fix(repo): stop advertising HTTP clone URLs when DISABLE_HTTP_GIT is set (#38378 )

Fixes #38339 --------- Signed-off-by: TowyTowy <towy@airreps.link> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
[skip ci] Updated translations via Crowdin
2026-07-17 05:36:09 +00:00 · 2026-07-17 05:17:28 +00:00 · 2026-07-17 00:51:13 +00:00 · 2026-07-16 21:56:31 +00:00 · 2026-07-16 21:38:39 +00:00 · 2026-07-16 23:10:43 +02:00
287 changed files with 4214 additions and 3618 deletions
@@ -9,10 +9,10 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+    - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
    - name: Build regular image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -20,7 +20,7 @@ runs:
        file: Dockerfile
        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
    - name: Build rootless image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -16,34 +16,34 @@ runs:
  using: composite
  steps:
    - if: ${{ github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/go-build
        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/go-build
        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/golangci-lint
        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/golangci-lint
        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
@@ -13,10 +13,10 @@ runs:
    - if: ${{ inputs.cache == 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 24
+        node-version: 26
        cache: pnpm
        cache-dependency-path: pnpm-lock.yaml
    - if: ${{ inputs.cache != 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 24
+        node-version: 26
@@ -21,12 +21,12 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
+      - uses: renovatebot/github-action@b50d2ba2bd928235abdcc14d06dfafc217f1c565 # v46.1.18
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg|generate-codemirror-languages)$"]'
          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -50,7 +50,7 @@ jobs:
      shell: ${{ steps.changes.outputs.shell }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: changes
        with:
          filters: |
@@ -42,7 +42,7 @@ jobs:
      - run: make lint-spell

      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          python-version: 3.14
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
@@ -131,7 +131,7 @@ jobs:
        ports:
          - "7700:7700"
      redis:
-        image: redis:latest@sha256:c904002d182255b6db3cbe3a1e8ce6c187d15390c39500b59fc07181aabff7bf
+        image: redis:latest@sha256:5d2c689b4b55fc3fab4b0cc8aaa950f85b508c76c1e0f35a90d8f411d55a8b2b
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -17,7 +17,7 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        with:
          sync-labels: true

@@ -35,7 +35,7 @@ jobs:
          ref: ${{ github.event.pull_request.base.sha }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version: 24
+          node-version: 26
      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
      - run: node ./tools/ci-tools.ts lint-pr-title
        env:
@@ -6,40 +6,35 @@ on:
      - main
  workflow_dispatch:

