Commit graph

1526 commits

Author SHA1 Message Date
zokki
4247c37300 fix(api): deactivate issue api for disabled or external issue-tracker (#8829)
- When the issue unit is disabled for a repository, don't allow issue related APIs.
- Added integration tests.
- Resolves #8408

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8829
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: zokki <zokki.softwareschmiede@gmail.com>
Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
2025-09-03 16:13:40 +02:00
Antonin Delpeuch
8f4ebab023 tests: increase checkAccessibility timeout to 2s (#9137)
Because the flakiness of this check seems to be also present in Firefox, this is an attempt at reducing the flakiness, as an alternative to #9118.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9137
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Antonin Delpeuch <antonin@delpeuch.eu>
Co-committed-by: Antonin Delpeuch <antonin@delpeuch.eu>
2025-09-02 16:08:58 +02:00
zokki
9162c82150 fix: preserved 'Custom access' even after no permissions (#8943)
fixes #5382

Co-authored-by: Otto <otto@codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8943
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: zokki <zokki.softwareschmiede@gmail.com>
Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
2025-09-01 15:19:17 +02:00
Maxim Slipenko
ed3b70cbb9 feat: allow any README for .profile (#8798)
closes #1624

Co-authored-by: Maxim Slipenko <maks1ms@altlinux.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8798
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Maxim Slipenko <maks1ms@noreply.codeberg.org>
Co-committed-by: Maxim Slipenko <maks1ms@noreply.codeberg.org>
2025-09-01 13:58:00 +02:00
dawe
a87153b089 fix(ui): clear fields when canceling adding ssh key (#8990)
- Add javascript to clear fields upon clicking the cancel button inside the panel for adding new SSH keys.
- Add E2E test.
- Resolves #8915

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8990
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: dawe <dawedawe@posteo.de>
Co-committed-by: dawe <dawedawe@posteo.de>
2025-09-01 09:24:42 +02:00
0ko
af7066de64 chore(i18n): migrate migration descriptions to json (#9041)
Followup to https://codeberg.org/forgejo/forgejo/pulls/8987

* migrate strings, get rid of the `repo.` prefix
* simplify template and test

Followup to https://codeberg.org/forgejo/forgejo/pulls/8736#issuecomment-6801385

* restore lost translations

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9041
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-08-31 08:19:19 +02:00
0ko
18cd9b5efa feat(ui): implement hover for switch (#9057)
Followup to https://codeberg.org/forgejo/forgejo/issues/6459

Preview:
- https://codeberg.org/attachments/cc12a227-c6eb-4ab5-91ad-0ef967f88c7a
- https://codeberg.org/attachments/a13c8cb6-f654-430c-a6c6-990a2a7f0911

Changes:
- hovered items now have background painted with transition
- added E2E testing: mostly for CSS logic introduced in this PR but also a bit for existing functionality
- variable --color-active is now consistently non-transparent: it already was in forgejo-dark but is now in all themes
- some code improvements in switch.css

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9057
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-08-30 18:54:11 +02:00
Earl Warren
1b13fda06b fix: email comments are removed from email addresses (#9074)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9074
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
2025-08-30 13:15:30 +02:00
Earl Warren
608f9ee8e6 fix: validate CSRF on non-safe methods (#9071)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9071
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2025-08-30 13:13:29 +02:00
Earl Warren
c064ce4ad0 fix: require password login for creation of new token (#9070)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9070
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2025-08-30 13:12:54 +02:00
Earl Warren
829062808a fix: use credentials helpers for git clones (#9067)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9067
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
2025-08-30 13:12:11 +02:00
famfo
a511e37572
chore: add email blocklist unit test 2025-08-30 09:45:19 +02:00
Gusted
5fdd6ce9a6
chore: add integration test
Verify that PUT/DELETE requests return invalid CSRF token when no CSRF
token is given with the request.
2025-08-30 09:32:49 +02:00
Gusted
7bf7c0cb61
chore: add integration test
Add a test that verifies that you cannot create new tokens via basic
OAuth2 and basic access token.
2025-08-30 09:27:33 +02:00
Gusted
f7fb1226a4
chore: unbreak existing tests
Because the user:password is no longer automatically set as upstream
origin, we have to set it manually if we want push to work.
2025-08-30 08:52:34 +02:00
Gusted
9fb75a141d
chore: add migration credentials integration test 2025-08-30 08:52:29 +02:00
Gusted
374a29fd35
chore: add integration test
Demonstrate that the it's not possible to migrate or add a push mirror
from a URL that contains credentials.
2025-08-30 08:07:26 +02:00
Gusted
d00200dc3e
chore: add integration test
Demonstrate that the credential isn't shown in the flash message
2025-08-30 08:07:21 +02:00
BtbN
9828aca733 feat: github compatability for removing label from issue API (#8831)
On GitHub, `DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id}` takes the label name, not id:

