feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433 )

### Summary Closes #37308 Adds native rendering support for Jupyter notebook files (`.ipynb`) in Gitea using backend rendering, allowing users to view formatted notebooks with code cells, markdown, outputs, and visualizations directly in the repository browser. ### Motivation Jupyter notebooks are widely used in data science, machine learning, and scientific computing. Currently, Gitea displays `.ipynb` files as raw JSON, making them difficult to read. This feature enables users to view notebooks in a formatted, readable way similar to GitHub and GitLab. ### Implementation Approach **Evolution:** Initially implemented frontend rendering using `marked` and `Shiki` libraries. After review feedback, migrated to backend rendering for better performance, security, and consistency with Gitea architecture. #### Backend Rendering Advantages - Server-side HTML generation eliminates client-side parsing overhead - Integrates with Gitea existing markup sanitizer for security - Uses Chroma for syntax highlighting (consistent with code files) - Uses Goldmark for markdown rendering (consistent with `.md` files) - No additional frontend dependencies required - Better performance for large notebooks ### Features #### Supported Cell Types - **Markdown cells:** Rendered with Goldmark (tables, lists, links, code blocks, etc.) - **Code cells:** Syntax-highlighted with Chroma, execution counts, language detection from notebook metadata - **Output cells:** Multiple output types in a single cell #### Supported Output Types - ✅ Text/plain outputs - ✅ Images (PNG, JPEG, SVG) with base64 data URIs - ✅ HTML outputs (tables, DataFrames, formatted text) - ✅ LaTeX/math equations (rendered as code blocks) - ✅ Error outputs with traceback (styled in red) - ✅ Stream outputs (`stdout`/`stderr`) - ⚠️ Interactive widgets (Plotly, ipywidgets) show informative messages - ⚠️ JavaScript outputs show security warning (disabled for safety) #### Edge Cases Handled - Empty notebooks or notebooks with no outputs - Corrupted JSON with graceful error display - Mixed output types in single cell - Large base64-encoded images - Execution count of `null` or `0` - `nbformat` version compatibility (only renders `nbformat 4+`, shows message for older versions) ### Changes #### Backend (Go) - `modules/markup/jupyter/jupyter.go` (**NEW**) - Jupyter notebook renderer implementation - Parses `.ipynb` JSON structure and generates HTML - Integrates Chroma for code syntax highlighting - Integrates Goldmark for markdown cell rendering - Dynamic language detection from notebook metadata - Handles all standard Jupyter output types - Comprehensive error handling with user-friendly messages - `modules/markup/renderer.go` (**MODIFIED**) - Registered Jupyter renderer in markup system - `main.go` (**MODIFIED**) - Import Jupyter renderer package for initialization #### Styling (CSS) - `web_src/css/markup/jupyter.css` (**NEW**) - Comprehensive styling for notebook cells, code, outputs - Uses Gitea CSS variables for consistent theming - Responsive layout with proper spacing - Table styling for DataFrame outputs - Removed parent container padding for consistency with other renderers #### Sanitizer Rules - `modules/markup/jupyter/jupyter.go` → `SanitizerRules()` - Configured HTML sanitization rules for safe rendering: - Cell structure (markdown, code, input/output wrappers) - Code highlighting (Chroma classes) - Images (base64 data URIs only) - Tables (DataFrames) - Markdown elements (headers, lists, links, etc.) ### Security Considerations - Server-side rendering: No client-side JavaScript execution - HTML sanitization: Strict allowlist for HTML elements and attributes - Image security: Only base64 data URIs allowed (no external URLs) - JavaScript disabled: `application/javascript` outputs show warning - XSS protection: Gitea markup sanitizer handles all HTML output ### Testing Manual testing performed with various notebooks: - Markdown rendering (headers, lists, tables, links, code blocks) - Code cells with execution counts and syntax highlighting - Multiple output types (text, images, HTML, LaTeX, errors, streams) - Error handling for edge cases - Theme compatibility (light/dark mode) ### Screenshots <img width="1080" height="553" alt="image" src="https://github.com/user-attachments/assets/aef9afa7-ed96-434d-98b0-b160565fc967" /> <img width="1092" height="552" alt="image" src="https://github.com/user-attachments/assets/6e61e792-4737-41c1-851e-5c375c1f932a" /> <img width="1104" height="622" alt="image" src="https://github.com/user-attachments/assets/4ac630c1-3a75-4e1c-9bba-c0a27484d001" /> <img width="1104" height="529" alt="image" src="https://github.com/user-attachments/assets/33750c47-70de-4ab2-893d-e5d09fa8d9c4" /> <img width="1111" height="343" alt="image" src="https://github.com/user-attachments/assets/52107d9f-0e06-420b-9ab4-1603dcd676b1" /> <img width="1091" height="650" alt="image" src="https://github.com/user-attachments/assets/0addae21-efa4-44bb-a56e-0418e3d4d227" /> <img width="1077" height="298" alt="image" src="https://github.com/user-attachments/assets/a3a8c5be-638c-45ff-82f3-816264254ead" /> ### Dependencies No new dependencies required: - Chroma (existing) - Syntax highlighting - Goldmark (existing) - Markdown rendering - Standard library - JSON parsing ### Key Design Decisions - Backend rendering for performance and security - Reuses existing Gitea infrastructure (Chroma, Goldmark, sanitizer) - Consistent styling with other markup renderers - Graceful degradation for unsupported features --- **Development Note:** This PR was developed with assistance from Amazon Q Developer and Claude AI for implementation, debugging, and testing. --------- Signed-off-by: Karthik Bhandary <34509856+karthikbhandary2@users.noreply.github.com> Co-authored-by: karthik.bhandary <karthik.bhandary@kfintech.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com>
fix(ui): prevent commit status popup overflowing its row (#38081 )
2026-06-14 14:37:04 +00:00 · 2026-06-14 15:52:37 +02:00 · 2026-06-13 10:14:02 +00:00 · 2026-06-13 11:56:17 +02:00 · 2026-06-13 04:43:25 +00:00 · 2026-06-13 12:02:02 +08:00
3398 changed files with 100725 additions and 39753 deletions
@@ -37,10 +37,7 @@ groups:
    name: BUGFIXES
    labels:
      - type/bug
-  -
-    name: API
-    labels:
-      - modifies/api
+
  -
    name: TESTING
    labels:
@@ -1,6 +1,6 @@
 {
  "name": "Gitea DevContainer",
-  "image": "mcr.microsoft.com/devcontainers/go:1.25-trixie",
+  "image": "mcr.microsoft.com/devcontainers/go:1.26-trixie",
  "containerEnv": {
    // override "local" from packaged version
    "GOTOOLCHAIN": "auto"
@@ -40,9 +40,7 @@ cpu.out
 *.log

 /gitea
-/gitea-vet
 /debug
-/integrations.test

 /bin
 /dist
@@ -54,12 +52,6 @@ cpu.out
 /indexers
 /log
 /tests/integration/gitea-integration-*
-/tests/integration/indexers-*
-/tests/e2e/gitea-e2e-*
-/tests/e2e/indexers-*
-/tests/e2e/reports
-/tests/e2e/test-artifacts
-/tests/e2e/test-snapshots
 /tests/*.ini
 /node_modules
 /yarn.lock
@@ -18,7 +18,7 @@ indent_style = tab
 [templates/custom/*.tmpl]
 insert_final_newline = false

-[templates/swagger/v1_json.tmpl]
+[templates/swagger/*_json.tmpl]
 indent_style = space
 insert_final_newline = false

@@ -4,6 +4,7 @@
 /assets/*.json linguist-generated
 /public/assets/img/svg/*.svg linguist-generated
 /templates/swagger/v1_json.tmpl linguist-generated
+/templates/swagger/v1_openapi3_json.tmpl linguist-generated
 /options/fileicon/** linguist-generated
 /vendor/** -text -eol linguist-vendored
 /web_src/js/vendor/** -text -eol linguist-vendored
@@ -1,42 +0,0 @@
-<!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue -->
-
-<!--
-    1. Please speak English, this is the language all maintainers can speak and write.
-    2. Please ask questions or configuration/deploy problems on our Discord
-       server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-    3. Please take a moment to check that your issue doesn't already exist.
-    4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
-    5. Please give all relevant information below for bug reports, because
-       incomplete details will be handled as an invalid report.
-->
-
- Gitea version (or commit ref):
- Git version:
- Operating system:
-  <!-- Please include information on whether you built gitea yourself, used one of our downloads or are using some other package -->
-  <!-- Please also tell us how you are running gitea, e.g. if it is being run from docker, a command-line, systemd etc. --->
-  <!-- If you are using a package or systemd tell us what distribution you are using -->
- Database (use `[x]`):
-  - [ ] PostgreSQL
-  - [ ] MySQL
-  - [ ] MSSQL
-  - [ ] SQLite
- Can you reproduce the bug at https://demo.gitea.com:
-  - [ ] Yes (provide example URL)
-  - [ ] No
- Log gist:
-<!-- It really is important to provide pertinent logs -->
-<!-- Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help -->
-<!-- In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini -->
-
-## Description
-<!-- If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please
-     disable the proxy/CDN fully and connect to gitea directly to confirm
-     the issue still persists without those services. -->
-
-...
-
-
-## Screenshots
-
-<!-- **If this issue involves the Web Interface, please include a screenshot** -->
@@ -1,91 +1,28 @@
 name: Bug Report
-description: Found something you weren't expecting? Report it here!
+description: Something isn't working as expected.
 labels: ["type/bug"]
 body:
  - type: markdown
    attributes:
      value: |
-        NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.
-  - type: markdown
-    attributes:
-      value: |
-        1. Please speak English, this is the language all maintainers can speak and write.
-        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-        3. Make sure you are using the latest release and
-           take a moment to check that your issue hasn't been reported before.
-        4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
-        5. It's really important to provide pertinent details and logs (https://docs.gitea.com/help/support),
-           incomplete details will be handled as an invalid report.
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: |
-        Please provide a description of your issue here, with a URL if you were able to reproduce the issue (see below)
-        If you are using a proxy or a CDN (e.g. Cloudflare) in front of Gitea, please disable the proxy/CDN fully and access Gitea directly to confirm the issue still persists without those services.
+        - **Security issue?** Email security@gitea.io instead of opening a public issue.
+        - **Need help** with setup or configuration? Ask on [Discord](https://discord.gg/Gitea) or the [forum](https://forum.gitea.com).
+        - Search [existing issues](https://github.com/go-gitea/gitea/issues?q=is%3Aissue) first.
  - type: input
    id: gitea-ver
    attributes:
      label: Gitea Version
-      description: Gitea version (or commit reference) of your instance
    validations:
      required: true
-  - type: dropdown
-    id: can-reproduce
+  - type: textarea
+    id: description
    attributes:
-      label: Can you reproduce the bug on the Gitea demo site?
-      description: |
-        If so, please provide a URL in the Description field
-        URL of Gitea demo: https://demo.gitea.com
-      options:
-        - "Yes"
-        - "No"
+      label: What happened?
+      description: What you did, what you expected to happen, and what happened instead. Include logs if relevant.
    validations:
      required: true
-  - type: markdown
-    attributes:
-      value: |
-        It's really important to provide pertinent logs
-        Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help
-        In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini
-  - type: input
-    id: logs
-    attributes:
-      label: Log Gist
-      description: Please provide a gist URL of your logs, with any sensitive information (e.g. API keys) removed/hidden
  - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: If this issue involves the Web Interface, please provide one or more screenshots
-  - type: input
-    id: git-ver
-    attributes:
-      label: Git Version
-      description: The version of git running on the server
-  - type: input
-    id: os-ver
-    attributes:
-      label: Operating System
-      description: The operating system you are using to run Gitea
-  - type: textarea
-    id: run-info
+    id: environment
    attributes:
      label: How are you running Gitea?
-      description: |
-        Please include information on whether you built Gitea yourself, used one of our downloads, are using https://demo.gitea.com or are using some other package
-        Please also tell us how you are running Gitea, e.g. if it is being run from docker, a command-line, systemd etc.
-        If you are using a package or systemd tell us what distribution you are using
-    validations:
-      required: true
-  - type: dropdown
-    id: database
-    attributes:
-      label: Database
-      description: What database system are you running?
-      options:
-        - PostgreSQL
-        - MySQL/MariaDB
-        - MSSQL
-        - SQLite
+      description: Install method (binary, Docker, package), operating system, and database.
@@ -1,24 +1,20 @@
 name: Feature Request
-description: Got an idea for a feature that Gitea doesn't have currently?  Submit your idea here!
+description: Suggest an idea for Gitea.
 labels: ["type/proposal"]
 body:
  - type: markdown
    attributes:
      value: |
-        1. Please speak English, this is the language all maintainers can speak and write.
-        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-        3. Please take a moment to check that your feature hasn't already been suggested.
+        Search [existing issues](https://github.com/go-gitea/gitea/issues?q=is%3Aissue) first.
  - type: textarea
-    id: description
+    id: problem
    attributes:
-      label: Feature Description
-      placeholder: |
-        I think it would be great if Gitea had...
+      label: What problem would this solve?
    validations:
      required: true
  - type: textarea
-    id: screenshots
+    id: proposal
    attributes:
-      label: Screenshots
-      description: If you can, provide screenshots of an implementation on another site e.g. GitHub
+      label: What do you propose?
+    validations:
+      required: true
@@ -1,66 +0,0 @@
-name: Web Interface Bug Report
-description: Something doesn't look quite as it should?  Report it here!
-labels: ["type/bug", "topic/ui"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.
-  - type: markdown
-    attributes:
-      value: |
-        1. Please speak English, this is the language all maintainers can speak and write.
-        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-        3. Please take a moment to check that your issue doesn't already exist.
-        4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
-        5. Please give all relevant information below for bug reports, because
-           incomplete details will be handled as an invalid report.
-        6. In particular it's really important to provide pertinent logs. If you are certain that this is a javascript
-           error, show us the javascript console. If the error appears to relate to Gitea the server you must also give us
-           DEBUG level logs. (See https://docs.gitea.com/administration/logging-config#collecting-logs-for-help)
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: |
-        Please provide a description of your issue here, with a URL if you were able to reproduce the issue (see below)
-        If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please disable the proxy/CDN fully and connect to gitea directly to confirm the issue still persists without those services.
-  - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: Please provide at least 1 screenshot showing the issue.
-    validations:
-      required: true
-  - type: input
-    id: gitea-ver
-    attributes:
-      label: Gitea Version
-      description: Gitea version (or commit reference) your instance is running
-    validations:
-      required: true
-  - type: dropdown
-    id: can-reproduce
-    attributes:
-      label: Can you reproduce the bug on the Gitea demo site?
-      description: |
-        If so, please provide a URL in the Description field
-        URL of Gitea demo: https://demo.gitea.com
-      options:
-        - "Yes"
-        - "No"
-    validations:
-      required: true
-  - type: input
-    id: os-ver
-    attributes:
-      label: Operating System
-      description: The operating system you are using to access Gitea
-  - type: input
-    id: browser-ver
-    attributes:
-      label: Browser Version
-      description: The browser and version that you are using to access Gitea
-    validations:
-      required: true
@@ -0,0 +1,29 @@
+name: docker-dryrun
+description: Composite action that performs the container build steps for a single platform.
+
+inputs:
+  platform:
+    description: "The target platform: linux/amd64, linux/arm64, linux/riscv64."
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+    - name: Build regular image
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      with:
+        context: .
+        platforms: ${{ inputs.platform }}
+        push: false
+        file: Dockerfile
+        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
+    - name: Build rootless image
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      with:
+        context: .
+        platforms: ${{ inputs.platform }}
+        push: false
+        file: Dockerfile.rootless
+        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
@@ -0,0 +1,17 @@
+name: free-disk-space
+description: Free space on / before large cache restores
+
+# Delete preinstalled toolchains which gitea doesn't use and show disk space usage
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        echo "free space before cleanup:"
+        df -h /
+        for dir in /usr/local/lib/android /usr/local/.ghcup /opt/ghc /usr/share/dotnet; do
+          sudo rm -rf "$dir" &
+        done
+        wait
+        echo "free space after cleanup:"
+        df -h /
@@ -0,0 +1,50 @@
+name: go-caches
+description: Restore the go module, build, and golangci-lint caches. Save only on the cache-seeder workflow.
+
+# Only the cache-seeder workflow saves; rename requires updating cache-seeder.yml.
+# The lint job restores but does not save the gobuild cache, so only one writer
+# (the gobuild job) populates it and there is no contention on the cache key.
+# Seeder restores by exact key only (no restore-keys) so each go.sum seeds a clean
+# cache and size stays bounded; do not add restore-keys here. PR runs keep them.
+
+inputs:
+  lint-cache:
+    description: Restore (and save in cache-seeder) ~/.cache/golangci-lint
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - if: ${{ github.workflow == 'cache-seeder' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/go/pkg/mod
+        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+    - if: ${{ github.workflow != 'cache-seeder' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/go/pkg/mod
+        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
+    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.cache/go-build
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.cache/go-build
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
+    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.cache/golangci-lint
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.cache/golangci-lint
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}
@@ -0,0 +1,24 @@
+name: go-setup
+description: Set up go and restore caches
+
+inputs:
+  cache:
+    description: Restore go caches
+    default: "true"
+  lint-cache:
+    description: Also restore the golangci-lint cache
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/free-disk-space
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      with:
+        go-version-file: go.mod
+        check-latest: true
+        cache: false
+    - if: ${{ inputs.cache == 'true' }}
+      uses: ./.github/actions/go-cache
+      with:
+        lint-cache: ${{ inputs.lint-cache }}
@@ -0,0 +1,22 @@
+name: node-setup
+description: Set up pnpm and node and restore caches
+
+inputs:
+  cache:
+    description: Cache pnpm downloads
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+    - if: ${{ inputs.cache == 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
+        cache: pnpm
+        cache-dependency-path: pnpm-lock.yaml
+    - if: ${{ inputs.cache != 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
@@ -0,0 +1,40 @@
+name: pgsql-shard
+description: Run one pgsql integration test shard
+
+inputs:
+  shard:
+    description: Shard index
+    required: true
+  total-shards:
+    description: Total shard count
+    required: true
+  run-migration:
+    description: Also run migration tests
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Add hosts to /etc/hosts
+      shell: bash
+      run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
+    - shell: bash
+      run: make deps-backend
+    - shell: bash
+      run: make backend
+      env:
+        TAGS: bindata
+    - name: run migration tests
+      if: ${{ inputs.run-migration == 'true' }}
+      shell: bash
+      run: GITEA_TEST_DATABASE=pgsql make test-migration
+    - name: run tests
+      shell: bash
+      run: GITEA_TEST_DATABASE=pgsql make test-integration
+      env:
+        # pgsql is chosen to be the unlucky one to run with the slow "race detector", it is about 60% slower.
+        GOTEST_FLAGS: -race -timeout=40m
+        TAGS: bindata gogit
+        TEST_LDAP: 1
+        TEST_SHARD: ${{ inputs.shard }}
+        TEST_TOTAL_SHARDS: ${{ inputs.total-shards }}
@@ -1,10 +0,0 @@
-version: 2
-
-updates:
-  - package-ecosystem: github-actions
-    labels: [modifies/dependencies]
-    directory: /
-    schedule:
-      interval: daily
-    cooldown:
-      default-days: 5
@@ -1,80 +1,3 @@
-modifies/docs:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.md"
-          - "docs/**"
-
-modifies/templates:
-  - changed-files:
-      - all-globs-to-any-file:
-          - "templates/**"
-          - "!templates/swagger/v1_json.tmpl"
-
-modifies/api:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "routers/api/**"
-          - "templates/swagger/v1_json.tmpl"
-
-modifies/cli:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "cmd/**"
-
-modifies/translation:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "options/locale/*.ini"
-
-modifies/migrations:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "models/migrations/**"
-
-modifies/internal:
-  - changed-files:
-      - any-glob-to-any-file:
-          - ".air.toml"
-          - "Makefile"
-          - "Dockerfile"
-          - "Dockerfile.rootless"
-          - ".dockerignore"
-          - "docker/**"
-          - ".editorconfig"
-          - ".eslintrc.cjs"
-          - ".golangci.yml"
-          - ".markdownlint.yaml"
-          - ".spectral.yaml"
-          - "stylelint.config.*"
-          - ".yamllint.yaml"
-          - ".github/**"
-          - ".gitea/**"
-          - ".devcontainer/**"
-          - "build/**"
-          - "contrib/**"
-
-modifies/dependencies:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "package.json"
-          - "pnpm-lock.yaml"
-          - "pyproject.toml"
-          - "uv.lock"
-          - "go.mod"
-          - "go.sum"
-
-modifies/go:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.go"
-
-modifies/frontend:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "*.js"
-          - "*.ts"
-          - "web_src/**"
-
 docs-update-needed:
  - changed-files:
      - any-glob-to-any-file:
@@ -1,10 +1,9 @@
-<!-- start tips -->
-Please check the following:
-1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for backports.
-2. Make sure you have read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md .
-3. For documentations contribution, please go to https://gitea.com/gitea/docs
-4. Describe what your pull request does and which issue you're targeting (if any).
-5. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
-6. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
-7. Delete all these tips before posting.
-<!-- end tips -->
+<!--
+Before submitting:
+- Target the `main` branch; release branches are for backports only.
+- Use a Conventional Commits title, e.g. `fix(repo): handle empty branch names`.
+- Read the contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md
+- Documentation changes go to https://gitea.com/gitea/docs
+
+Describe your change below and link any issue it fixes.
+-->
@@ -0,0 +1,72 @@
+# Populates main's cache scope so PR runs warm-start from it. Saves the go
+# module, go build (incl. test compile), and golangci-lint caches.
+#
+# Caches are ref-scoped: PR runs read their own scope then fall back to the
+# base branch. Per .github/actions/go-cache/action.yml, PRs are restore-only,
+# so push-to-main is the only opportunity to populate the fallback scope.
+
+name: cache-seeder
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "go.sum"
+      - ".golangci.yml"
+      - ".github/actions/go-cache/action.yml"
+      - ".github/actions/go-setup/action.yml"
+      - ".github/workflows/cache-seeder.yml"
+
+concurrency:
+  group: cache-seeder
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  gobuild:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
+      - run: make deps-backend deps-tools
+      - run: TAGS="bindata" make backend
+      - run: TAGS="bindata gogit" GOEXPERIMENT="" make backend
+      - name: warm test compile cache (bindata)
+        env:
+          TAGS: bindata
+          GOTEST_FLAGS: -race -list=^$$ -count=1
+        run: make test-backend
+      - name: warm test compile cache (bindata gogit)
+        env:
+          TAGS: bindata gogit
+          GOEXPERIMENT:
+          GOTEST_FLAGS: -race -list=^$$ -count=1
+        run: make test-backend
+      - name: warm integration compile cache
+        run: |
+          TAGS="bindata" make test-integration-compile
+          TAGS="bindata gogit" GOEXPERIMENT="" make test-integration-compile
+          TAGS="bindata gogit" GOTEST_FLAGS="-race" make test-integration-compile
+
+  lint:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { tags: "bindata", target: "lint-backend" }
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
+        with:
+          lint-cache: "true"
+      - run: make deps-backend deps-tools
+      - run: make generate-go
+        env:
+          TAGS: ${{ matrix.tags }}
+      - run: make ${{ matrix.target }}
+        env:
+          TAGS: ${{ matrix.tags }}
@@ -1,22 +0,0 @@
-name: cron-flake-updater
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
-
-jobs:
-  nix-flake-update:
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: DeterminateSystems/determinate-nix-action@v3
-      - uses: DeterminateSystems/update-flake-lock@main
-        with:
-          pr-title: "Update Nix flake"
-          pr-labels: |
-            dependencies
@@ -12,15 +12,15 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
      - run: make generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@3b2c8661652360dbf1afe1b319a49dbb739c39f1 # v1.2.0
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -0,0 +1,32 @@
+name: cron-renovate
+
+on:
+  schedule:
+    - cron: "23 * * * *" # hourly at :23
+  workflow_dispatch:
+
+concurrency:
+  group: cron-renovate
+
+env:
+  RENOVATE_VERSION: 43.141.5 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
+
+permissions:
+  contents: read
+
+jobs:
+  cron-renovate:
+    runs-on: ubuntu-latest
+    if: github.repository == 'go-gitea/gitea' # prevent running on forks
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
+        with:
+          renovate-version: ${{ env.RENOVATE_VERSION }}
+          configurationFile: renovate.json5
+          token: ${{ secrets.RENOVATE_TOKEN }}
+        env:
+          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
+          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -12,8 +12,8 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v6
-      - uses: crowdin/github-action@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
        with:
          upload_sources: true
          upload_translations: false
@@ -29,7 +29,7 @@ jobs:
      - name: update locales
        run: ./build/update-locales.sh
      - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@3b2c8661652360dbf1afe1b319a49dbb739c39f1 # v1.2.0
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -15,19 +15,26 @@ on:
        value: ${{ jobs.detect.outputs.templates }}
      docker:
        value: ${{ jobs.detect.outputs.docker }}
+      dockerfile:
+        value: ${{ jobs.detect.outputs.dockerfile }}
      swagger:
        value: ${{ jobs.detect.outputs.swagger }}
      yaml:
        value: ${{ jobs.detect.outputs.yaml }}
      json:
        value: ${{ jobs.detect.outputs.json }}
+      e2e:
+        value: ${{ jobs.detect.outputs.e2e }}
+      shell:
+        value: ${{ jobs.detect.outputs.shell }}
+
+permissions:
+  contents: read

 jobs:
  detect:
    runs-on: ubuntu-latest
    timeout-minutes: 3
-    permissions:
-      contents: read
    outputs:
      backend: ${{ steps.changes.outputs.backend }}
      frontend: ${{ steps.changes.outputs.frontend }}
@@ -35,12 +42,15 @@ jobs:
      actions: ${{ steps.changes.outputs.actions }}
      templates: ${{ steps.changes.outputs.templates }}
      docker: ${{ steps.changes.outputs.docker }}
+      dockerfile: ${{ steps.changes.outputs.dockerfile }}
      swagger: ${{ steps.changes.outputs.swagger }}
      yaml: ${{ steps.changes.outputs.yaml }}
      json: ${{ steps.changes.outputs.json }}
+      e2e: ${{ steps.changes.outputs.e2e }}
+      shell: ${{ steps.changes.outputs.shell }}
    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
          filters: |
@@ -54,49 +64,61 @@ jobs:
              - ".golangci.yml"
              - ".editorconfig"
              - "options/locale/locale_en-US.json"
+              - "models/fixtures/**"
+              - "tests/*.ini.tmpl"
+              - "tests/gitea-repositories-meta/**"
+              - "tests/testdata/**"
+              - "tools/test-integration.sh"

            frontend:
-              - "*.js"
              - "*.ts"
              - "web_src/**"
-              - "tools/*.js"
-              - "tools/*.ts"
+              - "tools/generate-svg.ts"
+              - "tools/generate-svg-vscode-extensions.json"
+              - "tsconfig.json"
              - "assets/emoji.json"
              - "package.json"
              - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"
              - "Makefile"
-              - ".eslintrc.cjs"
-              - ".npmrc"

            docs:
              - "**/*.md"
              - ".markdownlint.yaml"
              - "package.json"
              - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"

            actions:
              - ".github/workflows/*"
+              - ".github/actions/**"
              - "Makefile"

            templates:
-              - "tools/lint-templates-*.js"
+              - "tools/lint-templates-*.ts"
              - "templates/**/*.tmpl"
              - "pyproject.toml"
              - "uv.lock"

            docker:
              - ".github/workflows/pull-docker-dryrun.yml"
+              - ".github/actions/docker-dryrun/**"
              - "Dockerfile"
              - "Dockerfile.rootless"
              - "docker/**"
              - "Makefile"