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

 jobs:
  build-and-publish:
-    runs-on: ubuntu-latest
-
-    env:
-      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Install snapcraft
-        run: sudo snap install snapcraft --classic
-
-      - name: Authenticate snapcraft
-        shell: bash
-        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
-
-      - name: Remote build
+        with:
+          fetch-depth: 0
+      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
+        id: build
+      # retry snapcraft uploads which can be flaky
+      - name: Publish snap
        run: |
-          snapcraft remote-build \
-            --launchpad-accept-public-upload \
-            --build-for=amd64,arm64,armhf
-
-      - name: List built snaps
-        run: find . -maxdepth 1 -type f -name '*.snap' -print
-
-      - name: Upload and release snapcraft nightly build
-        run: |
-          set -euo pipefail
-
-          for snap in ./*.snap; do
-            echo "Uploading $snap to edge"
-            snapcraft upload --release="latest/edge" "$snap"
+          for attempt in 1 2 3 4 5; do
+            snapcraft upload "${{ steps.build.outputs.snap }}" --release latest/edge && exit 0
+            echo "::warning::snap upload attempt $attempt failed, retrying in 15s"
+            sleep 15
          done
+          exit 1
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
@@ -23,12 +23,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -61,7 +56,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -83,8 +78,8 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -92,7 +87,7 @@ jobs:
        run: |
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |-
@@ -102,7 +97,7 @@ jobs:
            type=raw,value=${{ steps.clean_name.outputs.branch }}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta_rootless
        with:
          images: |-
@@ -116,18 +111,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -137,7 +132,7 @@ jobs:
          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
      - name: build rootless docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -24,12 +24,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -62,7 +57,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -94,9 +89,9 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |-
@@ -109,7 +104,7 @@ jobs:
            type=semver,pattern={{version}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta_rootless
        with:
          images: |-
@@ -125,18 +120,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -144,7 +139,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -27,12 +27,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -65,7 +60,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -97,9 +92,9 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |-
@@ -116,7 +111,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta_rootless
        with:
          images: |-
@@ -137,18 +132,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -156,7 +151,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -4,309 +4,6 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.27.0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0) - 2026-07-13
-
-* BREAKING
-  * Feat(actions)!: improve support for reusable workflows (#37478)
-  * Use Content-Security-Policy: script nonce (#37232)
-
-* SECURITY
-  * Fix: various security fixes (#38406) (#38426)
-  * Fix(security): harden access checks and migration validation (#38324) (#38400)
-  * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
-  * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
-  * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
-  * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
-  * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
-  * Fix: golang html template url escaping (#38363) (#38369)
-  * Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
-  * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
-  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
-  * Fix(oauth): restrict introspection to the token's client (#38042)
-  * Fix(api): don't expose private org membership via public_members (#38145)
-  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
-  * Fix(migrations): prevent path traversal in repository restore (#38215)
-
-* FEATURES
-  * Feat(actions): add workflow status badge modal (#38196)
-  * Feat(actions): support owner-level and global scoped workflows (#38154)
-  * Feat(api): support ref suffixes in compare (#38148)
-  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
-  * Feat(actions): show run status on browser tab favicon (#38071)
-  * Feat(api): add token introspection and self-deletion endpoint (#37995)
-  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
-  * Feat(repo): split repository creation limit into user and org scopes (#37872)
-  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
-  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
-  * Feat(org): add team visibility so org members can discover teams (#37680)
-  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
-  * Feat: Add avatar stacks (#37594)
-  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
-  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
-  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
-  * Feat(orgs): Add search bar for organization members tab page (#37347)
-  * Feat(api): Add assignees APIs (#37330)
-  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
-  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
-  * Add project column picker to issue and pull request sidebar (#37037)
-  * Allow multiple projects per issue and pull requests (#36784)
-  * Feat(ui): add "follow rename" to file commit history list (#34994)
-  * Feat(ssh): auto generate additional ssh keys (#33974)
-
-* ENHANCEMENTS
-  * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
-  * Enhance: allow builtin default git config options to be overridden (#38172)
-  * Enhance: allow MathML core elements (#38034)
-  * Enhance(markup): improve issue title rendering (#37908)
-  * Enhance(actions): set descriptive browser tab title on run view (#37870)
-  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
-  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
-  * Feat(actions): add before/after to PR synchronize event payload (#37827)
-  * Enhance(actions): add branch filters to run list (#37826)
-  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
-  * Feat: add copy button to action step header, improve other copy buttons (#37744)
-  * Fix(icon): use repo-forked icon to display forks count (#37731)
-  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
-  * Feat(api): add last_sync to repository API (#37566)
-  * Enhance: Adjust Workflow Graph styling (#37497)
-  * Improve code editor text selection and clean up lint enablement (#37474)
-  * Add mirror auth updates to repo edit API and settings (#37468)
-  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
-  * Feat: Add default PR branch update style setting (#37410)
-  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
-  * Allow fast-forward-only merge when signed commits are required (#37335)
-  * Enhance styling in actions page (#37323)
-  * Fix: improve actions status icons and texts (#37206)
-  * Make Markdown fenced code block work with more syntaxes (#37154)
-  * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
-  * Add API endpoint to reply to pull request review comments (#36683)
-
-* PERFORMANCE
-  * Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
-  * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
-  * Perf: Various performance regression fixes (#38078)
-  * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076)
-  * Batch-load related data in actions run, job, and task API endpoints (#37032)
-
-* BUGFIXES
-  * Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
-  * Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
-  * Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
-  * Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
-  * Fix: actions task state concurrent update (#38405) (#38409)
-  * Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
-  * Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
-  * Fix: co-author detection (#38392) (#38397)
-  * Fix: incorrect co-author detection on commit page (#38386) (#38387)
-  * Fix(ui): restore commits table column widths (#38379) (#38383)
-  * Fix: minio init check (#38355) (#38361)
-  * Fix: org project view assignee list (#38357) (#38360)
-  * Fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347)
-  * Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
-  * Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
-  * Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
-  * Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
-  * Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
-  * Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
-  * Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
-  * Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
-  * Fix: update npm dependencies, fix misc issues (#38257)
-  * Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
-  * Fix: codemirror regressions (#38248)
-  * Fix(api): support HEAD requests on all API GET endpoints (#38245)
-  * Fix(actions): Cleanup workflow status badge code (#38241)
-  * Fix(web): Correctly align the "disabled" label on larger workflow names (#38240)
-  * Fix(actions): don't swallow HTML entities into linkified URLs (#38239)
-  * Fix(packages): accept npm "repository" and "bin" in string form (#38236)
-  * Fix(actions): fix 500 error when canceling a canceling task (#38223)
-  * Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
-  * Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
-  * Fix(api): deny private org member enumeration via /members (#38213)
-  * Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
-  * Fix(deps): update go dependencies (#38194)