https://docs.github.com/en/rest/issues/labels?apiVersion=2022-11-28#remove-a-label-from-an-issue

This breaks workflows and actions that interact with labels and delete them.
It also makes the API quite difficult to use, always having to query the ID first before deleting a label from an issue, potentially with two API calls, because it could be a repo or org label.

For backwards compatibility, if no label with the given name is found, and the name converts to an int without error, it'll still be looked up by ID.

The API on GitHub also does not return 204, but 200, with the label it just removed from the issue as content. So this is returned when `application/vnd.github+json` is set in the `Accept` request header.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8831
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: BtbN <btbn@btbn.de>
Co-committed-by: BtbN <btbn@btbn.de>
2025-08-30 03:29:23 +02:00
Mathieu Fenniak
86ce1477c1 test(e2e): improve reliability of workflow list dynamic refresh test (#9059)
The "refresh does not break interacting with open drop-downs" is flaky.  It attempts to verify that a refresh of the "Actions" list page does not occur when the user is currently navigating the dropdowns on the page, as htmx would replace their dropdowns mid-action.  It does this by clicking on the dropdowns, verifying the dropdown text is visible, simulating a refresh, and verifying that the dropdown text is still visible.

Example failure log:
```
  1) [chromium] › tests/e2e/actions.test.e2e.ts:173:3 › workflow list dynamic refresh › refresh does not break interacting with open drop-downs

    Error: Timed out 3000ms waiting for expect(locator).toBeVisible()

    Locator: getByText('Waiting')
    Expected: visible
    Received: hidden
    Call log:
      - Expect "toBeVisible" with timeout 3000ms
      - waiting for getByText('Waiting')
        7 × locator resolved to <a class="item" href="?workflow=test-dispatch.yml&actor=0&status=5">↵⇆⇆⇆⇆⇆⇆⇆Waiting↵⇆⇆⇆⇆⇆⇆</a>
          - unexpected value "hidden"

      194 |     await expect(page.getByText('Failure')).toBeVisible();
      195 |     await simulatePollingInterval(page);
    > 196 |     await expect(page.getByText('Waiting')).toBeVisible();
          |                                             ^
      197 |     await expect(page.getByText('Failure')).toBeVisible();
      198 |
      199 |     // Actor dropdown
        at /workspace/forgejo/forgejo/tests/e2e/actions.test.e2e.ts:196:45
```

The dropdown list stops refreshes if there are any `[aria-expanded=true]` elements on the page:
ab6ea6a743/templates/repo/actions/list.tmpl (L31-L33)

But fomantic doesn't set the `aria-expanded` attribute immediately on mouseup; it delays for up to 100ms:
f8a332c2e6/web_src/js/modules/fomantic/dropdown.js (L241-L246)

The easiest fix is to align the test's expectations with the underlying code, which is to verify that the `aria-expanded=true` element is present in the test before proceeding with the simulated refresh.

Before this change, this test would fail as frequently as 10-out-of-10 in local runs, but usually more around 70% (albeit closer to 0% in a playwright ui).  After this change, I've executed the test with zero failures in 100 back-to-back runs with `npx playwright test ./tests/e2e/actions.test.e2e.ts --project chromium --repeat-each 100`.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9059
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-08-30 01:38:38 +02:00
Mathieu Fenniak
11218ac43c fix(ui): don't allow comment boxes to stretch outside diff boundries on small device UI (#9052)
The context menu of the comment box was not always available  on a mobile-sized device, because it would escape its container, overlap other elements, and be unable to be clicked.
To address this, I've made the comment box constrained to the width of the diff box.