+            dockerfile:
+              - "Dockerfile"
+              - "Dockerfile.rootless"
+
            swagger:
              - "templates/swagger/v1_json.tmpl"
              - "templates/swagger/v1_input.json"
              - "Makefile"
              - "package.json"
              - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"
              - ".spectral.yaml"

            yaml:
@@ -107,3 +129,14 @@ jobs:

            json:
              - "**/*.json"
+              - "**/*.json5"
+              - "eslint.json.config.ts"
+
+            e2e:
+              - "tests/e2e/**"
+              - "tools/test-e2e.sh"
+              - "playwright.config.ts"
+
+            shell:
+              - "**/*.sh"
+              - ".shellcheckrc"
@@ -0,0 +1,26 @@
+name: giteabot backport
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  giteabot:
+    if: github.repository == 'go-gitea/gitea'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
+        with:
+          github_token: ${{ secrets.GITEABOT_TOKEN }}
+          gitea_fork: giteabot/gitea
+          checks: backport
@@ -0,0 +1,51 @@
+name: giteabot
+
+on:
+  # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
+  # forks, which the bot needs to write labels, statuses and comments. Safe here
+  # because the job only runs a pinned action and never checks out PR HEAD.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
+    types:
+      - opened
+      - synchronize
+      - labeled
+      - unlabeled
+      - closed
+      - review_requested
+      - review_request_removed
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+      - dismissed
+  schedule:
+    - cron: "15 3 * * *"
+  workflow_dispatch:
+    inputs:
+      checks:
+        description: Comma-separated list of non-backport checks to run
+        required: false
+        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  statuses: write
+
+concurrency:
+  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
+  cancel-in-progress: false
+
+jobs:
+  giteabot:
+    if: github.repository == 'go-gitea/gitea'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # pull_request_review runs without repository secrets on fork PRs, so fall
+      # back to the workflow token for the non-backport checks handled here.
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
+        with:
+          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
+          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
@@ -7,156 +7,63 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  lint-backend:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
        with:
-          go-version-file: go.mod
-          check-latest: true
+          lint-cache: "true"
      - run: make deps-backend deps-tools
+      - run: TAGS="bindata" make generate-go # lint-go also lints with "bindata" tags which requires "_bindata.go"
      - run: make lint-backend
-        env:
-          TAGS: bindata sqlite sqlite_unlock_notify

-  lint-templates:
-    if: needs.files-changed.outputs.templates == 'true'
+  lint-on-demand:
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.0.0
-      - run: uv python install 3.14
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - run: make deps-py
-      - run: make deps-frontend
-      - run: make lint-templates
-
-  lint-yaml:
-    if: needs.files-changed.outputs.yaml == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.0.0
-      - run: uv python install 3.14
-      - run: make deps-py
-      - run: make lint-yaml
-
-  lint-json:
-    if: needs.files-changed.outputs.json == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v5
+          cache: "false"
+      - uses: ./.github/actions/node-setup
        with:
-          node-version: 24
-      - run: make deps-frontend
-      - run: make lint-json
+          cache: "false"

-  lint-swagger:
-    if: needs.files-changed.outputs.swagger == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - run: make deps-frontend
-      - run: make lint-swagger
-
-  lint-spell:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.templates == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
      - run: make lint-spell

-  lint-go-windows:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
-          go-version-file: go.mod
-          check-latest: true
-      - run: make deps-backend deps-tools
-      - run: make lint-go-windows lint-go-gitea-vet
-        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
-          GOOS: windows
-          GOARCH: amd64
+          python-version: 3.14
+      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
+        run: make deps-py lint-templates lint-yaml

-  lint-go-gogit:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - run: make deps-backend deps-tools
-      - run: make lint-go
-        env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
+      - if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.swagger == 'true' || needs.files-changed.outputs.json == 'true'
+        run: make deps-frontend lint-md lint-swagger lint-json
+
+      - if: needs.files-changed.outputs.actions == 'true'
+        run: make lint-actions
+
+      - if: needs.files-changed.outputs.shell == 'true'
+        run: make lint-shell

  checks-backend:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: make --always-make checks-backend # ensure the "go-licenses" make target runs

@@ -164,16 +71,9 @@ jobs:
    if: needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
@@ -184,20 +84,14 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      # no frontend build here as backend should be able to build
-      # even without any frontend files
-      - run: make deps-backend
-      - run: go build -o gitea_no_gcc # test if build succeeds without the sqlite tag
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
+      - run: make deps-backend generate-go
+      # no frontend build here as backend should be able to build, even without any frontend files
+      # CGO is not used when cross-compile, so these steps also test if the code is compatible with CGO disabled
      - name: build-backend-arm64
-        run: make backend # test cross compile
+        run: go build -o gitea_linux_arm64
        env:
          GOOS: linux
          GOARCH: arm64
@@ -209,38 +103,7 @@ jobs:
          GOARCH: amd64
          TAGS: bindata gogit
      - name: build-backend-386
-        run: go build -o gitea_linux_386 # test if compatible with 32 bit
+        run: go build -o gitea_linux_386
        env:
          GOOS: linux
          GOARCH: 386
-
-  docs:
-    if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - run: make deps-frontend
-      - run: make lint-md
-
-  actions:
-    if: needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - run: make lint-actions
@@ -7,18 +7,18 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

-  test-pgsql:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+  test-pgsql-shard-1:
+    if: needs.files-changed.outputs.backend == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
+    timeout-minutes: 50
    services:
      pgsql:
        image: postgres:14
@@ -28,79 +28,100 @@ jobs:
        ports:
          - "5432:5432"
      ldap:
-        image: gitea/test-openldap:latest
+        image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
        ports:
          - "389:389"
          - "636:636"
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2023.8.31
+        image: bitnamilegacy/minio:2025.7.23
        env:
          MINIO_ROOT_USER: 123456
          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
+      - uses: ./.github/actions/pgsql-shard
        with:
-          go-version-file: go.mod
-          check-latest: true
-      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
-      - run: make deps-backend
-      - run: make backend
+          shard: 1
+          total-shards: 2
+          run-migration: "true"
+
+  test-pgsql-shard-2:
+    if: needs.files-changed.outputs.backend == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    timeout-minutes: 50
+    services:
+      pgsql:
+        image: postgres:14
        env:
-          TAGS: bindata
-      - name: run migration tests
-        run: make test-pgsql-migration
-      - name: run tests
-        run: make test-pgsql
-        timeout-minutes: 50
+          POSTGRES_DB: test
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - "5432:5432"
+      ldap:
+        image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
+        ports:
+          - "389:389"
+          - "636:636"
+      minio:
+        # as github actions doesn't support "entrypoint", we need to use a non-official image
+        # that has a custom entrypoint set to "minio server /data"
+        image: bitnamilegacy/minio:2025.7.23
        env:
-          TAGS: bindata gogit
-          RACE_ENABLED: true
-          TEST_TAGS: gogit
-          TEST_LDAP: 1
+          MINIO_ROOT_USER: 123456
+          MINIO_ROOT_PASSWORD: 12345678
+        ports:
+          - "9000:9000"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
+      - uses: ./.github/actions/pgsql-shard
+        with:
+          shard: 2
+          total-shards: 2

  test-sqlite:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
      - run: make deps-backend
-      - run: GOEXPERIMENT='' make backend
+      - run: make backend
        env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
-      - name: run migration tests
-        run: make test-sqlite-migration
+          TAGS: bindata gogit
+          GOEXPERIMENT:
+      - run: GITEA_TEST_DATABASE=sqlite make test-migration
+        env:
+          TAGS: bindata gogit
      - name: run tests
-        run: GOEXPERIMENT='' make test-sqlite
+        run: GITEA_TEST_DATABASE=sqlite make test-integration
        timeout-minutes: 50
        env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
-          RACE_ENABLED: true
-          TEST_TAGS: gogit sqlite sqlite_unlock_notify
+          # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
+          GOTEST_FLAGS: -timeout=40m
+          TAGS: bindata gogit
+          GOEXPERIMENT:

  test-unit:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: needs.files-changed.outputs.backend == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      elasticsearch:
-        image: elasticsearch:7.5.0
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
        env:
          discovery.type: single-node
+          xpack.security.enabled: false
+          xpack.ml.enabled: false
+          ingest.geoip.downloader.enabled: false
+          ES_JAVA_OPTS: "-Xms1g -Xmx1g"
        ports:
          - "9200:9200"
      meilisearch:
@@ -110,7 +131,7 @@ jobs:
        ports:
          - "7700:7700"
      redis:
-        image: redis
+        image: redis:latest@sha256:e74c9b933d78e2829583d88f92793f4524752a15ac59c8baff2dd5ed000b7432
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -119,51 +140,49 @@ jobs:
        ports:
          - 6379:6379
      minio:
-        image: bitnamilegacy/minio:2021.3.17
+        image: bitnamilegacy/minio:2025.7.23
        env:
-          MINIO_ACCESS_KEY: 123456
-          MINIO_SECRET_KEY: 12345678
+          MINIO_ROOT_USER: 123456
+          MINIO_ROOT_PASSWORD: 12345678
        ports:
          - "9000:9000"
      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
      - run: make deps-backend
-      - run: make backend
+      - run: make generate-go
        env:
          TAGS: bindata
      - name: unit-tests
-        run: make unit-test-coverage test-check
+        run: make test-backend
        env:
+          GOTEST_FLAGS: -race -timeout=20m
          TAGS: bindata
-          RACE_ENABLED: true
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
      - name: unit-tests-gogit
-        run: GOEXPERIMENT='' make unit-test-coverage test-check
+        run: make test-backend
        env:
+          GOTEST_FLAGS: -race -timeout=20m
          TAGS: bindata gogit
-          RACE_ENABLED: true
+          GOEXPERIMENT:
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
+          GITEA_TEST_CI_SKIP_EXTERNAL: true
+      - run: make test-check

  test-mysql:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: needs.files-changed.outputs.backend == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      mysql:
        # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnamilegacy/mysql:8.0
+        image: bitnamilegacy/mysql:8.4
        env:
          ALLOW_EMPTY_PASSWORD: true
          MYSQL_DATABASE: testgitea
@@ -172,46 +191,42 @@ jobs:
        options: >-
          --mount type=tmpfs,destination=/bitnami/mysql/data
      elasticsearch:
-        image: elasticsearch:7.5.0
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
        env:
          discovery.type: single-node
+          xpack.security.enabled: false
+          xpack.ml.enabled: false
+          ingest.geoip.downloader.enabled: false
+          ES_JAVA_OPTS: "-Xms1g -Xmx1g"
        ports:
          - "9200:9200"
      smtpimap:
-        image: tabascoterrier/docker-imap-devel:latest
+        image: tabascoterrier/docker-imap-devel:latest@sha256:3fb7cf50b47693e7b80f6f74abea2def4d7386016931d61359864de8a0aba551
        ports:
          - "25:25"
          - "143:143"
          - "587:587"
          - "993:993"
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
      - run: make deps-backend
      - run: make backend
        env:
          TAGS: bindata
-      - name: run migration tests
-        run: make test-mysql-migration
+      - run: GITEA_TEST_DATABASE=mysql make test-migration
      - name: run tests
-        # run: make integration-test-coverage (at the moment, no coverage is really handled)
-        run: make test-mysql
+        run: GITEA_TEST_DATABASE=mysql make test-integration
        env:
          TAGS: bindata
-          RACE_ENABLED: true
          TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"

  test-mssql:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: needs.files-changed.outputs.backend == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      mssql:
        image: mcr.microsoft.com/mssql/server:2019-latest
@@ -222,24 +237,21 @@ jobs:
        ports:
          - "1433:1433"
      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
      - run: make deps-backend
      - run: make backend
        env:
          TAGS: bindata
-      - run: make test-mssql-migration
+      - run: GITEA_TEST_DATABASE=mssql make test-migration
      - name: run tests
-        run: make test-mssql
+        run: GITEA_TEST_DATABASE=mssql make test-integration
        timeout-minutes: 50
        env:
          TAGS: bindata
@@ -7,34 +7,41 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

-  container:
+  # QEMU-based build is slow (40-50 minutes), so run arm64 and riscv64 when dockerfile changes.
+  # Run amd64 when any docker-related files change, which is fast (4 minutes).
+  container-amd64:
    if: needs.files-changed.outputs.docker == 'true'
-    needs: files-changed
+    needs: [files-changed]
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - name: Build regular container image
-        uses: docker/build-push-action@v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/docker-dryrun
        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: false
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
-      - name: Build rootless container image
-        uses: docker/build-push-action@v7
+          platform: linux/amd64
+
+  container-arm64:
+    if: needs.files-changed.outputs.dockerfile == 'true'
+    needs: [files-changed]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/docker-dryrun
        with:
-          context: .
-          push: false
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          file: Dockerfile.rootless
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
+          platform: linux/arm64
+
+  container-riscv64:
+    if: needs.files-changed.outputs.dockerfile == 'true'
+    needs: [files-changed]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/docker-dryrun
+        with:
+          platform: linux/riscv64
@@ -7,37 +7,31 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  test-e2e:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true'
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.e2e == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: ./.github/actions/go-setup
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
      - run: make frontend
      - run: make deps-backend
-      - run: make gitea-e2e
+      - run: make backend
+        env:
+          TAGS: bindata
      - run: make playwright
      - run: make test-e2e
        timeout-minutes: 10
        env:
+          TAGS: bindata
          FORCE_COLOR: 1
          GITEA_TEST_E2E_DEBUG: 1
@@ -1,8 +1,10 @@
 name: labeler

 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
+  # pull_request_target is required to label PRs from forks; jobs only use pinned
+  # actions or base-branch checkout, never PR-head code.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
+    types: [opened, synchronize, reopened, edited, ready_for_review]

 concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -15,6 +17,31 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          sync-labels: true
+
+  pr-title:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
+      - run: node ./tools/ci-tools.ts lint-pr-title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+      - run: node ./tools/ci-tools.ts set-pr-labels
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ github.token }}
@@ -0,0 +1,41 @@
+name: release-nightly-snapcraft
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    env:
+      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Remote build
+        run: |
+          snapcraft remote-build \
+            --launchpad-accept-public-upload \
+            --build-for=amd64,arm64,armhf
+
+      - name: List built snaps
+        run: find . -maxdepth 1 -type f -name '*.snap' -print
+
+      - name: Upload and release snapcraft nightly build
+        run: |
+          set -euo pipefail
+
+          for snap in ./*.snap; do
+            echo "Uploading $snap to edge"
+            snapcraft upload --release="latest/edge" "$snap"
+          done
@@ -14,16 +14,16 @@ jobs:
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
@@ -32,34 +32,42 @@ jobs:
      # xgo build
      - run: make release
        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
      - name: sign binaries
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
+            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
+        env:
+          REF: ${{ github.ref }}
        run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      - name: upload binaries to s3
+        env:
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress

  nightly-container:
    runs-on: namespace-profile-gitea-release-docker
@@ -67,18 +75,20 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
      - name: Get cleaned branch name
        id: clean_name
+        env:
+          REF: ${{ github.ref }}
        run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -88,7 +98,7 @@ jobs:
            type=raw,value=${{ steps.clean_name.outputs.branch }}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -102,18 +112,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -123,7 +133,7 @@ jobs:
          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
      - name: build rootless docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -15,16 +15,16 @@ jobs:
    permissions:
      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
@@ -33,43 +33,52 @@ jobs:
      # xgo build
      - run: make release
        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
      - name: sign binaries
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
+            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
+        env:
+          REF: ${{ github.ref }}
        run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      - name: upload binaries to s3
+        env:
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
          gh-cli-version: 2.39.1
      - name: create github release
-        run: |
-          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --draft --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG" --title "$TAG" --draft --notes-from-tag dist/release/*

  container:
    runs-on: namespace-profile-gitea-release-docker
@@ -77,13 +86,13 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/metadata-action@v6
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -96,7 +105,7 @@ jobs:
            type=semver,pattern={{version}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -112,18 +121,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -131,7 +140,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -18,16 +18,16 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm
@@ -36,43 +36,52 @@ jobs:
      # xgo build
      - run: make release
        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
      - name: sign binaries
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
+            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
+        env:
+          REF: ${{ github.ref }}
        run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      - name: upload binaries to s3
+        env:
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
          gh-cli-version: 2.39.1
      - name: create github release
-        run: |
-          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*

  container:
    runs-on: namespace-profile-gitea-release-docker
@@ -80,13 +89,13 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/metadata-action@v6
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta
        with:
          images: |-
@@ -103,7 +112,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
        id: meta_rootless
        with:
          images: |-
@@ -124,18 +133,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -143,7 +152,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -55,10 +55,7 @@ cpu.out
 *.log.*.gz

 /gitea
-/gitea-e2e
-/gitea-vet
 /debug
-/integrations.test

 /bin
 /dist
@@ -43,7 +43,7 @@ linters:
              desc: use os or io instead
            - pkg: golang.org/x/exp
              desc: it's experimental and unreliable
-            - pkg: code.gitea.io/gitea/modules/git/internal
+            - pkg: gitea.dev/modules/git/internal
              desc: do not use the internal package, use AddXxx function instead
            - pkg: gopkg.in/ini.v1
              desc: do not use the ini package, use gitea's config system instead
@@ -51,6 +51,14 @@ linters:
              desc: do not use the go-chi cache package, use gitea's cache system
            - pkg: github.com/pkg/errors
              desc: use builtin errors package instead
+        migrations:
+          files:
+            - '**/models/migrations/**/*.go'
+          deny:
+            - pkg: gitea.dev/models$
+              desc: migrations must not depend on the models package
+            - pkg: gitea.dev/modules/structs
+              desc: migrations must not depend on modules/structs (API structures change over time)
    nolintlint:
      allow-unused: false
      require-explanation: true
@@ -158,9 +166,16 @@ issues:
  max-same-issues: 0
 formatters:
  enable:
-    - gofmt
+    - gci
    - gofumpt
  settings:
+    gci:
+      custom-order: true
+      sections:
+        - standard
+        - prefix(gitea.dev)
+        - blank
+        - default
    gofumpt:
      extra-rules: true
  exclusions:
@@ -170,9 +185,6 @@ formatters:
      - .venv
      - public
      - web_src
-      - third_party$
-      - builtin$
-      - examples$

 run:
  timeout: 10m
@@ -1,7 +0,0 @@
-audit=false
-fund=false
-update-notifier=false
-save-exact=true
-auto-install-peers=true
-dedupe-peer-dependents=false
-enable-pre-post-scripts=true
@@ -0,0 +1 @@
+disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2154,SC2155,SC2164,SC2181,SC2207
@@ -2,10 +2,19 @@
 - Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
 - Run `make lint-js` to lint `.ts` files
 - Run `make tidy` after any `go.mod` changes
+- Run single go tests with `go test -run '^TestName$' ./modulepath/`
+- Run single js test files with `pnpm exec vitest <path-filter>`
+- Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
 - Add the current year into the copyright header of new `.go` files
 - Ensure no trailing whitespace in edited files
+- Use Conventional Commits for commit messages and PR titles, e.g. `type(scope): subject`; `!` before the colon if breaking. Use `test` type for test-only changes.
 - Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
 - Preserve existing code comments, do not remove or rewrite comments that are still relevant
+- Keep comments short, prefer same-line, explain why, never narrate code
+- Prefer unit tests over integration tests when logic is testable in isolation
+- Aim for sub-2s local runtime for integration and e2e tests
 - In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
+- For CSS layout, prefer `flex-*` helpers over per-child `tw-ml-*` / `tw-mr-*` margins; fall back to `tw-*` utilities when specificity requires `!important`
 - Include authorship attribution in issue and pull request comments
- Add `Co-Authored-By` lines to all commits, indicating name and model used
+- Always add `Assisted-By` trailers to commit messages in format `Assisted-by: AGENT_NAME:MODEL_VERSION`
+- Never add `Co-Authored-By` `Signed-off-by` trailer to commit messages. Sign off must be done by a human.
@@ -4,6 +4,490 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