-  * Fix(deps): update npm dependencies (#38193)
-  * Fix(cli): default must-change-password to false for bot users (#38175)
-  * Fix(actions): show run index in run view and fix summary graph height (#38165)
-  * Fix: csp (#38162)
-  * Fix(deps): update npm dependencies (#38123)
-  * Fix(mssql): expand legacy issue and comment long-text columns (#38120)
-  * Fix(packages): validate debian distribution and component names (#38116)
-  * Fix(packages): validate module version in goproxy ParsePackage (#38104)
-  * Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
-  * Fix: git push hook post receive (#38089)
-  * Fix(ui): prevent commit status popup overflowing its row (#38081)
-  * Fix: validate gem name in rubygems parseMetadataFile (#38061)
-  * Fix: commit display name (#38057)
-  * Fix: csp regressions (#38047)
-  * Fix: api error message (#38031)
-  * Fix(deps): update npm dependencies (#38029)
-  * Fix: pgsql lint (#38022)
-  * Fix(indexer): fix assignee filters in issue search (#38021)
-  * Fix: various dropdown problems (#38020)
-  * Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
-  * Fix: raise git required version to 2.13 (#37996)
-  * Fix: remove "no-transfrom" from the cache-control header (#37985)
-  * Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
-  * Fix: use committer time where ever possible as default (#37969)
-  * Fix(deps): update npm dependencies, remove nolyfill (#37968)
-  * Fix(deps): update go dependencies (#37967)
-  * Fix(pull): preserve squash message trailers and additional commit messages (#37954)
-  * Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
-  * Fix: support ##[command] log prefix in action run UI (#37882)
-  * Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
-  * Fix(deps): update npm dependencies (#37844)
-  * Fix(deps): update go dependencies (#37841)
-  * Fix(frontend): resolve Vite assets by manifest source path (#37836)
-  * Fix(locales): Replace hardcoded strings (#37788)
-  * Fix(packages): render markdown links relative to linked repo (#37676)
-  * Fix: persist mirror repository metadata (#37519)
-  * Fix cmd tests by mocking builtin paths (#37369)
-  * Add `form-fetch-action` to some forms, fix "fetch action" resp bug (#37305)
-  * Feat: execute post run cleanup when workflow is cancelled (#37275)
-  * Fix `relative-time` error and improve global error handler (#37241)
-  * Refactor flash message and remove SanitizeHTML template func (#37179)
-
-* TESTING
-  * Test(e2e): fix race in pdf file render test (#38380) (#38381)
-  * Test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331)
-  * Test: speed up two tests (#37905)
-  * Test: Fix random failure test (#37887)
-  * Test: fix flaky `issue-comment` close test (#37880)
-  * Test: enable WAL for sqlite integration tests (#37861)
-  * Test: fix flaky `TestResourceIndex` and reduce its runtime (#37847)
-  * Test: run `TestAPIRepoMigrate` offline via a local clone source (#37817)
-  * Ci: shard tests and reduce redundant work (#37618)
-  * Test(e2e): run playwright via container (#37300)
-  * Remove external service dependencies in migration tests (#36866)
-
-* BUILD
-  * Fix(actions): authenticate snapcraft before nightly remote build (#38252)
-  * Ci: cap Elasticsearch heap in db-tests (#37816)
-  * Build(snap): publish nightly version to snapcraft via actions (#37814)
-  * Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
-  * Ci: narrow files-changed frontend filter (#37749)
-  * Ci: add `zizmor` to `lint-actions` (#37720)
-  * Chore: clean up "contrib" dir (#37690)
-  * Fix: snap build (main branch) (#37685)
-  * Ci: Also lint json5 files (#37659)
-  * Feat(editor): broaden language detection in web code editor (#37619)
-  * Build: update pnpm to v11 (#37591)
-  * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557)
-  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
-  * Update go js py dependencies (#37525)
-  * Ci: lint PR titles with commitlint (#37498)
-  * Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
-  * Update GitHub Actions to latest major versions (#37313)
-  * Update go js dependencies (#37312)
-  * Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
-  * Remove htmx (#37224)
-  * Replace custom Go formatter with `golangci-lint fmt` (#37194)
-  * Refactor htmx and fetch-action related code (#37186)
-  * Integrate renovate bot for all dependency updates (#37050)
-  * Build(sign): move to sigstore (#38250)
-
-* DOCS
-  * Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
-  * Docs: fix duplicated word in foreachref doc comment (#38161)
-  * Docs: Clarify criteria for becoming a merger (#38113)
-  * Docs: Publish TOC Election Result 2026 (#38111)
-  * Docs: mark openapi3 as autogenerated in attributes (#37963)
-  * Docs: add development setup guide (#37960)
-
-* MISC
-  * Revert(sign): restore gpg (#38251)
-  * Refactor: replace legacy `delete-button` with `link-action` (#38143)
-  * Refactor(actions): read runner capabilities from proto field (#38068)
-  * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
-  * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
-  * Fix(deps): update go dependencies (#37851)
-  * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
-  * Ci: tweak `files-changed`, add `free-disk-space` (#37819)
-  * Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
-  * Test(e2e): add comment, release, star, PR and fork tests (#37800)
-  * Chore: simplify issue and pull request templates (#37799)
-  * Chore: Update giteabot to fix failure when backport (#37789)
-  * Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
-  * Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
-  * Ci: split giteabot workflow (#37770)
-  * Fix(deps): update npm dependencies (#37768)
-  * Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
-  * Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
-  * Ci: fix cache-related issues (#37761)
-  * Chore: fix tests (#37760)
-  * Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
-  * Fix(deps): update npm dependencies (#37753)
-  * Fix(deps): update go dependencies (#37752)
-  * Chore(deps): update action dependencies (#37751)
-  * Fix(markup): wrap indented code blocks for the code-copy button (#37748)
-  * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
-  * Feat(web): also display PR counts in repo list (#37739)
-  * Refactor(glob): use strings.Builder for regexp compilation (#37730)
-  * Chore(doctor): remove four obsolete doctor check implementations (#37728)
-  * Refactor(org): simplify owner-team org repo creation logic (#37727)
-  * Refactor: move `workflowpattern` into `modules/actions` (#37717)
-  * Chore: clean up tests (#37715)
-  * Style: misc UI fixes (#37691)
-  * Ci: add shellcheck linter (#37682)
-  * Fix: catch and fix more lint problems (#37674)
-  * Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
-  * Fix(deps): update npm dependencies (#37647)
-  * Ci(renovate): update Go import paths on major bumps (#37641)
-  * Fix(deps): update go dependencies (major) (#37639)
-  * Chore(deps): update action dependencies (major) (#37638)
-  * Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
-  * Fix(deps): update npm dependencies (#37636)
-  * Refactor(log): replace log.Critical with log.Error (#37624)
-  * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
-  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
-  * Chore(deps): update action dependencies (#37603)
-  * Ci: allow `chore` type in PR title lint (#37575)
-  * Refactor: only reset a database table when the table's data was changed (#37573)
-  * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
-  * Refactor: use modernc sqlite driver as default (#37562)
-  * Docs: fix 4 typos in CHANGELOG.md (#37549)
-  * Fix(deps): update go dependencies (#37541)
-  * Chore(deps): update action dependencies (#37540)
-  * Refactor pull request view (6) (#37522)
-  * Fix: redirect early CLI console logger to stderr (#37507)
-  * Refactor "flex-list" to "flex-divided-list" (#37505)
-  * Refactor compare diff/pull page (1) (#37481)
-  * Refactor pull request view (4) (#37451)
-  * Update 1.26.1 changelog in main (#37442)
-  * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441)
-  * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405)
-  * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
-  * Update `Block a user` form (#37359)
-  * Move review request functions to a standalone file (#37358)
-  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
-  * Enable strict TypeScript, add `errorMessage` helper (#37292)
-  * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291)
-  * Update Nix flake (#37284)
-  * Fix Repository transferring page (#37277)
-  * Remove `SubmitEvent` polyfill (#37276)
-  * Remove dead code identified by `deadcode` tool (#37271)
-  * Upgrade go-git to v5.18.0 (#37268)
-  * Don't add useless labels which will bother changelog generation (#37267)
-  * Move heatmap to first-party code (#37262)
-  * Tests/integration: simplify code (#37249)
-  * Add pagination and search box to org teams list (#37245)
-  * Remove error returns from crypto random helpers and callers (#37240)
-  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
-  * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
-  * Refactor "htmx" to "fetch action" (#37208)
-  * Update go js py dependencies (#37204)
-  * Add comment for the design of "user activity time" (#37195)
-  * Remove outdated RunUser logic (#37180)
-  * Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150)
-  * Update javascript dependencies (#37142)
-  * Update go dependencies (#37141)
-  * Frontport changelog of v1.26.0-rc0 (#37138)
-  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
-  * Workflow Artifact Info Hover (#37100)
-  * Extend issue context popup beyond markdown content (#36908)
-  * Add bulk repository deletion for organizations (#36763)
-  * Feat: Add bypass allowlist for branch protection (#36514)
-
 ## [1.26.4](https://github.com/go-gitea/gitea/releases/tag/1.26.4) - 2026-06-21

