Commit graph

1732 commits

Author SHA1 Message Date
zokki
dc0a63efe2 fix: endless redirection loop between /user/settings/change_password and /user/settings/security (#10002)
Fixes forgejo/forgejo#9980

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/10002): <!--number 10002 --><!--line 0 --><!--description ZW5kbGVzcyByZWRpcmVjdGlvbiBsb29wIGJldHdlZW4gL3VzZXIvc2V0dGluZ3MvY2hhbmdlX3Bhc3N3b3JkIGFuZCAvdXNlci9zZXR0aW5ncy9zZWN1cml0eQ==-->endless redirection loop between /user/settings/change_password and /user/settings/security<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10002
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: zokki <zokki.softwareschmiede@gmail.com>
Co-committed-by: zokki <zokki.softwareschmiede@gmail.com>
2025-11-07 21:12:47 +01:00
Earl Warren
57f986c7b1
feat: UI for the pull request trust management panel
See the documentation pull request for a description

https://codeberg.org/forgejo/docs/pulls/1567
https://forgejo.codeberg.page/@docs_pull_1567/docs/next/user/actions/security-pull-request/
2025-11-06 11:07:39 +01:00
Earl Warren
e41bcf5048
feat: add task to cleanup the ActionUser table weekly
test coverage is provided by TestAPICron which runs
registerCleanupActionUser()
2025-11-06 11:07:39 +01:00
Cyborus
54b3066e45 fix: paginate GET /api/v1/admin/hooks response (#9915)
Fixes #9911

The endpoint was documented as taking `page` and `limit` parameters but did not actually use then and just returned the full list. Now it does use them!

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9915
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Cyborus <cyborus@cyborus.xyz>
Co-committed-by: Cyborus <cyborus@cyborus.xyz>
2025-11-06 00:08:13 +01:00
Earl Warren
59f68b9469
chore(typo): s/Copyright 20124/Copyright 2024/ 2025-11-05 23:43:13 +01:00
Andreas Ahlenstorf
9ae926b330 test: Ensure jobs.<job_id>.runs-on works with vars (#9982)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9982
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
Co-committed-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
2025-11-05 22:55:02 +01:00
Andreas Ahlenstorf
addc393e71 Allow referencing inputs in jobs.<job_id>.runs-on (#9950)
This PR is a follow-up to https://code.forgejo.org/forgejo/runner/pulls/1117. That PR has to be merged before this one can proceed.

The objective is to allow referencing the `inputs` context in `jobs.<job_id>.runs-on`. That enables users to enter a label in the Forgejo UI during `workflow_dispatch`.

Example:

```yaml
name: test
on:
  workflow_dispatch:
    inputs:
      image:
        required: true
        type: string

jobs:
  test:
    runs-on: ${{ inputs.image }}
    steps:
      - run: echo "Running on ${{ inputs.image }}"
```

Using `inputs` with reusable workflows does not work. I haven't changed `schedule_tasks.go` because the `schedule` trigger does not support `inputs`.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9950): <!--number 9950 --><!--line 0 --><!--description QWxsb3cgcmVmZXJlbmNpbmcgaW5wdXRzIGluIGpvYnMuPGpvYl9pZD4ucnVucy1vbg==-->Allow referencing inputs in jobs.<job_id>.runs-on<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9950
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
Co-committed-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
2025-11-05 20:41:05 +01:00
Mathieu Fenniak
df30277369 fix: admin repo page error on NumIssues (#9983)
Fixes #9978.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9983
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-11-05 18:16:35 +01:00
fnoopv
b98c8f696c fix: /api/forgejo/v1/version Content-Type error (#9897)
fix: #9782
## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9897
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Cyborus <cyborus@noreply.codeberg.org>
Co-authored-by: fnoopv <fnoopv@noreply.codeberg.org>
Co-committed-by: fnoopv <fnoopv@noreply.codeberg.org>
2025-11-05 17:35:50 +01:00
Earl Warren
ec7dc193b4 chore: use code.forgejo.org/forgejo/actions-proto (#9981)
instead of code.gitea.io/actions-proto-go

It is a hard fork of code.gitea.io/actions-proto-go which has been used by the runner in the past few months.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9981
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
2025-11-05 16:10:52 +01:00
0ko
d05002fbfb fix(ui): prevent JS from removing icon from close/reopen button (#9959)
Followup to https://codeberg.org/forgejo/forgejo/pulls/9598. A bug surfaced.