+## [1.26.2](https://github.com/go-gitea/gitea/releases/tag/1.26.2) - 2026-05-20
+
+* SECURITY
+  * fix(permissions): Fix reading permission (#37769)
+  * fix(actions): make artifact signature payloads unambiguous (#37707)
+  * fix: Unify public-only token filtering in API queries and repo access checks (#37118)
+  * fix: Add missed token scope checking (#37735)
+  * fix(oauth): bind token exchanges to the original client request (#37704)
+  * fix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
+  * fix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
+  * fix(security): enforce wiki git writes and LFS token access at request time (#37695)
+  * feat(api): encrypt AWS creds (#37679)
+  * fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
+  * fix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
+  * fix(git): Fix smart http request scope bug (#37583)
+  * Fix basic auth bug (#37503)
+  * Fix allow maintainer edit permission check (#37479) (#37484)
+  * Fix URL sanitization to handle schemeless credentials (#37440) (#37471)
+  * Fix attachment Content-Security-Policy (#37455) (#37464)
+  * chore(deps): bump go-git/go-git/v5 to 5.19.0 (#37608)
+
+* BUGFIXES
+  * fix(pull): handle empty pull request files view to allow reviews (#37783)
+  * fix(markup): make RenderString never fail (#37779)
+  * fix: add natural sort to sortTreeViewNodes (#37772)
+  * fix: package creation unique conflict (#37774)
+  * fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
+  * fix: Allow direct commits for unprotected files with push restrictions (#37657)
+  * fix(actions): wrong assumption that run id always >= job id (#37737)
+  * fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
+  * fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
+  * fix(repo): /generate must sync the branch table for the new repo (#37693)
+  * build: Fix snap build (1.26)
+  * fix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
+  * fix show correct mergebase
+  * fix: make clone URL respect public URL detection setting (#37615)
+  * fix: "run as root" check (#37622)
+  * chore(deps): update dependency go to v1.26.3 (#37601)
+  * Compare dropdown fails when selecting branch with no common merge-base (#37470)
+  * fix: treat email addresses case-insensitively (#37600)
+  * fix(actions): fix blank lines after ::endgroup:: (#37597)
+  * fix(actions): report individual step status in workflow job API response (#37592)
+  * fix: Invalid UTF-8 commit messages in JSON API responses (#37542)
+  * fix: use consistent GetUser family functions (#37553)
+  * fix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
+  * fix(actions): prevent panic when workflow contains null jobs (#37570)
+  * Make ServeSetHeaders default to download attachment if filename exists (#37552) (#37555)
+  * Fix(actions): validate workflow param to prevent 500 error (#37546) (#37554)
+  * Don't unblock run-level-concurrency-blocked runs in the resolver (#37461) (#37538)
+  * Fix(packages): use file names for generic web downloads (#37514) (#37520)
+  * Fix merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once (#37512) (#37516)
+  * Fix update branch protection order (#37508) (#37513)
+  * Fix mCaptcha broken after Vite migration (#37492) (#37509)
+  * Fix review submission from single-commit PR view (#37475) (#37485)
+  * Fix scheduled action panic with null event payload (#37459) (#37466)
+  * Make GetPossibleUserByID can handle deleted user (#37430) (#37431)
+  * Remove excessive quote from terraform instructions (#37424) (#37426)
+  * Fix color regressions, add `priority` color (#37417) (#37421)
+
+* MISC
+  * Add CurrentURL template variable back (#37444) (#37449)
+
+## [1.26.1](https://github.com/go-gitea/gitea/releases/tag/v1.26.1) - 2026-04-21
+
+* BUGFIXES
+  * Add event.schedule context for schedule actions task (#37320) (#37348)
+  * Fix an issue where changing an organization's visibility caused problems when users had forked its repositories. (#37324) (#37344)
+  * Use modern "git update-index --cacheinfo" syntax to support more file names (#37338) (#37343)
+  * Fix URL related escaping for oauth2 (#37334) (#37340)
+  * When the requested arch rpm is missing fall back to noarch (#37236) (#37339)
+  * Fix actions concurrency groups cross-branch leak (#37311) (#37331)
+  * Fix bug when accessing user badges (#37321) (#37329)
+  * Fix AppFullLink (#37325) (#37328)
+  * Fix container auth for public instance (#37290) (#37294)
+  * Enhance GetActionWorkflow to support fallback references (#37189) (#37283)
+  * Fix vite manifest update masking build errors (#37279) (#37310)
+  * Fix Mermaid diagrams failing when node labels contain line breaks (#37296) (#37299)
+  * Use TriggerEvent instead of Event in workflow runs API response for scheduled runs (#37288) #37360
+  * Add URL to Learn more about blocking a user. (#37355) #37367
+  * Fix button layout shift when collapsing file tree in editor (#37363) #37375
+  * Fix org team assignee/reviewer lookups for team member permissions (#37365) #37391
+  * Fix repo init README EOL (#37388) #37399
+  * Fix: dump with default zip type produces uncompressed zip (#37401) #37402
+
+## [1.26.0](https://github.com/go-gitea/gitea/releases/tag/v1.26.0) - 2026-04-17
+
+* BREAKING
+  * Correct swagger annotations for enums, status codes, and notification state (#37030)
+  * Remove GET API registration-token (#36801)
+  * Support Actions `concurrency` syntax (#32751)
+  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
+* SECURITY
+  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
+* FEATURES
+  * Support Actions `concurrency` syntax (#32751)
+  * Add terraform state registry (#36710)
+  * Instance-wide (global) info banner and maintenance mode (#36571)
+  * Support rendering OpenAPI spec (#36449)
+  * Add keyboard shortcuts for repository file and code search (#36416)
+  * Add support for archive-upload rpc (#36391)
+  * Add ability to download subpath archive (#36371)
+  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
+  * Automatic generation of release notes (#35977)
+  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
+  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
+  * Add button to re-run failed jobs in Actions (#36924)
+  * Support actions and reusable workflows from private repos (#32562)
+  * Add summary to action runs view (#36883)
+  * Add user badges (#36752)
+  * Add configurable permissions for Actions automatic tokens (#36173)
+  * Add per-runner "Disable/Pause"  (#36776)
+  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
+* PERFORMANCE
+  * WorkflowDispatch API optionally return runid (#36706)
+  * Add render cache for SVG icons (#36863)
+  * Load `mentionValues` asynchronously (#36739)
+  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
+  * Load heatmap data asynchronously (#36622)
+  * Use prev/next pagination for user profile activities page to speed up (#36642)
+  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
+  * Use merge tree to detect conflicts when possible (#36400)
+* ENHANCEMENTS
+  * Implement logout redirection for reverse proxy auth setups (#36085) (#37171)
+  * Adds option to force update new branch in contents routes (#35592)
+  * Add viewer controller for mermaid (zoom, drag) (#36557)
+  * Add code editor setting dropdowns (#36534)
+  * Add `elk` layout support to mermaid (#36486)
+  * Add resolve/unresolve review comment API endpoints (#36441)
+  * Allow configuring default PR base branch (fixes #36412) (#36425)
+  * Add support for RPM Errata (updateinfo.xml) (#37125)
+  * Require additional user confirmation for making repo private (#36959)
+  * Add `actions.WORKFLOW_DIRS` setting (#36619)
+  * Avoid opening new tab when downloading actions logs (#36740)
+  * Implements OIDC RP-Initiated Logout (#36724)
+  * Show workflow link (#37070)
+  * Desaturate dark theme background colors (#37056)
+  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
+  * Add webhook name field to improve webhook identification (#37025) (#37040)
+  * Make task list checkboxes clickable in the preview tab (#37010)
+  * Improve severity labels in Actions logs and tweak colors (#36993)
+  * Linkify URLs in Actions workflow logs (#36986)
+  * Allow text selection on checkbox labels (#36970)
+  * Support dark/light theme images in markdown (#36922)
+  * Enable native dark mode for swagger-ui (#36899)
+  * Rework checkbox styling, remove `input` border hover effect (#36870)
+  * Refactor storage content-type handling of ServeDirectURL (#36804)
+  * Use "Enable Gravatar" but not "Disable" (#36771)
+  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
+  * Add "Copy Source" to markup comment menu (#36726)
+  * Change image transparency grid to CSS (#36711)
+  * Add "Run" prefix for unnamed action steps (#36624)
+  * Persist actions log time display settings in `localStorage` (#36623)
+  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
+  * Improve BuildCaseInsensitiveLike with lowercase (#36598)
+  * Improve diff highlighting (#36583)
+  * Exclude cancelled runs from failure-only email notifications (#36569)
+  * Use full-file highlighting for diff sections (#36561)
+  * Color command/error logs in Actions log (#36538)
+  * Add paging headers (#36521)
+  * Improve timeline entries for WIP prefix changes in pull requests (#36518)
+  * Add FOLDER_ICON_THEME configuration option (#36496)
+  * Normalize guessed languages for code highlighting (#36450)
+  * Add chunked transfer encoding support for LFS uploads (#36380)
+  * Indicate when only optional checks failed (#36367)
+  * Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
+  * Support closing keywords with URL references (#36221)
+  * Improve diff file headers (#36215)
+  * Fix and enhance comment editor monospace toggle (#36181)
+  * Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
+  * Add matching pair insertion to markdown textarea (#36121)
+  * Add sorting/filtering to admin user search API endpoint (#36112)
+  * Allow action user have read permission in public repo like other user (#36095)
+  * Disable matchBrackets in monaco (#36089)
+  * Use GitHub-style commit message for squash merge (#35987)
+  * Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
+  * Add GITEA_PR_INDEX env variable to githooks (#35938)
+  * Add proper error message if session provider can not be created (#35520)
+  * Add button to copy file name in PR files (#35509)
+  * Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (#30256)
+  * Add placeholder content for empty content page (#37114)
+  * Add `DEFAULT_DELETE_BRANCH_AFTER_MERGE` setting (#36917)
+  * Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
+  * Add admin badge to navbar avatar (#36790)
+  * Add `never` option to `PUBLIC_URL_DETECTION` configuration (#36785)
+  * Add background and run count to actions list page (#36707)
+  * Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
+  * Add support for in_progress event in workflow_run webhook (#36979)
+  * Report commit status for pull_request_review events (#36589)
+  * Render merged pull request title as such in dashboard feed (#36479)
+  * Feature to be able to filter project boards by milestones (#36321)
+  * Use user id in noreply emails (#36550)
+  * Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
+  * Remove striped tables in UI (#36509)
+  * Improve control char rendering and escape button styling (#37094)
+  * Support legacy run/job index-based URLs and refactor migration 326 (#37008)
+  * Add date to "No Contributions" tooltip (#36190)
+  * Show edit page confirmation dialog on tree view file change (#36130)
+  * Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
+  * Reuse selectable style for wiki (#35990)
+  * Support blue yellow colorblind theme (#35910)
+  * Support selecting theme on the footer (#35741)
+  * Improve online runner check (#35722)
+  * Add quick approve button on PR page (#35678)
+  * Enable commenting on expanded lines in PR diffs (#35662)
+  * Print PR-Title into tooltip for actions (#35579)
+  * Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
+  * Improve the compare page (#36261)
+  * Unify repo names in system notices (#36491)
+  * Move package settings to package instead of being tied to version (#37026)
+  * Add Actions API rerun endpoints for runs and jobs (#36768)
+  * Add branch_count to repository API (#35351) (#36743)
+  * Add created_by filter to SearchIssues (#36670)
+  * Allow admins to rename non-local users (#35970)
+  * Support updating branch via API (#35951)
+  * Add an option to automatically verify SSH keys from LDAP (#35927)
+  * Make "update file" API can create a new file when SHA is not set (#35738)
+  * Update issue.go with labels documentation (labels content, not ids) (#35522)
+  * Expose content_version for optimistic locking on issue and PR edits (#37035)
+  * Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
+* BUGFIXES
+  * Frontend iframe renderer framework: 3D models, OpenAPI (#37233) (#37273)
+  * Fix CODEOWNERS absolute path matching. (#37244) (#37264)
+  * Swift registry metadata: preserve more JSON fields and accept empty metadata (#37254) (#37261)
+  * Fix user ssh key exporting and tests (#37256) (#37258)
+  * Fix team member avatar size and add tooltip (#37253)
+  * Fix commit title rendering in action run and blame (#37243) (#37251)
+  * Fix corrupted JSON caused by goccy library (#37214) (#37220)
+  * Add test for "fetch redirect", add CSS value validation for external render (#37207) (#37216)
+  * Fix incorrect concurrency check (#37205) (#37215)
+  * Fix handle missing base branch in PR commits API (#37193) (#37203)
+  * Fix encoding for Matrix Webhooks (#37190) (#37201)
+  * Fix handle fork-only commits in compare API (#37185) (#37199)
+  * Indicate form field readonly via background, fix RunUser config (#37175, #37180) (#37178)
+  * Report structurally invalid workflows to users (#37116) (#37164)
+  * Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
+  * Rename CSS variables and improve colorblind themes (#36353)
+  * Hide `add-matcher` and `remove-matcher` from actions job logs (#36520)
+  * Prevent navigation keys from triggering actions during IME composition (#36540)
+  * Fix vertical alignment of `.commit-sign-badge` children (#36570)
+  * Fix duplicate startup warnings in admin panel (#36641)
+  * Fix CODEOWNERS review request attribution using comment metadata (#36348)
+  * Fix HTML tags appearing in wiki table of contents (#36284)
+  * Fix various bugs (#37096)
+  * Fix various legacy problems (#37092)
+  * Fix RPM Registry 404 when package name contains 'package' (#37087)
+  * Merge some standalone Vite entries into index.js (#37085)
+  * Fix various problems (#37077)
+  * Fix issue label deletion with Actions tokens (#37013)
+  * Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
+  * Fix org contact email not clearable once set (#36975)
+  * Fix a bug when forking a repository in an organization (#36950)
+  * Preserve sort order of exclusive labels from template repo (#36931)
+  * Make container registry support Apple Container (basic auth) (#36920)
+  * Fix the wrong push commits in the pull request when force push (#36914)
+  * Add class "list-header-filters" to the div for projects (#36889)
+  * Fix dbfs error handling (#36844)
+  * Fix incorrect viewed files counter if reverted change was viewed (#36819)
+  * Refactor avatar package, support default avatar fallback (#36788)
+  * Fix README symlink resolution in subdirectories like .github (#36775)
+  * Fix CSS stacking context issue in actions log (#36749)
+  * Add gpg signing for merge rebase and update by rebase (#36701)
+  * Delete non-exist branch should return 404 (#36694)
+  * Fix `TestActionsCollaborativeOwner` (#36657)
+  * Fix multi-arch Docker build SIGILL by splitting frontend stage (#36646)
+  * Fix linguist-detectable attribute being ignored for configuration files (#36640)
+  * Fix state desync in ComboMarkdownEditor (#36625)
+  * Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)
+  * Pull Request Pusher should be the author of the merge (#36581)
+  * Fix various version parsing problems (#36553)
+  * Fix highlight diff result (#36539)
+  * Fix mirror sync parser and fix mirror messages (#36504)
+  * Fix bug when list pull request commits (#36485)
+  * Fix various bugs (#36446)
+  * Fix issue filter menu layout (#36426)
+  * Restrict branch naming when new change matches with protection rules (#36405)
+  * Fix link/origin referrer and login redirect (#36279)
+  * Generate IDs for HTML headings without id attribute (#36233)
+  * Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
+  * Fix issue close timeline icon (#36138)
+  * Fix diff blob excerpt expansion (#35922)
+  * Fix external render (#35727)
+  * Fix review request webhook bug (#35339) (#35723)
+  * Fix shutdown waitgroup panic (#35676)
+  * Cleanup ActionRun creation (#35624)
+  * Fix possible bug when migrating issues/pull requests (#33487)
+  * Various fixes (#36697)
+  * Apply notify/register mail flags during install load (#37120)
+  * Repair duration display for bad stopped timestamps (#37121)
+  * Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#36930)
+  * Fix various trivial problems (#36921)
+  * Fix various trivial problems (#36953)
+  * Fix NuGet package upload error handling (#37074)
+  * Fix CodeQL code scanning alerts (#36858)
+  * Refactor issue sidebar and fix various problems (#37045)
+  * Fix various problems (#37029)
+  * Fix relative-time RangeError (#37021)
+  * Fix chroma lexer mapping (#36629)
+  * Fix typos and grammar in English locale (#36751)
+  * Fix milestone/project text overflow in issue sidebar (#36741)
+  * Fix `no-content` message not rendering after comment edit (#36733)
+  * Fix theme loading in development (#36605)
+  * Fix workflow run jobs API returning null steps (#36603)
+  * Fix timeline event layout overflow with long content (#36595)
+  * Fix minor UI issues in runner edit page (#36590)
+  * Fix incorrect vendored detections (#36508)
+  * Fix editorconfig not respected in PR Conversation view (#36492)
+  * Don't create self-references in merged PRs (#36490)
+  * Fix potential incorrect runID in run status update (#36437)
+  * Fix file-tree ui error when adding files to repo without commits (#36312)
+  * Improve image captcha contrast for dark mode (#36265)
+  * Fix panic in blame view when a file has only a single commit (#36230)
+  * Fix spelling error in migrate-storage cmd utility (#36226)
+  * Fix code highlighting on blame page (#36157)
+  * Fix nilnil in onedev downloader (#36154)
+  * Fix actions lint (#36029)
+  * Fix oauth2 session gob register (#36017)
+  * Fix Arch repo pacman.conf snippet (#35825)
+  * Fix a number of `strictNullChecks`-related issues (#35795)
+  * Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (#36861)
+  * Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#36384)
+  * Update message severity colors, fix navbar double border (#37019)
+  * Inline and lazy-load EasyMDE CSS, fix border colors (#36714)
+  * Closed milestones with no issues now show as 100% completed (#36220)
+  * Add test for ExtendCommentTreePathLength migration and fix bugs (#35791)
+  * Only turn links to current instance into hash links (#36237)
+  * Fix typos in code comments: doesnt, dont, wont (#36890)
+* REFACTOR
+  * Clean up and improve non-gitea js error filter (#37148) (#37155)
+  * Always show owner/repo name in compare page dropdowns (#37172) (#37200)
+  * Remove dead CSS rules (#37173) (#37177)
+  * Replace Monaco with CodeMirror (#36764)
+  * Replace CSRF cookie with `CrossOriginProtection` (#36183)
+  * Replace index with id in actions routes (#36842)
+  * Remove unnecessary function parameter (#35765)
+  * Move jobparser from act repository to Gitea (#36699)
+  * Refactor compare router param parse (#36105)
+  * Optimize 'refreshAccesses' to perform update without removing then adding (#35702)
+  * Clean up checkbox cursor styles (#37016)
+  * Remove undocumented support of signing key in the repository git configuration file (#36143)
+  * Switch `cmd/` to use constructor functions. (#36962)
+  * Use `relative-time` to render absolute dates (#36238)
+  * Some refactors about GetMergeBase (#36186)
+  * Some small refactors (#36163)
+  * Use gitRepo as parameter instead of repopath when invoking sign functions (#36162)
+  * Move blame to gitrepo (#36161)
+  * Move some functions to gitrepo package to reduce RepoPath reference directly (#36126)
+  * Use gitrepo's clone and push when possible (#36093)
+  * Remove mermaid margin workaround (#35732)
+  * Move some functions to gitrepo package (#35543)
+  * Move GetDiverging functions to gitrepo (#35524)
+  * Use global lock instead of status pool for cron lock (#35507)
+  * Use explicit mux instead of DefaultServeMux (#36276)
+  * Use gitrepo's push function (#36245)
+  * Pass request context to generateAdditionalHeadersForIssue (#36274)
+  * Move assign project when creating pull request to the same database transaction (#36244)
+  * Move catfile batch to a sub package of git module (#36232)
+  * Use gitrepo.Repository instead of wikipath (#35398)
+  * Use experimental go json v2 library (#35392)
+  * Refactor template render (#36438)
+  * Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#36434)
+  * Refactor text utility classes to Tailwind CSS (#36703)
+  * Refactor git command stdio pipe (#36422)
+  * Refactor git command context & pipeline (#36406)
+  * Refactor git command stdio pipe (#36393)
+  * Remove unused functions (#36672)
+  * Refactor Actions Token Access (#35688)
+  * Move commit related functions to gitrepo package (#35600)
+  * Move archive function to repo_model and gitrepo (#35514)
+  * Move some functions to gitrepo package (#35503)
+  * Use git model to detect whether branch exist instead of gitrepo method (#35459)
+  * Some refactor for repo path (#36251)
+  * Extract helper functions from SearchIssues (#36158)
+  * Refactor merge conan and container auth preserve actions taskID (#36560)
+  * Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
+  * Refactor ActionsTaskID (#36503)
+  * Refactor auth middleware (#36848)
+  * Refactor code render and render control chars (#37078)
+  * Clean up AppURL, remove legacy origin-url webcomponent (#37090)
+  * Remove `util.URLJoin` and replace all callers with direct path concatenation (#36867)
+  * Replace legacy tw-flex utility classes with flex-text-block/inline (#36778)
+  * Mark unused&immature activitypub as "not implemented" (#36789)
+* TESTING
+  * Add e2e tests for server push events (#36879)
+  * Rework e2e tests (#36634)
+  * Add e2e reaction test, improve accessibility, enable parallel testing (#37081)
+  * Increase e2e test timeouts on CI to fix flaky tests (#37053)
+* BUILD
+  * Upgrade go-git to v5.18.0 (#37269)
+  * Replace rollup-plugin-license with rolldown-license-plugin (#37130) (#37158)
+  * Bump min go version to 1.26.2 (#37139) (#37143)
+  * Convert locale files from ini to json format (#35489)
+  * Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)
+  * Port away from `flake-utils` (#35675)
+  * Remove nolint (#36252)
+  * Update the Unlicense copy to latest version (#36636)
+  * Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)
+  * Replace `google/go-licenses` with custom generation (#36575)
+  * Update go dependencies (#36548)
+  * Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#36306)
+  * Remove fomantic form module (#36222)
+  * Bump setup-node to v6, re-enable cache (#36207)
+  * Bump crowdin/github-action from 1 to 2 (#36204)
+  * Revert "Bump alpine to 3.23 (#36185)" (#36202)
+  * Update chroma to v2.21.1 (#36201)
+  * Bump astral-sh/setup-uv from 6 to 7 (#36198)
+  * Bump docker/build-push-action from 5 to 6 (#36197)
+  * Bump aws-actions/configure-aws-credentials from 4 to 5 (#36196)
+  * Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#36195)
+  * Add JSON linting (#36192)
+  * Enable dependabot for actions (#36191)
+  * Bump alpine to 3.23 (#36185)
+  * Update chroma to v2.21.0 (#36171)
+  * Update JS deps and eslint enhancements (#36147)
+  * Update JS deps (#36091)
+  * update golangci-lint to v2.7.0 (#36079)
+  * Update JS deps, fix deprecations (#36040)
+  * Update JS deps (#35978)
+  * Add toolchain directive to go.mod (#35901)
+  * Move `gitea-vet` to use `go tool` (#35878)
+  * Update to go 1.25.4 (#35877)
+  * Enable TypeScript `strictNullChecks` (#35843)
+  * Enable `vue/require-typed-ref` eslint rule (#35764)
+  * Update JS dependencies (#35759)
+  * Move `codeformat` folder to tools (#35758)
+  * Update dependencies (#35733)
+  * Bump happy-dom from 20.0.0 to 20.0.2 (#35677)
+  * Bump setup-go to v6 (#35660)
+  * Update JS deps, misc tweaks (#35643)
+  * Bump happy-dom from 19.0.2 to 20.0.0 (#35625)
+  * Use bundled version of spectral (#35573)
+  * Update JS and PY deps (#35565)
+  * Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557)
+  * Migrate from webpack to vite (#37002)
+  * Update JS dependencies and misc tweaks (#37064)
+  * Update to eslint 10 (#36925)
+  * Optimize Docker build with dependency layer caching (#36864)
+  * Update JS deps (#36850)
+  * Update tool dependencies and fix new lint issues (#36702)
+  * Remove redundant linter rules (#36658)
+  * Move Fomantic dropdown CSS to custom module (#36530)
+  * Remove and forbid `@ts-expect-error` (#36513)
+  * Refactor git command stderr handling (#36402)
+  * Enable gocheckcompilerdirectives linter (#36156)
+  * Replace `lint-go-gopls` with additional `govet` linters (#36028)
+  * Update golangci-lint to v2.6.0 (#35801)
+  * Misc tool tweaks (#35734)
+  * Add cache to container build (#35697)
+  * Upgrade vite (#37126)
+  * Update `setup-uv` to v8.0.0 (#37101)
+  * Upgrade `go-git` to v5.17.2 and related dependencies (#37060)
+  * Raise minimum Node.js version to 22.18.0 (#37058)
+  * Upgrade `golang.org/x/image` to v0.38.0 (#37054)
+  * Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876)
+  * Enable eslint concurrency (#36878)
+  * Vendor relative-time-element as local web component (#36853)
+  * Update material-icon-theme v5.32.0 (#36832)
+  * Update Go dependencies (#36781)
+  * Upgrade minimatch (#36760)
+  * Remove i18n backport tool at the moment because of translation format changed (#36643)
+  * Update emoji data for Unicode 16 (#36596)
+  * Update JS dependencies, adjust webpack config, misc fixes (#36431)
+  * Update material-icon-theme to v5.31.0 (#36427)
+  * Update JS and PY deps (#36383)
+  * Bump alpine to 3.23, add platforms to `docker-dryrun` (#36379)
+  * Update JS deps (#36354)
+  * Update goldmark to v1.7.16 (#36343)
+  * Update chroma to v2.22.0 (#36342)
+* DOCS
+  * Update AI Contribution Policy (#37022)
+  * Update AGENTS.md with additional guidelines (#37018)
+  * Add missing cron tasks to example ini (#37012)
+  * Add AI Contribution Policy to CONTRIBUTING.md (#36651)
+  * Minor punctuation improvement in CONTRIBUTING.md (#36291)
+  * Add documentation for markdown anchor post-processing (#36443)
+* MISC
+  * Correct spelling (#36783)
+  * Update Nix flake (#37110)
+  * Update Nix flake (#37024)
+  * Add valid github scopes (#36977)
+  * Update Nix flake (#36943)
+  * Update Nix flake (#36902)
+  * Update Nix flake (#36857)
+  * Update Nix flake (#36787)
+
 ## [1.25.5](https://github.com/go-gitea/gitea/releases/tag/v1.25.5) - 2026-03-10

 * SECURITY
@@ -961,7 +1445,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix mCaptcha bug (#33659) (#33661)
  * Git graph: don't show detached commits (#33645) (#33650)
  * Use MatchPhraseQuery for bleve code search (#33628)
-  * Adjust appearence of commit status webhook (#33778) #33789
+  * Adjust appearance of commit status webhook (#33778) #33789
  * Upgrade golang net from 0.35.0 -> 0.36.0 (#33795) #33796

 ## [1.23.4](https://github.com/go-gitea/gitea/releases/tag/v1.23.4) - 2025-02-16
@@ -1692,7 +2176,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Optimize repo-list layout to enhance visual experience (#31272) (#31276)
  * fixed the dropdown menu for the top New button to expand to the left (#31273) (#31275)
  * Fix Activity Page Contributors dropdown (#31264) (#31269)
-  * fix: allow actions artifacts storage migration to complete succesfully (#31251) (#31257)
+  * fix: allow actions artifacts storage migration to complete successfully (#31251) (#31257)
  * Make blockquote attention recognize more syntaxes (#31240) (#31250)
  * Remove .segment from .project-column (#31204) (#31239)
  * Ignore FindRecentlyPushedNewBranches err (#31164) (#31171)
@@ -1876,7 +2360,7 @@ Key highlights of this release encompass significant changes categorized under `
  * Performance optimization for git push and check permissions for push options (#30104) (#30354)
 * BUGFIXES
  * Fix close file in the Upload func (#30262) (#30269)
-  * Fix inline math blocks can't be preceeded/followed by alphanumerical characters (#30175) (#30250)
+  * Fix inline math blocks can't be preceded/followed by alphanumerical characters (#30175) (#30250)
  * Fix missing 0 prefix of GPG key id (#30245) (#30247)
  * Include encoding in signature payload (#30174) (#30181)
  * Move from `max( id )` to `max( index )` for latest commit statuses (#30076) (#30155)
@@ -5168,7 +5652,7 @@ Key highlights of this release encompass significant changes categorized under `
  * Fix navbar on project view (#17749)
  * More pleasantly handle broken or missing git repositories (#17747)
  * Use `*PushUpdateOptions` as receiver (#17724)
-  * Remove unused `user` paramater (#17723)
+  * Remove unused `user` parameter (#17723)
  * Better builtin avatar generator (#17707)
  * Cleanup and use global style on popups (#17674)
  * Move user/org deletion to services (#17673)
@@ -1,5 +1,14 @@
 # Contribution Guidelines

+This document explains how to contribute changes to the Gitea project. Topic-specific guides live in separate files so the essentials are easier to find.
+
+| Topic | Document |
+| :---- | :------- |
+| Backend (Go modules, API v1) | [docs/guideline-backend.md](docs/guideline-backend.md) |
+| Frontend (npm, UI guidelines) | [docs/guideline-frontend.md](docs/guideline-frontend.md) |
+| Maintainers, TOC, labels, merge queue, commit format for mergers | [docs/community-governance.md](docs/community-governance.md) |
+| Release cycle, backports, tagging releases | [docs/release-management.md](docs/release-management.md) |
+
 <details><summary>Table of Contents</summary>

 - [Contribution Guidelines](#contribution-guidelines)
@@ -11,10 +20,6 @@
    - [Discuss your design before the implementation](#discuss-your-design-before-the-implementation)
    - [Issue locking](#issue-locking)
  - [Building Gitea](#building-gitea)
-  - [Dependencies](#dependencies)
-    - [Backend](#backend)
-    - [Frontend](#frontend)
-  - [Design guideline](#design-guideline)
  - [Styleguide](#styleguide)
  - [Copyright](#copyright)
  - [Testing](#testing)
@@ -22,47 +27,19 @@
  - [Code review](#code-review)
    - [Pull request format](#pull-request-format)
    - [PR title and summary](#pr-title-and-summary)
-    - [Milestone](#milestone)
-    - [Labels](#labels)
    - [Breaking PRs](#breaking-prs)
      - [What is a breaking PR?](#what-is-a-breaking-pr)
      - [How to handle breaking PRs?](#how-to-handle-breaking-prs)
    - [Maintaining open PRs](#maintaining-open-prs)
-    - [Getting PRs merged](#getting-prs-merged)
-    - [Final call](#final-call)
-    - [Commit messages](#commit-messages)
-      - [PR Co-authors](#pr-co-authors)
-      - [PRs targeting `main`](#prs-targeting-main)
-      - [Backport PRs](#backport-prs)
+    - [Reviewing PRs](#reviewing-prs)
+      - [For PR authors](#for-pr-authors)
  - [Documentation](#documentation)
-  - [API v1](#api-v1)
-    - [GitHub API compatibility](#github-api-compatibility)
-    - [Adding/Maintaining API routes](#addingmaintaining-api-routes)
-    - [When to use what HTTP method](#when-to-use-what-http-method)
-    - [Requirements for API routes](#requirements-for-api-routes)
-  - [Backports and Frontports](#backports-and-frontports)
-    - [What is backported?](#what-is-backported)
-    - [How to backport?](#how-to-backport)
-    - [Format of backport PRs](#format-of-backport-prs)
-    - [Frontports](#frontports)
  - [Developer Certificate of Origin (DCO)](#developer-certificate-of-origin-dco)
-  - [Release Cycle](#release-cycle)
-  - [Maintainers](#maintainers)
-  - [Technical Oversight Committee (TOC)](#technical-oversight-committee-toc)
-    - [TOC election process](#toc-election-process)
-    - [Current TOC members](#current-toc-members)
-    - [Previous TOC/owners members](#previous-tocowners-members)
-  - [Governance Compensation](#governance-compensation)
-  - [TOC \& Working groups](#toc--working-groups)
-  - [Roadmap](#roadmap)
-  - [Versions](#versions)
-  - [Releasing Gitea](#releasing-gitea)

 </details>

 ## Introduction

-This document explains how to contribute changes to the Gitea project. \
 It assumes you have followed the [installation instructions](https://docs.gitea.com/category/installation). \
 Sensitive security-related issues should be reported to [security@gitea.io](mailto:security@gitea.io).