 * SECURITY
@@ -41,7 +41,6 @@ Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
-Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
@@ -12,13 +12,13 @@ COMMA := ,
 XGO_VERSION := go-1.26.x

 AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.8.0 # renovate: datasource=go
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.1 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.35.0 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.4.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.5.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

@@ -231,7 +231,9 @@ endif
 generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments

 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
-	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'
+	@output="$$($(GO) run $(SWAGGER_PACKAGE) generate spec --enable-allof-compounding --skip-enum-desc --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)' 2>&1)" || { printf '%s\n' "$$output" >&2; exit 1; }; \
+	warnings="$$(printf '%s\n' "$$output" | grep -v '^go: ')"; \
+	if [ -n "$$warnings" ]; then printf '%s\n' "$$warnings" >&2; exit 1; fi

 .PHONY: swagger-check
 swagger-check: generate-swagger
@@ -246,9 +248,11 @@ swagger-check: generate-swagger
 swagger-validate: ## check if the swagger spec is valid
 	@# swagger "validate" requires that the "basePath" must start with a slash, but we are using Golang template "{{...}}"
 	@$(SED_INPLACE) -E -e 's|"basePath":( *)"(.*)"|"basePath":\1"/\2"|g' './$(SWAGGER_SPEC)' # add a prefix slash to basePath
-	@# FIXME: there are some warnings
-	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
-	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath
+	@output="$$($(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)' 2>&1)"; status=$$?; \
+	$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)'; \
+	printf '%s\n' "$$output" | grep -v '^go: '; \
+	[ $$status -eq 0 ] || exit $$status; \
+	case "$$output" in *WARNING:*) exit 1;; esac

 .PHONY: generate-openapi3
 generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec
@@ -436,6 +436,7 @@
      "jsonl",
      "mcmeta",
      "sarif",
+      "slnlaunch",
      "tact",
      "tfstate",
      "topojson",
@@ -691,10 +692,17 @@
    "extensions": [
      "ini",
      "cnf",
+      "container",
      "dof",
      "lektorproject",
+      "mount",
+      "network",
      "prefs",
      "properties",
+      "service",
+      "socket",
+      "target",
+      "timer",
      "url",
      "conf"
    ],
@@ -18,6 +18,7 @@ func newUserCommand() *cli.Command {
 			microcmdUserDelete(),
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
+			microcmdUserDisableTwoFactor(),
 		},
 	}
 }
@@ -0,0 +1,72 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+
+	"github.com/urfave/cli/v3"
+)
+
+func microcmdUserDisableTwoFactor() *cli.Command {
+	return &cli.Command{
+		Name:  "disable-2fa",
+		Usage: "Disable two-factor authentication for a user",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "username",
+				Aliases: []string{"u"},
+				Usage:   "Username of the user to disable 2FA for",
+			},
+			&cli.Int64Flag{
+				Name:  "id",
+				Usage: "ID of the user to disable 2FA for",
+			},
+		},
+		Action: runDisableTwoFactor,
+	}
+}
+
+func runDisableTwoFactor(ctx context.Context, c *cli.Command) error {
+	if !c.IsSet("id") && !c.IsSet("username") {
+		return errors.New("either --id or --username must be provided")
+	}
+
+	if !setting.IsInTesting {
+		if err := initDB(ctx); err != nil {
+			return err
+		}
+	}
+
+	var user *user_model.User
+	var err error
+	if c.IsSet("id") {
+		user, err = user_model.GetUserByID(ctx, c.Int64("id"))
+	} else {
+		user, err = user_model.GetUserByName(ctx, c.String("username"))
+	}
+	if err != nil {
+		return err
+	}
+
+	// When both selectors are given, make sure they refer to the same user.
+	if c.IsSet("id") && c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
+		return fmt.Errorf("the user with id %d is %q, which does not match the provided username %q", user.ID, user.Name, c.String("username"))
+	}
+
+	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, user.ID)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Disabled 2FA for user %q (removed %d TOTP and %d WebAuthn credential(s))\n", user.Name, totp, webAuthn)
+	return nil
+}
@@ -0,0 +1,119 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"io"
+	"strconv"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/go-webauthn/webauthn/webauthn"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDisableTwoFactorCommand(t *testing.T) {
+	ctx := t.Context()
+
+	defer func() {
+		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
+	}()
+
+	t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "tfuser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
+
+		// Enroll TOTP.
+		tf := &auth_model.TwoFactor{UID: user.ID}
+		require.NoError(t, tf.SetSecret("test-secret"))
+		_, err := tf.GenerateScratchToken()
+		require.NoError(t, err)
+		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
+
+		// Register a WebAuthn credential.
+		_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
+		require.NoError(t, err)
+
+		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		require.True(t, has)
+
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
+
+		// Both factors must be gone afterwards.
+		has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		assert.False(t, has)
+	})
+
+	t.Run("disable by id", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "iduser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
+
+		tf := &auth_model.TwoFactor{UID: user.ID}
+		require.NoError(t, tf.SetSecret("test-secret"))
+		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
+
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
+
+		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		assert.False(t, has)
+	})
+
+	t.Run("no enrollment is a no-op", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "plainuser@gitea.local", "--random-password"}))
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
+	})
+
+	t.Run("id and username must match when both given", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "matchuser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
+		id := strconv.FormatInt(user.ID, 10)
+
+		// Matching id + username is accepted.
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
+
+		// Mismatched id + username is rejected.
+		cmd := microcmdUserDisableTwoFactor()
+		cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+		err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "does not match the provided username")
+	})
+
+	t.Run("failure cases", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			args        []string
+			expectedErr string
+		}{
+			{
+				name:        "user does not exist",
+				args:        []string{"disable-2fa", "--username", "nonexistentuser"},
+				expectedErr: "user does not exist",
+			},
+			{
+				name:        "neither id nor username",
+				args:        []string{"disable-2fa"},
+				expectedErr: "either --id or --username must be provided",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				cmd := microcmdUserDisableTwoFactor()
+				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+				err := cmd.Run(ctx, tc.args)
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.expectedErr)
+			})
+		}
+	})
+}
@@ -1198,6 +1198,7 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
+;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -95,8 +95,15 @@ However, if there are no objections from maintainers, the PR can be merged with
 ### Commit messages

 Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
+Usually the Pull Request description and commit message body should not be empty, unless the title is already clear enough or the description would be a copy of the comments in code.

-The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+The final commit message:
+
+- should match the code changes.
+- should only keep true co-authors, false-positive co-authors should be removed.
+- should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+- should not contain hidden information like `<!-- -->` or extra information after the description's divider `----`.
+- should not contain unrelated contents (e.g.: Release Notes, Configuration, etc.) from a Renovate update PR.