When typing text in, JS was updating button's `textContent`, which also affected the icon included in the button. To avoid complex rebuilding of the button element in JS I just placed the text it it's own span, `textContent` of which is now updated by JS instead of the whole button.

Preview

Normal state from template:
https://codeberg.org/attachments/f504bcc3-c1bc-4b10-96ae-e8b666c4a828
https://codeberg.org/attachments/5e72109c-04c7-49b0-ba05-e8f17c949fcb

After editing text, without the fix:
https://codeberg.org/attachments/2c61b02f-b36a-4b80-8816-98bed3fc48e0
https://codeberg.org/attachments/923d4419-97ee-48c6-b60d-9719e36ae6ff

With the fix:
https://codeberg.org/attachments/458c1f6a-549e-4ef7-8822-8529351b7bc4
https://codeberg.org/attachments/839032f7-2f4a-488a-a8a5-d3fbfc45504b

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9959
Reviewed-by: Otto <otto@codeberg.org>
2025-11-05 05:02:52 +01:00
0ko
382c3c3228 feat(ui): allow dropdown to contain not just items (#9951)
Currently the dropdown component only supports having one `<summary>` and one `<ul>` (with interactive items) in it. This PR refactors it to add a `.content` container so that it is possible for the dropdown to contain things the more complex dropdowns do like `<hr>` and a searchbar.

Also adds an `<hr>` to user actions as a little demo.

Preview
B: https://codeberg.org/attachments/8dfb98d2-52be-4c3c-8fc0-8fe470f34703
A: https://codeberg.org/attachments/53f2acfb-2e61-4420-b616-13d563f5c257

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9951
Reviewed-by: Otto <otto@codeberg.org>
2025-11-05 05:00:15 +01:00
Mathieu Fenniak
78c98911a3 perf: update concurrency group query to be index-capable for status (#9943)
When `concurrency.cancel-in-progress: false` is set on a Forgejo Action run, the run will be queued behind other runs of the same concurrency group.  This requires a complex query to identify when a run can be dispatched to a runner.  During a refactoring of this code in #9927, @earl-warren noted that the query was using a `status NOT IN (...)` clause, which we had discussed in another issue as a possible performance concern -- an index on `status` cannot be used to fulfill that query clause.  This PR inverts the clause allowing an index to be used.

Covered by existing automated tests in `tests/integration/actions_concurrency_group_queue_test.go` -- a minor commented-out section was removed in these tests while reviewing for this change.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
    - Minor implementation change for a feature that is new in the v14 release; not relevant for the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9943
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-11-03 00:01:51 +01:00
Mathieu Fenniak
1d02b74f62 fix: prevent deadlocks updating repo.num_action_runs/num_closed_action_runs (#9927)
Fixes #9846.  The number of open action runs on a repo is not precomputed and stored on the repo, but is computed as needed and cached.  The computation is faster than the update because it only calculates the smaller set of which action runs are not completed (as opposed to counting all of them).

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9927
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-11-02 22:24:56 +01:00
Alex619829
c3412d0579 fix(alt): handle package names with dots in ALT repository (#9763)
Followup to https://codeberg.org/forgejo/forgejo/pulls/6351

Previously, ALT RPM repository did not match packages with dots in their
names, causing 404 errors. Updated the regexp to correctly parse these paths.

Co-authored-by: Aleksandr Gamzin <gamzin@altlinux.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9763
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Alex619829 <alex619829@noreply.codeberg.org>
Co-committed-by: Alex619829 <alex619829@noreply.codeberg.org>
2025-11-02 16:18:56 +01:00
Mathieu Fenniak
40b06af048 test: concurrent merges targeting separate branches proceed without errors (#9925)
Follow-up to #9868, #9916, #9922, adding an automated test that verifies no deadlocks occur when concurrently merging PRs in the same repo, with the same labels, and same milestone.  Different base and head branches are used to ensure there are no git conflicts.

Resolves #9785.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9925
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-11-01 15:10:16 +01:00
Mathieu Fenniak
a3c6c78e08 fix: reduce deadlocks merging PRs by using caching for repo issue count stats (#9922)
The `repository` table has quite a few "count of related objects" fields on it, including the number of issues, closed issues, pull requests, and closed pull requests.  These fields specifically will cause deadlocks during concurrent PR merges as documented in #9785.

These fields are not used in database queries.  In order to eliminate the deadlock possibility on them, I've moved them to be calculated on-demand with caching, with the cache being invalidated in the same places that the recalc used to be triggered.