This allows Playwright to interact with the element without ambiguity of the click targets, avoiding any "intercepts pointer events".

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9052
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-08-29 21:32:50 +02:00
0ko
ab6ea6a743 fix(ui): restore code search types (#9053)
Fix regression of https://codeberg.org/forgejo/forgejo/pulls/8736

Preview
Before: https://codeberg.org/attachments/d46743e7-beb3-404e-a103-ea8068760171
After: https://codeberg.org/attachments/0d9dcdb7-7b4f-4bbc-8776-67fd364e26a9

Reported-by: Antonin Delpeuch <antonin@delpeuch.eu>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9053
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Antonin Delpeuch <wetneb@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Ellen Εμιλία Άννα Zscheile <fogti@noreply.codeberg.org>
2025-08-29 18:56:54 +02:00
Mathieu Fenniak
6ac0ab3549 test(e2e): improve resiliency of accessibilityCheck (#9051)
In the helper method `accessibilityCheck`, accessibility checks are performed on the page including measurements of contrast between elements, and the theme is transitioned from the `light` to `dark` theme and back between two checks (with a hard-coded 100ms wait).  Experimentally this is proven to result in false-positive failures of the accessibilityCheck.

I believe the cause of these failures are CSS transitions that are occurring either between the theme transition, or from operations that have occurred before the `accessibilityCheck` method is called.  For example, one test `Markdown insert link` pops open the `Add a link` dialog box which has a CSS transition applied as the background is greyed out.

To fix this, I've wrapped both accessibility scans within `accessibilityCheck` in a `expect(...).toPass({ timeout: 1000 })` to allow Playwright to retry the assertions over the next second.  1 second exceeds the time that I've observed of any CSS transition in the project (max found was 0.3 seconds).

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9051
Reviewed-by: Antonin Delpeuch <wetneb@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-08-29 07:33:59 +02:00
Antonin Delpeuch
9d896028bd tests: Disable Create review from commit flaky e2e test (#9049)
This test fails on unrelated changes (see for instance https://codeberg.org/forgejo/forgejo/actions/runs/98626/jobs/3 or #9047).
This defeats the purpose of such a test and hinders development for all Forgejo contributors, so I am proposing to disable it.

I have notified PR #7155 (which introduced it) about the need to fix it.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9049
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Antonin Delpeuch <antonin@delpeuch.eu>
Co-committed-by: Antonin Delpeuch <antonin@delpeuch.eu>
2025-08-28 12:50:23 +02:00
Beowulf
e101a8e2dd fix: hide edit button on tag releases, improve ghost user display, fix tag signature banner (#7703)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7703
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-08-27 22:33:17 +02:00
Lucas Schwiderski
20f6639f11
Hide edit button on tag releases
When the release is "just" a tag, there is no release object to edit.

Closes: #3589
2025-08-27 19:29:12 +02:00
Lucas Schwiderski
33b9bf20bc
Consolidate tag release user display with issue comments
Increase consistency of rendering the ghost user, by re-using
the same template.
Also add a tooltip to the shared template, to explain the ghost user.

Closes: #5630
2025-08-27 19:29:11 +02:00
Earl Warren
b047a60a09
fix!: use run ID instead of run Index in artifacts download web views
- the run ID used to download artifacts is absolute (ID) instead of being
  relative to the repository (Index) for compatibility with the url built
  and returned as `artifact-url` by the the upload-artifact@v4 action.
- this is a breaking change because URLs to download artifacts
  previous saved/bookmarked and not yet expired expired are no
  longer working, they need to be looked up again by visiting the job
  web page.

- add unit tests for getRunByID().
- RepoActionView.test.js verifies the download URL is built using the
  run ID.
- lAdd integration tests to verify the RunID is set as expected in
  the template used by RepoActionView.vue.