 #### PR Co-authors

@@ -158,9 +165,16 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:

 - Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
- Rewriting the PR title and summary so the squash [commit message](#commit-messages) is clear, removing false-positive co-authors while keeping every true co-author.
+- Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
+  In particular, mergers should edit the PR description.\
+  Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.
 - Assigning the correct labels (including `type/…`) needed for changelog and backport decisions.
 - Agreeing, together with the owners, on when a release is ready (see [release management](release-management.md)).
+- Merging a PR also means the PR looks good to the merger and is approved by the merger.
+
+If a merger violates these merge guides more than 3 times in the past 365 days
+(e.g.: merge with unresolved reviews without TOC decision to ignore the review, merge with garbage commit messages),
+they may lose their merging privileges for at least three months.

 #### Becoming a merger

@@ -200,20 +214,20 @@ random.seed("Gitea TOC <YEAR> Election")
 random.choice([<CANDIDATE_1>, <CANDIDATE_2>, ...])
 ```

-The result of this script needs then to be published in the TOC election issue to ensure transparency of the process. 
+The result of this script needs then to be published in the TOC election issue to ensure transparency of the process.

 ### Current TOC members

 - 2026-06-14 ~ 2026-12-31
  - Company
-    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
+    - [Yu Tian](https://gitea.com/Zettat123) <zettat123@gmail.com>
    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
  - Community
    - [bircni](https://gitea.com/bircni) <bircni@icloud.com>
    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
    - [TheFox0x7](https://gitea.com/TheFox0x7) <thefox0x7@gmail.com>
-    
+

 ### Previous TOC/owners members

@@ -227,7 +241,7 @@ Here's the history of the owners and the time they served:
 - [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [6543](https://gitea.com/6543) - 2023, 2025
 - [John Olheiser](https://gitea.com/jolheiser) - 2023, 2024
- [Jason Song](https://gitea.com/wolfogre) - 2023
+- [Jason Song](https://gitea.com/wolfogre) - 2023, 2025

 ## Governance Compensation

@@ -1,6 +1,4 @@
-import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
-import deMorgan from 'eslint-plugin-de-morgan';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
@@ -15,7 +13,6 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
-import type {ESLint} from 'eslint';

 import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts';

@@ -64,10 +61,8 @@ export default defineConfig([
      '@eslint-community/eslint-comments': comments,
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
-      'array-func': arrayFunc,
-      'de-morgan': deMorgan,
      'gitea': {rules: {'unescaped-html-literal': unescapedHtmlLiteral}},
-      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      'import-x': importPlugin,
      regexp,
      sonarjs,
      unicorn,
@@ -278,12 +273,6 @@ export default defineConfig([
      '@typescript-eslint/unified-signatures': [2],
      'accessor-pairs': [2],
      'array-callback-return': [2, {checkForEach: true}],
-      'array-func/avoid-reverse': [2],
-      'array-func/from-map': [2],
-      'array-func/no-unnecessary-this-arg': [2],
-      'array-func/prefer-array-from': [2],
-      'array-func/prefer-flat-map': [0], // handled by unicorn/prefer-array-flat-map
-      'array-func/prefer-flat': [0], // handled by unicorn/prefer-array-flat
      'arrow-body-style': [0],
      'block-scoped-var': [2],
      'camelcase': [0],
@@ -294,8 +283,6 @@ export default defineConfig([
      'consistent-this': [0],
      'constructor-super': [2],
      'curly': [0],
-      'de-morgan/no-negated-conjunction': [2],
-      'de-morgan/no-negated-disjunction': [2],
      'default-case-last': [2],
      'default-case': [0],
      'default-param-last': [0],
@@ -745,6 +732,7 @@ export default defineConfig([
      'unicorn/consistent-json-file-read': [2],
      'unicorn/consistent-optional-chaining': [2],
      'unicorn/consistent-template-literal-escape': [2],
+      'unicorn/consistent-tuple-labels': [2],
      'unicorn/custom-error-definition': [0],
      'unicorn/default-export-style': [2],
      'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
@@ -778,6 +766,7 @@ export default defineConfig([
      'unicorn/no-array-sort-for-min-max': [2],
      'unicorn/no-array-splice': [0],
      'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
+      'unicorn/no-async-promise-finally': [2],
      'unicorn/no-await-expression-member': [0],
      'unicorn/no-await-in-promise-methods': [2],
      'unicorn/no-blob-to-file': [2],
@@ -814,8 +803,10 @@ export default defineConfig([
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-file-input-accept': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
+      'unicorn/no-invalid-well-known-symbol-methods': [2],
      'unicorn/no-keyword-prefix': [0],
      'unicorn/no-late-current-target-access': [2],
+      'unicorn/no-late-event-control': [2],
      'unicorn/no-lonely-if': [2],
      'unicorn/no-loop-iterable-mutation': [2],
      'unicorn/no-magic-array-flat-depth': [0],
@@ -852,9 +843,11 @@ export default defineConfig([
      'unicorn/no-uncalled-method': [2],
      'unicorn/no-undeclared-class-members': [2],
      'unicorn/no-unnecessary-array-flat-depth': [2],
+      'unicorn/no-unnecessary-array-flat-map': [2],
      'unicorn/no-unnecessary-array-splice-count': [2],
      'unicorn/no-unnecessary-await': [2],
      'unicorn/no-unnecessary-boolean-comparison': [2],
+      'unicorn/no-unnecessary-fetch-options': [0],
      'unicorn/no-unnecessary-global-this': [0],
      'unicorn/no-unnecessary-nested-ternary': [2],
      'unicorn/no-unnecessary-polyfills': [2],
@@ -867,6 +860,7 @@ export default defineConfig([
      'unicorn/no-unreadable-object-destructuring': [0],
      'unicorn/no-unsafe-buffer-conversion': [2],
      'unicorn/no-unsafe-dom-html': [0],
+      'unicorn/no-unsafe-promise-all-settled-values': [2],
      'unicorn/no-unsafe-property-key': [0],
      'unicorn/no-unsafe-string-replacement': [0],
      'unicorn/no-unused-array-method-return': [2],
@@ -896,13 +890,17 @@ export default defineConfig([
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
      'unicorn/operator-assignment': [2],