@@ -131,34 +108,6 @@ If further discussion is needed, we encourage you to open a new issue instead an

 See the [development setup instructions](https://docs.gitea.com/development/hacking-on-gitea).

-## Dependencies
-
-### Backend
-
-Go dependencies are managed using [Go Modules](https://go.dev/cmd/go/#hdr-Module_maintenance). \
-You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).
-
-Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
-Apart from that, these files should only be modified by Pull Requests whose only purpose is to update dependencies.
-
-The `go.mod`, `go.sum` update needs to be justified as part of the PR description,
-and must be verified by the reviewers and/or merger to always reference
-an existing upstream commit.
-
-### Frontend
-
-For the frontend, we use [npm](https://www.npmjs.com/).
-
-The same restrictions apply for frontend dependencies as for backend dependencies, with the exceptions that the files for it are `package.json` and `package-lock.json`, and that new versions must always reference an existing version.
-
-## Design guideline
-
-Depending on your change, please read the
-
- [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend)
- [frontend development guideline](https://docs.gitea.com/contributing/guidelines-frontend)
- [refactoring guideline](https://docs.gitea.com/contributing/guidelines-refactoring)
-
 ## Styleguide

 You should always run `make fmt` before committing to conform to Gitea's styleguide.
@@ -190,11 +139,11 @@ Here's how to run the test suite:

 - run tests (we suggest running them on Linux)

-|  Command                                    | Action                                                   |                                             |
-| :------------------------------------------ | :------------------------------------------------------- | ------------------------------------------- |
-|``make test[\#SpecificTestName]``            |  run unit test(s)                                        |                                             |
-|``make test-sqlite[\#SpecificTestName]``     |  run [integration](tests/integration) test(s) for SQLite | [More details](tests/integration/README.md) |
-|``make test-e2e``                            |  run [end-to-end](tests/e2e) test(s) using Playwright    |                                             |
+| Command                                       | Action                                               |                                             |
+|:----------------------------------------------|:-----------------------------------------------------| ------------------------------------------- |
+| ``make test-backend[\#SpecificTestName]``     | run unit test(s)                                     |                                             |
+| ``make test-integration[\#SpecificTestName]`` | run [integration](tests/integration) test(s)         | [More details](tests/integration/README.md) |
+| ``make test-e2e``                             | run [end-to-end](tests/e2e) test(s) using Playwright |                                             |

 - E2E test environment variables

@@ -202,7 +151,7 @@ Here's how to run the test suite:
 | :-------------------------------- | :---------------------------------------------------------- |
 | ``GITEA_TEST_E2E_DEBUG``          | When set, show Gitea server output                          |
 | ``GITEA_TEST_E2E_FLAGS``          | Additional flags passed to Playwright, for example ``--ui`` |
-| ``GITEA_TEST_E2E_TIMEOUT_FACTOR`` | Timeout multiplier (default: 3 on CI, 1 locally)            |
+| ``GITEA_TEST_E2E_TIMEOUT_FACTOR`` | Timeout multiplier (default: 4 on CI, 1 locally)            |

 ## Translation

@@ -216,6 +165,8 @@ The tool `go run build/backport-locale.go` can be used to backport locales from

 ## Code review

+How labels, milestones, and the merge queue work is documented in [docs/community-governance.md](docs/community-governance.md).
+
 ### Pull request format

 Please try to make your pull request easy to review for us. \
@@ -238,6 +189,38 @@ In the PR title, describe the problem you are fixing, not how you are fixing it.
 Use the first comment as a summary of your PR. \
 In the PR summary, you can describe exactly how you are fixing this problem.

+PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message:
+
+```text
+type(scope)!: subject
+```
+
+The scope in parentheses is optional. A `!` immediately before the colon marks a [breaking change](https://www.conventionalcommits.org/en/v1.0.0/#summary): either `type!:` or `type(scope)!:` (not `type!(scope):`).
+
+Use one of these types:
+
+- `build`: Changes affecting the build system, packaging, or external dependencies
+- `ci`: Changes to CI/CD configuration files and scripts
+- `chore`: Maintenance changes that do not affect production code or should not appear in the changelog
+- `docs`: Documentation-only changes
+- `feat`: A larger user-facing feature, improvement, or new functionality
+- `enhance`: Small or trivial user-facing improvements or UX polish (for example wording changes, color adjustments, spacing or padding tweaks, placeholders, small UI behavior improvements)
+- `fix`: A bug fix, UX correction, or security-related dependency update
+- `perf`: Performance improvements (speed, memory, scalability)
+- `refactor`: A code change that neither fixes a bug nor adds a feature
+- `revert`: Reverts a previous change
+- `style`: Formatting or style-only changes that do not affect code behavior (for example lint-driven edits)
+- `test`: Adding or correcting tests
+
+Examples:
+
+```text
+fix(web): prevent avatar upload crash on empty file
+feat(api): add pagination to repo hooks list
+enhance(repo): improve diff toolbar spacing
+ci(workflows): lint PR titles in CI
+```
+
 Keep this summary up-to-date as the PR evolves. \
 If your PR changes the UI, you must add **after** screenshots in the PR summary. \
 If you are not implementing a new feature, you should also post **before** screenshots for comparison.
@@ -250,6 +233,10 @@ Another requirement for merging PRs is that the PR is labeled correctly.\
 However, this is not your job as a contributor, but the job of the person merging your PR.\
 If you think that your PR was labeled incorrectly, or notice that it was merged without labels, please let us know.

