Gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-08-13 14:31:45 +00:00

Files

T

bircni 8161479fde fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886 )

For a `pull_request_target` (PRT) run, Gitea loads the top-level
workflow from the trusted base branch, but any local reusable workflow
it calls (`uses: ./...`) was read from the PR **head** commit, which the
fork author controls.

## Fix

**Record the source commit where the content is read.**
`DetectedWorkflow` now carries a `SourceCommitSHA` filled in next to
`Content`, so the PRT detection pass at the base commit records the base
SHA automatically.

**Defense in depth.** `loadReusableWorkflowSource` pins the PR base
commit for a PRT run's local `uses: ./...` rather than trusting the
stored SHA. This also covers runs recorded before this change, whose
rows still hold the head SHA and would otherwise resolve from the fork
on rerun.

Existing run rows are not migrated.

---------

Co-authored-by: Zettat <zettat123@gmail.com>

2026-08-12 19:03:44 +02:00

jobparser

refactor: use the shared workflow model from actionslib (#38768 )

2026-08-07 20:56:40 -07:00

workflowpattern

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

artifacts_test.go

fix(actions): make artifact signature payloads unambiguous (#37707 )

2026-05-20 16:34:27 +00:00

artifacts.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )