public/gitea
1
0 Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-26 06:16:56 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
c45af635e4fa9779e59e344346ee57d748f339ea
gitea/models/audit/action.go
T
Lunny Xiao c45af635e4 feat: Allow automatic project actions on events (#30205) 
This PR introduces project workflows, allowing users to configure
event-based automations directly from the UI.
Users can define filters and actions for each workflow event, and
duplicate existing events when needed.

### Concepts

Every workflow is composed of `event`, `filters`, and `actions`.

- **Event** - An Event defines when a workflow should be triggered. It
represents specific activities such as an issue being added to the
project, a pull request being merged, or a project column being changed.
- **Filter** - A Filter refines when an event should take effect. It
allows users to specify conditions like issue type, labels, or project
columns to ensure actions only run in targeted scenarios.
- **Action** - An Action defines what happens when the event and filters
match. It performs operations such as adding labels, moving issues
between columns, or changing the issue or pull request state.

### Available Events

Currently, the following eight events are supported:

- On issues/pull requests closed
- On issues/pull requests reopened
- On issues/pull requests was added to the project, including when
created in it
- On issues/pull requests was removed from the project
- On issues/pull requests' column was changed
- On code changes requested
- On code review approved
- On pull request merged

Each event type supports its own set of filters and actions.

### Available Filters

There are four types of filters that can be configured for an event:

- **Apply to** - Specify the target type: `issues only`, `pull requests
only`, or `issues and pull requests`.
- **Labels** - Trigger the event only if the issue or pull request
contains one or more specified labels.
- **Move from column** - Filter events based on the original project
column.
- **Move to column** - Filter events based on the destination project
column.

### Available Actions

There are four types of actions that can be executed when an event is
triggered:

- **Add labels** - Automatically add one or more labels to the issue or
pull request.
- **Remove labels** - Remove one or more specified labels.
- **Move to column** - Move the issue or pull request to a designated
project column.
- **Issue state** - Close or reopen the issue. Pull requests can only be
closed.

### Enable/Disable an event workflow

Each event workflow can be individually enabled or disabled. When
disabled, the workflow will be ignored even if the event occurs. This
feature is useful when you want to temporarily stop certain automated
actions without deleting the workflow configuration. Workflows of closed
projects don't run either.

### Clone an event workflow

When you need multiple workflows for the same event, you can clone an
existing event to create a new one with different filters and actions.
This allows you to customize how the same event behaves under different
conditions, making workflows more flexible and powerful.

### Permissions

Permissions are checked when workflows are managed, not when they run:

- Viewing a project's workflows needs read access to the project
- Managing them needs write access to the project plus write access to
both issues and pull requests of a repository project's repository,
being an owner of an organization project's organization or a site
administrator, or being the user of a user project. Tokens limited to
public repositories can't manage owner-level projects' workflows
- A workflow runs when its event happens to an item of an open project
that can hold the item's repository, unless that repository is archived,
no matter who caused the event, and applies its actions without further
permission checks. Pull requests are never reopened
- Changes show as made by "Project workflow" on behalf of the user who
triggered the event and don't trigger other workflows
- Only users who can read an item can put it on a board or move its card

The management rule is also documented on `CanManageWorkflows` in
`services/projects/workflow.go`.

Fixes:  #14359
Fixes: #26704
Fixes: #27990
Replaces:  #28745
Documentation PR: https://gitea.com/gitea/docs/pulls/308
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-10-23 01:53:45 +00:00

