jojo/routers/api
Mathieu Fenniak 3d6acf5e8c ci: add semgrep detection for API code ignoring repo-specific access tokens (#11476)
This PR is part of a series (#11311).

Prevents the usage of three internal APIs in the web API code:
- `repo_model.SearchRepoOptions{}` without an `AuthorizationReducer`
- `organization.SearchTeamRepoOptions{}` without an `AuthorizationReducer`
- `access_model.GetUserRepoPermission()`, which doesn't take an `AuthorizationReducer` -- use `GetUserRepoPermissionWithReducer` instead.

A couple lingering usages are marked with `// nosemgrep: ...` as they have been inspected and considered correct as-is.

The `GetUserRepoPermission` is tested via the `.semgrep/tests` files; the other rules have been tested manually.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11476
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-03 17:55:35 +01:00
..
actions Revert "fix: ensure actions logs are transferred when a task is done (#10008)" (#11462) 2026-03-02 15:34:09 +01:00
forgejo/v1 fix: /api/forgejo/v1/version Content-Type error (#9897) 2025-11-05 17:35:50 +01:00
packages ci: add semgrep detection for API code ignoring repo-specific access tokens (#11476) 2026-03-03 17:55:35 +01:00
shared feat: add APIContext.Reducer computed from access token 2026-02-27 17:17:29 +01:00
v1 ci: add semgrep detection for API code ignoring repo-specific access tokens (#11476) 2026-03-03 17:55:35 +01:00