+For pull requests that use a valid Conventional Commits title, CI automatically applies a matching `type/…` label when the title prefix is `feat`, `enhance`, `fix`, `docs`, or `test` (for example `enhance(web): …` receives `type/enhancement`).\
+That label is kept in sync with the PR title when the title is edited.\
+Other title prefixes do not get an automatic `type/…` label; the merger still assigns the correct labels (including `type/…` when needed) for changelog and backport decisions.
+
 If your PR closes some issues, you must note that in a way that both GitHub and Gitea understand, i.e. by appending a paragraph like

 ```text
@@ -260,29 +247,6 @@ Fixes/Closes/Resolves #<ISSUE_NR_Y>.
 to your summary. \
 Each issue that will be closed must stand on a separate line.

-### Milestone
-
-A PR should only be assigned to a milestone if it will likely be merged into the given version. \
-As a rule of thumb, assume that a PR will stay open for an additional month for every 100 added lines. \
-PRs without a milestone may not be merged.
-
-### Labels
-
-Almost all labels used inside Gitea can be classified as one of the following:
-
- `modifies/…`: Determines which parts of the codebase are affected. These labels will be set through the CI.
- `topic/…`:  Determines the conceptual component of Gitea that is affected, i.e. issues, projects, or authentication. At best, PRs should only target one component but there might be overlap. Must be set manually.
- `type/…`: Determines the type of an issue or PR (feature, refactoring, docs, bug, …). If GitHub supported scoped labels, these labels would be exclusive, so you should set **exactly** one, not more or less (every PR should fall into one of the provided categories, and only one).
- `issue/…` / `pr/…`: Labels that are specific to issues or PRs respectively and that are only necessary in a given context, i.e. `issue/not-a-bug` or `pr/need-2-approvals`
-
-Every PR should be labeled correctly with every label that applies.
-
-There are also some labels that will be managed automatically.\
-In particular, these are
-
- the amount of pending required approvals
- has all `backport`s or needs a manual backport
-
 ### Breaking PRs

 #### What is a breaking PR?
@@ -311,165 +275,29 @@ Breaking PRs will not be merged as long as not both of these requirements are me

 ### Maintaining open PRs

-The moment you create a non-draft PR or the moment you convert a draft PR to a non-draft PR is the moment code review starts for it. \
-Once that happens, do not rebase or squash your branch anymore as it makes it difficult to review the new changes. \
-Merge the base branch into your branch only when you really need to, i.e. because of conflicting changes in the mean time. \
-This reduces unnecessary CI runs. \
-Don't worry about merge commits messing up your commit history as every PR will be squash merged. \
-This means that all changes are joined into a single new commit whose message is as described below.
+Code review starts when you open a non-draft PR or move a draft out of draft state. After that, do not rebase or squash your branch; it makes new changes harder to review.

-### Getting PRs merged
+Merge the base branch into yours only when you need to, for example because of conflicting changes elsewhere. That limits unnecessary CI runs.

-Changes to Gitea must be reviewed before they are accepted — no matter who
-makes the change, even if they are an owner or a maintainer. \
-The only exception are critical bugs that prevent Gitea from being compiled or started. \
-Specifically, we require two approvals from maintainers for every PR. \
-Once this criteria has been met, your PR receives the `lgtm/done` label. \
-From this point on, your only responsibility is to fix merge conflicts or respond to/implement requests by maintainers. \
-It is the responsibility of the maintainers from this point to get your PR merged.
+Every PR is squash-merged, so merge commits on your branch do not matter for final history. The squash produces a single commit; mergers follow the [commit message format](docs/community-governance.md#commit-messages) in the governance guide.

-If a PR has the `lgtm/done` label and there are no open discussions or merge conflicts anymore, any maintainer can add the `reviewed/wait-merge` label. \
-This label means that the PR is part of the merge queue and will be merged as soon as possible. \
-The merge queue will be cleared in the order of the list below:
+### Reviewing PRs

-<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
+Maintainers are encouraged to review pull requests in areas where they have expertise or particular interest.

-Gitea uses it's own tool, the <https://github.com/GiteaBot/gitea-backporter> to automate parts of the review process. \
-This tool does the things listed below automatically:
+#### For PR authors

- create a backport PR if needed once the initial PR was merged
- remove the PR from the merge queue after the PR merged
- keep the oldest branch in the merge queue up to date with merges
+- **Response**: When answering reviewer questions, use real-world cases or examples and avoid speculation.
+- **Discussion**: A discussion is always welcome and should be used to clarify the changes and the intent of the PR.
+- **Help**: If you need help with the PR or comments are unclear, ask for clarification.

-### Final call
-
-If a PR has been ignored for more than 7 days with no comments or reviews, and the author or any maintainer believes it will not survive a long wait (such as a refactoring PR), they can send "final call" to the TOC by mentioning them in a comment.
-
-After another 7 days, if there is still zero approval, this is considered a polite refusal, and the PR will be closed to avoid wasting further time. Therefore, the "final call" has a cost, and should be used cautiously.
-
-However, if there are no objections from maintainers, the PR can be merged with only one approval from the TOC (not the author).
-
-### Commit messages
-
-Mergers are able and required to rewrite the PR title and summary (the first comment of a PR) so that it can produce an easily understandable commit message if necessary. \
-The final commit message should no longer contain any uncertainty such as `hopefully, <x> won't happen anymore`. Replace uncertainty with certainty.
-
-#### PR Co-authors
-
-A person counts as a PR co-author the moment they (co-)authored a commit that is not simply a `Merge base branch into branch` commit. \
-Mergers are required to remove such "false-positive" co-authors when writing the commit message. \
-The true co-authors must remain in the commit message.
-
-#### PRs targeting `main`
-
-The commit message of PRs targeting `main` is always
-
-```bash
-$PR_TITLE ($PR_INDEX)
-
-$REWRITTEN_PR_SUMMARY
-```
-
-#### Backport PRs
-
-The commit message of backport PRs is always
-
-```bash
-$PR_TITLE ($INITIAL_PR_INDEX) ($BACKPORT_PR_INDEX)
-
-$REWRITTEN_PR_SUMMARY
-```
+Guidance for reviewers, the merge queue, and the squash commit message format is in [docs/community-governance.md](docs/community-governance.md).

 ## Documentation

 If you add a new feature or change an existing aspect of Gitea, the documentation for that feature must be created or updated in another PR at [https://gitea.com/gitea/docs](https://gitea.com/gitea/docs).
 **The docs directory on main repository will be removed at some time. We will have a yaml file to store configuration file's meta data. After that completed, configuration documentation should be in the main repository.**

-## API v1
-
-The API is documented by [swagger](https://gitea.com/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
-
-### GitHub API compatibility
-
-Gitea's API should use the same endpoints and fields as the GitHub API as far as possible, unless there are good reasons to deviate. \
-If Gitea provides functionality that GitHub does not, a new endpoint can be created. \
-If information is provided by Gitea that is not provided by the GitHub API, a new field can be used that doesn't collide with any GitHub fields. \
-Updating an existing API should not remove existing fields unless there is a really good reason to do so. \
-The same applies to status responses. If you notice a problem, feel free to leave a comment in the code for future refactoring to API v2 (which is currently not planned).
-
-### Adding/Maintaining API routes
-
-All expected results (errors, success, fail messages) must be documented ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L319-L327)). \
-All JSON input types must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L76-L91)) \
-and referenced in [routers/api/v1/swagger/options.go](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/options.go). \
-They can then be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L318). \
-All JSON responses must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L36-L68)) \
-and referenced in its category in [routers/api/v1/swagger/](routers/api/v1/swagger/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/issue.go#L11-L16)) \
-They can be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L277-L279).
-
-### When to use what HTTP method
-
-In general, HTTP methods are chosen as follows:
-
- **GET** endpoints return the requested object(s) and status **OK (200)**
- **DELETE** endpoints return the status **No Content (204)** and no content either
- **POST** endpoints are used to **create** new objects (e.g. a User) and return the status **Created (201)** and the created object
- **PUT** endpoints are used to **add/assign** existing Objects (e.g. a user to a team) and return the status **No Content (204)** and no content either
- **PATCH** endpoints are used to **edit/change** an existing object and return the changed object and the status **OK (200)**
-
-### Requirements for API routes
-
-All parameters of endpoints changing/editing an object must be optional (except the ones to identify the object, which are required).
-
-Endpoints returning lists must
-
- support pagination (`page` & `limit` options in query)
- set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
-
-## Backports and Frontports
-
-### What is backported?
-
-We backport PRs given the following circumstances:
-
-1. Feature freeze is active, but `<version>-rc0` has not been released yet. Here, we backport as much as possible. <!-- TODO: Is that our definition with the new backport bot? -->
-2. `rc0` has been released. Here, we only backport bug- and security-fixes, and small enhancements. Large PRs such as refactors are not backported anymore. <!-- TODO: Is that our definition with the new backport bot? -->
-3. We never backport new features.
-4. We never backport breaking changes except when
-    1. The breaking change has no effect on the vast majority of users
-    2. The component triggering the breaking change is marked as experimental
-
-### How to backport?
-
-In the past, it was necessary to manually backport your PRs. \
-Now, that's not a requirement anymore as our [backport bot](https://github.com/GiteaBot) tries to create backports automatically once the PR is merged when the PR
-
- does not have the label `backport/manual`
- has the label `backport/<version>`
-
-The `backport/manual` label signifies either that you want to backport the change yourself, or that there were conflicts when backporting, thus you **must** do it yourself.
-
-### Format of backport PRs
-
-The title of backport PRs should be
-
-```
-<original PR title> (#<original pr number>)
-```
-
-The first two lines of the summary of the backporting PR should be
-
-```
-Backport #<original pr number>
-
-```
-
-with the rest of the summary and labels matching the original PR.
-
-### Frontports
-
-Frontports behave exactly as described above for backports.
-
 ## Developer Certificate of Origin (DCO)

 We consider the act of contributing to the code by submitting a Pull Request as the "Sign off" or agreement to the certifications and terms of the [DCO](DCO) and [MIT license](LICENSE). \
@@ -483,148 +311,3 @@ Signed-off-by: Joe Smith <joe.smith@email.com>
 If you set the `user.name` and `user.email` Git config options, you can add the line to the end of your commits automatically with `git commit -s`.

 We assume in good faith that the information you provide is legally binding.
-
-## Release Cycle
-
-We adopted a release schedule to streamline the process of working on, finishing, and issuing releases. \
-The overall goal is to make a major release every three or four months, which breaks down into two or three months of general development followed by one month of testing and polishing known as the release freeze. \
-All the feature pull requests should be
-merged before feature freeze. All feature pull requests haven't been merged before this feature freeze will be moved to next milestone, please notice our feature freeze announcement on discord. And, during the frozen period, a corresponding
-release branch is open for fixes backported from main branch. Release candidates
-are made during this period for user testing to
-obtain a final version that is maintained in this branch.
-
-During a development cycle, we may also publish any necessary minor releases
-for the previous version. For example, if the latest, published release is
-v1.2, then minor changes for the previous release—e.g., v1.1.0 -> v1.1.1—are
-still possible.
-
-## Maintainers
-
-To make sure every PR is checked, we have [maintainers](MAINTAINERS). \
-Every PR **must** be reviewed by at least two maintainers (or owners) before it can get merged. \
-For refactoring PRs after a week and documentation only PRs, the approval of only one maintainer is enough. \
-A maintainer should be a contributor of Gitea and contributed at least
-4 accepted PRs. A contributor should apply as a maintainer in the
-[Discord](https://discord.gg/Gitea) `#develop` channel. The team maintainers may invite the contributor. A maintainer
-should spend some time on code reviews. If a maintainer has no
-time to do that, they should apply to leave the maintainers team
-and we will give them the honor of being a member of the [advisors
-team](https://github.com/orgs/go-gitea/teams/advisors). Of course, if
-an advisor has time to code review, we will gladly welcome them back
-to the maintainers team. If a maintainer is inactive for more than 3
-months and forgets to leave the maintainers team, the owners may move
-him or her from the maintainers team to the advisors team.
-For security reasons, Maintainers should use 2FA for their accounts and
-if possible provide GPG signed commits.
-https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
-https://help.github.com/articles/signing-commits-with-gpg/
-
-Furthermore, any account with write access (like bots and TOC members) **must** use 2FA.
-https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
-
-## Technical Oversight Committee (TOC)
-
-At the start of 2023, the `Owners` team was dissolved. Instead, the governance charter proposed a technical oversight committee (TOC) which expands the ownership team of the Gitea project from three elected positions to six positions. Three positions are elected as it has been over the past years, and the other three consist of appointed members from the Gitea company.
-https://blog.gitea.com/quarterly-23q1/
-
-### TOC election process
-
-Any maintainer is eligible to be part of the community TOC if they are not associated with the Gitea company.
-A maintainer can either nominate themselves, or can be nominated by other maintainers to be a candidate for the TOC election.
-If you are nominated by someone else, you must first accept your nomination before the vote starts to be a candidate.
-
-The TOC is elected for one year, the TOC election happens yearly.
-After the announcement of the results of the TOC election, elected members have two weeks time to confirm or refuse the seat.
-If an elected member does not answer within this timeframe, they are automatically assumed to refuse the seat.
-Refusals result in the person with the next highest vote getting the same choice.
-As long as seats are empty in the TOC, members of the previous TOC can fill them until an elected member accepts the seat.
-
-If an elected member that accepts the seat does not have 2FA configured yet, they will be temporarily counted as `answer pending` until they manage to configure 2FA, thus leaving their seat empty for this duration.
-
-### Current TOC members
-
- 2024-01-01 ~ 2024-12-31
-  - Company
-    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
-    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
-    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
-  - Community
-    - [6543](https://gitea.com/6543) <6543@obermui.de>
-    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
-    - [John Olheiser](https://gitea.com/jolheiser) <john.olheiser@gmail.com>
-
-### Previous TOC/owners members
-
-Here's the history of the owners and the time they served:
-
- [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [Kim Carlbäcker](https://github.com/bkcsoft) - 2016, 2017
- [Thomas Boerger](https://gitea.com/tboerger) - 2016, 2017
- [Lauris Bukšis-Haberkorns](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801)
- [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [6543](https://gitea.com/6543) - 2023
- [John Olheiser](https://gitea.com/jolheiser) - 2023
- [Jason Song](https://gitea.com/wolfogre) - 2023
-
-## Governance Compensation
-
-Each member of the community elected TOC will be granted $500 each month as compensation for their work.
-
-Furthermore, any community release manager for a specific release or LTS will be compensated $500 for the delivery of said release.
-
-These funds will come from community sources like the OpenCollective rather than directly from the company.
-Only non-company members are eligible for this compensation, and if a member of the community TOC takes the responsibility of release manager, they would only be compensated for their TOC duties.
-Gitea Ltd employees are not eligible to receive any funds from the OpenCollective unless it is reimbursement for a purchase made for the Gitea project itself.
-
-## TOC & Working groups
-
-With Gitea covering many projects outside of the main repository, several groups will be created to help focus on specific areas instead of requiring maintainers to be a jack-of-all-trades. Maintainers are of course more than welcome to be part of multiple groups should they wish to contribute in multiple places.
-
-The currently proposed groups are:
-
- **Core Group**: maintain the primary Gitea repository
- **Integration Group**: maintain the Gitea ecosystem's related tools, including go-sdk/tea/changelog/bots etc.
- **Documentation Group**: maintain related documents and repositories
- **Translation Group**: coordinate with translators and maintain translations
- **Security Group**: managed by TOC directly, members are decided by TOC, maintains security patches/responsible for security items
-
-## Roadmap
-
-Each year a roadmap will be discussed with the entire Gitea maintainers team, and feedback will be solicited from various stakeholders.
-TOC members need to review the roadmap every year and work together on the direction of the project.
-
-When a vote is required for a proposal or other change, the vote of community elected TOC members count slightly more than the vote of company elected TOC members. With this approach, we both avoid ties and ensure that changes align with the mission statement and community opinion.
-
-You can visit our roadmap on the wiki.
-
-## Versions
-
-Gitea has the `main` branch as a tip branch and has version branches
-such as `release/v1.19`. `release/v1.19` is a release branch and we will
-tag `v1.19.0` for binary download. If `v1.19.0` has bugs, we will accept
-pull requests on the `release/v1.19` branch and publish a `v1.19.1` tag,
-after bringing the bug fix also to the main branch.
-
-Since the `main` branch is a tip version, if you wish to use Gitea
-in production, please download the latest release tag version. All the
-branches will be protected via GitHub, all the PRs to every branch must
-be reviewed by two maintainers and must pass the automatic tests.
-
-## Releasing Gitea
-
- Let $vmaj, $vmin and $vpat be Major, Minor and Patch version numbers, $vpat should be rc1, rc2, 0, 1, ...... $vmaj.$vmin will be kept the same as milestones on github or gitea in future.
- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
- If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
-  - Create `-dev` tag as `git tag -s -F release.notes v$vmaj.$vmin.0-dev` and push the tag as `git push origin v$vmaj.$vmin.0-dev`.
-  - When CI has finished building tag then you have to create a new branch named `release/v$vmaj.$vmin`
- If it is bugfix version create PR for changelog on branch `release/v$vmaj.$vmin` and wait till it is reviewed and merged.
- Add a tag as `git tag -s -F release.notes v$vmaj.$vmin.$`, release.notes file could be a temporary file to only include the changelog this version which you added to `CHANGELOG.md`.
- And then push the tag as `git push origin v$vmaj.$vmin.$`. Drone CI will automatically create a release and upload all the compiled binary. (But currently it doesn't add the release notes automatically. Maybe we should fix that.)
- If needed send a frontport PR for the changelog to branch `main` and update the version in `docs/config.yaml` to refer to the new version.
- Send PR to [blog repository](https://gitea.com/gitea/blog) announcing the release.
- Verify all release assets were correctly published through CI on dl.gitea.com and GitHub releases. Once ACKed:
-  - bump the version of https://dl.gitea.com/gitea/version.json
-  - merge the blog post PR
-  - announce the release in discord `#announcements`
@@ -3,7 +3,7 @@
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
-COPY package.json pnpm-lock.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
 COPY --exclude=.git/ . .
 RUN make frontend
@@ -12,7 +12,7 @@ RUN make frontend
 FROM docker.io/library/golang:1.26-alpine3.23 AS build-env

 ARG GITEA_VERSION
-ARG TAGS="sqlite sqlite_unlock_notify"
+ARG TAGS=""
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

@@ -21,7 +21,7 @@ RUN apk --no-cache add \
    build-base \
    git

-WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+WORKDIR ${GOPATH}/src/gitea.dev
 COPY go.mod go.sum ./
 RUN go mod download
 # Use COPY instead of bind mount as read-only one breaks makefile state tracking and read-write one needs binary to be moved as it's discarded.
@@ -42,7 +42,7 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
              /tmp/local/etc/s6/gitea/* \
              /tmp/local/etc/s6/openssh/* \
              /tmp/local/etc/s6/.s6-svscan/* \
-              /go/src/code.gitea.io/gitea/gitea
+              /go/src/gitea.dev/gitea

 FROM docker.io/library/alpine:3.23 AS gitea

@@ -74,7 +74,7 @@ RUN addgroup \
  echo "git:*" | chpasswd -e

 COPY --from=build-env /tmp/local /
-COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env /go/src/gitea.dev/gitea /app/gitea/gitea

 ENV USER=git
 ENV GITEA_CUSTOM=/data/gitea
@@ -3,7 +3,7 @@
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
-COPY package.json pnpm-lock.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
 COPY --exclude=.git/ . .
 RUN make frontend
@@ -12,7 +12,7 @@ RUN make frontend
 FROM docker.io/library/golang:1.26-alpine3.23 AS build-env

 ARG GITEA_VERSION
-ARG TAGS="sqlite sqlite_unlock_notify"
+ARG TAGS=""
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

@@ -21,7 +21,7 @@ RUN apk --no-cache add \
    build-base \
    git

-WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+WORKDIR ${GOPATH}/src/gitea.dev
 COPY go.mod go.sum ./
 RUN go mod download
 # See the comments in Dockerfile
@@ -37,7 +37,7 @@ COPY docker/rootless /tmp/local

 # Set permissions for builds that made under windows which strips the executable bit from file
 RUN chmod 755 /tmp/local/usr/local/bin/* \
-              /go/src/code.gitea.io/gitea/gitea
+              /go/src/gitea.dev/gitea

 FROM docker.io/library/alpine:3.23 AS gitea-rootless

@@ -68,7 +68,7 @@ RUN mkdir -p /var/lib/gitea /etc/gitea
 RUN chown git:git /var/lib/gitea /etc/gitea

 COPY --from=build-env /tmp/local /
-COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env --chown=root:root /go/src/gitea.dev/gitea /app/gitea/gitea

 # git:git
 USER 1000:1000
@@ -64,4 +64,4 @@ metiftikci <metiftikci@hotmail.com> (@metiftikci)
 Christopher Homberger <christopher.homberger@web.de> (@ChristopherHX)
 Tobias Balle-Petersen <tobiasbp@gmail.com> (@tobiasbp)
 TheFox <thefox0x7@gmail.com> (@TheFox0x7)
-Nicolas <bircni@icloud.com> (@bircni)
+Nicolas <bircni@icloud.com> (@bircni)
@@ -7,33 +7,44 @@ export GOEXPERIMENT ?= jsonv2

 GO ?= go
 SHASUM ?= shasum -a 256
-HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 COMMA := ,

-XGO_VERSION := go-1.25.x
+XGO_VERSION := go-1.26.x

-AIR_PACKAGE ?= github.com/air-verse/air@v1
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3
-GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.9.2
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15
-MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1
-XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
+AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.0 # renovate: datasource=go
+XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0 # renovate: datasource=go
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
+SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

-DOCKER_IMAGE ?= gitea/gitea
-DOCKER_TAG ?= latest
-DOCKER_REF := $(DOCKER_IMAGE):$(DOCKER_TAG)
+CONTAINER_RUNTIME ?= $(shell hash docker >/dev/null 2>&1 && echo docker || echo podman)

+HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 ifeq ($(HAS_GO), yes)
 	CGO_EXTRA_CFLAGS := -DSQLITE_MAX_VARIABLE_NUMBER=32766
 	CGO_CFLAGS ?= $(shell $(GO) env CGO_CFLAGS) $(CGO_EXTRA_CFLAGS)
 endif

+MAKE_EVIDENCE_DIR := .make_evidence
+
+# Use sqlite as default database if running tests, only do so for local tests, not in CI.
+# CI should explicitly set the database to avoid unexpected results.
+ifneq ($(findstring test-,$(MAKECMDGOALS)),)
+	ifeq ($(CI),)
+		GITEA_TEST_DATABASE ?= sqlite
+	endif
+endif
+
+TAGS ?=
+TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags
+
 CGO_ENABLED ?= 0
-ifneq (,$(findstring sqlite,$(TAGS))$(findstring pam,$(TAGS)))
+ifneq (,$(findstring sqlite_mattn,$(TAGS))$(findstring pam,$(TAGS)))
 	CGO_ENABLED = 1
 endif

@@ -50,15 +61,16 @@ else ifeq ($(patsubst Windows%,Windows,$(OS)),Windows)
 		IS_WINDOWS := yes
 	endif
 endif
+
+# GOFLAGS and EXTRA_GOFLAGS are for the 'go build' command only
 ifeq ($(IS_WINDOWS),yes)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= gitea.exe
-	EXECUTABLE_E2E ?= gitea-e2e.exe
 else
 	GOFLAGS := -v
 	EXECUTABLE ?= gitea
-	EXECUTABLE_E2E ?= gitea-e2e
 endif
+EXTRA_GOFLAGS ?=

 ifeq ($(shell sed --version 2>/dev/null | grep -q GNU && echo gnu),gnu)
 	SED_INPLACE := sed -i
@@ -66,15 +78,8 @@ else
 	SED_INPLACE := sed -i ''
 endif

-EXTRA_GOFLAGS ?=
-
-MAKE_EVIDENCE_DIR := .make_evidence
-
-GOTESTFLAGS ?=
-ifeq ($(RACE_ENABLED),true)
-	GOFLAGS += -race
-	GOTESTFLAGS += -race
-endif
+# GOTEST_FLAGS is for unit test and integration test
+GOTEST_FLAGS ?= -timeout 40m

 STORED_VERSION_FILE := VERSION

@@ -108,8 +113,8 @@ LDFLAGS := $(LDFLAGS) -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"

 LINUX_ARCHS ?= linux/amd64,linux/386,linux/arm-5,linux/arm-6,linux/arm64,linux/riscv64

-GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list code.gitea.io/gitea/models/migrations/...) code.gitea.io/gitea/tests/integration/migration-test code.gitea.io/gitea/tests code.gitea.io/gitea/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
-MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list code.gitea.io/gitea/models/migrations/...)
+GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list gitea.dev/models/migrations/...) gitea.dev/tests/integration/migration-test gitea.dev/tests gitea.dev/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
+MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list gitea.dev/models/migrations/...)

 FRONTEND_SOURCES := $(shell find web_src/js web_src/css -type f)
 FRONTEND_CONFIGS := vite.config.ts tailwind.config.ts
@@ -127,12 +132,6 @@ AIR_TMP_DIR := .air

 GO_LICENSE_FILE := assets/go-licenses.json

-TAGS ?=
-TAGS_SPLIT := $(subst $(COMMA), ,$(TAGS))
-TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags
-
-TEST_TAGS ?= $(TAGS_SPLIT) sqlite sqlite_unlock_notify
-
 TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR)