215 lines
19 KiB
Go
Raw Blame History

// Copyright 2026 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT
package audit
import (
"slices"
"strings"
)
type Action string
var (
actionMessages = map[Action]string{}
allActions []Action
)
func define(id, message string) Action {
a := Action(id)
if _, exists := actionMessages[a]; exists {
panic("duplicate audit action: " + id)
}
actionMessages[a] = message
allActions = append(allActions, a)
return a
}
// MessageTemplate returns the message template registered for an action.
func MessageTemplate(a Action) (string, bool) {
m, ok := actionMessages[a]
return m, ok
}
// AllActions returns every registered action.
func AllActions() []Action {
return allActions
}
// ActionFilters returns every exact action and its selectable hierarchy prefixes.
// A prefix is useful when an operator wants every event in a family, such as
// user:impersonation, without having to download and post-process the log.
func ActionFilters() []Action {
filters := make(map[Action]struct{}, len(allActions)*2)
for _, action := range allActions {
filters[action] = struct{}{}
parts := strings.Split(string(action), ":")
for i := 2; i < len(parts); i++ {
filters[Action(strings.Join(parts[:i], ":"))] = struct{}{}
}
}
result := make([]Action, 0, len(filters))
for action := range filters {
result = append(result, action)
}
slices.Sort(result)
return result
}
// IsActionFilter reports whether action is an exact action or a family prefix.
func IsActionFilter(action Action) bool {
return slices.Contains(ActionFilters(), action)
}
var (
UserImpersonation = define("user:impersonation:start", "User {actor} started impersonating user {scope}.")
UserImpersonationExit = define("user:impersonation:exit", "User {actor} stopped impersonating user {scope}.")
UserCreate = define("user:create", "Created user {scope}.")
UserDelete = define("user:delete", "Deleted user {scope}.")
UserAuthenticationFailTwoFactor = define("user:authentication:fail:twofactor", "Failed two-factor authentication for user {scope}.")
UserAuthenticationSource = define("user:authentication:source:update", "Changed authentication source of user {scope} to {auth_source}.")
UserActive = define("user:status:active", "Changed activation status of user {scope} to {active}.")
UserRestricted = define("user:status:restricted", "Changed restricted status of user {scope} to {restricted}.")
UserAdmin = define("user:status:admin", "Changed admin status of user {scope} to {admin}.")
UserType = define("user:type:update", "Changed type of user {scope} to {user_type}.")
UserName = define("user:name:update", "Changed user name from {previous_name} to {scope}.")
UserPassword = define("user:password", "Changed password of user {scope}.")
UserPasswordResetRequest = define("user:password:resetrequest", "Requested password reset for user {scope}.")
UserVisibility = define("user:visibility:update", "Changed visibility of user {scope} from {old_visibility} to {new_visibility}.")
UserEmailPrimaryChange = define("user:email:primary", "Changed primary email of user {scope} to {email}.")
UserEmailAdd = define("user:email:add", "Added email {email} to user {scope}.")
UserEmailActivate = define("user:email:activate", "Changed activation status of email {email} of user {scope}.")
UserEmailRemove = define("user:email:remove", "Removed email {email} from user {scope}.")
UserTwoFactorEnable = define("user:twofactor:enable", "Enabled two-factor authentication for user {scope}.")
UserTwoFactorRegenerate = define("user:twofactor:regenerate", "Regenerated two-factor authentication secret for user {scope}.")
UserTwoFactorDisable = define("user:twofactor:disable", "Disabled two-factor authentication for user {scope}.")
UserWebAuthAdd = define("user:webauth:add", "Added WebAuthn key {credential} for user {scope}.")
UserWebAuthRename = define("user:webauth:rename", "Renamed WebAuthn key {previous_credential} of user {scope} to {credential}.")
UserWebAuthRemove = define("user:webauth:remove", "Removed WebAuthn key {credential} from user {scope}.")
UserExternalLoginAdd = define("user:externallogin:add", "Added external login {external_id} for user {scope} using provider {provider}.")
UserExternalLoginRemove = define("user:externallogin:remove", "Removed external login from authentication source {auth_source_id} for user {scope}.")
UserOpenIDAdd = define("user:openid:add", "Associated OpenID {openid} to user {scope}.")