I've supplemented the already in-place automated testing with manual testing performing simple close & reopen of issues & PRs, and the counts which are used in the tabs at the top of the repo page are updated correctly as expected.

Near future work:
- Similar change can probably be performed to fix #9846
- Last known deadlock identified from #9785; I'm hoping to incorporate the synthetic deadlock test in a near future PR to prevent regressions

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- Tests were already in-place covering these fields; they've been adjusted from using the fields to the new accessor methods.
- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9922): <!--number 9922 --><!--line 0 --><!--description cmVkdWNlIGRlYWRsb2NrcyBtZXJnaW5nIFBScyBieSB1c2luZyBjYWNoaW5nIGZvciByZXBvIGlzc3VlIGNvdW50IHN0YXRz-->reduce deadlocks merging PRs by using caching for repo issue count stats<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9922
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-31 23:50:05 +01:00
BtbN
6298ee4d3a fix: pull request review comment position (#9914)
## Checklist

This PR contains both #9889 and #9912, since it depends on the one, and the other provides a test for it.
The exact reasoning behind its logic is described here: https://codeberg.org/forgejo/forgejo/issues/9473#issuecomment-7976186

This PR should return the behaviour back to how it was before a PR to Gitea changed it.
Only the resulting Database-Entry will reference the line blamed commit, now also with the correct adjusted line.
While the context diff view is pulled from the commit the commenter actually commented on.

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9914
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: BtbN <btbn@btbn.de>
Co-committed-by: BtbN <btbn@btbn.de>
2025-10-31 16:17:23 +01:00
Mathieu Fenniak
327cdc1787 fix: reduce deadlocks merging PRs w/ async milestone stat recalcs (#9916)
Continuing the pattern from #9868, fixes another deadlock discovered in synthetic testing of #9785.  This modifies the `milestone` table to have the `num_issues`, `num_closed_issues`, and `completeness` statistics be calculated asynchronously.

An optional `updateTimestamp` field was added to the stats queue to support the conditional updating of the milestone's modification date, retaining existing functionality.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9916
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-31 15:53:45 +01:00
Mathieu Fenniak
9e07bb07be fix: reduce deadlocks merging PRs w/ async label stat recalcs (#9868)
The intent of this change is to reduce the scope of deadlock issues identified in #9785.  I've identified other deadlock issues from synthetic testing, so this is not a complete fix, but it's a partial fix.  This design was discussed in #9785 and this is the most basic implementation, with a very small scope of work converted to use it.

Introduces a new `forgejo.org/services/stats` module which allows for the queuing and routing of recalc requests for object stats; in this case, the "number of issues" that are assigned to a label, and the number of closed issues that are assigned to a label.

The reasons that these calculations are performed asynchronously through a queue are:
- User operations that are common and performance-sensitive don't have to wait for recalculations that don't need to be exactly up-to-date at all times.  For example, merging a pull request will be a faster operation; as it closes an issue, it needs to recalculate `label.num_closed_issues` for every label attached to the PR.

- Database deadlocks that can occur between concurrent operations -- for example, if you were holding a lock on an issue while recalculating a label's count of open issues -- can be broken by making the recalculation occur outside of the transaction.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.
    - Internal developer documentation is present.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [x] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9868
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-31 02:12:36 +01:00
Gusted
2a3d852e46 feat: convert create/rename branch and create tag to native dialog (#9760)
Followup to https://codeberg.org/forgejo/forgejo/pulls/8859, https://codeberg.org/forgejo/forgejo/pulls/9636.

Convert the create branch and rename branch modals in the branch list to native dialogs and convert the create branch and create tag in the commit view to native dialogs.

The dialogs in the commit view have been simplified and no longer uses javascript to construct the data in the dialog (thus would be eligible for nojs modals).

The dialogs have footer styled actions.

The rename branch modal now has a 'branch name' label to indicate the field is required.

E2E testing is added.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9760
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-30 21:06:14 +01:00
erik
aed579b9ee fix: stuck gitea/forgejo migration due to API pagination bug (#9274)
The Gitea API responds with the full number of issue comments, when the `/repos/{owner}/{repo}/issues/{index}/comments` endpoint is hit. Originally the number of comments is expected to paginated, so in the end it should always be lower than `MAX_RESPONSE_ITEMS` when the last page is hit.
However, due to the bug, this can never happen and so there will be an infinite loop.

