3 Commits

Include renames

Author	SHA1	Message	Date
3 people	0964106988	fix: add missing access checks and size limits (#39942) (#40085) ... Backport https://github.com/go-gitea/gitea/pull/39942 Several handlers and parsers skipped checks that their siblings already perform. - Reject issue, comment, label, milestone and release mutations in archived repositories via the API with one guard per route group, matching the web UI - Hide timeline references and dependencies pointing at issues the doer cannot read, in the web UI and the API, including pull requests of the same repository without pull request access - Reject workflow runs with more than `MaxJobNumPerRun` jobs, including inline reusable workflow jobs, and show rejected pushes as invalid workflow runs - Bound how much of a Helm chart archive is inflated while looking for `Chart.yaml` `release/v28` lacks two helpers this needs, so they are included: `insertInvalidWorkflowRun`, split out of `handleInvalidWorkflows` by https://github.com/go-gitea/gitea/pull/39480, and `packages.NewLimitedReader` from https://github.com/go-gitea/gitea/pull/39366. Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-10-30 08:08:32 +01:00
silverwind	9e7b302bd3	enhance(actions): add pending job status and align job statuses with GitHub (#39376)	2026-09-27 18:30:42 +00:00
silverwind	f757631a47	feat(actions): update actionslib, support self:, misc fixes (#39358) ... Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow parsing into it and aligns behaviour with GitHub. 1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths. 1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept expressions, including over `needs`. A job whose `name`, `runs-on` or `continue-on-error` reads `needs` is resolved once they finish. 1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and is decided before the matrix, as on github.com. 1. Matrix `fail-fast` cancels the other combinations, and `always()` jobs keep running when a run is cancelled. 1. Invalid workflow files, including a malformed `on:` and unknown or cyclic `needs`, show up on push as failed runs with the error. 1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or failed with the error, instead of staying blocked. 1. Reusable workflows: a missing and an unreadable repository fail alike, public callers cannot use private workflows, nested jobs cannot exceed the caller's token permissions. 1. Runner labels match case-insensitively, and `runs-on` accepts an array from an expression. Runner PR: https://gitea.com/gitea/runner/pulls/1247 Docs PR: https://gitea.com/gitea/docs/pulls/553 Fixes: https://github.com/go-gitea/gitea/issues/38990 Fixes: https://github.com/go-gitea/gitea/issues/39382 Fixes: https://github.com/go-gitea/gitea/issues/32364 Fixes: https://github.com/go-gitea/gitea/issues/36077 Fixes: https://github.com/go-gitea/gitea/issues/23277 Fixes: https://github.com/go-gitea/gitea/issues/29020 Co-authored-by: Claude (Opus 5) <noreply@anthropic.com> Co-authored-by: Zettat123 <zettat123@gmail.com>	2026-09-25 00:06:42 +02:00