jojo/routers/api
abdo e16dc2ebfd fix: apply signed-merge checks by merge style (#11403)
Fixes #6438

When a protected branch requires signed commits and no signing key is available, fast-forward-only merges should still be allowed because they do not create a new commit.

This patch applies signing checks by merge behaviour/style instead of one global gate:

- pass `mergeStyle` through `CheckPullMergeable(...)` in web/API/automerge paths
- require signing for commit-creating styles (`merge`, `rebase`, `rebase-merge`, `squash`)
- bypass signing precheck only for `fast-forward-only`
- align merge UI options with backend behaviour so signing-dependent styles are unavailable when signing cannot happen
- add Go unit tests for merge-style signing requirements
- add frontend unit coverage for the no-allowed-merge-styles guard

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11403
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: abdo <dev@abdo.wtf>
Co-committed-by: abdo <dev@abdo.wtf>
2026-04-09 20:26:27 +02:00
..
actions fix: prevent actions workflows from generating OIDC tokens if not authorized in workflow (#12030) 2026-04-08 15:42:39 +02:00
forgejo/v1 fix: /api/forgejo/v1/version Content-Type error (#9897) 2025-11-05 17:35:50 +01:00
packages Revert "fix: add challenge for HTTP Basic Authentication to container registry" (#12058) 2026-04-09 12:21:44 +02:00
shared feat: remove admin-level permissions from repo-specific & public-only access tokens (#11468) 2026-03-04 16:17:41 +01:00
v1 fix: apply signed-merge checks by merge style (#11403) 2026-04-09 20:26:27 +02:00