+      'unicorn/prefer-abort-signal-any': [2],
+      'unicorn/prefer-abort-signal-timeout': [2],
      'unicorn/prefer-add-event-listener': [2],
      'unicorn/prefer-add-event-listener-options': [2],
+      'unicorn/prefer-aggregate-error': [2],
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
      'unicorn/prefer-array-from-async': [2],
      'unicorn/prefer-array-from-map': [2],
+      'unicorn/prefer-array-from-range': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-iterable-methods': [2],
      'unicorn/prefer-array-last-methods': [2],
@@ -912,6 +910,7 @@ export default defineConfig([
      'unicorn/prefer-await': [2],
      'unicorn/prefer-bigint-literals': [2],
      'unicorn/prefer-blob-reading-methods': [2],
+      'unicorn/prefer-block-statement-over-iife': [2],
      'unicorn/prefer-boolean-return': [2],
      'unicorn/prefer-class-fields': [2],
      'unicorn/prefer-classlist-toggle': [2],
@@ -924,15 +923,18 @@ export default defineConfig([
      'unicorn/prefer-dom-node-append': [2],
      'unicorn/prefer-dom-node-html-methods': [0],
      'unicorn/prefer-dom-node-remove': [2],
+      'unicorn/prefer-dom-node-replace-children': [2],
      'unicorn/prefer-dom-node-text-content': [2],
      'unicorn/prefer-early-return': [0],
      'unicorn/prefer-else-if': [2],
+      'unicorn/prefer-error-is-error': [0],
      'unicorn/prefer-event-target': [2],
      'unicorn/prefer-export-from': [0],
      'unicorn/prefer-flat-math-min-max': [2],
      'unicorn/prefer-get-or-insert-computed': [2],
      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
+      'unicorn/prefer-group-by': [2],
      'unicorn/prefer-has-check': [2],
      'unicorn/prefer-hoisting-branch-code': [2],
      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
@@ -942,6 +944,7 @@ export default defineConfig([
      'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
      'unicorn/prefer-iterable-in-constructor': [2],
      'unicorn/prefer-iterator-concat': [0], // too opinionated
+      'unicorn/prefer-iterator-helpers': [2],
      'unicorn/prefer-iterator-to-array': [2],
      'unicorn/prefer-iterator-to-array-at-end': [2],
      'unicorn/prefer-keyboard-event-key': [2],
@@ -966,9 +969,11 @@ export default defineConfig([
      'unicorn/prefer-object-destructuring-defaults': [2],
      'unicorn/prefer-object-from-entries': [2],
      'unicorn/prefer-object-iterable-methods': [2],
+      'unicorn/prefer-observer-apis': [2],
      'unicorn/prefer-optional-catch-binding': [2],
      'unicorn/prefer-path2d': [2],
      'unicorn/prefer-private-class-fields': [0],
+      'unicorn/prefer-promise-try': [2],
      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [0],
      'unicorn/prefer-query-selector': [2],
@@ -979,10 +984,12 @@ export default defineConfig([
      'unicorn/prefer-response-static-json': [2],
      'unicorn/prefer-scoped-selector': [0],
      'unicorn/prefer-set-has': [0],
+      'unicorn/prefer-set-methods': [0],
      'unicorn/prefer-set-size': [2],
      'unicorn/prefer-short-arrow-method': [2],
      'unicorn/prefer-simple-condition-first': [0],
      'unicorn/prefer-simple-sort-comparator': [2],
+      'unicorn/prefer-simplified-conditions': [2],
      'unicorn/prefer-single-array-predicate': [2],
      'unicorn/prefer-single-call': [2],
      'unicorn/prefer-single-object-destructuring': [2],
@@ -1002,6 +1009,7 @@ export default defineConfig([
      'unicorn/prefer-switch': [0],
      'unicorn/prefer-temporal': [0],
      'unicorn/prefer-ternary': [0],
+      'unicorn/prefer-toggle-attribute': [2],
      'unicorn/prefer-top-level-await': [0],
      'unicorn/prefer-type-error': [0],
      'unicorn/prefer-type-literal-last': [0],
@@ -1010,6 +1018,7 @@ export default defineConfig([
      'unicorn/prefer-unicode-code-point-escapes': [0],
      'unicorn/prefer-url-can-parse': [2],
      'unicorn/prefer-url-href': [2],
+      'unicorn/prefer-url-search-parameters': [2],
      'unicorn/prefer-while-loop-condition': [2],
      'unicorn/prevent-abbreviations': [0],
      'unicorn/relative-url-style': [2],
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1776877367,
-        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "lastModified": 1782723713,
+        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
        "type": "github"
      },
      "original": {
@@ -34,7 +34,7 @@

              # only bump toolchain versions here
              go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_24;
+              nodejs = pkgs.nodejs_26;
              python3 = pkgs.python314;
              pnpm = pkgs.pnpm_10;

@@ -1,6 +1,6 @@
 module gitea.dev

-go 1.26.4
+go 1.26.5

 require (
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
@@ -9,11 +9,11 @@ require (
 	gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
-	gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e
+	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
 	gitea.dev/actions-proto-go v0.6.0
-	gitea.dev/sdk v1.1.0
+	gitea.dev/sdk v1.2.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
@@ -24,12 +24,12 @@ require (
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
 	github.com/alecthomas/chroma/v2 v2.27.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.28
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.35.0
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
-	github.com/buildkite/terminal-to-html/v3 v3.16.8
+	github.com/buildkite/terminal-to-html/v3 v3.17.1
 	github.com/caddyserver/certmagic v0.25.4
 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635
 	github.com/chi-middleware/proxy v1.1.1
@@ -44,20 +44,20 @@ require (
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/getkin/kin-openapi v0.140.0
 	github.com/gliderlabs/ssh v0.3.8
-	github.com/go-chi/chi/v5 v5.3.0
+	github.com/go-chi/chi/v5 v5.3.1
 	github.com/go-chi/cors v1.2.2
 	github.com/go-co-op/gocron/v2 v2.21.2
 	github.com/go-enry/go-enry/v2 v2.9.6
 	github.com/go-git/go-billy/v5 v5.9.0
 	github.com/go-git/go-git/v5 v5.19.1
 	github.com/go-ldap/ldap/v3 v3.4.13
-	github.com/go-redsync/redsync/v4 v4.16.0
+	github.com/go-redsync/redsync/v4 v4.17.0
 	github.com/go-sql-driver/mysql v1.10.0
 	github.com/go-webauthn/webauthn v0.17.4
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v88 v88.0.0
+	github.com/google/go-github/v89 v89.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
 	github.com/google/pprof v0.0.0-20260604005048-7023385849c0
