From 917d0e9fa024a27097005d447b73cb038fda179a Mon Sep 17 00:00:00 2001
From: Earl Warren <contact@earl-warren.org>
Date: Thu, 30 Oct 2025 16:11:08 +0100
Subject: [PATCH] feat: cancel all pull requests runs when blocking a user

---
 services/user/block.go      |  8 ++++++++
 services/user/block_test.go | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/services/user/block.go b/services/user/block.go
index 6be8dc5f70..6182df7ca7 100644
--- a/services/user/block.go
+++ b/services/user/block.go
@@ -9,6 +9,7 @@ import (
 	"forgejo.org/models/db"
 	repo_model "forgejo.org/models/repo"
 	user_model "forgejo.org/models/user"
+	actions_service "forgejo.org/services/actions"
 
 	"xorm.io/builder"
 )
@@ -91,5 +92,12 @@ func BlockUser(ctx context.Context, userID, blockID int64) error {
 		return err
 	}
 
+	err = db.Iterate(ctx, builder.Eq{"owner_id": userID}, func(ctx context.Context, repo *repo_model.Repository) error {
+		return actions_service.RevokeTrust(ctx, repo.ID, blockID)
+	})
+	if err != nil {
+		return err
+	}
+
 	return committer.Commit()
 }
diff --git a/services/user/block_test.go b/services/user/block_test.go
index a2ba5d71a7..b9f23a7cda 100644
--- a/services/user/block_test.go
+++ b/services/user/block_test.go
@@ -7,11 +7,13 @@ import (
 	"testing"
 
 	model "forgejo.org/models"
+	actions_model "forgejo.org/models/actions"
 	"forgejo.org/models/db"
 	issues_model "forgejo.org/models/issues"
 	repo_model "forgejo.org/models/repo"
 	"forgejo.org/models/unittest"
 	user_model "forgejo.org/models/user"
+	actions_module "forgejo.org/modules/actions"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -110,4 +112,37 @@ func TestBlockUser(t *testing.T) {
 		_, err = issues_model.ChangeIssueStatus(db.DefaultContext, issue, blockedUser, false)
 		require.Error(t, err)
 	})
+
+	t.Run("Pull requests actions are cancelled", func(t *testing.T) {
+		doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2, OwnerID: doer.ID})
+		blockedUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+		defer user_model.UnblockUser(db.DefaultContext, doer.ID, blockedUser.ID)
+
+		pullRequestPosterID := blockedUser.ID
+		singleWorkflows, err := actions_module.JobParser([]byte(`
+jobs:
+  job:
+    runs-on: docker
+    steps:
+      - run: echo OK
+`))
+		require.NoError(t, err)
+		require.Len(t, singleWorkflows, 1)
+		runWaiting := &actions_model.ActionRun{
+			TriggerUserID:       2,
+			RepoID:              repo.ID,
+			Status:              actions_model.StatusWaiting,
+			PullRequestPosterID: pullRequestPosterID,
+		}
+		require.NoError(t, actions_model.InsertRun(t.Context(), runWaiting, singleWorkflows))
+
+		run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runWaiting.ID})
+		require.Equal(t, actions_model.StatusWaiting.String(), run.Status.String())
+
+		require.NoError(t, BlockUser(db.DefaultContext, doer.ID, blockedUser.ID))
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runWaiting.ID})
+		require.Equal(t, actions_model.StatusCancelled.String(), run.Status.String())
+	})
 }