 GO_DIRS := build cmd models modules routers services tests tools
@@ -151,7 +150,8 @@ ESLINT_CONCURRENCY ?= 2

 SWAGGER_SPEC := templates/swagger/v1_json.tmpl
 SWAGGER_SPEC_INPUT := templates/swagger/v1_input.json
-SWAGGER_EXCLUDE := code.gitea.io/sdk
+SWAGGER_EXCLUDE := gitea.dev/sdk
+OPENAPI3_SPEC := templates/swagger/v1_openapi3_json.tmpl

 TEST_MYSQL_HOST ?= mysql:3306
 TEST_MYSQL_DBNAME ?= testgitea
@@ -164,13 +164,19 @@ TEST_PGSQL_PASSWORD ?= postgres
 TEST_PGSQL_SCHEMA ?= gtestschema
 TEST_MINIO_ENDPOINT ?= minio:9000
 TEST_MSSQL_HOST ?= mssql:1433
-TEST_MSSQL_DBNAME ?= gitea
+TEST_MSSQL_DBNAME ?= testgitea
 TEST_MSSQL_USERNAME ?= sa
 TEST_MSSQL_PASSWORD ?= MwantsaSecurePassword1

 # Include local Makefile
 # Makefile.local is listed in .gitignore
-sinclude Makefile.local
+ifneq ("$(wildcard Makefile.local)","")
+	include Makefile.local
+endif
+
+$(foreach v, $(filter TEST_%, $(.VARIABLES)), $(eval MAKEFILE_VARS+=$v=$($v)))
+$(foreach v, $(filter GITEA_TEST_%, $(.VARIABLES)), $(eval MAKEFILE_VARS+=$v=$($v)))
+export MAKEFILE_VARS

 .PHONY: all
 all: build
@@ -179,15 +185,8 @@ all: build
 help: Makefile ## print Makefile help information.
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m[TARGETS] default target: build\033[0m\n\n\033[35mTargets:\033[0m\n"} /^[0-9A-Za-z._-]+:.*?##/ { printf "  \033[36m%-45s\033[0m %s\n", $$1, $$2 }' Makefile #$(MAKEFILE_LIST)
 	@printf "  \033[36m%-46s\033[0m %s\n" "test-e2e" "test end to end using playwright"
-	@printf "  \033[36m%-46s\033[0m %s\n" "test[#TestSpecificName]" "run unit test"
-	@printf "  \033[36m%-46s\033[0m %s\n" "test-sqlite[#TestSpecificName]" "run integration test for sqlite"
-
-.PHONY: git-check
-git-check:
-	@if git lfs >/dev/null 2>&1 ; then : ; else \
-		echo "Gitea requires git with lfs support to run tests." ; \
-		exit 1; \
-	fi
+	@printf "  \033[36m%-46s\033[0m %s\n" "test-backend[#TestSpecificName]" "run unit test (sqlite only)"
+	@printf "  \033[36m%-46s\033[0m %s\n" "test-integration[#TestSpecificName]" "run integration test for GITEA_TEST_DATABASE (sqlite, mysql, pgsql, mssql)"

 .PHONY: clean-all
 clean-all: clean ## delete backend, frontend and integration files
@@ -195,18 +194,12 @@ clean-all: clean ## delete backend, frontend and integration files

 .PHONY: clean
 clean: ## delete backend and integration files
-	rm -rf $(EXECUTABLE) $(EXECUTABLE_E2E) $(DIST) $(BINDATA_DEST_WILDCARD) \
-		integrations*.test \
-		tests/integration/gitea-integration-* \
-		tests/integration/indexers-* \
-		tests/sqlite.ini tests/mysql.ini tests/pgsql.ini tests/mssql.ini man/ \
-		tests/e2e/gitea-e2e-*/ \
-		tests/e2e/indexers-*/ \
-		tests/e2e/reports/ tests/e2e/test-artifacts/ tests/e2e/test-snapshots/
+	rm -f $(EXECUTABLE) test-*.test tests/*.ini
+	rm -rf  $(DIST) $(BINDATA_DEST_WILDCARD) man tests/integration/gitea-integration-*

 .PHONY: fmt
 fmt: ## format the Go and template code
-	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run tools/code-batch-process.go gitea-fmt -w '{file-list}'
+	$(GO) run $(GOLANGCI_LINT_PACKAGE) fmt
 	$(eval TEMPLATES := $(shell find templates -type f -name '*.tmpl'))
 	@# strip whitespace after '{{' or '(' and before '}}' or ')' unless there is only
 	@# whitespace before it
@@ -234,7 +227,7 @@ TAGS_PREREQ := $(TAGS_EVIDENCE)
 endif

 .PHONY: generate-swagger
-generate-swagger: $(SWAGGER_SPEC) ## generate the swagger spec from code comments
+generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments

 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
 	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'
@@ -256,6 +249,21 @@ swagger-validate: ## check if the swagger spec is valid
 	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
 	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath

+.PHONY: generate-openapi3
+generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec
+
+$(OPENAPI3_SPEC): $(SWAGGER_SPEC) build/generate-openapi.go $(wildcard build/openapi3gen/*.go)
+	$(GO) run build/generate-openapi.go
+
+.PHONY: openapi3-check
+openapi3-check: generate-openapi3
+	@diff=$$(git diff --color=always '$(OPENAPI3_SPEC)'); \
+	if [ -n "$$diff" ]; then \
+		echo "Please run 'make generate-openapi3' and commit the result:"; \
+		printf "%s" "$${diff}"; \
+		exit 1; \
+	fi
+
 .PHONY: checks
 checks: checks-frontend checks-backend ## run various consistency checks

@@ -263,10 +271,10 @@ checks: checks-frontend checks-backend ## run various consistency checks
 checks-frontend: lockfile-check svg-check ## check frontend files

 .PHONY: checks-backend
-checks-backend: tidy-check swagger-check fmt-check swagger-validate security-check ## check backend files
+checks-backend: tidy-check swagger-check openapi3-check fmt-check swagger-validate security-check ## check backend files

 .PHONY: lint
-lint: lint-frontend lint-backend lint-spell ## lint everything
+lint: lint-frontend lint-backend lint-templates lint-swagger lint-spell lint-md lint-actions lint-json lint-yaml lint-shell ## lint everything

 .PHONY: lint-fix
 lint-fix: lint-frontend-fix lint-backend-fix lint-spell-fix ## lint everything and fix issues
@@ -278,10 +286,10 @@ lint-frontend: lint-js lint-css ## lint frontend files
 lint-frontend-fix: lint-js-fix lint-css-fix ## lint frontend files and fix issues

 .PHONY: lint-backend
-lint-backend: lint-go lint-go-gitea-vet lint-editorconfig ## lint backend files
+lint-backend: lint-go lint-editorconfig ## lint backend files

 .PHONY: lint-backend-fix
-lint-backend-fix: lint-go-fix lint-go-gitea-vet lint-editorconfig ## lint backend files and fix issues
+lint-backend-fix: lint-go-fix lint-editorconfig ## lint backend files and fix issues

 .PHONY: lint-js
 lint-js: node_modules ## lint js and ts files
@@ -323,23 +331,11 @@ lint-spell-fix: ## lint spelling and fix issues

 .PHONY: lint-go
 lint-go: ## lint go files
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
+	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go

 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
-
-# workaround step for the lint-go-windows CI task because 'go run' can not
-# have distinct GOOS/GOARCH for its build and run steps
-.PHONY: lint-go-windows
-lint-go-windows:
-	@GOOS= GOARCH= $(GO) install $(GOLANGCI_LINT_PACKAGE)
-	golangci-lint run
-
-.PHONY: lint-go-gitea-vet
-lint-go-gitea-vet: ## lint go files with gitea-vet
-	@echo "Running gitea-vet..."
-	@$(GO) vet -vettool="$(shell GOOS= GOARCH= go tool -n gitea-vet)" ./...
+	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go --fix

 .PHONY: lint-editorconfig
 lint-editorconfig:
@@ -347,8 +343,13 @@ lint-editorconfig:
 	@$(GO) run $(EDITORCONFIG_CHECKER_PACKAGE) $(EDITORCONFIG_FILES)

 .PHONY: lint-actions
-lint-actions: ## lint action workflow files
-	$(GO) run $(ACTIONLINT_PACKAGE)
+lint-actions: .venv ## lint action workflow files
+	@$(GO) run $(ACTIONLINT_PACKAGE)
+	@uv run --frozen zizmor --quiet --min-confidence=medium .github
+
+.PHONY: lint-shell
+lint-shell: ## lint shell scripts
+	@SHELLCHECK_IMAGE=$(SHELLCHECK_IMAGE) CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) ./tools/lint-shell.sh $$(git ls-files '*.sh')

 .PHONY: lint-templates
 lint-templates: .venv node_modules ## lint template files
@@ -379,13 +380,10 @@ watch-frontend: node_modules ## start vite dev server for frontend
 watch-backend: ## watch backend files and continuously rebuild
 	GITEA_RUN_MODE=dev $(GO) run $(AIR_PACKAGE) -c .air.toml

-.PHONY: test
-test: test-frontend test-backend ## test everything
-
 .PHONY: test-backend
 test-backend: ## test backend files
-	@echo "Running go test with $(GOTESTFLAGS) -tags '$(TEST_TAGS)'..."
-	@$(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' $(GO_TEST_PACKAGES)
+	@echo "Running go test with $(GOTEST_FLAGS) -tags '$(TAGS)'..."
+	@$(GO) test $(GOTEST_FLAGS) -tags='$(TAGS)' $(GO_TEST_PACKAGES)

 .PHONY: test-frontend
 test-frontend: node_modules ## test frontend files
@@ -403,10 +401,10 @@ test-check:
 		exit 1; \
 	fi

-.PHONY: test\#%
-test\#%:
-	@echo "Running go test with -tags '$(TEST_TAGS)'..."
-	@$(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -run $(subst .,/,$*) $(GO_TEST_PACKAGES)
+.PHONY: test-backend\#%
+test-backend\#%:
+	@echo "Running go test with -tags '$(TAGS)'..."
+	@$(GO) test $(GOTEST_FLAGS) -tags='$(TAGS)' -run $(subst .,/,$*) $(GO_TEST_PACKAGES)

 .PHONY: coverage
 coverage:
@@ -416,8 +414,8 @@ coverage:

 .PHONY: unit-test-coverage
 unit-test-coverage:
-	@echo "Running unit-test-coverage $(GOTESTFLAGS) -tags '$(TEST_TAGS)'..."
-	@$(GO) test $(GOTESTFLAGS) -timeout=20m -tags='$(TEST_TAGS)' -cover -coverprofile coverage.out $(GO_TEST_PACKAGES) && echo "\n==>\033[32m Ok\033[m\n" || exit 1
+	@echo "Running unit-test-coverage $(GOTEST_FLAGS) -tags '$(TAGS)'..."
+	@$(GO) test $(GOTEST_FLAGS) -tags='$(TAGS)' -cover -coverprofile coverage.out $(GO_TEST_PACKAGES) && echo "\n==>\033[32m Ok\033[m\n" || exit 1

 .PHONY: tidy
 tidy: ## run go mod tidy
@@ -444,193 +442,45 @@ go-licenses: $(GO_LICENSE_FILE) ## regenerate go licenses
 $(GO_LICENSE_FILE): go.mod go.sum
 	GO=$(GO) $(GO) run build/generate-go-licenses.go $(GO_LICENSE_FILE)

-generate-ini-sqlite:
-	sed -e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-sqlite|g' \
-		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
-			tests/sqlite.ini.tmpl > tests/sqlite.ini
+.PHONY: test-integration
+test-integration:
+	@# Use a compiled binary: testlogger forwards gitea logs to t.Log, so `go test -v`
+	@# would flood output per passing test. testcache can't help these tests anyway —
+	@# they mutate the work directory, so cache inputs change between runs.
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -c gitea.dev/tests/integration -o ./test-integration-$(GITEA_TEST_DATABASE).test
+	./tools/test-integration.sh ./test-integration-$(GITEA_TEST_DATABASE).test

-.PHONY: test-sqlite
-test-sqlite: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test
+.PHONY: test-integration-compile
+test-integration-compile:
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -c -o /dev/null gitea.dev/tests/integration

-.PHONY: test-sqlite\#%
-test-sqlite\#%: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.run $(subst .,/,$*)
+.PHONY: test-integration\#%
+test-integration\#%:
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -run $(subst .,/,$*) gitea.dev/tests/integration

-.PHONY: test-sqlite-migration
-test-sqlite-migration:  migrations.sqlite.test migrations.individual.sqlite.test
+.PHONY: test-migration
+test-migration: migrations.integration.test migrations.individual.test

-generate-ini-mysql:
-	sed -e 's|{{TEST_MYSQL_HOST}}|${TEST_MYSQL_HOST}|g' \
-		-e 's|{{TEST_MYSQL_DBNAME}}|${TEST_MYSQL_DBNAME}|g' \
-		-e 's|{{TEST_MYSQL_USERNAME}}|${TEST_MYSQL_USERNAME}|g' \
-		-e 's|{{TEST_MYSQL_PASSWORD}}|${TEST_MYSQL_PASSWORD}|g' \
-		-e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-mysql|g' \
-		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
-			tests/mysql.ini.tmpl > tests/mysql.ini
+.PHONY: migrations.integration.test
+migrations.integration.test:
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/tests/integration/migration-test

-.PHONY: test-mysql
-test-mysql: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test
+.PHONY: migrations.individual.test
+migrations.individual.test:
+	@# tests of multiple packages use the same database, don't run in parallel
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

-.PHONY: test-mysql\#%
-test-mysql\#%: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test -test.run $(subst .,/,$*)
-
-.PHONY: test-mysql-migration
-test-mysql-migration: migrations.mysql.test migrations.individual.mysql.test
-
-generate-ini-pgsql:
-	sed -e 's|{{TEST_PGSQL_HOST}}|${TEST_PGSQL_HOST}|g' \
-		-e 's|{{TEST_PGSQL_DBNAME}}|${TEST_PGSQL_DBNAME}|g' \
-		-e 's|{{TEST_PGSQL_USERNAME}}|${TEST_PGSQL_USERNAME}|g' \
-		-e 's|{{TEST_PGSQL_PASSWORD}}|${TEST_PGSQL_PASSWORD}|g' \
-		-e 's|{{TEST_PGSQL_SCHEMA}}|${TEST_PGSQL_SCHEMA}|g' \
-		-e 's|{{TEST_MINIO_ENDPOINT}}|${TEST_MINIO_ENDPOINT}|g' \
-		-e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-pgsql|g' \
-		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
-			tests/pgsql.ini.tmpl > tests/pgsql.ini
-
-.PHONY: test-pgsql
-test-pgsql: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test
-
-.PHONY: test-pgsql\#%
-test-pgsql\#%: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.run $(subst .,/,$*)
-
-.PHONY: test-pgsql-migration
-test-pgsql-migration: migrations.pgsql.test migrations.individual.pgsql.test
-
-generate-ini-mssql:
-	sed -e 's|{{TEST_MSSQL_HOST}}|${TEST_MSSQL_HOST}|g' \
-		-e 's|{{TEST_MSSQL_DBNAME}}|${TEST_MSSQL_DBNAME}|g' \
-		-e 's|{{TEST_MSSQL_USERNAME}}|${TEST_MSSQL_USERNAME}|g' \
-		-e 's|{{TEST_MSSQL_PASSWORD}}|${TEST_MSSQL_PASSWORD}|g' \
-		-e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-mssql|g' \
-		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
-			tests/mssql.ini.tmpl > tests/mssql.ini
-
-.PHONY: test-mssql
-test-mssql: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test
-
-.PHONY: test-mssql\#%
-test-mssql\#%: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test -test.run $(subst .,/,$*)
-
-.PHONY: test-mssql-migration
-test-mssql-migration: migrations.mssql.test migrations.individual.mssql.test
+.PHONY: migrations.individual.test\#%
+migrations.individual.test\#%:
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/models/migrations/$*

 .PHONY: playwright
 playwright: deps-frontend
-	@# on GitHub Actions VMs, playwright's system deps are pre-installed
-	@pnpm exec playwright install $(if $(GITHUB_ACTIONS),,--with-deps) chromium firefox $(PLAYWRIGHT_FLAGS)
+	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) ./tools/test-e2e.sh install

 .PHONY: test-e2e
-test-e2e: playwright $(EXECUTABLE_E2E)
-	@EXECUTABLE=$(EXECUTABLE_E2E) ./tools/test-e2e.sh $(GITEA_TEST_E2E_FLAGS)
-
-.PHONY: bench-sqlite
-bench-sqlite: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
-
-.PHONY: bench-mysql
-bench-mysql: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
-
-.PHONY: bench-mssql
-bench-mssql: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
-
-.PHONY: bench-pgsql
-bench-pgsql: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
-
-.PHONY: integration-test-coverage
-integration-test-coverage: integrations.cover.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.cover.test -test.coverprofile=integration.coverage.out
-
-.PHONY: integration-test-coverage-sqlite
-integration-test-coverage-sqlite: integrations.cover.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.cover.sqlite.test -test.coverprofile=integration.coverage.out
-
-integrations.mysql.test: git-check $(GO_SOURCES)
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.mysql.test
-
-integrations.pgsql.test: git-check $(GO_SOURCES)
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.pgsql.test
-
-integrations.mssql.test: git-check $(GO_SOURCES)
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.mssql.test
-
-integrations.sqlite.test: git-check $(GO_SOURCES)
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.sqlite.test -tags '$(TEST_TAGS)'
-
-integrations.cover.test: git-check $(GO_SOURCES)
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -coverpkg $(shell echo $(GO_TEST_PACKAGES) | tr ' ' ',') -o integrations.cover.test
-
-integrations.cover.sqlite.test: git-check $(GO_SOURCES)
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -coverpkg $(shell echo $(GO_TEST_PACKAGES) | tr ' ' ',') -o integrations.cover.sqlite.test -tags '$(TEST_TAGS)'
-
-.PHONY: migrations.mysql.test
-migrations.mysql.test: $(GO_SOURCES) generate-ini-mysql
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mysql.test
-	GITEA_TEST_CONF=tests/mysql.ini ./migrations.mysql.test
-
-.PHONY: migrations.pgsql.test
-migrations.pgsql.test: $(GO_SOURCES) generate-ini-pgsql
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.pgsql.test
-	GITEA_TEST_CONF=tests/pgsql.ini ./migrations.pgsql.test
-
-.PHONY: migrations.mssql.test
-migrations.mssql.test: $(GO_SOURCES) generate-ini-mssql
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mssql.test
-	GITEA_TEST_CONF=tests/mssql.ini ./migrations.mssql.test
-
-.PHONY: migrations.sqlite.test
-migrations.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
-	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.sqlite.test -tags '$(TEST_TAGS)'
-	GITEA_TEST_CONF=tests/sqlite.ini ./migrations.sqlite.test
-
-.PHONY: migrations.individual.mysql.test
-migrations.individual.mysql.test: $(GO_SOURCES) generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
-
-.PHONY: migrations.individual.sqlite.test\#%
-migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
-
-.PHONY: migrations.individual.pgsql.test
-migrations.individual.pgsql.test: $(GO_SOURCES) generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
-
-.PHONY: migrations.individual.pgsql.test\#%
-migrations.individual.pgsql.test\#%: $(GO_SOURCES) generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
-
-.PHONY: migrations.individual.mssql.test
-migrations.individual.mssql.test: $(GO_SOURCES) generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
-
-.PHONY: migrations.individual.mssql.test\#%
-migrations.individual.mssql.test\#%: $(GO_SOURCES) generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
-
-.PHONY: migrations.individual.sqlite.test
-migrations.individual.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
-
-.PHONY: migrations.individual.sqlite.test\#%
-migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
-
-.PHONY: check
-check: test
-
-.PHONY: install $(TAGS_PREREQ)
-install: $(wildcard *.go)
-	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) install -v -tags '$(TAGS)' -ldflags '-s -w $(LDFLAGS)'
+test-e2e: playwright frontend backend
+	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) EXECUTABLE=$(EXECUTABLE) ./tools/test-e2e.sh run $(GITEA_TEST_E2E_FLAGS)

 .PHONY: build
 build: frontend backend ## build everything
@@ -663,9 +513,6 @@ ifneq ($(and $(STATIC),$(findstring pam,$(TAGS))),)
 endif
 	CGO_ENABLED="$(CGO_ENABLED)" CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@

-$(EXECUTABLE_E2E): $(GO_SOURCES) $(FRONTEND_DEST)
-	CGO_ENABLED=1 $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TEST_TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@
-
 .PHONY: release
 release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-check

@@ -730,7 +577,6 @@ deps-backend: ## install backend dependencies
 deps-tools: ## install tool dependencies
 	$(GO) install $(AIR_PACKAGE) & \
 	$(GO) install $(EDITORCONFIG_CHECKER_PACKAGE) & \
-	$(GO) install $(GOFUMPT_PACKAGE) & \
 	$(GO) install $(GOLANGCI_LINT_PACKAGE) & \
 	$(GO) install $(GXZ_PACKAGE) & \
 	$(GO) install $(MISSPELL_PACKAGE) & \
@@ -761,8 +607,6 @@ update-js: node_modules ## update js dependencies
 	pnpm exec updates -u -f package.json
 	rm -rf node_modules pnpm-lock.yaml
 	pnpm install
-	pnpm exec nolyfill install
-	pnpm install
 	@touch node_modules

 .PHONY: update-py
@@ -816,6 +660,10 @@ generate-gitignore: ## update gitignore files
 generate-images: | node_modules ## generate images
 	cd tools && node generate-images.ts $(TAGS)

+.PHONY: generate-codemirror-languages
+generate-codemirror-languages: | node_modules ## generate codemirror languages
+	node tools/generate-codemirror-languages.ts
+
 .PHONY: generate-manpage
 generate-manpage: ## generate manpage
 	@[ -f gitea ] || make backend
@@ -824,11 +672,6 @@ generate-manpage: ## generate manpage
 	@gzip -9 man/man1/gitea.1 && echo man/man1/gitea.1.gz created
 	@#TODO A small script that formats config-cheat-sheet.en-us.md nicely for use as a config man page

-.PHONY: docker
-docker:
-	docker build --disable-content-trust=false -t $(DOCKER_REF) .
-# support also build args docker build --build-arg GITEA_VERSION=v1.2.3 --build-arg TAGS="bindata sqlite sqlite_unlock_notify"  .
-
 # Disable parallel execution because it would break some targets that don't
 # specify exact dependencies like 'backend' which does currently not depend
 # on 'frontend' to enable Node.js-less builds from source tarballs.
@@ -2,8 +2,8 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
+[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
@@ -44,10 +44,6 @@ From the root of the source tree, run:

    TAGS="bindata" make build

-or if SQLite support is required:
-
-    TAGS="bindata sqlite sqlite_unlock_notify" make build
-
 The `build` target is split into two sub-targets:

 - `make backend` which requires [Go Stable](https://go.dev/dl/), the required version is defined in [go.mod](/go.mod).
@@ -2,8 +2,8 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
+[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
@@ -38,10 +38,6 @@

    TAGS="bindata" make build

-如果需要 SQLite 支持：
-
-    TAGS="bindata sqlite sqlite_unlock_notify" make build
-
 `build` 目标分为两个子目标：

 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定义。
@@ -2,8 +2,8 @@

 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
+[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
@@ -38,10 +38,6 @@

    TAGS="bindata" make build

-如果需要 SQLite 支援：
-
-    TAGS="bindata sqlite sqlite_unlock_notify" make build
-
 `build` 目標分為兩個子目標：

 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定義。
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"

-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 )

 func main() {
@@ -20,7 +20,7 @@ import (
 	"strings"
 	"unicode/utf8"

-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )

 const (
@@ -1,3 +1,6 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
 //go:build ignore

 package main
@@ -15,7 +18,7 @@ import (
 	"path/filepath"
 	"strings"

-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )

 func main() {
@@ -19,6 +19,7 @@ import (

 // regexp is based on go-license, excluding README and NOTICE
 // https://github.com/google/go-licenses/blob/master/licenses/find.go
+// also defined in vite.config.ts
 var licenseRe = regexp.MustCompile(`^(?i)((UN)?LICEN(S|C)E|COPYING).*$`)

 // primaryLicenseRe matches exact primary license filenames without suffixes.
@@ -28,8 +29,8 @@ var primaryLicenseRe = regexp.MustCompile(`^(?i)(LICEN[SC]E|COPYING)$`)

 // ignoredNames are LicenseEntry.Name values to exclude from the output.
 var ignoredNames = map[string]bool{
-	"code.gitea.io/gitea":                 true,
-	"code.gitea.io/gitea/options/license": true,
+	"gitea.dev":                 true,
+	"gitea.dev/options/license": true,
 }

 var excludedExt = map[string]bool{
@@ -0,0 +1,97 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// generate-openapi converts Gitea's Swagger 2.0 spec into an OpenAPI 3.0 spec.
+//
+// Gitea generates a Swagger 2.0 spec from code annotations (make generate-swagger).
+// This tool converts it to OAS3 so that SDK generators and tools that require
+// OAS3 (e.g. progenitor for Rust) can consume it directly. The conversion also
+// deduplicates inline enum definitions into named schema components, producing
+// cleaner SDK output with proper enum types instead of anonymous strings.
+//
+// Run: go run build/generate-openapi.go
+// Output: templates/swagger/v1_openapi3_json.tmpl
+
+//go:build ignore
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"regexp"
+	"sort"
+	"strings"
+
+	"gitea.dev/build/openapi3gen"
+
+	"github.com/getkin/kin-openapi/openapi3"
+)
+
+const (
+	swaggerSpecPath = "templates/swagger/v1_json.tmpl"
+	openapi3OutPath = "templates/swagger/v1_openapi3_json.tmpl"
+
+	appSubUrlVar = "{{.SwaggerAppSubUrl}}"
+	appVerVar    = "{{.SwaggerAppVer}}"
+
+	appSubUrlPlaceholder = "GITEA_APP_SUB_URL_PLACEHOLDER"
+	appVerPlaceholder    = "0.0.0-gitea-placeholder"
+)
+
+var (
+	appSubUrlRe = regexp.MustCompile(regexp.QuoteMeta(appSubUrlVar))
+	appVerRe    = regexp.MustCompile(regexp.QuoteMeta(appVerVar))
+
+	enumScanDirs = []string{
+		"modules/structs",
+		"modules/commitstatus",
+	}
+)
+
+func main() {
+	astEnumMap, err := openapi3gen.ScanSwaggerEnumTypes(enumScanDirs)
+	if err != nil {
+		log.Fatalf("scanning swagger:enum annotations: %v", err)
+	}
+	names := make([]string, 0, len(astEnumMap))
+	for _, n := range astEnumMap {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	fmt.Fprintf(os.Stderr, "discovered %d swagger:enum types: %s\n", len(names), strings.Join(names, ", "))
+
+	data, err := os.ReadFile(swaggerSpecPath)
+	if err != nil {
+		log.Fatalf("reading swagger spec: %v", err)
+	}
+
+	cleaned := appSubUrlRe.ReplaceAll(data, []byte(appSubUrlPlaceholder))
+	cleaned = appVerRe.ReplaceAll(cleaned, []byte(appVerPlaceholder))
+
+	oas3, err := openapi3gen.Convert(cleaned, astEnumMap)
+	if err != nil {
+		log.Fatalf("converting to openapi 3.0: %v", err)
+	}
+
+	oas3.Servers = openapi3.Servers{
+		{URL: appSubUrlPlaceholder + "/api/v1"},
+	}
+
+	out, err := json.MarshalIndent(oas3, "", "  ")
+	if err != nil {
+		log.Fatalf("marshaling openapi 3.0: %v", err)
+	}
+
+	result := strings.ReplaceAll(string(out), appSubUrlPlaceholder, appSubUrlVar)
+	result = strings.ReplaceAll(result, appVerPlaceholder, appVerVar)
+	result = strings.TrimSpace(result)
+
+	if err := os.WriteFile(openapi3OutPath, []byte(result), 0o644); err != nil {
+		log.Fatalf("writing openapi 3.0 spec: %v", err)
+	}
+
+	fmt.Printf("Generated %s\n", openapi3OutPath)
+}
@@ -0,0 +1,281 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package openapi3gen
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"gitea.dev/modules/json"
+
+	"github.com/getkin/kin-openapi/openapi2"
+	"github.com/getkin/kin-openapi/openapi2conv"
+	"github.com/getkin/kin-openapi/openapi3"
+)
+
+// rxDeprecated matches "deprecated" as a word at the start of a description
+// or preceded by whitespace/punctuation that indicates a leading marker (e.g.
+// "Deprecated: true", "deprecated (use X instead)"). Rejects negated phrases
+// like "not deprecated" or "previously deprecated, now supported".
+var rxDeprecated = regexp.MustCompile(`(?i)(?:^|[\n.;])\s*deprecated\b`)
+
+// Convert parses a Swagger 2.0 spec and returns an OAS3 spec, applying
+// Gitea-specific post-processing: file-schema fixups, URI formats,
+// deprecated flags, and shared-enum extraction.
+//
+// astEnumMap is a value-set-key → Go-type-name map (built by
+// ScanSwaggerEnumTypes). If a shared enum in the spec has no entry in the
+// map, Convert returns an error — no fallback naming.
+func Convert(swaggerJSON []byte, astEnumMap map[string]string) (*openapi3.T, error) {
+	var swagger2 openapi2.T
+	if err := json.Unmarshal(swaggerJSON, &swagger2); err != nil {
+		return nil, fmt.Errorf("parsing swagger 2.0: %w", err)
+	}
+
+	oas3, err := openapi2conv.ToV3(&swagger2)
+	if err != nil {
+		return nil, fmt.Errorf("converting to openapi 3.0: %w", err)
+	}
+
+	fixFileSchemas(oas3)
+	addURIFormats(oas3)
+	addDeprecatedFlags(oas3)
+	if err := extractSharedEnums(oas3, astEnumMap); err != nil {
+		return nil, err
+	}
+	return oas3, nil
+}
+
+func fixFileSchemas(doc *openapi3.T) {
+	for _, pathItem := range doc.Paths.Map() {
+		for _, op := range []*openapi3.Operation{
+			pathItem.Get, pathItem.Post, pathItem.Put, pathItem.Patch,
+			pathItem.Delete, pathItem.Head, pathItem.Options, pathItem.Trace,
+		} {
+			if op == nil {
+				continue
+			}
+			for _, resp := range op.Responses.Map() {
+				if resp.Value == nil {
+					continue
+				}
+				for _, mediaType := range resp.Value.Content {
+					fixSchema(mediaType.Schema)
+				}
+			}
+			if op.RequestBody != nil && op.RequestBody.Value != nil {
+				for _, mediaType := range op.RequestBody.Value.Content {
+					fixSchema(mediaType.Schema)
+				}
+			}
+		}
+	}
+}
+
+// fixSchema rewrites any "type: file" schemas to the OAS3 equivalent
+// (type: string, format: binary), recursing into Properties, Items, and
+// AllOf/OneOf/AnyOf/Not branches. $ref nodes are skipped so shared schemas
+// are rewritten exactly once when visited through their declaration.
+func fixSchema(ref *openapi3.SchemaRef) {
+	if ref == nil || ref.Value == nil || ref.Ref != "" {
+		return
+	}
+	s := ref.Value
+	if s.Type.Is("file") {
+		s.Type = &openapi3.Types{"string"}
+		s.Format = "binary"
+	}
+	for _, p := range s.Properties {
+		fixSchema(p)
+	}
+	fixSchema(s.Items)
+	for _, sub := range s.AllOf {
+		fixSchema(sub)
+	}
+	for _, sub := range s.OneOf {
+		fixSchema(sub)
+	}
+	for _, sub := range s.AnyOf {
+		fixSchema(sub)
+	}
+	fixSchema(s.Not)
+}
+
+// addURIFormats sets format: uri on string properties whose names indicate
+// they hold URLs. This information is lost in Swagger 2.0 but is valuable
+// for code generators.
+func addURIFormats(doc *openapi3.T) {
+	if doc.Components == nil {
+		return
+	}
+	for _, schemaRef := range doc.Components.Schemas {
+		if schemaRef.Value == nil {
+			continue
+		}
+		for propName, propRef := range schemaRef.Value.Properties {