Refs https://code.forgejo.org/forgejo/runner/issues/187
2025-08-27 08:53:20 +02:00
Earl Warren
f7b0eb16c8
chore: refactor the web UI tests for the actions run
- create tests/integration/actions_view_test.go
- extract TestActionsArtifactDeletion from actions_route_test.go
- extract tests misplaced in
  - api_actions_artifact_test.go
  - api_actions_artifact_v4_test.go
- add a tests for the /{owner}/{repo}/actions/runs/{run_index}/artifacts
  because it is useful for debugging
2025-08-27 08:34:19 +02:00
Earl Warren
014bf73db8 chore: prefix all Actions related integration tests with TestActions (#9035)
So they can conveniently be run all together with:

`make 'test-sqlite#TestActions'`

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9035
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-08-27 08:32:47 +02:00
0ko
cd08265406 ui: refactor display of review threads on pr view (#8138)
* refactored to untangle comment headers of different styles of comments from each other
* fixed misalignments
* improved consistency
* fixed missing avatar rounding
* made reactions aligned with content
* fixed text in the "Outdated" label overflowing into the toggle icon

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8138
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-08-27 06:02:56 +02:00
Ruud van Asseldonk
995dba14ec feat: search in the docs directory for issue and pull request templates (#8863)
For pull request templates, Forgejo currently does not look in the `docs` directory, but [GitHub does](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/creating-a-pull-request-template-for-your-repository#adding-a-pull-request-template). By making Forgejo also look there, it becomes possible to have the same repository work on both sites, without the need for vendor-specific paths.

There was duplication in the list of accepted file paths. On the one hand it’s nice for greppability that they are all spelled out, but it does mean adding 6 variants, I thought it would be more maintainable to deduplicate the Cartesian product. I added one fully spelled out path in the comment to still maintain some greppability.

Resolves forgejo/forgejo#8284

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8863
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Ruud van Asseldonk <dev@veniogames.com>
Co-committed-by: Ruud van Asseldonk <dev@veniogames.com>
2025-08-26 22:08:10 +02:00
Earl Warren
ff03a4eff6 chore: make migration tests relative to the root of the repository (#8999)
This is a noop refactor. It is on the path of each integration tests and this is why it needs no additional testing.

It makes it possible to run the migration tests using `go test` (which runs from the root) instead of building a test binary with `go test -c` that runs in the target directory, which is what the current tests are doing. This will be put to use to extract coverage in a unified way.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8999
Reviewed-by: jerger <jerger@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-08-26 07:36:00 +02:00
Earl Warren
c258003be9 feat: artifacts can be downloaded using their id instead of their name (#8957)
The web endpoint

`/{owner}/{repo}/actions/runs/{run_id}/artifacts/{artifact_name_or_id}`

can be used with either the artifact name used when it is uploaded or the instance wide unique number of the artifact, if it is not found. For instance:

`/root/myrepo/actions/run/3/artifacts/my_artifact_name`

or

`/root/myrepo/actions/run/3/artifacts/42`

The `upload-artifact@v4` output value `artifact-url` is built in this way and is now a valid URL to access the artifact.

Refs https://codeberg.org/forgejo/forgejo/issues/6147
Refs https://code.forgejo.org/forgejo/runner/issues/187
Refs https://code.forgejo.org/forgejo/upload-artifact/src/tag/v4#outputs

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/8957): <!--number 8957 --><!--line 0 --><!--description YXJ0aWZhY3RzIGNhbiBiZSBkb3dubG9hZGVkIHVzaW5nIHRoZWlyIGlkIGluc3RlYWQgb2YgdGhlaXIgbmFtZQ==-->artifacts can be downloaded using their id instead of their name<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8957
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-08-25 15:51:26 +02:00
Earl Warren
0a8d7826a4 feat: improve custom emojis (#8855)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8855
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-08-24 16:16:46 +02:00
Shiny Nematoda
ecda48307d fix(code-search): fix broken pagination. (#9000)
Missing parameters for:
- repo: path and mode
- user: mode
- explore: mode