UserOpenIDRemove = define("user:openid:remove", "Removed OpenID {openid} from user {scope}.")
UserAccessTokenAdd = define("user:accesstoken:add", "Added access token {token} for user {scope} with scope {token_scope}.")
UserAccessTokenRemove = define("user:accesstoken:remove", "Removed access token {token} from user {scope}.")
UserOAuth2ApplicationAdd = define("user:oauth2application:add", "Added OAuth2 application {oauth2_application} for user {scope}.")
UserOAuth2ApplicationUpdate = define("user:oauth2application:update", "Updated OAuth2 application {oauth2_application} of user {scope}.")
UserOAuth2ApplicationSecret = define("user:oauth2application:secret", "Regenerated secret for OAuth2 application {oauth2_application} of user {scope}.")
UserOAuth2ApplicationGrant = define("user:oauth2application:grant", "Granted OAuth2 application {oauth2_application} access to user {scope}.")
UserOAuth2ApplicationRevoke = define("user:oauth2application:revoke", "Revoked OAuth2 grant for application {oauth2_application} of user {scope}.")
UserOAuth2ApplicationRemove = define("user:oauth2application:remove", "Removed OAuth2 application {oauth2_application} of user {scope}.")
UserKeySSHAdd = define("user:key:ssh:add", "Added SSH key {fingerprint} for user {scope}.")
UserKeySSHRemove = define("user:key:ssh:remove", "Removed SSH key {fingerprint} of user {scope}.")
UserKeyPrincipalAdd = define("user:key:principal:add", "Added principal key {key} for user {scope}.")
UserKeyPrincipalRemove = define("user:key:principal:remove", "Removed principal key {key} of user {scope}.")
UserKeyGPGAdd = define("user:key:gpg:add", "Added GPG key {gpg_key_id} for user {scope}.")
UserKeyGPGRemove = define("user:key:gpg:remove", "Removed GPG key {gpg_key_id} of user {scope}.")
UserSecretAdd = define("user:secret:add", "Added secret {secret} to user {scope}.")
UserSecretUpdate = define("user:secret:update", "Updated secret {secret} of user {scope}.")
UserSecretRemove = define("user:secret:remove", "Removed secret {secret} from user {scope}.")
UserWebhookAdd = define("user:webhook:add", "Added webhook {webhook} to user {scope}.")
UserWebhookUpdate = define("user:webhook:update", "Updated webhook {webhook} of user {scope}.")
UserWebhookRemove = define("user:webhook:remove", "Removed webhook {webhook} of user {scope}.")
OrganizationCreate = define("organization:create", "Created organization {scope}.")
OrganizationDelete = define("organization:delete", "Deleted organization {scope}.")
OrganizationName = define("organization:name:update", "Changed organization name from {previous_name} to {scope}.")
OrganizationVisibility = define("organization:visibility", "Changed visibility of organization {scope} to {new_visibility}.")
OrganizationMemberRemove = define("organization:member:remove", "Removed user {member} from organization {scope}.")
OrganizationTeamAdd = define("organization:team:add", "Added team {team} to organization {scope}.")
OrganizationTeamUpdate = define("organization:team:update", "Updated settings of team {scope}/{team}.")
OrganizationTeamRemove = define("organization:team:remove", "Removed team {team} from organization {scope}.")
OrganizationTeamPermission = define("organization:team:permission", "Changed permission of team {scope}/{team} to {permission}.")
OrganizationTeamMemberAdd = define("organization:team:member:add", "Added user {member} to team {scope}/{team}.")
OrganizationTeamMemberRemove = define("organization:team:member:remove", "Removed user {member} from team {scope}/{team}.")
OrganizationOAuth2ApplicationAdd = define("organization:oauth2application:add", "Added OAuth2 application {oauth2_application} for organization {scope}.")
OrganizationOAuth2ApplicationUpdate = define("organization:oauth2application:update", "Updated OAuth2 application {oauth2_application} of organization {scope}.")
OrganizationOAuth2ApplicationSecret = define("organization:oauth2application:secret", "Regenerated secret for OAuth2 application {oauth2_application} of organization {scope}.")
OrganizationOAuth2ApplicationRemove = define("organization:oauth2application:remove", "Removed OAuth2 application {oauth2_application} of organization {scope}.")
OrganizationSecretAdd = define("organization:secret:add", "Added secret {secret} to organization {scope}.")
OrganizationSecretUpdate = define("organization:secret:update", "Updated secret {secret} of organization {scope}.")