+			if propRef == nil || propRef.Value == nil || propRef.Ref != "" {
+				continue
+			}
+			prop := propRef.Value
+			if !prop.Type.Is("string") || prop.Format != "" {
+				continue
+			}
+			if isURLProperty(propName) {
+				prop.Format = "uri"
+			}
+		}
+	}
+}
+
+func isURLProperty(name string) bool {
+	if strings.HasSuffix(name, "_url") {
+		return true
+	}
+	switch name {
+	case "url", "html_url", "clone_url":
+		return true
+	}
+	return false
+}
+
+// addDeprecatedFlags sets deprecated: true on schema properties whose
+// description starts with a "deprecated" marker (e.g. "Deprecated: true"
+// or "deprecated (use X instead)"). Does not match negated phrases.
+func addDeprecatedFlags(doc *openapi3.T) {
+	if doc.Components == nil {
+		return
+	}
+	for _, schemaRef := range doc.Components.Schemas {
+		if schemaRef.Value == nil {
+			continue
+		}
+		for _, propRef := range schemaRef.Value.Properties {
+			if propRef == nil || propRef.Value == nil || propRef.Ref != "" {
+				continue
+			}
+			if rxDeprecated.MatchString(propRef.Value.Description) {
+				propRef.Value.Deprecated = true
+			}
+		}
+	}
+}
+
+type enumUsage struct {
+	schemaName string
+	propName   string
+	propRef    *openapi3.SchemaRef
+	inItems    bool
+}
+
+// extractSharedEnums finds identical enum arrays used by multiple schema
+// properties, creates a standalone named schema for each, and replaces
+// the inline enums with $ref pointers.
+//
+// If the derived enum name collides with an existing component schema, or
+// no // swagger:enum annotation matches the value set, generation aborts
+// with an actionable error — there are no silent fallbacks.
+func extractSharedEnums(doc *openapi3.T, astEnumMap map[string]string) error {
+	if doc.Components == nil {
+		return nil
+	}
+
+	enumGroups := map[string][]enumUsage{}
+
+	for schemaName, schemaRef := range doc.Components.Schemas {
+		if schemaRef.Value == nil {
+			continue
+		}
+		for propName, propRef := range schemaRef.Value.Properties {
+			if propRef == nil || propRef.Value == nil || propRef.Ref != "" {
+				continue
+			}
+			if len(propRef.Value.Enum) > 1 && propRef.Value.Type.Is("string") {
+				key := EnumKey(propRef.Value.Enum)
+				enumGroups[key] = append(enumGroups[key], enumUsage{schemaName, propName, propRef, false})
+			}
+			if propRef.Value.Type.Is("array") && propRef.Value.Items != nil &&
+				propRef.Value.Items.Value != nil && propRef.Value.Items.Ref == "" &&
+				len(propRef.Value.Items.Value.Enum) > 1 && propRef.Value.Items.Value.Type.Is("string") {
+				key := EnumKey(propRef.Value.Items.Value.Enum)
+				enumGroups[key] = append(enumGroups[key], enumUsage{schemaName, propName, propRef, true})
+			}
+		}
+	}
+
+	for key, usages := range enumGroups {
+		if len(usages) < 2 {
+			continue
+		}
+
+		enumName, err := deriveEnumName(key, usages, astEnumMap)
+		if err != nil {
+			return err
+		}
+		if _, exists := doc.Components.Schemas[enumName]; exists {
+			return fmt.Errorf("enum name collision: %s already exists as a component schema", enumName)
+		}
+
+		var enumValues []any
+		if usages[0].inItems {
+			enumValues = usages[0].propRef.Value.Items.Value.Enum
+		} else {
+			enumValues = usages[0].propRef.Value.Enum
+		}
+
+		doc.Components.Schemas[enumName] = &openapi3.SchemaRef{
+			Value: &openapi3.Schema{
+				Type: &openapi3.Types{"string"},
+				Enum: enumValues,
+			},
+		}
+
+		ref := "#/components/schemas/" + enumName
+
+		for _, usage := range usages {
+			if usage.inItems {
+				usage.propRef.Value.Items = &openapi3.SchemaRef{Ref: ref}
+			} else {
+				old := usage.propRef.Value
+				if old.Description == "" && !old.Deprecated && old.Format == "" {
+					usage.propRef.Ref = ref
+					usage.propRef.Value = nil
+				} else {
+					usage.propRef.Value = &openapi3.Schema{
+						AllOf: openapi3.SchemaRefs{
+							{Ref: ref},
+						},
+						Description: old.Description,
+						Deprecated:  old.Deprecated,
+						Format:      old.Format,
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// deriveEnumName looks up a shared enum's Go type name from astEnumMap by
+// value-set key. If no annotation matches, returns an error identifying the
+// offending properties and the fix.
+func deriveEnumName(key string, usages []enumUsage, astEnumMap map[string]string) (string, error) {
+	if name, ok := astEnumMap[key]; ok {
+		return name, nil
+	}
+
+	props := map[string]bool{}
+	for _, u := range usages {
+		props[fmt.Sprintf("%s.%s", u.schemaName, u.propName)] = true
+	}
+	propList := make([]string, 0, len(props))
+	for p := range props {
+		propList = append(propList, p)
+	}
+	return "", fmt.Errorf(
+		"no swagger:enum annotation matches value-set %q used by %d properties: %v; "+
+			"fix by adding a named string type with // swagger:enum to modules/structs or modules/commitstatus",
+		key, len(usages), propList,
+	)
+}
@@ -0,0 +1,170 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package openapi3gen
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/getkin/kin-openapi/openapi3"
+)
+
+func TestDeriveEnumName_hit(t *testing.T) {
+	key := EnumKey([]any{"red", "green", "blue"})
+	astMap := map[string]string{key: "Color"}
+	usages := []enumUsage{{schemaName: "Paint", propName: "color"}}
+	got, err := deriveEnumName(key, usages, astMap)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "Color" {
+		t.Fatalf("got %q, want %q", got, "Color")
+	}
+}
+
+func TestDeriveEnumName_miss(t *testing.T) {
+	key := EnumKey([]any{"x", "y"})
+	usages := []enumUsage{{schemaName: "Thing", propName: "kind"}}
+	_, err := deriveEnumName(key, usages, map[string]string{})
+	if err == nil {
+		t.Fatal("expected miss error, got nil")
+	}
+	msg := err.Error()
+	if !strings.Contains(msg, "Thing.kind") {
+		t.Fatalf("error %q should list the missing usage", msg)
+	}
+	if !strings.Contains(msg, "swagger:enum") {
+		t.Fatalf("error %q should hint at the fix", msg)
+	}
+}
+
+func TestExtractSharedEnums_usesASTMap(t *testing.T) {
+	doc := &openapi3.T{
+		Components: &openapi3.Components{
+			Schemas: openapi3.Schemas{
+				"A": {Value: &openapi3.Schema{
+					Type: &openapi3.Types{"object"},
+					Properties: openapi3.Schemas{
+						"color": {Value: &openapi3.Schema{
+							Type: &openapi3.Types{"string"},
+							Enum: []any{"red", "green", "blue"},
+						}},
+					},
+				}},
+				"B": {Value: &openapi3.Schema{
+					Type: &openapi3.Types{"object"},
+					Properties: openapi3.Schemas{
+						"color": {Value: &openapi3.Schema{
+							Type: &openapi3.Types{"string"},
+							Enum: []any{"red", "green", "blue"},
+						}},
+					},
+				}},
+			},
+		},
+	}
+	astMap := map[string]string{EnumKey([]any{"red", "green", "blue"}): "Color"}
+	if err := extractSharedEnums(doc, astMap); err != nil {
+		t.Fatalf("extractSharedEnums: %v", err)
+	}
+	if _, ok := doc.Components.Schemas["Color"]; !ok {
+		t.Fatalf("expected Color schema to be extracted")
+	}
+}
+
+func TestFixFileSchemas_recursesIntoNested(t *testing.T) {
+	fileType := func() *openapi3.SchemaRef {
+		return &openapi3.SchemaRef{Value: &openapi3.Schema{Type: &openapi3.Types{"file"}}}
+	}
+	doc := &openapi3.T{
+		Paths: openapi3.NewPaths(),
+	}
+	doc.Paths.Set("/upload", &openapi3.PathItem{
+		Post: &openapi3.Operation{
+			RequestBody: &openapi3.RequestBodyRef{
+				Value: &openapi3.RequestBody{
+					Content: openapi3.Content{
+						"multipart/form-data": {
+							Schema: &openapi3.SchemaRef{Value: &openapi3.Schema{
+								Type: &openapi3.Types{"object"},
+								Properties: openapi3.Schemas{
+									"attachment": fileType(),
+									"items": {Value: &openapi3.Schema{
+										Type:  &openapi3.Types{"array"},
+										Items: fileType(),
+									}},
+									"alt": {Value: &openapi3.Schema{
+										AllOf: openapi3.SchemaRefs{fileType()},
+									}},
+									"one": {Value: &openapi3.Schema{
+										OneOf: openapi3.SchemaRefs{fileType()},
+									}},
+									"any": {Value: &openapi3.Schema{
+										AnyOf: openapi3.SchemaRefs{fileType()},
+									}},
+									"not": {Value: &openapi3.Schema{
+										Not: fileType(),
+									}},
+								},
+							}},
+						},
+					},
+				},
+			},
+			Responses: openapi3.NewResponses(),
+		},
+	})
+
+	fixFileSchemas(doc)
+
+	props := doc.Paths.Value("/upload").Post.RequestBody.Value.Content["multipart/form-data"].Schema.Value.Properties
+	if !props["attachment"].Value.Type.Is("string") || props["attachment"].Value.Format != "binary" {
+		t.Errorf("nested property not fixed: %+v", props["attachment"].Value)
+	}
+	if !props["items"].Value.Items.Value.Type.Is("string") || props["items"].Value.Items.Value.Format != "binary" {
+		t.Errorf("array items not fixed: %+v", props["items"].Value.Items.Value)
+	}
+	if !props["alt"].Value.AllOf[0].Value.Type.Is("string") || props["alt"].Value.AllOf[0].Value.Format != "binary" {
+		t.Errorf("allOf branch not fixed: %+v", props["alt"].Value.AllOf[0].Value)
+	}
+	if !props["one"].Value.OneOf[0].Value.Type.Is("string") || props["one"].Value.OneOf[0].Value.Format != "binary" {
+		t.Errorf("oneOf branch not fixed: %+v", props["one"].Value.OneOf[0].Value)
+	}
+	if !props["any"].Value.AnyOf[0].Value.Type.Is("string") || props["any"].Value.AnyOf[0].Value.Format != "binary" {
+		t.Errorf("anyOf branch not fixed: %+v", props["any"].Value.AnyOf[0].Value)
+	}
+	if !props["not"].Value.Not.Value.Type.Is("string") || props["not"].Value.Not.Value.Format != "binary" {
+		t.Errorf("not branch not fixed: %+v", props["not"].Value.Not.Value)
+	}
+}
+
+func TestExtractSharedEnums_missReturnsError(t *testing.T) {
+	doc := &openapi3.T{
+		Components: &openapi3.Components{
+			Schemas: openapi3.Schemas{
+				"A": {Value: &openapi3.Schema{
+					Type: &openapi3.Types{"object"},
+					Properties: openapi3.Schemas{
+						"color": {Value: &openapi3.Schema{
+							Type: &openapi3.Types{"string"},
+							Enum: []any{"red", "green"},
+						}},
+					},
+				}},
+				"B": {Value: &openapi3.Schema{
+					Type: &openapi3.Types{"object"},
+					Properties: openapi3.Schemas{
+						"color": {Value: &openapi3.Schema{
+							Type: &openapi3.Types{"string"},
+							Enum: []any{"red", "green"},
+						}},
+					},
+				}},
+			},
+		},
+	}
+	if err := extractSharedEnums(doc, map[string]string{}); err == nil {
+		t.Fatal("expected miss error")
+	}
+}
@@ -0,0 +1,188 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Package openapi3gen converts Gitea's Swagger 2.0 spec to an OpenAPI 3.0
+// spec. It discovers Go enum type names by scanning swagger:enum annotations
+// in the source tree, then names extracted shared-enum schemas accordingly.
+package openapi3gen
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// EnumKey returns a canonical key for a set of enum values: values are
+// stringified, sorted, and joined with "|". Used to match enum value sets
+// across spec properties and scanned Go type declarations.
+func EnumKey(values []any) string {
+	strs := make([]string, len(values))
+	for i, v := range values {
+		strs[i] = fmt.Sprintf("%v", v)
+	}
+	sort.Strings(strs)
+	return strings.Join(strs, "|")
+}
+
+var rxSwaggerEnum = regexp.MustCompile(`swagger:enum\s+(\w+)`)
+
+// ScanSwaggerEnumTypes walks .go files under each dir and returns a map from
+// a canonical value-set key (see EnumKey) to the Go type name declared with
+// // swagger:enum TypeName.
+//
+// Returns an error on parse failure, on an annotation for a type whose
+// constants can't be extracted, or on value-set collisions between two
+// different enum types.
+func ScanSwaggerEnumTypes(dirs []string) (map[string]string, error) {
+	fset := token.NewFileSet()
+	parsed := []*ast.File{}
+
+	for _, dir := range dirs {
+		entries, err := os.ReadDir(dir)
+		if err != nil {
+			return nil, fmt.Errorf("reading %s: %w", dir, err)
+		}
+		for _, entry := range entries {
+			if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".go") {
+				continue
+			}
+			if strings.HasSuffix(entry.Name(), "_test.go") {
+				continue
+			}
+			path := filepath.Join(dir, entry.Name())
+			file, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
+			if err != nil {
+				return nil, fmt.Errorf("%s: %w", path, err)
+			}
+			parsed = append(parsed, file)
+		}
+	}
+
+	enumTypes := map[string]string{} // typeName → "" (presence marker)
+	enumValues := map[string][]any{} // typeName → values
+
+	// Pass 1: collect every // swagger:enum TypeName declaration.
+	for _, file := range parsed {
+		for _, decl := range file.Decls {
+			gd, ok := decl.(*ast.GenDecl)
+			if !ok || gd.Tok != token.TYPE {
+				continue
+			}
+			if err := collectEnumType(gd, enumTypes); err != nil {
+				return nil, fmt.Errorf("%s: %w", fset.Position(gd.Pos()).Filename, err)
+			}
+		}
+	}
+
+	// Pass 2: collect const values; now every annotated type is visible.
+	for _, file := range parsed {
+		for _, decl := range file.Decls {
+			gd, ok := decl.(*ast.GenDecl)
+			if !ok || gd.Tok != token.CONST {
+				continue
+			}
+			collectEnumValues(gd, enumTypes, enumValues)
+		}
+	}
+
+	result := map[string]string{}
+	for typeName := range enumTypes {
+		values, ok := enumValues[typeName]
+		if !ok || len(values) == 0 {
+			return nil, fmt.Errorf("swagger:enum %s has no const block with typed string values", typeName)
+		}
+		key := EnumKey(values)
+		if existing, ok := result[key]; ok && existing != typeName {
+			return nil, fmt.Errorf("swagger:enum value-set collision: %s and %s both use %q", existing, typeName, key)
+		}
+		result[key] = typeName
+	}
+	return result, nil
+}
+
+// collectEnumType scans a `type` GenDecl for // swagger:enum annotations,
+// handling both the lone form (`// swagger:enum Foo\n type Foo string`)
+// where the comment group is attached to the GenDecl, and the grouped form:
+//
+//	type (
+//	    // swagger:enum Foo
+//	    Foo string
+//	)
+//
+// where the comment group is attached to each TypeSpec. Caveat: Go's parser
+// only attaches a CommentGroup when it is immediately adjacent to the decl.
+// A blank line (not a `//` continuation line) between the comment and the
+// declaration drops the Doc, so annotations MUST sit directly above their
+// type. All current annotated files obey this — the rule is noted here so
+// a future edit that inserts a blank line fails fast rather than silently.
+func collectEnumType(gd *ast.GenDecl, enumTypes map[string]string) error {
+	if err := registerEnumAnnotation(gd.Doc, gd.Specs, enumTypes); err != nil {
+		return err
+	}
+	for _, spec := range gd.Specs {
+		ts, ok := spec.(*ast.TypeSpec)
+		if !ok || ts.Doc == nil {
+			continue
+		}
+		if err := registerEnumAnnotation(ts.Doc, []ast.Spec{ts}, enumTypes); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func registerEnumAnnotation(doc *ast.CommentGroup, specs []ast.Spec, enumTypes map[string]string) error {
+	if doc == nil {
+		return nil
+	}
+	matches := rxSwaggerEnum.FindStringSubmatch(doc.Text())
+	if len(matches) < 2 {
+		return nil
+	}
+	annotated := matches[1]
+	for _, spec := range specs {
+		ts, ok := spec.(*ast.TypeSpec)
+		if !ok {
+			continue
+		}
+		if ts.Name.Name == annotated {
+			enumTypes[annotated] = ""
+			return nil
+		}
+	}
+	return fmt.Errorf("swagger:enum %s: no type declaration with that name in the same decl group; check for a typo", annotated)
+}
+
+func collectEnumValues(gd *ast.GenDecl, enumTypes map[string]string, enumValues map[string][]any) {
+	for _, spec := range gd.Specs {
+		vs, ok := spec.(*ast.ValueSpec)
+		if !ok || vs.Type == nil {
+			continue
+		}
+		ident, ok := vs.Type.(*ast.Ident)
+		if !ok {
+			continue
+		}
+		if _, isEnum := enumTypes[ident.Name]; !isEnum {
+			continue
+		}
+		for _, val := range vs.Values {
+			lit, ok := val.(*ast.BasicLit)
+			if !ok || lit.Kind != token.STRING {
+				continue
+			}
+			unquoted, err := strconv.Unquote(lit.Value)
+			if err != nil {
+				continue
+			}
+			enumValues[ident.Name] = append(enumValues[ident.Name], unquoted)
+		}
+	}
+}
@@ -0,0 +1,239 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package openapi3gen
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestEnumKey_sortsAndJoins(t *testing.T) {
+	key := EnumKey([]any{"b", "a", "c"})
+	if key != "a|b|c" {
+		t.Fatalf("EnumKey = %q, want %q", key, "a|b|c")
+	}
+}
+
+func TestEnumKey_handlesNonStringValues(t *testing.T) {
+	key := EnumKey([]any{2, 1, 3})
+	if key != "1|2|3" {
+		t.Fatalf("EnumKey = %q, want %q", key, "1|2|3")
+	}
+}
+
+func TestScanSwaggerEnumTypes_basic(t *testing.T) {
+	dir := t.TempDir()
+	src := `package fixture
+
+// Color is a primary color.
+// swagger:enum Color
+type Color string
+
+const (
+	ColorRed   Color = "red"
+	ColorGreen Color = "green"
+	ColorBlue  Color = "blue"
+)
+`
+	if err := os.WriteFile(filepath.Join(dir, "color.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ScanSwaggerEnumTypes([]string{dir})
+	if err != nil {
+		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
+	}
+	wantKey := EnumKey([]any{"red", "green", "blue"})
+	if got[wantKey] != "Color" {
+		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Color")
+	}
+}
+
+func TestScanSwaggerEnumTypes_orphanAnnotation(t *testing.T) {
+	dir := t.TempDir()
+	src := `package fixture
+
+// swagger:enum Sttype
+type StateType string
+
+const (
+	StateOpen StateType = "open"
+)
+`
+	if err := os.WriteFile(filepath.Join(dir, "typo.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := ScanSwaggerEnumTypes([]string{dir})
+	if err == nil {
+		t.Fatal("expected error for annotation referencing a non-matching type name")
+	}
+	if !strings.Contains(err.Error(), "Sttype") {
+		t.Fatalf("error %q should mention the typo'd name Sttype", err.Error())
+	}
+}
+
+func TestScanSwaggerEnumTypes_collision(t *testing.T) {
+	dir := t.TempDir()
+	src := `package fixture
+
+// swagger:enum Alpha
+type Alpha string
+const (
+	AlphaX Alpha = "x"
+	AlphaY Alpha = "y"
+)
+
+// swagger:enum Beta
+type Beta string
+const (
+	BetaX Beta = "x"
+	BetaY Beta = "y"
+)
+`
+	if err := os.WriteFile(filepath.Join(dir, "dup.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := ScanSwaggerEnumTypes([]string{dir})
+	if err == nil {
+		t.Fatal("expected collision error, got nil")
+	}
+	msg := err.Error()
+	if !strings.Contains(msg, "Alpha") || !strings.Contains(msg, "Beta") {
+		t.Fatalf("error %q should mention both Alpha and Beta", msg)
+	}
+}
+
+func TestScanSwaggerEnumTypes_parseFailure(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "bad.go"), []byte("package fixture\nfunc Foo() {"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := ScanSwaggerEnumTypes([]string{dir})
+	if err == nil {
+		t.Fatal("expected parse error, got nil")
+	}
+}
+
+func TestScanSwaggerEnumTypes_annotationWithoutConsts(t *testing.T) {
+	dir := t.TempDir()
+	src := `package fixture
+
+// swagger:enum Lonely
+type Lonely string
+`
+	if err := os.WriteFile(filepath.Join(dir, "lonely.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := ScanSwaggerEnumTypes([]string{dir})
+	if err == nil {
+		t.Fatal("expected error for annotation without consts")
+	}
+	if !strings.Contains(err.Error(), "Lonely") {
+		t.Fatalf("error %q should mention Lonely", err.Error())
+	}
+}
+
+func TestScanSwaggerEnumTypes_constsAndTypeInDifferentFiles(t *testing.T) {
+	dir := t.TempDir()
+	// Name ordering: `a_consts.go` < `b_type.go`, so readdir returns consts first.
+	// Old single-pass scanner would miss the values; two-pass must not.
+	constsSrc := `package fixture
+
+const (
+	HueA Hue = "a"
+	HueB Hue = "b"
+)
+`
+	typeSrc := `package fixture
+
+// swagger:enum Hue
+type Hue string
+`
+	if err := os.WriteFile(filepath.Join(dir, "a_consts.go"), []byte(constsSrc), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "b_type.go"), []byte(typeSrc), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ScanSwaggerEnumTypes([]string{dir})
+	if err != nil {
+		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
+	}
+	wantKey := EnumKey([]any{"a", "b"})
+	if got[wantKey] != "Hue" {
+		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Hue")
+	}
+}
+
+func TestScanSwaggerEnumTypes_constsBeforeType(t *testing.T) {
+	dir := t.TempDir()
+	src := `package fixture
+
+const (
+	ShadeDark  Shade = "dark"
+	ShadeLight Shade = "light"
+)
+
+// swagger:enum Shade
+type Shade string
+`
+	if err := os.WriteFile(filepath.Join(dir, "shade.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ScanSwaggerEnumTypes([]string{dir})
+	if err != nil {
+		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
+	}
+	wantKey := EnumKey([]any{"dark", "light"})
+	if got[wantKey] != "Shade" {
+		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Shade")
+	}
+}
+
+func TestScanSwaggerEnumTypes_groupedTypeDecl(t *testing.T) {
+	dir := t.TempDir()
+	src := `package fixture
+
+type (
+	// swagger:enum Color
+	Color string
+	// swagger:enum Shade
+	Shade string
+)
+
+const (
+	ColorRed  Color = "red"
+	ColorBlue Color = "blue"
+)
+
+const (
+	ShadeDark  Shade = "dark"
+	ShadeLight Shade = "light"
+)
+`
+	if err := os.WriteFile(filepath.Join(dir, "grouped.go"), []byte(src), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := ScanSwaggerEnumTypes([]string{dir})
+	if err != nil {
+		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
+	}
+	colorKey := EnumKey([]any{"red", "blue"})
+	shadeKey := EnumKey([]any{"dark", "light"})
+	if got[colorKey] != "Color" {
+		t.Fatalf("Color: map[%q] = %q, want %q", colorKey, got[colorKey], "Color")
+	}
+	if got[shadeKey] != "Shade" {
+		t.Fatalf("Shade: map[%q] = %q, want %q", shadeKey, got[shadeKey], "Shade")
+	}
+}
@@ -1,24 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ ! -f ./build/test-env-check.sh ]; then
-  echo "${0} can only be executed in gitea source root directory"
-  exit 1
-fi
-
-
-echo "check uid ..."
-
-# the uid of gitea defined in "https://gitea.com/gitea/test-env" is 1000
-gitea_uid=$(id -u gitea)
-if [ "$gitea_uid" != "1000" ]; then
-  echo "The uid of linux user 'gitea' is expected to be 1000, but it is $gitea_uid"
-  exit 1
-fi
-
-cur_uid=$(id -u)
-if [ "$cur_uid" != "0" -a "$cur_uid" != "$gitea_uid" ]; then
-  echo "The uid of current linux user is expected to be 0 or $gitea_uid, but it is $cur_uid"
-  exit 1
-fi
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ ! -f ./build/test-env-prepare.sh ]; then
-  echo "${0} can only be executed in gitea source root directory"
-  exit 1
-fi
-
-echo "change the owner of files to gitea ..."
-chown -R gitea:gitea .
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"

-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -8,12 +8,12 @@ import (
 	"context"
 	"fmt"

-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"

 	"github.com/urfave/cli/v3"
 )
@@ -10,9 +10,9 @@ import (
 	"os"
 	"text/tabwriter"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	auth_service "code.gitea.io/gitea/services/auth"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	auth_service "gitea.dev/services/auth"

 	"github.com/urfave/cli/v3"
 )
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"

-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/ldap"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/ldap"

 	"github.com/urfave/cli/v3"
 )
@@ -7,9 +7,9 @@ import (
 	"context"
 	"testing"

-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/auth/source/ldap"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/auth/source/ldap"

 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"net/url"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/oauth2"

 	"github.com/urfave/cli/v3"
 )
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth/source/oauth2"

 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
@@ -8,9 +8,9 @@ import (
 	"errors"
 	"strings"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/smtp"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/smtp"

 	"github.com/urfave/cli/v3"
 )
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/smtp"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth/source/smtp"

 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
@@ -6,9 +6,9 @@ package cmd
 import (
 	"context"

-	"code.gitea.io/gitea/modules/graceful"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/graceful"
+	asymkey_service "gitea.dev/services/asymkey"
+	repo_service "gitea.dev/services/repository"

 	"github.com/urfave/cli/v3"
 )
@@ -8,11 +8,11 @@ import (
 	"errors"
 	"fmt"

-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	user_service "gitea.dev/services/user"

 	"github.com/urfave/cli/v3"
 )
@@ -4,11 +4,12 @@
 package cmd

 import (
+	"io"
 	"testing"

-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -82,7 +83,9 @@ func TestChangePasswordCommand(t *testing.T) {

 		for _, tc := range testCases {
 			t.Run(tc.name, func(t *testing.T) {
-				err := microcmdUserChangePassword().Run(ctx, tc.args)
+				cmd := microcmdUserChangePassword()
+				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+				err := cmd.Run(ctx, tc.args)
 				require.Error(t, err)
 				require.Contains(t, err.Error(), tc.expectedErr)
 			})
@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"strings"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	pwd "code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	pwd "gitea.dev/modules/auth/password"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -9,10 +9,10 @@ import (
 	"fmt"
 	"strings"

-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	user_service "gitea.dev/services/user"

 	"github.com/urfave/cli/v3"
 )
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"

-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/require"
 )
@@ -8,8 +8,8 @@ import (
 	"errors"
 	"fmt"

-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"

 	"github.com/urfave/cli/v3"
 )
@@ -9,7 +9,7 @@ import (
 	"os"
 	"text/tabwriter"

-	user_model "code.gitea.io/gitea/models/user"
+	user_model "gitea.dev/models/user"

 	"github.com/urfave/cli/v3"
 )
@@ -8,8 +8,8 @@ import (
 	"errors"
 	"fmt"

-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -6,9 +6,9 @@ package cmd
 import (
 	"testing"

-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -4,6 +4,7 @@
 package cmd

 import (
+	"io"
 	"path/filepath"
 	"testing"

@@ -107,6 +108,7 @@ func TestCertCommandFailures(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			app := cmdCert()
+			app.Writer, app.ErrWriter = io.Discard, io.Discard
 			tempDir := t.TempDir()

 			certFile := filepath.Join(tempDir, "cert.pem")
@@ -1,38 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
-)
-
-func TestDefaultCommand(t *testing.T) {
-	test := func(t *testing.T, args []string, expectedRetName string, expectedRetValid bool) {
-		called := false
-		cmd := &cli.Command{
-			DefaultCommand: "test",
-			Commands: []*cli.Command{
-				{
-					Name: "test",
-					Action: func(ctx context.Context, command *cli.Command) error {
-						retName, retValid := isValidDefaultSubCommand(command)
-						assert.Equal(t, expectedRetName, retName)
-						assert.Equal(t, expectedRetValid, retValid)
-						called = true
-						return nil
-					},
-				},
-			},
-		}
-		assert.NoError(t, cmd.Run(t.Context(), args))
-		assert.True(t, called)
-	}
-	test(t, []string{"./gitea"}, "", true)
-	test(t, []string{"./gitea", "test"}, "", true)
-	test(t, []string{"./gitea", "other"}, "other", false)
-}
@@ -0,0 +1,237 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Tests here reload the config system multiple times with uncontrollable details.
+// So they must be in a separate package, to avoid affecting other tests
+
+package cmdtest
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.dev/cmd"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/urfave/cli/v3"
+)
+
+func TestMain(m *testing.M) {
+	unittest.MainTest(m)
+}
+
+func makePathOutput(workPath, customPath, customConf string) string {
+	return fmt.Sprintf("WorkPath=%s\nCustomPath=%s\nCustomConf=%s", workPath, customPath, customConf)
+}
+
+func newTestApp(testCmd cli.Command) *cli.Command {
+	app := cmd.NewMainApp(cmd.AppVersion{})
+	testCmd.Name = util.IfZero(testCmd.Name, "test-cmd")
+	cmd.PrepareSubcommandWithGlobalFlags(&testCmd)
+	app.Commands = append(app.Commands, &testCmd)
+	app.DefaultCommand = testCmd.Name
+	return app
+}
+
+type runResult struct {
+	Stdout   string
+	Stderr   string
+	ExitCode int
+}
+
+func runTestApp(app *cli.Command, args ...string) (runResult, error) {
+	outBuf := new(strings.Builder)
+	errBuf := new(strings.Builder)
+	app.Writer = outBuf
+	app.ErrWriter = errBuf
+	exitCode := -1
+	defer test.MockVariableValue(&cli.ErrWriter, app.ErrWriter)()
+	defer test.MockVariableValue(&cli.OsExiter, func(code int) {
+		if exitCode == -1 {
+			exitCode = code // save the exit code once and then reset the writer (to simulate the exit)