resolves forgejo/forgejo!8997 and codeberg/community!2098

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9000): <!--number 9000 --><!--line 0 --><!--description Zml4KGNvZGUtc2VhcmNoKTogZml4IGJyb2tlbiBwYWdpbmF0aW9uLg==-->fix(code-search): fix broken pagination.<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9000
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
Co-committed-by: Shiny Nematoda <snematoda.751k2@aleeas.com>
2025-08-23 13:06:41 +02:00
0ko
f58f84562a fix(ui): use correct string for pagure description (#8987)
Followup to https://codeberg.org/forgejo/forgejo/pulls/8513

As we already got translated strings w/ incorrect key, I prefer to not touch them and teach the UI a workaround. Maybe later all related INI strings will be migrated to JSON without the prefix, too.

Preview
Before: https://codeberg.org/forgejo/forgejo/attachments/8e603325-bb2b-4e32-a9bc-f1fa20b6c40b
After: https://codeberg.org/forgejo/forgejo/attachments/38e8afeb-5214-4085-bd6c-3ba8ff3894cd

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8987
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
2025-08-22 12:00:08 +02:00
Earl Warren
af5df243d4 chore: replace gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 (#8956)
- gopkg.in/yaml.v3 is archived and unmaintained
- go.yaml.in/yaml/v3 is a compatible fork under the umbrella
  of https://yaml.org/

### Tests

There is no need for more tests than already provided: it is like an upgrade to a minor version, only from a fork. I browsed the changes and there are some bug fixes. They all seem reasonably minimal. It is not one of those forks that went crazy with breaking changes 😁 And there is a non zero chance that [a bug that matters to Forgejo Actions](https://github.com/yaml/go-yaml/issues/76) is fixed there. It is rare and can wait but it did happen on Codeberg.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8956
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-08-20 15:31:12 +02:00
Hailey Somerville
cb4ffd29cf fix: allow Actions tokens to access repos readable by signed in users (#8889)
This is an alternate take on https://codeberg.org/forgejo/forgejo/pulls/8808 which allows Actions tokens to access other repos which are readable by by signed in users. In practise this means public repos belonging to public or limited owners.

This PR is split into two commits to aid review of the security-sensitive changes I've made:

* The first commit is a refactor _which is not intended to change behaviour_. It extracts the permission logic for Actions tokens from the githttp handler and moves it to `repo_permission.go` alongside the permission logic for regular users. The new function, `GetActionRepoPermission` returns a `Permission` object just like `GetUserRepoPermission`. Only code unit access is currently allowed in the interest of keeping this commit from changing any access logic.

* The second commit is the broadening of access: this commit changes the logic in `GetActionRepoPermission` to give actions tokens access to repos readable by signed in users.

cc @earl-warren
ref https://codeberg.org/forgejo/forgejo/issues/5877

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/8889): <!--number 8889 --><!--line 0 --><!--description YWxsb3cgQWN0aW9ucyB0b2tlbnMgdG8gYWNjZXNzIHJlcG9zIHJlYWRhYmxlIGJ5IHNpZ25lZCBpbiB1c2Vycw==-->allow Actions tokens to access repos readable by signed in users<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8889
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Hailey Somerville <hailey@hails.org>
Co-committed-by: Hailey Somerville <hailey@hails.org>
2025-08-18 14:40:07 +02:00
jank1619
011e876f5c fix: use correct format for pull request references (#8890)
Use `!` instead of `#` for references in the sidebar of pull requests. This is useful when the repository uses a external issue tracker to avoid it being redirected to the external issue tracker.