 	github.com/google/uuid v1.6.0
@@ -68,8 +68,8 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jhillyerd/enmime/v2 v2.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.18.6
-	github.com/klauspost/cpuid/v2 v2.3.0
+	github.com/klauspost/compress v1.19.0
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.22
@@ -78,7 +78,7 @@ require (
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.10.0
-	github.com/minio/minio-go/v7 v7.2.0
+	github.com/minio/minio-go/v7 v7.2.1
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
@@ -96,29 +96,29 @@ require (
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.0
-	github.com/wneessen/go-mail v0.7.3
+	github.com/urfave/cli/v3 v3.10.1
+	github.com/wneessen/go-mail v0.8.1
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.42.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.46.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
-	golang.org/x/crypto v0.53.0
-	golang.org/x/image v0.43.0
-	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.56.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/image v0.44.0
+	golang.org/x/mod v0.38.0
+	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.21.0
-	golang.org/x/sys v0.46.0
-	golang.org/x/text v0.38.0
-	google.golang.org/grpc v1.81.1
+	golang.org/x/sync v0.22.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/text v0.40.0
+	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
 	modernc.org/sqlite v1.53.0
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.3.11
+	xorm.io/xorm v1.4.1
 )

 require (
@@ -133,10 +133,10 @@ require (
 	github.com/andybalholm/brotli v1.2.1 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
-	github.com/aws/aws-sdk-go-v2 v1.42.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect
-	github.com/aws/smithy-go v1.27.2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.42.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/smithy-go v1.27.3 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.5 // indirect
@@ -199,9 +199,7 @@ require (
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inbucket/html2text v1.0.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -269,7 +267,7 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -18,8 +18,8 @@ gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
 gitea.com/go-chi/cache v0.2.1/go.mod h1:Qic0HZ8hOHW62ETGbonpwz8WYypj9NieU9659wFUJ8Q=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 h1:p2ki+WK0cIeNQuqjR98IP2KZQKRzJJiV7aTeMAFwaWo=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098/go.mod h1:LjzIOHlRemuUyO7WR12fmm18VZIlCAaOt9L3yKw40pk=
-gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e h1:4bugwPyGMLvblEm3pZ8fZProSPVxE4l0UXF2Kv6IJoY=
-gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
+gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS48ZmQYLkzssdeABxHPhbdnxPDIU=
+gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
@@ -28,8 +28,8 @@ gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGq
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
 gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
-gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
-gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
+gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
+gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -92,18 +92,18 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuW
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
-github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4 h1:Uu+wqrOXozYYvaxcNIqjFsMTjoIJIZDN3R0f70ZIjyQ=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
-github.com/aws/smithy-go v1.27.2 h1:y9NPmSE6am6LjEFPfqHqG/jJk7AauQvhCJONKh7kpzk=
-github.com/aws/smithy-go v1.27.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
+github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.28 h1:zTXJSsNcoO91/mTXsZoYf0AK8dvNPiA58/VtyGXR+wM=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.28/go.mod h1:Kd9E0JzDBW/q1xbsHFrev/GnbAf5J0Ng8xoyc7HZ91Q=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.35.0 h1:w/iPWj+VObIbyo1WYN5010Bi61OkkqOiFZpNDAP1Rfc=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.35.0/go.mod h1:uH156Pb0jnMXuCSD9irU0Qz6UNhYUF2qbowFqIwyLQ8=
+github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
+github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -185,8 +185,8 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
-github.com/buildkite/terminal-to-html/v3 v3.16.8 h1:QN/daUob6cmK8GcdKnwn9+YTlPr1vNj+oeAIiJK6fPc=
-github.com/buildkite/terminal-to-html/v3 v3.16.8/go.mod h1:+k1KVKROZocrTLsEQ9PEf9A+8+X8uaVV5iO1ZIOwKYM=
+github.com/buildkite/terminal-to-html/v3 v3.17.1 h1:gs9WhKUwxK27YHf3hijj4tG4wuDLfCANYbRPd5ltMdI=
+github.com/buildkite/terminal-to-html/v3 v3.17.1/go.mod h1:0pv+Z75FC+NvIju2o+Cw+YHIDkueeudIoeyfVm8i8GQ=
 github.com/caddyserver/certmagic v0.25.4 h1:8eIXh0HC3MsGnNo8One+BCxMGTbe5zb/oz+2KsxBFQg=
 github.com/caddyserver/certmagic v0.25.4/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
 github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
@@ -285,8 +285,8 @@ github.com/glycerine/goconvey v0.0.0-20190410193231-58a59202ab31/go.mod h1:Ogl1T
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-chi/chi/v5 v5.0.1/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
-github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
+github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY=
@@ -319,8 +319,8 @@ github.com/go-redis/redis/v7 v7.4.1 h1:PASvf36gyUpr2zdOUS/9Zqc80GbM+9BDyiJSJDDOr
 github.com/go-redis/redis/v7 v7.4.1/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-redsync/redsync/v4 v4.16.0 h1:bNcOzeHH9d3s6pghU9NJFMPrQa41f5Nx3L4YKr3BdEU=
-github.com/go-redsync/redsync/v4 v4.16.0/go.mod h1:V4gagqgyASWBZuwx4xGzu72aZNb/6Mo05byUa3mVmKQ=
+github.com/go-redsync/redsync/v4 v4.17.0 h1:FFJ+uxZs44y4Sq10//IFKic9T94AYl+u3Sog98AHzBo=
+github.com/go-redsync/redsync/v4 v4.17.0/go.mod h1:CKVA6qwT07S/916i+Yd9h1/8YFQhCCpPYTQhvvYytJo=
 github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
 github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
@@ -376,8 +376,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
-github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -413,17 +413,10 @@ github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pw
 github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
-github.com/graph-gophers/graphql-go v1.10.2 h1:HXu6Wu5klCH4ALn1fQHVI20cjEIa4wftavHIgbLA4Fo=
-github.com/graph-gophers/graphql-go v1.10.2/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