OrganizationSecretRemove = define("organization:secret:remove", "Removed secret {secret} from organization {scope}.")
OrganizationWebhookAdd = define("organization:webhook:add", "Added webhook {webhook} to organization {scope}.")
OrganizationWebhookUpdate = define("organization:webhook:update", "Updated webhook {webhook} of organization {scope}.")
OrganizationWebhookRemove = define("organization:webhook:remove", "Removed webhook {webhook} of organization {scope}.")
RepositoryCreate = define("repository:create", "Created repository {scope}.")
RepositoryCreateFork = define("repository:fork:create", "Created fork {scope} of repository {base_repo}.")
RepositoryArchive = define("repository:archive", "Archived repository {scope}.")
RepositoryUnarchive = define("repository:unarchive", "Unarchived repository {scope}.")
RepositoryDelete = define("repository:delete", "Deleted repository {scope}.")
RepositoryName = define("repository:name:update", "Changed repository name from {previous_name} to {scope}.")
RepositoryVisibility = define("repository:visibility:update", "Changed visibility of repository {scope} to {visibility}.")
RepositoryConvertFork = define("repository:fork:convert", "Converted repository {scope} from fork to regular repository.")
RepositoryConvertMirror = define("repository:mirror:convert", "Converted repository {scope} from pull mirror to regular repository.")
RepositoryMirrorPushAdd = define("repository:mirror:push:add", "Added push mirror to {remote_address} for repository {scope}.")
RepositoryMirrorPushRemove = define("repository:mirror:push:remove", "Removed push mirror to {remote_address} for repository {scope}.")
RepositorySigningVerification = define("repository:signingverification", "Changed signing verification of repository {scope} to {trust_model}.")
RepositoryTransferStart = define("repository:transfer:start", "Started repository transfer of {scope} to {new_owner}.")
RepositoryTransferFinish = define("repository:transfer:finish", "Transferred repository {scope} from {old_owner} to {new_owner}.")
RepositoryTransferCancel = define("repository:transfer:cancel", "Canceled transfer of repository {scope}.")
RepositoryWikiDelete = define("repository:wiki:delete", "Deleted wiki of repository {scope}.")
RepositoryCollaboratorAdd = define("repository:collaborator:add", "Added user {collaborator} as collaborator for repository {scope} with access mode {access_mode}.")
RepositoryCollaboratorAccess = define("repository:collaborator:access", "Changed access mode of collaborator {collaborator} of repository {scope} to {access_mode}.")
RepositoryCollaboratorRemove = define("repository:collaborator:remove", "Removed collaborator {collaborator} from repository {scope}.")
RepositoryCollaboratorTeamAdd = define("repository:collaborator:team:add", "Added team {team} as collaborator for repository {scope}.")
RepositoryCollaboratorTeamRemove = define("repository:collaborator:team:remove", "Removed team {team} as collaborator from repository {scope}.")
RepositoryBranchDefault = define("repository:branch:default", "Changed default branch of repository {scope} to {default_branch}.")
RepositoryBranchProtectionAdd = define("repository:branch:protection:add", "Added branch protection {rule} for repository {scope}.")
RepositoryBranchProtectionUpdate = define("repository:branch:protection:update", "Updated branch protection {rule} for repository {scope}.")
RepositoryBranchProtectionRemove = define("repository:branch:protection:remove", "Removed branch protection {rule} from repository {scope}.")
RepositoryTagProtectionAdd = define("repository:tag:protection:add", "Added tag protection {pattern} for repository {scope}.")
RepositoryTagProtectionUpdate = define("repository:tag:protection:update", "Updated tag protection {pattern} for repository {scope}.")
RepositoryTagProtectionRemove = define("repository:tag:protection:remove", "Removed tag protection {pattern} from repository {scope}.")
RepositoryWebhookAdd = define("repository:webhook:add", "Added webhook {webhook} to repository {scope}.")
RepositoryWebhookUpdate = define("repository:webhook:update", "Updated webhook {webhook} of repository {scope}.")
RepositoryWebhookRemove = define("repository:webhook:remove", "Removed webhook {webhook} of repository {scope}.")
RepositoryDeployKeyAdd = define("repository:deploykey:add", "Added deploy key {deploy_key} for repository {scope}.")