+			app.Writer, app.ErrWriter, cli.ErrWriter = io.Discard, io.Discard, io.Discard
+		}
+	})()
+	err := cmd.RunMainApp(app, args...)
+	return runResult{outBuf.String(), errBuf.String(), exitCode}, err
+}
+
+func TestCliCmd(t *testing.T) {
+	defaultWorkPath := filepath.FromSlash("/tmp/mocked-work-path")
+	defaultCustomPath := filepath.Join(defaultWorkPath, "custom")
+	defaultCustomConf := filepath.Join(defaultCustomPath, "conf/app.ini")
+	defer setting.MockBuiltinPaths(defaultWorkPath, "", "")()
+
+	cli.CommandHelpTemplate = "(command help template)"
+	cli.RootCommandHelpTemplate = "(app help template)"
+	cli.SubcommandHelpTemplate = "(subcommand help template)"
+
+	cases := []struct {
+		env map[string]string
+		cmd string
+		exp string
+	}{
+		// help commands
+		{
+			cmd: "./gitea -h",
+			exp: "DEFAULT CONFIGURATION:",
+		},
+		{
+			cmd: "./gitea help",
+			exp: "DEFAULT CONFIGURATION:",
+		},
+
+		{
+			cmd: "./gitea -c /dev/null -h",
+			exp: "ConfigFile: /dev/null",
+		},
+
+		{
+			cmd: "./gitea -c /dev/null help",
+			exp: "ConfigFile: /dev/null",
+		},
+		{
+			cmd: "./gitea help -c /dev/null",
+			exp: "ConfigFile: /dev/null",
+		},
+
+		{
+			cmd: "./gitea -c /dev/null test-cmd -h",
+			exp: "ConfigFile: /dev/null",
+		},
+		{
+			cmd: "./gitea test-cmd -c /dev/null -h",
+			exp: "ConfigFile: /dev/null",
+		},
+		{
+			cmd: "./gitea test-cmd -h -c /dev/null",
+			exp: "ConfigFile: /dev/null",
+		},
+
+		{
+			cmd: "./gitea -c /dev/null test-cmd help",
+			exp: "ConfigFile: /dev/null",
+		},
+		{
+			cmd: "./gitea test-cmd -c /dev/null help",
+			exp: "ConfigFile: /dev/null",
+		},
+		{
+			cmd: "./gitea test-cmd help -c /dev/null",
+			exp: "ConfigFile: /dev/null",
+		},
+
+		// parse paths
+		{
+			cmd: "./gitea test-cmd",
+			exp: makePathOutput(defaultWorkPath, defaultCustomPath, defaultCustomConf),
+		},
+		{
+			cmd: "./gitea -c /tmp/app.ini test-cmd",
+			exp: makePathOutput(defaultWorkPath, defaultCustomPath, "/tmp/app.ini"),
+		},
+		{
+			cmd: "./gitea test-cmd -c /tmp/app.ini",
+			exp: makePathOutput(defaultWorkPath, defaultCustomPath, "/tmp/app.ini"),
+		},
+		{
+			env: map[string]string{"GITEA_WORK_DIR": "/tmp"},
+			cmd: "./gitea test-cmd",
+			exp: makePathOutput("/tmp", "/tmp/custom", "/tmp/custom/conf/app.ini"),
+		},
+		{
+			env: map[string]string{"GITEA_WORK_DIR": "/tmp"},
+			cmd: "./gitea test-cmd --work-path /tmp/other",
+			exp: makePathOutput("/tmp/other", "/tmp/other/custom", "/tmp/other/custom/conf/app.ini"),
+		},
+		{
+			env: map[string]string{"GITEA_WORK_DIR": "/tmp"},
+			cmd: "./gitea test-cmd --config /tmp/app-other.ini",
+			exp: makePathOutput("/tmp", "/tmp/custom", "/tmp/app-other.ini"),
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.cmd, func(t *testing.T) {
+			app := newTestApp(cli.Command{
+				Action: func(ctx context.Context, cmd *cli.Command) error {
+					_, _ = fmt.Fprint(cmd.Root().Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
+					return nil
+				},
+			})
+			for k, v := range c.env {
+				t.Setenv(k, v)
+			}
+			args := strings.Split(c.cmd, " ") // for test only, "split" is good enough
+			r, err := runTestApp(app, args...)
+			assert.NoError(t, err, c.cmd)
+			assert.NotEmpty(t, c.exp, c.cmd)
+			if !assert.Contains(t, r.Stdout, c.exp, c.cmd) {
+				t.Log("Full output:\n" + r.Stdout)
+				t.Log("Expected:\n" + c.exp)
+			}
+		})
+	}
+}
+
+func TestCliCmdError(t *testing.T) {
+	app := newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return errors.New("normal error") }})
+	r, err := runTestApp(app, "./gitea", "test-cmd")
+	assert.Error(t, err)
+	assert.Equal(t, 1, r.ExitCode)
+	assert.Empty(t, r.Stdout)
+	assert.Equal(t, "Command error: normal error\n", r.Stderr)
+
+	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return cli.Exit("exit error", 2) }})
+	r, err = runTestApp(app, "./gitea", "test-cmd")
+	assert.Error(t, err)
+	assert.Equal(t, 2, r.ExitCode)
+	assert.Empty(t, r.Stdout)
+	assert.Equal(t, "exit error\n", r.Stderr)
+
+	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return nil }})
+	r, err = runTestApp(app, "./gitea", "test-cmd", "--no-such")
+	assert.Error(t, err)
+	assert.Equal(t, 1, r.ExitCode)
+	assert.Empty(t, r.Stdout)
+	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n\n", r.Stderr)
+
+	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return nil }})
+	r, err = runTestApp(app, "./gitea", "test-cmd")
+	assert.NoError(t, err)
+	assert.Equal(t, -1, r.ExitCode) // the cli.OsExiter is not called
+	assert.Empty(t, r.Stdout)
+	assert.Empty(t, r.Stderr)
+}
+
+func TestCliCmdBefore(t *testing.T) {
+	ctxNew := context.WithValue(context.Background(), any("key"), "value")
+	configValues := map[string]string{}
+	setting.CustomConf = "/tmp/any.ini"
+	var actionCtx context.Context
+	app := newTestApp(cli.Command{
+		Before: func(context.Context, *cli.Command) (context.Context, error) {
+			configValues["before"] = setting.CustomConf
+			return ctxNew, nil
+		},
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			configValues["action"] = setting.CustomConf
+			actionCtx = ctx
+			return nil
+		},
+	})
+	_, err := runTestApp(app, "./gitea", "--config", "/dev/null", "test-cmd")
+	assert.NoError(t, err)
+	assert.Equal(t, ctxNew, actionCtx)
+	assert.Equal(t, "/tmp/any.ini", configValues["before"], "BeforeFunc must be called before preparing config")
+	assert.Equal(t, "/dev/null", configValues["action"])
+}
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"

-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -12,16 +12,15 @@ import (
 	"strings"
 	"text/tabwriter"

-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/migrations"
-	migrate_base "code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/doctor"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	migrate_base "gitea.dev/models/migrations/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/doctor"

 	"github.com/urfave/cli/v3"
-	"xorm.io/xorm"
 )

 func newDoctorCommand() *cli.Command {
@@ -132,7 +131,7 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	}
 	recreateTables := migrate_base.RecreateTables(beans...)

-	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x *xorm.Engine) error {
+	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x db.EngineMigration) error {
 		if err := migrations.EnsureUpToDate(ctx, x); err != nil {
 			return err
 		}
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"

-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"

-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/doctor"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/doctor"

 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
@@ -11,13 +11,13 @@ import (
 	"path/filepath"
 	"strings"

-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/dump"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/dump"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"

 	"gitea.com/go-chi/session"
 	"github.com/urfave/cli/v3"
@@ -203,8 +203,8 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 			}
 		}()

-		targetDBType := cmd.String("database")
-		if len(targetDBType) > 0 && targetDBType != setting.Database.Type.String() {
+		targetDBType := setting.DatabaseType(cmd.String("database"))
+		if targetDBType != "" && targetDBType != setting.Database.Type {
 			log.Info("Dumping database %s => %s...", setting.Database.Type, targetDBType)
 		} else {
 			log.Info("Dumping database...")
@@ -10,14 +10,14 @@ import (
 	"os"
 	"strings"

-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/migrations"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/migrations"

 	"github.com/urfave/cli/v3"
 )
@@ -11,14 +11,14 @@ import (
 	"path/filepath"
 	"strings"

-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"

 	"github.com/urfave/cli/v3"
 )
@@ -6,10 +6,12 @@ package cmd

 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"

-	"code.gitea.io/gitea/modules/generate"
+	"gitea.dev/modules/generate"
+	"gitea.dev/modules/ssh"

 	"github.com/mattn/go-isatty"
 	"github.com/urfave/cli/v3"
@@ -21,6 +23,7 @@ func newGenerateCommand() *cli.Command {
 		Usage: "Generate Gitea's secrets/keys/tokens",
 		Commands: []*cli.Command{
 			newGenerateSecretCommand(),
+			newGenerateSSHCommand(),
 		},
 	}
 }
@@ -37,6 +40,17 @@ func newGenerateSecretCommand() *cli.Command {
 	}
 }

+func newGenerateSSHCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "ssh",
+		Usage: "Generate ssh keys",
+		Commands: []*cli.Command{
+			newGenerateSSHKeyCommand(),
+			newGenerateSSHHostKeysCommand(),
+		},
+	}
+}
+
 func newGenerateInternalTokenCommand() *cli.Command {
 	return &cli.Command{
 		Name:   "INTERNAL_TOKEN",
@@ -62,6 +76,30 @@ func newGenerateSecretKeyCommand() *cli.Command {
 	}
 }

+func newGenerateSSHKeyCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "key",
+		Usage: "Generate a new ssh key",
+		Flags: []cli.Flag{
+			&cli.IntFlag{Name: "bits", Aliases: []string{"b"}, Usage: "Number of bits in the key, ignored when key is ed25519"},
+			&cli.StringFlag{Name: "type", Aliases: []string{"t"}, Value: "ed25519", Usage: "Specifies the type of key to create."},
+			&cli.StringFlag{Name: "file", Aliases: []string{"f"}, Usage: "Specifies the path or base directory for the key file", Required: true},
+		},
+		Action: runGenerateKeyPair,
+	}
+}
+
+func newGenerateSSHHostKeysCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "host-keys",
+		Usage: "Generate host keys of all default key types (rsa, ecdsa, and ed25519) if they do not already exist.",
+		Flags: []cli.Flag{
+			&cli.StringFlag{Name: "dir", Aliases: []string{"d"}, Usage: "Specifies the base directory for the key files", Required: true},
+		},
+		Action: runGenerateHostKey,
+	}
+}
+
 func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 	internalToken, err := generate.NewInternalToken()
 	if err != nil {
@@ -103,3 +141,41 @@ func runGenerateSecretKey(_ context.Context, c *cli.Command) error {

 	return nil
 }
+
+func runGenerateHostKey(_ context.Context, c *cli.Command) error {
+	file := c.String("dir")
+	info, err := os.Stat(file)
+	if errors.Is(err, os.ErrNotExist) {
+		if err = os.MkdirAll(file, 0o644); err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	} else if !info.IsDir() {
+		return errors.New("file already exists and is not a directory")
+	}
+	fmt.Fprintf(c.Writer, "Generating host keys in %s\n", file)
+	_, err = ssh.InitDefaultHostKeys(file)
+	return err
+}
+
+func runGenerateKeyPair(_ context.Context, c *cli.Command) error {
+	file := c.String("file")
+	keyType := c.String("type")
+
+	fmt.Fprintf(c.Writer, "Generating public/private %s key pair.\n", keyType)
+
+	// Check if file exists to prevent overwriting
+	if _, err := os.Stat(file); err == nil {
+		if !confirm(c.Reader, c.Writer, "%s already exists.\nOverwrite (y/n)? ", file) {
+			fmt.Println("Aborting")
+			return nil
+		}
+	}
+	bits := c.Int("bits")
+	err := ssh.GenKeyPair(file, generate.SSHKeyType(keyType), bits)
+	if err == nil {
+		fmt.Printf("Your SSH key has been saved in %s\n", file)
+	}
+	return err
+}
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"syscall"

-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -38,22 +38,15 @@ func argsSet(c *cli.Command, args ...string) error {
 }

 // confirm waits for user input which confirms an action
-func confirm() (bool, error) {
+func confirm(stdin io.Reader, stdout io.Writer, msg string, args ...any) bool {
 	var response string
-
-	_, err := fmt.Scanln(&response)
-	if err != nil {
-		return false, err
-	}
-
+	_, _ = fmt.Fprintf(stdout, msg, args...)
+	_, _ = fmt.Fscanln(stdin, &response)
 	switch strings.ToLower(response) {
 	case "y", "yes":
-		return true, nil
-	case "n", "no":
-		return false, nil
-	default:
-		return false, errors.New(response + " isn't a correct confirmation string")
+		return true
 	}
+	return false
 }

 func initDB(ctx context.Context) error {
@@ -124,7 +117,7 @@ func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(context.Context, *cl
 		if setting.InstallLock {
 			// During config loading, there might also be logs (for example: deprecation warnings).
 			// It must make sure that console logger is set up before config is loaded.
-			log.Error("Config is loaded before console logger is setup, it will cause bugs. Please fix it.")
+			log.Error("Config is loaded before console logger is setup, it will cause bugs. Please fix it. CustomConf=%s", setting.CustomConf)
 			return nil, errors.New("console logger must be setup before config is loaded")
 		}
 		level := defaultLevel
@@ -134,7 +127,7 @@ func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(context.Context, *cl
 		if globalBool(c, "debug") || globalBool(c, "verbose") {
 			level = log.TRACE
 		}
-		log.SetConsoleLogger(log.DEFAULT, "console-default", level)
+		log.SetupStderrLogger(log.DEFAULT, "console-stderr", level)
 		return ctx, nil
 	}
 }
@@ -142,9 +135,9 @@ func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(context.Context, *cl
 func isValidDefaultSubCommand(cmd *cli.Command) (string, bool) {
 	// Dirty patch for urfave/cli's strange design.
 	// "./gitea bad-cmd" should not start the web server.
-	rootArgs := cmd.Root().Args().Slice()
-	if len(rootArgs) != 0 && rootArgs[0] != cmd.Name {
-		return rootArgs[0], false
+	args := cmd.Args().Slice()
+	if len(args) != 0 {
+		return args[0], false
 	}
 	return "", true
 }
@@ -14,12 +14,12 @@ import (
 	"strings"
 	"time"

-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -151,9 +151,6 @@ func (d *delayWriter) WriteString(s string) (n int, err error) {
 }

 func (d *delayWriter) Close() error {
-	if d == nil {
-		return nil
-	}
 	stopped := d.timer.Stop()
 	if stopped || d.buf == nil {
 		return nil
@@ -163,16 +160,6 @@ func (d *delayWriter) Close() error {
 	return err
 }

-type nilWriter struct{}
-
-func (n *nilWriter) Write(p []byte) (int, error) {
-	return len(p), nil
-}
-
-func (n *nilWriter) WriteString(s string) (int, error) {
-	return len(s), nil
-}
-
 func parseGitHookCommitRefLine(line string) (oldCommitID, newCommitID string, refFullName git.RefName, ok bool) {
 	fields := strings.Split(line, " ")
 	if len(fields) != 3 {
@@ -227,8 +214,7 @@ Gitea or set your environment appropriately.`, "")
 	total := 0
 	lastline := 0

-	var out io.Writer
-	out = &nilWriter{}
+	out := io.Discard
 	if setting.Git.VerbosePush {
 		if setting.Git.VerbosePushDelay > 0 {
 			dWriter := newDelayWriter(os.Stdout, setting.Git.VerbosePushDelay)
@@ -350,12 +336,10 @@ Gitea or set your environment appropriately.`, "")
 		return nil
 	}

-	var out io.Writer
-	var dWriter *delayWriter
-	out = &nilWriter{}
+	out := io.Discard
 	if setting.Git.VerbosePush {
 		if setting.Git.VerbosePushDelay > 0 {
-			dWriter = newDelayWriter(os.Stdout, setting.Git.VerbosePushDelay)
+			dWriter := newDelayWriter(os.Stdout, setting.Git.VerbosePushDelay)
 			defer dWriter.Close()
 			out = dWriter
 		} else {
@@ -382,101 +366,62 @@ Gitea or set your environment appropriately.`, "")
 		PushTrigger:                     repo_module.PushTrigger(os.Getenv(repo_module.EnvPushTrigger)),
 		IsWiki:                          isWiki,
 	}
-	oldCommitIDs := make([]string, hookBatchSize)
-	newCommitIDs := make([]string, hookBatchSize)
-	refFullNames := make([]git.RefName, hookBatchSize)
-	count := 0
-	total := 0
-	wasEmpty := false
-	masterPushed := false
+
+	oldCommitIDs := make([]string, 0, hookBatchSize)
+	newCommitIDs := make([]string, 0, hookBatchSize)
+	refFullNames := make([]git.RefName, 0, hookBatchSize)
 	results := make([]private.HookPostReceiveBranchResult, 0)

+	defer func() {
+		hookPrintResults(results)
+	}()
+
+	processBatch := func() error {
+		if len(refFullNames) == 0 {
+			return nil
+		}
+		_, _ = fmt.Fprintf(out, " Processing %d references\n", len(refFullNames))
+		hookOptions.OldCommitIDs = oldCommitIDs
+		hookOptions.NewCommitIDs = newCommitIDs
+		hookOptions.RefFullNames = refFullNames
+		resp, extra := private.HookPostReceive(ctx, repoUser, repoName, hookOptions)
+		if extra.HasError() {
+			return fail(ctx, extra.UserMsg, "HookPostReceive failed: %v", extra.Error)
+		}
+		results = append(results, resp.Results...)
+		oldCommitIDs = oldCommitIDs[:0]
+		newCommitIDs = newCommitIDs[:0]
+		refFullNames = refFullNames[:0]
+		return nil
+	}
+
 	scanner := bufio.NewScanner(os.Stdin)
 	for scanner.Scan() {
-		// TODO: support news feeds for wiki
+		// wiki doesn't need "post-receive" at the moment
 		if isWiki {
 			continue
 		}

-		var ok bool
-		oldCommitIDs[count], newCommitIDs[count], refFullNames[count], ok = parseGitHookCommitRefLine(scanner.Text())
+		oldCommitID, newCommitID, refFullName, ok := parseGitHookCommitRefLine(scanner.Text())
 		if !ok {
 			continue
 		}
+		_, _ = fmt.Fprintf(out, ".")

-		fmt.Fprintf(out, ".")
-		commitID, _ := git.NewIDFromString(newCommitIDs[count])
-		if refFullNames[count] == git.BranchPrefix+"master" && !commitID.IsZero() && count == total {
-			masterPushed = true
-		}
-		count++
-		total++
-
-		if count >= hookBatchSize {
-			fmt.Fprintf(out, " Processing %d references\n", count)
-			hookOptions.OldCommitIDs = oldCommitIDs
-			hookOptions.NewCommitIDs = newCommitIDs
-			hookOptions.RefFullNames = refFullNames
-			resp, extra := private.HookPostReceive(ctx, repoUser, repoName, hookOptions)
-			if extra.HasError() {
-				_ = dWriter.Close()
-				hookPrintResults(results)
-				return fail(ctx, extra.UserMsg, "HookPostReceive failed: %v", extra.Error)
+		oldCommitIDs = append(oldCommitIDs, oldCommitID)
+		newCommitIDs = append(newCommitIDs, newCommitID)
+		refFullNames = append(refFullNames, refFullName)
+		if len(refFullNames) >= hookBatchSize {
+			// process and start a new batch
+			if err := processBatch(); err != nil {
+				return err
 			}
-			wasEmpty = wasEmpty || resp.RepoWasEmpty
-			results = append(results, resp.Results...)
-			count = 0
 		}
 	}
 	if err := scanner.Err(); err != nil {
-		_ = dWriter.Close()
-		hookPrintResults(results)
 		return fail(ctx, "Hook failed: stdin read error", "scanner error: %v", err)
 	}
-
-	if count == 0 {
-		if wasEmpty && masterPushed {
-			// We need to tell the repo to reset the default branch to master
-			extra := private.SetDefaultBranch(ctx, repoUser, repoName, "master")
-			if extra.HasError() {
-				return fail(ctx, extra.UserMsg, "SetDefaultBranch failed: %v", extra.Error)
-			}
-		}
-		fmt.Fprintf(out, "Processed %d references in total\n", total)
-
-		_ = dWriter.Close()
-		hookPrintResults(results)
-		return nil
-	}
-
-	hookOptions.OldCommitIDs = oldCommitIDs[:count]
-	hookOptions.NewCommitIDs = newCommitIDs[:count]
-	hookOptions.RefFullNames = refFullNames[:count]
-
-	fmt.Fprintf(out, " Processing %d references\n", count)
-
-	resp, extra := private.HookPostReceive(ctx, repoUser, repoName, hookOptions)
-	if resp == nil {
-		_ = dWriter.Close()
-		hookPrintResults(results)
-		return fail(ctx, extra.UserMsg, "HookPostReceive failed: %v", extra.Error)
-	}
-	wasEmpty = wasEmpty || resp.RepoWasEmpty
-	results = append(results, resp.Results...)
-
-	fmt.Fprintf(out, "Processed %d references in total\n", total)
-
-	if wasEmpty && masterPushed {
-		// We need to tell the repo to reset the default branch to master
-		extra := private.SetDefaultBranch(ctx, repoUser, repoName, "master")
-		if extra.HasError() {
-			return fail(ctx, extra.UserMsg, "SetDefaultBranch failed: %v", extra.Error)
-		}
-	}
-	_ = dWriter.Close()
-	hookPrintResults(results)
-
-	return nil
+	return processBatch()
 }

 func hookPrintResults(results []private.HookPostReceiveBranchResult) {
@@ -9,8 +9,8 @@ import (
 	"fmt"
 	"strings"

-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"

 	"github.com/urfave/cli/v3"
 )
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"

-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -22,14 +22,10 @@ func runSendMail(ctx context.Context, c *cli.Command) error {

 	if !confirmSkipped {
 		if len(body) == 0 {
-			fmt.Print("warning: Content is empty")
+			fmt.Println("warning: Content is empty")
 		}

-		fmt.Print("Proceed with sending email? [Y/n] ")
-		isConfirmed, err := confirm()
-		if err != nil {
-			return err
-		} else if !isConfirmed {
+		if !confirm(c.Reader, c.Writer, "Proceed with sending email? [Y/n] ") {
 			fmt.Println("The mail was not sent")
 			return nil
 		}
@@ -10,8 +10,8 @@ import (
 	"os"
 	"strings"

-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"

 	"github.com/urfave/cli/v3"
 )
@@ -48,7 +48,7 @@ DEFAULT CONFIGURATION:
 	}
 }

-func prepareSubcommandWithGlobalFlags(originCmd *cli.Command) {
+func PrepareSubcommandWithGlobalFlags(originCmd *cli.Command) {
 	originBefore := originCmd.Before
 	originCmd.Before = func(ctxOrig context.Context, cmd *cli.Command) (ctx context.Context, err error) {
 		ctx = ctxOrig
@@ -145,7 +145,7 @@ func NewMainApp(appVer AppVersion) *cli.Command {

 	app.Before = PrepareConsoleLoggerLevel(log.INFO)
 	for i := range subCmdWithConfig {
-		prepareSubcommandWithGlobalFlags(subCmdWithConfig[i])
+		PrepareSubcommandWithGlobalFlags(subCmdWithConfig[i])
 	}
 	app.Commands = append(app.Commands, subCmdWithConfig...)
 	app.Commands = append(app.Commands, subCmdStandalone...)
@@ -5,17 +5,9 @@ package cmd

 import (
 	"context"
-	"errors"
-	"fmt"
-	"io"
-	"path/filepath"
-	"strings"
 	"testing"

-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/unittest"

 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
@@ -25,209 +17,29 @@ func TestMain(m *testing.M) {
 	unittest.MainTest(m)
 }

-func makePathOutput(workPath, customPath, customConf string) string {
-	return fmt.Sprintf("WorkPath=%s\nCustomPath=%s\nCustomConf=%s", workPath, customPath, customConf)
-}
-
-func newTestApp(testCmd cli.Command) *cli.Command {
-	app := NewMainApp(AppVersion{})
-	testCmd.Name = util.IfZero(testCmd.Name, "test-cmd")
-	prepareSubcommandWithGlobalFlags(&testCmd)
-	app.Commands = append(app.Commands, &testCmd)
-	app.DefaultCommand = testCmd.Name
-	return app
-}
-
-type runResult struct {
-	Stdout   string
-	Stderr   string
-	ExitCode int
-}
-
-func runTestApp(app *cli.Command, args ...string) (runResult, error) {
-	outBuf := new(strings.Builder)
-	errBuf := new(strings.Builder)
-	app.Writer = outBuf
-	app.ErrWriter = errBuf
-	exitCode := -1
-	defer test.MockVariableValue(&cli.ErrWriter, app.ErrWriter)()
-	defer test.MockVariableValue(&cli.OsExiter, func(code int) {
-		if exitCode == -1 {
-			exitCode = code // save the exit code once and then reset the writer (to simulate the exit)
-			app.Writer, app.ErrWriter, cli.ErrWriter = io.Discard, io.Discard, io.Discard
-		}
-	})()
-	err := RunMainApp(app, args...)
-	return runResult{outBuf.String(), errBuf.String(), exitCode}, err
-}
-
-func TestCliCmd(t *testing.T) {
-	defaultWorkPath := filepath.Dir(setting.AppPath)
-	defaultCustomPath := filepath.Join(defaultWorkPath, "custom")
-	defaultCustomConf := filepath.Join(defaultCustomPath, "conf/app.ini")
-
-	cli.CommandHelpTemplate = "(command help template)"
-	cli.RootCommandHelpTemplate = "(app help template)"
-	cli.SubcommandHelpTemplate = "(subcommand help template)"
-
-	cases := []struct {
-		env map[string]string
-		cmd string
-		exp string
-	}{
-		// help commands
-		{
-			cmd: "./gitea -h",
-			exp: "DEFAULT CONFIGURATION:",
-		},
-		{
-			cmd: "./gitea help",
-			exp: "DEFAULT CONFIGURATION:",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null -h",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null help",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea help -c /dev/null",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null test-cmd -h",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd -c /dev/null -h",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd -h -c /dev/null",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null test-cmd help",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd -c /dev/null help",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd help -c /dev/null",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		// parse paths
-		{
-			cmd: "./gitea test-cmd",
-			exp: makePathOutput(defaultWorkPath, defaultCustomPath, defaultCustomConf),
-		},
-		{
-			cmd: "./gitea -c /tmp/app.ini test-cmd",
-			exp: makePathOutput(defaultWorkPath, defaultCustomPath, "/tmp/app.ini"),
-		},
-		{
-			cmd: "./gitea test-cmd -c /tmp/app.ini",
-			exp: makePathOutput(defaultWorkPath, defaultCustomPath, "/tmp/app.ini"),
-		},
-		{
-			env: map[string]string{"GITEA_WORK_DIR": "/tmp"},
-			cmd: "./gitea test-cmd",
-			exp: makePathOutput("/tmp", "/tmp/custom", "/tmp/custom/conf/app.ini"),
-		},
-		{
-			env: map[string]string{"GITEA_WORK_DIR": "/tmp"},
-			cmd: "./gitea test-cmd --work-path /tmp/other",
-			exp: makePathOutput("/tmp/other", "/tmp/other/custom", "/tmp/other/custom/conf/app.ini"),
-		},
-		{
-			env: map[string]string{"GITEA_WORK_DIR": "/tmp"},
-			cmd: "./gitea test-cmd --config /tmp/app-other.ini",
-			exp: makePathOutput("/tmp", "/tmp/custom", "/tmp/app-other.ini"),
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.cmd, func(t *testing.T) {
-			defer test.MockVariableValue(&setting.InstallLock, false)()
-			app := newTestApp(cli.Command{
-				Action: func(ctx context.Context, cmd *cli.Command) error {
-					_, _ = fmt.Fprint(cmd.Root().Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
-					return nil
+func TestDefaultCommand(t *testing.T) {
+	test := func(t *testing.T, args []string, expectedRetName string, expectedRetValid bool) {
+		called := false
+		cmd := &cli.Command{
+			DefaultCommand: "test",
+			Commands: []*cli.Command{
+				{
+					Name: "test",
+					Action: func(ctx context.Context, command *cli.Command) error {
+						retName, retValid := isValidDefaultSubCommand(command)
+						assert.Equal(t, expectedRetName, retName)
+						assert.Equal(t, expectedRetValid, retValid)
+						called = true
+						return nil
+					},
 				},
-			})
-			for k, v := range c.env {
-				t.Setenv(k, v)
-			}
-			args := strings.Split(c.cmd, " ") // for test only, "split" is good enough
-			r, err := runTestApp(app, args...)
-			assert.NoError(t, err, c.cmd)
-			assert.NotEmpty(t, c.exp, c.cmd)
-			if !assert.Contains(t, r.Stdout, c.exp, c.cmd) {
-				t.Log("Full output:\n" + r.Stdout)
-				t.Log("Expected:\n" + c.exp)
-			}
-		})
+			},
+		}
+		assert.NoError(t, cmd.Run(t.Context(), args))
+		assert.True(t, called)
 	}
-}
-
-func TestCliCmdError(t *testing.T) {
-	app := newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return errors.New("normal error") }})
-	r, err := runTestApp(app, "./gitea", "test-cmd")
-	assert.Error(t, err)
-	assert.Equal(t, 1, r.ExitCode)
-	assert.Empty(t, r.Stdout)
-	assert.Equal(t, "Command error: normal error\n", r.Stderr)
-
-	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return cli.Exit("exit error", 2) }})
-	r, err = runTestApp(app, "./gitea", "test-cmd")
-	assert.Error(t, err)
-	assert.Equal(t, 2, r.ExitCode)
-	assert.Empty(t, r.Stdout)
-	assert.Equal(t, "exit error\n", r.Stderr)
-
-	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return nil }})
-	r, err = runTestApp(app, "./gitea", "test-cmd", "--no-such")
-	assert.Error(t, err)
-	assert.Equal(t, 1, r.ExitCode)
-	assert.Empty(t, r.Stdout)
-	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n\n", r.Stderr)
-
-	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return nil }})
-	r, err = runTestApp(app, "./gitea", "test-cmd")
-	assert.NoError(t, err)
-	assert.Equal(t, -1, r.ExitCode) // the cli.OsExiter is not called
-	assert.Empty(t, r.Stdout)
-	assert.Empty(t, r.Stderr)
-}
-
-func TestCliCmdBefore(t *testing.T) {
-	ctxNew := context.WithValue(context.Background(), any("key"), "value")
-	configValues := map[string]string{}
-	setting.CustomConf = "/tmp/any.ini"
-	var actionCtx context.Context
-	app := newTestApp(cli.Command{
-		Before: func(context.Context, *cli.Command) (context.Context, error) {
-			configValues["before"] = setting.CustomConf
-			return ctxNew, nil
-		},
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			configValues["action"] = setting.CustomConf
-			actionCtx = ctx
-			return nil
-		},
-	})
-	_, err := runTestApp(app, "./gitea", "--config", "/dev/null", "test-cmd")
-	assert.NoError(t, err)
-	assert.Equal(t, ctxNew, actionCtx)
-	assert.Equal(t, "/tmp/any.ini", configValues["before"], "BeforeFunc must be called before preparing config")
-	assert.Equal(t, "/dev/null", configValues["action"])
+	test(t, []string{"./gitea"}, "", true)
+	test(t, []string{"./gitea", "test"}, "", true)
+	test(t, []string{"./gitea", "other"}, "other", false)
+	test(t, []string{"./gitea", "test", "extra"}, "extra", false)
 }
@@ -8,7 +8,7 @@ import (
 	"os"
 	"time"

-	"code.gitea.io/gitea/modules/private"
+	"gitea.dev/modules/private"

 	"github.com/urfave/cli/v3"
 )
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2154,SC2155,SC2164,SC2181,SC2207`