This problem was inherited also into the Forgejo codebase. That means the same problem can occur when migrating from Forgejo to Forgejo.
Some fixes for the Forgejo API have been proposed for the Forgejo codebase see https://codeberg.org/forgejo/forgejo/issues/5177 and https://codeberg.org/codeberg/community/issues/1542

An integration test was written which reproduces the exact behaviour.  A more future proof solution was created that checks the relevant cases and decides whether the bug is still there or not.

It might be necessary to further distinguish between Gitea downloader and Forgejo downloader if we decide to update the Forgejo API. So we'll probably have to implement functionality and tests directly for the Forgejo downloader instead of just inheriting all the methods.

Co-authored-by: Michael Jerger <michael.jerger@meissa-gmbh.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9274
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: erik <erik_se@posteo.de>
Co-committed-by: erik <erik_se@posteo.de>
2025-10-30 17:32:55 +01:00
Gusted
a4642af51a feat: replace cross origin protection (#9830)
Replace the anti-CSRF token with a [cross origin protection by Go](https://go.dev/doc/go1.25#nethttppkgnethttp) that uses a stateless way of verifying if a request was cross origin or not. This allows is to remove al lot of code and replace it with a few lines of code and we no longer have to hand roll this protection. The new protection uses indicators by the browser itself that indicate if the request is cross-origin, thus we no longer have to take care of ensuring the generated CSRF token is passed back to the server any request by the the browser will have send this indicator.

Resolves forgejo/forgejo#3538

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9830
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-29 22:43:22 +01:00
Gusted
d4693941df fix: construct project links in timeline better (#9872)
- When a issue sees a modification regarding to which project they are assigned, then a timeline event is created for this. The link to the project that is constructed for this timeline event incorrectly assumes the project is a repository project.
- Use the `Link` function to construct the link to the project, this will correctly take into account if the project is a org, user or repo project.
- Resolves forgejo/forgejo#9817

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9872
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-29 17:46:13 +01:00
Gusted
1f4488215b fix: make edit label dialog work again (#9899)
- The E2E code did not actually assert that the functionality worked (`expect` was missing).
- Regression of forgejo/forgejo!9636
- Resolves forgejo/forgejo#9893

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9899
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-29 16:43:22 +01:00
Ryan Lerch
027fd3658a feat: Add admin individual user email management endpoints (#9594)
**AI Disclosure:** This work was produced with the assistance of an artificial intelligence tool

## feat: Add admin endpoints for individual user email management
Add GET and DELETE endpoints at `/admin/users/{username}/emails` to allow
administrators to list and delete individual email addresses for users.

These API endpoints provide programmatic access to functionality that is
currently only available through the web UI:
- http://forgejo.example/admin/emails (delete individual email addresses)
- http://forgejo.example/admin/users/1 (view individual user's emails)

The new endpoints follow existing admin API naming patterns such as
`/admin/users/{username}/keys`, `/admin/users/{username}/orgs`, and
`/admin/users/{username}/quota`, providing consistent resource management
under the `/admin/users/{username}` namespace.

This complements the existing `/admin/emails` endpoint which lists all emails
across all users, providing administrators with granular control over
individual user email management.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9594
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Ryan Lerch <rlerch@redhat.com>
Co-committed-by: Ryan Lerch <rlerch@redhat.com>
2025-10-28 15:52:37 +01:00
Andreas Ahlenstorf
f20bb27a4c feat: return all pending jobs if labels parameter is absent (#9839)
The API endpoints to query pending jobs require the presence of the query parameter `labels`, for example, `http://localhost:3000/api/v1/user/actions/runners/jobs?labels=ubuntu`. If the query parameter is absent, no jobs are returned. This PR lifts that requirement and makes the respective API endpoints return all pending jobs if the `labels` parameter is absent. If the parameter `labels` is empty, it only returns jobs without any labels.

This change simplifies writing programs that ask Forgejo for the presence of pending jobs without having to know all labels. It helps with #9670, too.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9839
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
Co-committed-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
2025-10-28 15:01:59 +01:00
Gusted
230519bd89 feat: migrate add/remove repositories in team to native dialog (#9877)
- Migrate add/remove org repositories for teams to a native dialog.
- Is potential to be fully no-js, as javascript no longer constructs the modal.
- Resolves forgejo/forgejo#9801