RepositoryDeployKeyRemove = define("repository:deploykey:remove", "Removed deploy key {deploy_key} from repository {scope}.")
RepositorySecretAdd = define("repository:secret:add", "Added secret {secret} to repository {scope}.")
RepositorySecretUpdate = define("repository:secret:update", "Updated secret {secret} of repository {scope}.")
RepositorySecretRemove = define("repository:secret:remove", "Removed secret {secret} from repository {scope}.")
IssueCreate = define("issue:create", "Created issue {issue} in repository {scope}.")
IssueDelete = define("issue:delete", "Deleted issue {issue} from repository {scope}.")
IssueCommentCreate = define("issue:comment:create", "Added comment {comment_id} to issue {issue} in repository {scope}.")
IssueCommentDelete = define("issue:comment:delete", "Deleted comment {comment_id} from issue {issue} in repository {scope}.")
PullRequestCreate = define("pr:create", "Created pull request {pull_request} in repository {scope}.")
PullRequestDelete = define("pr:delete", "Deleted pull request {pull_request} from repository {scope}.")
PullRequestMerge = define("pr:merge", "Merged pull request {pull_request} in repository {scope}.")
PullRequestCommentCreate = define("pr:comment:create", "Added comment {comment_id} to pull request {pull_request} in repository {scope}.")
PullRequestCommentDelete = define("pr:comment:delete", "Deleted comment {comment_id} from pull request {pull_request} in repository {scope}.")
ProjectCreate = define("project:create", "Created project {project} in {scope}.")
ProjectUpdate = define("project:update", "Updated project {project} in {scope}.")
ProjectDelete = define("project:delete", "Deleted project {project} from {scope}.")
ProjectWorkflowCreate = define("project:workflow:create", "Created workflow {workflow_id} for {event} in project {project} of {scope}.")
ProjectWorkflowUpdate = define("project:workflow:update", "Updated workflow {workflow_id} for {event} in project {project} of {scope}.")
ProjectWorkflowDelete = define("project:workflow:delete", "Deleted workflow {workflow_id} for {event} from project {project} of {scope}.")
WikiPageCreate = define("wiki:page:create", "Created wiki page {page} in repository {scope}.")
WikiPageUpdate = define("wiki:page:update", "Updated wiki page {page} in repository {scope}.")
WikiPageDelete = define("wiki:page:delete", "Deleted wiki page {page} from repository {scope}.")
ActionsWorkflowEnable = define("actions:workflow:enable", "Enabled Actions workflow {workflow} in repository {scope}.")
ActionsWorkflowDisable = define("actions:workflow:disable", "Disabled Actions workflow {workflow} in repository {scope}.")
ActionsWorkflowDispatch = define("actions:workflow:dispatch", "Dispatched Actions workflow {workflow} on {ref} in repository {scope}.")
// Do not change the startup message anymore. We guarantee the stability of this message for
// users wanting to parse the log themselves to be able to trace back events across gitea versions.
SystemStartup = define("system:startup", "System started [Gitea {version}]")
SystemShutdown = define("system:shutdown", "System shutdown")
SystemWebhookAdd = define("system:webhook:add", "Added instance-wide webhook {webhook}.")
SystemWebhookUpdate = define("system:webhook:update", "Updated instance-wide webhook {webhook}.")
SystemWebhookRemove = define("system:webhook:remove", "Removed instance-wide webhook {webhook}.")
SystemAuthenticationSourceAdd = define("system:authenticationsource:add", "Created authentication source {auth_source}.")
SystemAuthenticationSourceUpdate = define("system:authenticationsource:update", "Updated authentication source {auth_source}.")
SystemAuthenticationSourceRemove = define("system:authenticationsource:remove", "Removed authentication source {auth_source}.")
SystemOAuth2ApplicationAdd = define("system:oauth2application:add", "Added instance-wide OAuth2 application {oauth2_application}.")
SystemOAuth2ApplicationUpdate = define("system:oauth2application:update", "Updated instance-wide OAuth2 application {oauth2_application}.")
SystemOAuth2ApplicationSecret = define("system:oauth2application:secret", "Regenerated secret for instance-wide OAuth2 application {oauth2_application}.")
SystemOAuth2ApplicationRemove = define("system:oauth2application:remove", "Removed instance-wide OAuth2 application {oauth2_application}.")
)
Reference in new issue View Git Blame Copy Permalink