Resolves forgejo/forgejo#8713

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8890
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: jank1619 <jank1619@noreply.codeberg.org>
Co-committed-by: jank1619 <jank1619@noreply.codeberg.org>
2025-08-15 14:18:00 +02:00
zokki
d6838462b8 feat: Global 2FA enforcement (#8753)
resolves #8549

This PR add a config to enforce 2FA for the whole Forgejo instance. It can be configured to `none`, `admin` or `all`.
A user who is required to enable 2FA is like a disabled user. He can only see the `/user/settings/security`-Page to enable 2FA, this should be similar to a user which needs to change his password. Also api and git-commands are not allowed.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

I will do it, if the general idea of this PR is a good feature.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/8753): <!--number 8753 --><!--line 0 --><!--description R2xvYmFsIDJGQSBlbmZvcmNlbWVudA==-->Global 2FA enforcement<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8753
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Ellen Εμιλία Άννα Zscheile <fogti@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: zokki <zokki.softwareschmiede@gmail.com>
Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
2025-08-15 10:56:45 +02:00
Earl Warren
ff99331225 chore(docs): add instructions to run S3 tests locally (#8895)
Also fix the existing instructions that were missing a `-e` flag.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8895
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-08-15 08:54:09 +02:00
Squel
4abf9e9db4 feat: show CI status on force-pushes (#8655)
If a change is part of a force-push and the commit(s) have a CI status, this will now be shown after the hashes.

`interactiveBorder` has been lowered as it was possible to activate the hover state for both commits. It would be unreasonable to test this within Playwright and thus this needs to be manually tested. On a pull request page that contains a force-push you will notice:
a) the (de)activation area for force-pushes is now smaller, and;
b) it is not possible to activate the hover state/popup for both commits.

ExecuteTemplate function from @gusted
https://codeberg.org/forgejo/forgejo/pulls/5168
https://codeberg.org/forgejo/forgejo/pulls/2884

Close #4932

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8655
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Squel <squeljur+git@gmail.com>
Co-committed-by: Squel <squeljur+git@gmail.com>
2025-08-13 03:29:36 +02:00
zokki
fb1095d141 fix: redirect from /{username}/{reponame}/pulls/{index} to issue if index is a issue (#8874)
Redirection from issue to pull is already working, but from pull to issue is not working. This is now fixed.

Resolves forgejo/forgejo#7386

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8874
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: zokki <zokki.softwareschmiede@gmail.com>
Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
2025-08-12 20:50:46 +02:00
BtbN
fa5011b988 fix: CreateDeclarativeRepo should allow merging PRs when PRs are enabled 2025-08-11 12:55:25 +02:00
Mathieu Fenniak
9524b8c370 fix: PR review dismissals were not appearing in activity feed (#8853)
Discovered that `NotifyPullRevieweDismiss` was dead code while working on another issue; it should have been `PullReviewDismiss` when originally implemented.  Related fixes to the activity feed view which were incomplete as well.

Dismissing a PR review now appears on the activity feed:
![image](/attachments/99bd37c5-218d-4ecf-a74c-d01451ceae17)

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8853
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-08-11 07:39:17 +02:00
Gusted
b1a6d66cf5
chore: add e2e test
Check that emoji suggestion still work and that it is aware of custom emojis.
2025-08-10 23:16:42 +02:00
Gusted
9a8bdc6cbd
chore: add integration test
Check that the correct value ends up in `window.config`.
2025-08-10 23:11:41 +02:00
0ko
04e04b7073 fix(ui): move file rename notice to before pagination (#8818)
Followup to https://codeberg.org/forgejo/forgejo/pulls/1442

Move the rename notice to a more suitable place.

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8818
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2025-08-10 21:35:34 +02:00
Mathieu Fenniak
1f2bbbd4aa fix: prevent user-entered text with | characters from being truncated in activity feed (#8844)
Prevents a variety of user-entered texts that can contain `|` characters from being truncated in the activity feed, affecting: issue & PR titles, comment content, review comments, and review dismissal comments.

Where `action.content` was containing a pipe-separated list of UI data fields before, it now uses a JSON-encoded string array.  The old format is still supported for reading from the feed.  In some places where `action.content` was not using this format, or where user-generated text was not inserted, the old format is retained.

Fixes part of the cause behind #8781, allowing small mermaid graphs to be rendered in the feed (for now...) --
![image](/attachments/4de98825-4fb7-4b5d-87c3-bd54d6f0a1d1)

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8844
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-08-10 19:48:46 +02:00