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9877
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-28 14:29:34 +01:00
oliverpool
d60bdc6f6e fix: minor typos (#9880)
While implementing #8222, a couple of typos slept through. This fixes them.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9880
Reviewed-by: Lucas <sclu1034@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>
2025-10-28 13:31:29 +01:00
0ko
c13f3cae95 feat(ui): improve new buttons, use in more areas (#9863)
* Make danger buttons brighter - followup https://codeberg.org/forgejo/forgejo/pulls/9652#issuecomment-7803875
The new lightness 0.26 is same as lightness of --color-box-body instead of being darker than it, so the form controls aren't darker than the background they're on which might look bad. Looks pretty good, the calculated contrast is fine.
* Apply new buttons to avatar upload/removal forms
    * Better responds to overflowing
* Consistently apply medium font-weight to all buttons - followup https://codeberg.org/forgejo/forgejo/pulls/9652#issuecomment-7783718
    * This improves readability a lot. The previous normal weight was only chosen because some of the buttons had it, which wasn't a good excuse. We also have buttons with medium, and they are easier to read.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9863
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2025-10-28 00:10:38 +01:00
Gusted
4cb72644d3 feat: show spinner when loading content history menu (#9874)
- When clicking on the content history menu "edited" item, show a spinner animation as before the dropdown is show can take a measurable amount of time.
- We cannot rely on fomantic adding the loading indicator (although it does have this capability), it only adds this indicator when waiting for the network request. For a fast Forgejo instance waiting for the network response is faster than what fomantic is doing to prepare the dropdown.
- Resolves forgejo/forgejo#9841

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9874
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-27 22:04:04 +01:00
Mathieu Fenniak
77cab5dbe2
fix: prevent .forgejo/template from being out-of-repo content 2025-10-25 10:41:49 -06:00
Mathieu Fenniak
7be431da88
fix: prevent writing to out-of-repo symlink destinations while evaluating template repos 2025-10-25 10:41:36 -06:00
0ko
693e73b25f fix(ui/dropdown): ensure same height for all items (#9762)
Followup to https://codeberg.org/forgejo/forgejo/pulls/7906.

Depending on type (`a`, `button`) the height could have been different because of default styles:
* `base.css` supplies `body {line-height: 20px;}` which applies to `a`
* `normalize.css` supplies `button {line-height: 1.15;}`, making `button` shorter than `a`

To avoid this I refactored dropdown items' properties in the same way as I did to switch in `web_src/css/modules/switch.css` `min-height` is now used while `padding-block` is 0.

Preview
B: https://codeberg.org/forgejo/forgejo/attachments/29d9d9aa-bfb6-46a6-a368-23137e1ac60b
A: https://codeberg.org/forgejo/forgejo/attachments/026a0af2-9481-4335-930c-9c92ad00ef03

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9762
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
2025-10-20 12:05:03 +02:00
0ko
b1ba9b06b2 feat(ui): dangerous buttons (#9652)
Followup to https://codeberg.org/forgejo/forgejo/pulls/9359:
* add dangerous buttons type
    * they will be replacing `red` and `negative` buttons and don't have some of their problems:
        * they aren't as eye-catching and bright like `red` on dark and `negative` on both themes
        * they aren't as bland as `red` on light theme
        * ...they are consistent!
    * added them to the danger zone of repo settings for this initial PR

Preview:
- https://codeberg.org/attachments/e4d71f45-9455-4435-ab99-6e1bd2628d05
- https://codeberg.org/attachments/3056d3e1-d7b0-4417-8f2c-8fa34b399911

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9652
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Otto <otto@codeberg.org>
2025-10-20 12:03:17 +02:00
0ko
609ce8c268 feat: improve tooltips and aria-labels of stars/forks/watchers links (#9754)
Followup: https://codeberg.org/forgejo/forgejo/pulls/2634, https://codeberg.org/forgejo/forgejo/pulls/2862

* i18n: migrate aria-label counters `n stars`, `n forks` to JSON in effort to eliminate the use of the old-style plurals
    * previous such migration https://codeberg.org/forgejo/forgejo/pulls/9625
    * testing: present, inherited from other changes
* a11y: add these aria-labels to usercards links on repo homepages
    * add a new one for `n watchers`
    * testing: present, minimal
* ui: re-use the counters in the tooltips so that they include a measurement unit and look better
    * testing: present, minimal
* ui: pretty-print the numbers in the tooltips
    * but not in aria labels
    * testing: missing: IDK how to work around the condition `{{if ge .NumStars 1000}}`
        * but `PrettyNumber` it relies on has test coverage, so it seems fine

Preview:
- https://codeberg.org/attachments/6d726bbd-fd84-4ca0-9aa4-cd5492512305
- https://codeberg.org/attachments/686eb429-93a7-4268-98d7-84863d6eb5ee

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9754
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2025-10-19 18:33:26 +02:00
Gusted
0a7e438e43 feat: simplify GetPullRequestFiles (#9740)
`GetPullRequestFiles` is the API route handler to get the files that are changed in a pull request, it has to know the start commit and end commit to diff for (so it can gather the changed file and other information). The end commit is clear, the pr ref (`ref/pull/xxx/head`). However the start commit has to be computed, it is the merge base commit between the base branch and pr ref. However if the pr was merged, then we should use the `pr.MergeBase` as it's possible the `pr.BaseBranch` no longer exists.

