystemClient) Upload(ctx context.Context, objects []Pointer, callba
 	for _, object := range objects {
 		p := Pointer{object.Oid, object.Size}
 
-		objectPath := c.objectPath(p.Oid)
+		objectPath, err := c.objectPath(p.Oid)
-
+		if err != nil {
+			return err
+		}
 		if err := os.MkdirAll(filepath.Dir(objectPath), os.ModePerm); err != nil {
 			return err
 		}

modules/lfs/pointer.go

@@ -10,9 +10,11 @@ import (
 	"fmt"
 	"io"
 	"path"
-	"regexp"
 	"strconv"
 	"strings"
+
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // spec: https://github.com/git-lfs/git-lfs/blob/master/docs/spec.md
@@ -47,8 +49,6 @@ func ReadPointer(reader io.Reader) (Pointer, error) {
 	return ReadPointerFromBuffer(buf)
 }
 
-var oidPattern = regexp.MustCompile(`^[a-f\d]{64}$`)
-
 // ReadPointerFromBuffer will return a pointer if the provided byte slice is a pointer file or an error otherwise.
 func ReadPointerFromBuffer(buf []byte) (Pointer, error) {
 	var p Pointer
@@ -65,7 +65,7 @@ func ReadPointerFromBuffer(buf []byte) (Pointer, error) {
 
 	// spec says "key/value pairs MUST be sorted alphabetically in ascending order (version is exception and must be the first)"
 	oid := strings.TrimPrefix(splitLines[1], MetaFileOidPrefix)
-	if len(oid) != 64 || !oidPattern.MatchString(oid) {
+	if !isValidOid(oid) {
 		return p, ErrInvalidOIDFormat
 	}
 	size, err := strconv.ParseInt(strings.TrimPrefix(splitLines[2], "size "), 10, 64)
@@ -79,13 +79,24 @@ func ReadPointerFromBuffer(buf []byte) (Pointer, error) {
 	return p, nil
 }
 
+func isValidOid(oid string) bool {
+	if len(oid) != 64 {
+		return false
+	}
+	for i := range len(oid) {
+		c := oid[i]
+		valid := (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')
+		if !valid {
+			return false
+		}
+	}
+	return true
+}
+
 // IsValid checks if the pointer has a valid structure.
 // It doesn't check if the pointed-to-content exists.
 func (p Pointer) IsValid() bool {
-	if len(p.Oid) != 64 {
+	if !isValidOid(p.Oid) {
-		return false
-	}
-	if !oidPattern.MatchString(p.Oid) {
 		return false
 	}
 	if p.Size < 0 {
@@ -102,10 +113,13 @@ func (p Pointer) StringContent() string {
 
 // RelativePath returns the relative storage path of the pointer
 func (p Pointer) RelativePath() string {
-	if len(p.Oid) < 5 {
+	if !isValidOid(p.Oid) {
-		return p.Oid
+		setting.PanicInDevOrTesting("invalid LFS OID: %s", p.Oid)
+		return "invalid-lfs-oid-" + util.PathJoinRelX(p.Oid)
 	}
-
+	// HINT: LFS-INTERNAL-PATH-PATTERN: this path pattern is only used by Gitea internally,
+	// It isn't the same as the path pattern used by Git LFS, which is: <oid[0:2]>/<oid[2:4]>/<oid>
+	// However, there are other parts of Gitea that rely on such path pattern.
 	return path.Join(p.Oid[0:2], p.Oid[2:4], p.Oid[4:])
 }