Instead of doing this computation via `GetCompareInfo` that also does some other computations, compute the merge base directly ourselves in this function, if no merge base exists then fallback to the base reference (this is the same behavior as in `GetCompareInfo`). The only difference is that in the case of the fallback we don't convert the base ref to a commit ID, this is not necessary as the call to `git-diff` will accept any valid reference. So technically we could drop the call to `baseGitRepo.GetRefCommitID()` as well, but that's left for another time to keep the change minimal.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9740
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-18 08:03:47 +02:00
Gusted
6726861e49 feat: dont set merge-base on pull request creation (#9734)
This will be computed by [`NewPullrequest` via `testPatch`](3f1731a765/services/pull/pull.go (L40-L46)) before the pull request is inserted into the database: 4adec07103/services/pull/patch.go (L169-L177)
The AGit codepath already didn't set the mergebase.

Tests are added to confirm that merge-base is still indeed set upon pull request creation via the web route and API route.

There's no immediate benefit, this is in preparation of trying to do less `git` commands on certain web/API routes. The enhancement thus here being `compareInfo` is not used from `parseCompareInfo` and could potentially in the future no longer have to be computed or could be skipped to compute for this API route, similar for removing a dependency on `ci.CompareInfo`. The `compareInfo` is relatively _heavy_ to compute and is not used in all codepaths.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9734
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-18 08:03:29 +02:00
Bojidar Marinov
8ed95dc4c6 fix: use scrollHeight for rendered iframe if offsetHeight is unavailable (#9508)
Fixes #9421.

Added integration test.

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9508
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Bojidar Marinov <bojidar.marinov.bg@gmail.com>
Co-committed-by: Bojidar Marinov <bojidar.marinov.bg@gmail.com>
2025-10-16 15:51:57 +02:00
Mathieu Fenniak
6db2e23078 test: introduce TruncateBeansCascade test helper to support data cleanup of foreign-key referenced tables (#9684)
Noted in #9557 -- as more foreign keys are added, a couple test locations (`reverseproxy_test.go` and `cmd_admin_test.go`) that truncate fixture data have a growing list of impacted tables.  This PR introduces a new `TruncateBeansCascade` which can be used for tests, as well as enhancing some helper functions that I expect will be used later to support automatic operation ordering.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.  (**Implicitly tested** by virtue of usage in a test.)
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9684
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-15 20:26:41 +02:00
Earl Warren
ed0bec9aa9 refactor: developer-friendly database schema migration registration (#9561)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9561
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Lucas <sclu1034@noreply.codeberg.org>
2025-10-15 10:54:20 +02:00
Mathieu Fenniak
1c7e189dd0 chore(e2e): address another flakey failure in webauthn.test.e2e.ts (#9688)
Had another random failure in `webauthn.test.e2e.ts`:

```
Retry #1 ───────────────────────────────────────────────────────────────────────────────────────
TimeoutError: locator.click: Timeout 3000ms exceeded.
Call log:
  - waiting for getByText('Sign out')
    - waiting for" http://localhost:3003/user/settings/security" navigation to finish...
    - navigated to "http://localhost:3003/user/settings/security"
    - locator resolved to <a href="" tabindex="-1" role="menuitem" id="_aria_auto_id_10" data-url="/user/logout" class="item link-action">…</a>
  - attempting click action
    2 × waiting for element to be visible, enabled and stable
      - element is not visible
    - retrying click action
    - waiting 20ms
    2 × waiting for element to be visible, enabled and stable
      - element is not visible
    - retrying click action
      - waiting 100ms
    6 × waiting for element to be visible, enabled and stable
      - element is not visible
    - retrying click action
      - waiting 500ms
  41 |   // Logout.
  42 |   await page.locator('div[aria-label="Profile and settings…"]').click();
> 43 |   await page.getByText('Sign out').click();
      |                                    ^
  44 |   await expect(async () => {
  45 |     await page.waitForURL(`${workerInfo.project.use.baseURL}/`);
  46 |   }).toPass();
    at /workspace/forgejo/forgejo/tests/e2e/webauthn.test.e2e.ts:43:36
```

While attempting to click `Sign out`, playwright waited for page navigation to `http://localhost:3003/user/settings/security` to complete, and then the `Sign out` button never became visible.  This suggests to me that the test:
- Clicked `Add security key`
- There was a race between the browser, which began reloading `/user/settings/security`...
- And the test clicked on `Profile and settings…` immediately *before* the new page loaded, since that was visible and available on the old page
- Therefore `Sign out` never appeared on the new page to be clicked

This PR addresses the race by ensuring that after the security key is added, the page with the security key added is visible (specifically the Remove button).  This should prevent the click on "Profile and settings" and "Sign out" from potentially occurring on different pages (as would happen if the reload occurred between the two clicks).

I have not been able to reproduce this exact failure locally, but I have tricked my e2e testing situation into reproducing other errors in this test by introducing a synthetic 100ms wait on every web request in the gitea server.  After adding this fix, the test does not fail in that scenario. (🤷  Probably good, but no guarantee that we're not going to see another issue.)

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9688
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-15 09:50:53 +02:00
Ryan Lerch
626ff29545 feat: Add support for administrators to set email visibility on user accounts (#9668)
feat: Add support for administrators to set email visibility on user accounts
This feature allows administrators to control user email privacy settings
through both the API and web interface.

**note: This was originally part of #9594 but is now split out into it's own PR**

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9668): <!--number 9668 --><!--line 0 --><!--description QWRkIHN1cHBvcnQgZm9yIGFkbWluaXN0cmF0b3JzIHRvIHNldCBlbWFpbCB2aXNpYmlsaXR5IG9uIHVzZXIgYWNjb3VudHM=-->Add support for administrators to set email visibility on user accounts<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9668
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Ryan Lerch <rlerch@redhat.com>
Co-committed-by: Ryan Lerch <rlerch@redhat.com>
2025-10-15 03:21:15 +02:00
Mathieu Fenniak
a0be0f22fc
chore: rename 'migrations' to 'gitea_migrations' 2025-10-14 14:40:49 -06:00
Mathieu Fenniak
82ad5189fe feat: add foreign keys to the access table (#9557)
Adds two foreign keys:
- `access.user_id` -> `user`
- `access.repo_id` -> `repository`

Testing:
- Existing automated test suite
    - Minor adjustments required to `reverseproxy_test.go`
    - Test failures caused a reorganization of delete operations in `DeleteRepositoryDirectly`
- Manually tested
    - On "user" and "repo" Collaborator page, added, removed, and changed the access-level of collaborators

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9557): <!--number 9557 --><!--line 0 --><!--description YWRkIGZvcmVpZ24ga2V5cyB0byB0aGUgYGFjY2Vzc2AgdGFibGU=-->add foreign keys to the `access` table<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9557
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-14 05:39:47 +02:00
Mathieu Fenniak
906e2e7c4a fix: false error logging "Render JSON failed" from workflow dispatch via API (#9675)
When making a `POST` to start a workflow dispatch, and not specifying the option `"return_run_info": true`, the API handler attempts to render a `nil` as a JSON body to a `204 No Content` response.  This results in an error being logged to the console, as this status code does not permit a body.
```
Render JSON failed: http: request method or response status code does not allow body
```

There is no functional impact except for a false error log, as `ctx.JSON` just logs a `Render JSON failed` error if it fails.

I could not find any existing code which allows integration tests to intercept or inspect log output, which would be required for an automated test verifying this is fixed.  If anyone could advise an existing test that performs log interception, or any hints on how such a mechanism would be created, I don't mind adding it... but it may not be warranted for such a tiny bug either.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [x] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9675
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-14 02:10:46 +02:00
Gusted
8eb8f49581 feat: move more modals to native dialogs (#9636)
Follow up of forgejo/forgejo#8859

Move the following modals to native dialogs:
- Admin notice.
- Edit label.
- New label.
- Update email in admin's email list.

Each has a E2E test to screenshot the modal and test functionality.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9636
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-13 17:48:49 +02:00
Gusted
d0a6f93f9e fix: avoid jumping to begin of page on edit comment action (#9645)
When you edit a comment and the comment already has a markdown editor,
then the code will click on the 'Write' tab, in case you canceled
editting the comment when you were at the 'Preview' tab. In
forgejo/forgejo#2681 I added `href="#"` to the tab items, this causes
that when the 'Write' tab is being clicked by the code the page is
jumped the beginning of the page.

Instead of being clever and trying to make this item interactive via
another way or via javascript avoid this jumping, we do better and make
this element a button. This item is not a link, it's a button that will
perform a action. This entirely avoids the issue of jumping and it's
still interactive.

Resolves forgejo/forgejo#9542

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9645
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2025-10-13 17:46:35 +02:00
Mathieu Fenniak
92684b6208 chore(e2e): test flakiness in issue-comment-dropzone.test.e2e.ts (#9660)
Flaky e2e test failure:
```
  1) [Mobile Chrome] › tests/e2e/issue-comment-dropzone.test.e2e.ts:74:1 › Re-add images to dropzone on edit
    Error: expect(locator).toHaveCount(expected) failed
    Locator:  locator('.dropzone').locator('.dz-preview')
    Expected: 1
    Received: 0
    Timeout:  3000ms
    Call log:
      - Expect "toHaveCount" with timeout 3000ms
      - waiting for locator('.dropzone').locator('.dz-preview')
        7 × locator resolved to 0 elements
          - unexpected value "0"
      87 |   await expect(dropzone.locator('.files').first()).toHaveCount(1);
      88 |   const preview = dropzone.locator('.dz-preview');
    > 89 |   await expect(preview).toHaveCount(1);
         |                         ^
      90 |   await expect(preview.locator('.dz-filename')).toHaveText('foo.png');
      91 |   await expect(preview.locator('.octicon-copy')).toBeVisible();
      92 |   await assertCopy(page, workerInfo, '![foo](');
        at /workspace/forgejo/forgejo/tests/e2e/issue-comment-dropzone.test.e2e.ts:89:25
```

Observed on chromium and Mobile Chrome.

I haven't been able to reproduce this test failure in local testing, but in examining the playwright test artifacts I noted that the browser is getting a `404 Not Found` error attempting to load a URL `(test server url)/uploading...` (where `...` is literally present in the URL).  My theory is that the test is firing the paste event in `pasteImage` and not waiting for the XMLHttpRequest to complete the upload, and then saving the issue comment with the placeholder URL `uploading...` in the Markdown, causing a later failure.  This patch adds two `waitForResponse` calls -- one when pasting the image to wait for the upload to complete, and one which is probably redundant which waits for the `/attachments` GET while editing the comment.

If this test continues to be flaky, it may at least have a different error revealing more about its cause.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9660
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-13 08:43:29 +02:00
Mathieu Fenniak
a80f8f9d01 chore(e2e): test flakiness in webauthn.test.e2e.ts (#9662)
Test failure:
```
  1) [chromium] › tests/e2e/webauthn.test.e2e.ts:14:1 › WebAuthn register & login flow ─────────────
    Error: page.goto: Navigation to "http://localhost:3003/user/login" is interrupted by another navigation to "http://localhost:3003/"
    Call log:
      - navigating to "http://localhost:3003/user/login", waiting until "load"
      46 |
      47 |   // Login.
    > 48 |   response = await page.goto('/user/login');
         |                         ^
      49 |   expect(response?.status()).toBe(200);
      50 |
      51 |   await page.getByLabel('Username or email address').fill(username);
        at /workspace/forgejo/forgejo/tests/e2e/webauthn.test.e2e.ts:48:25
```

I have not been able to reproduce this locally.

What seems to be happening is that the current code is clicking the "Sign out" menu option, and then while the browser is busy (navigating to `/logout`, redirecting to `/`), the test attempts to navigate directly to `/user/login`.  The two navigations are racey, depending on how fast they work they may result in this error.  The proposed fix is to wait for the sign-out operation to complete by waiting for the URL to land on `/`, before then proceeding with the rest of the test with the second login.

Normally this would be *just* a `waitForURL` call.  But because of the redirect on logout, I've encountered the below error if the code is just invoking `waitForURL`.  So I put the `waitForURL` invocation into an `expect(...).toPass()`.  This isn't technically the correct usage of `toPass` which is intended for *assertions* which will eventually become successful, whereas this is attempting to retry a wait... but... a wait shouldn't need a retry.  (I'd argue this is a Playwright bug.)
```
Error: page.waitForURL: net::ERR_ABORTED; maybe frame was detached?
```

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9662
Reviewed-by: Otto <otto@codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2025-10-13 01:01:42 +02:00