@@ -471,12 +464,12 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -534,8 +527,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
-github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
+github.com/minio/minio-go/v7 v7.2.1 h1:PfBfwvKB/MmqyN8Vb1G9voWisaM9OrLv+WwOvMwS9Dw=
+github.com/minio/minio-go/v7 v7.2.1/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
 github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -620,10 +613,10 @@ github.com/quasoft/websspi v1.1.2/go.mod h1:HmVdl939dQ0WIXZhyik+ARdI03M6bQzaSEKc
 github.com/rcrowley/go-metrics v0.0.0-20190826022208-cac0b30c2563/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=
 github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
-github.com/redis/rueidis v1.0.71 h1:pODtnAR5GAB7j4ekhldZ29HKOxe4Hph0GTDGk1ayEQY=
-github.com/redis/rueidis v1.0.71/go.mod h1:lfdcZzJ1oKGKL37vh9fO3ymwt+0TdjkkUCJxbgpmcgQ=
-github.com/redis/rueidis/rueidiscompat v1.0.71 h1:wNZ//kEjMZgBM0KCk7ncOX8KmAgROU2kDdDNpwheG4w=
-github.com/redis/rueidis/rueidiscompat v1.0.71/go.mod h1:esmCLJvaRzZoKlgB82G1bY7Iky5TnO9Rz+NlhbEccFI=
+github.com/redis/rueidis v1.0.76 h1:RdDWuvlYBSp+bTrBvaXqJnNEL3VVzsnjo+0psPFgLc4=
+github.com/redis/rueidis v1.0.76/go.mod h1:UsfHPSbomB6QAVMk4iiFkzRy0nh9o7scDGa+SitvBY4=
+github.com/redis/rueidis/rueidiscompat v1.0.76 h1:7LikbiqCQqCsZXeZ+akgZMnjIV/J0VHih9PIX4gGZC4=
+github.com/redis/rueidis/rueidiscompat v1.0.76/go.mod h1:UatQQLVj4QMIsZtpvRWY28qm6r2d72idhcS+C/RM+Zg=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rhysd/actionlint v1.7.12 h1:vQ4GeJN86C0QH+gTUQcs8McmK62OLT3kmakPMtEWYnY=
@@ -709,11 +702,11 @@ github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
-github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.1 h1:7Kx9H50hrHbRbyxgO1KP6/BcbiGRz0uYh5YyQ30JEEY=
+github.com/urfave/cli/v3 v3.10.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
-github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
+github.com/wneessen/go-mail v0.8.1 h1:tVcncj02/QySVFw3zr/kXOzZcuFQqBNT6K+Rbgm/pcM=
+github.com/wneessen/go-mail v0.8.1/go.mod h1:dWZ61zadzCIyvB4y1/YzC5O7MrbbzBfPkARmbosdf8w=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -740,8 +733,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0 h1:Bq5YIYgUJVbt4Hbh7ibBwNR4SNEafsyDVhIXl7dXDdg=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
+gitlab.com/gitlab-org/api/client-go/v2 v2.46.0 h1:t9QSeMck3kuHu9R6C7h8cYk4qBI4ZD4SQ0jspxKYs2E=
+gitlab.com/gitlab-org/api/client-go/v2 v2.46.0/go.mod h1:1LK5UOowqo9apkL+zn7sM8t/hCzBV6F1b2RUIHL9+Oo=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -776,12 +769,12 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
-golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
-golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
+golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -790,8 +783,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -807,8 +800,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -822,8 +815,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181221143128-b4a75ba826a6/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -854,8 +847,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -865,8 +858,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -877,8 +870,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -890,16 +883,16 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -964,5 +957,5 @@ strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab h1:3IZDVyI
 strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
-xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
+xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
@@ -277,6 +277,12 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }

+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
+	var runs []*ActionRun
+	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
+	return runs, err
+}
+
 func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
 	run, has, err := db.Get[ActionRun](ctx, builder.Eq{"repo_id": repoID, "`index`": runIndex})
 	if err != nil {
@@ -195,3 +195,18 @@ func HasTwoFactorOrWebAuthn(ctx context.Context, id int64) (bool, error) {
 	}
 	return HasWebAuthnRegistrationsByUID(ctx, id)
 }
+
+// DisableTwoFactor removes every two-factor method of the given user atomically,
+// returning the number of TOTP records and WebAuthn credentials removed.
+// It is a no-op for a user that has no 2FA enrolled.
+func DisableTwoFactor(ctx context.Context, uid int64) (totp, webAuthn int64, err error) {
+	err = db.WithTx(ctx, func(ctx context.Context) error {
+		var e error
+		if totp, e = db.GetEngine(ctx).Where("uid = ?", uid).Delete(&TwoFactor{}); e != nil {
+			return e
+		}
+		webAuthn, e = db.GetEngine(ctx).Where("user_id = ?", uid).Delete(&WebAuthnCredential{})
+		return e
+	})
+	return totp, webAuthn, err
+}
@@ -10,6 +10,7 @@ import (
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"

+	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pquerna/otp/totp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -45,3 +46,37 @@ func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
 	require.NoError(t, err)
 	assert.False(t, ok)
 }
+
+func TestDisableTwoFactor(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	const uid = 1000 // a uid with no user/2FA fixtures
+
+	// Enroll TOTP and register a WebAuthn credential.
+	tfa := &auth_model.TwoFactor{UID: uid}
+	require.NoError(t, tfa.SetSecret("test-secret"))
+	require.NoError(t, auth_model.NewTwoFactor(ctx, tfa))
+	_, err := auth_model.CreateCredential(ctx, uid, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
+	require.NoError(t, err)
+
+	has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
+	require.NoError(t, err)
+	require.True(t, has)
+
+	// Both records are removed and counted separately.
+	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, uid)
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, totp)
+	assert.EqualValues(t, 1, webAuthn)
+
+	has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
+	require.NoError(t, err)
+	assert.False(t, has)
+
+	// A second call on a user without 2FA is a no-op.
+	totp, webAuthn, err = auth_model.DisableTwoFactor(ctx, uid)
+	require.NoError(t, err)
+	assert.EqualValues(t, 0, totp)
+	assert.EqualValues(t, 0, webAuthn)
+}
@@ -117,8 +117,8 @@ func (t *Team) CanNonMemberReadMeta(ctx context.Context, org, doer *user_model.U
 	}
 }

-func NormalizeTeamVisibility(s string) structs.VisibleType {
-	if vt, ok := structs.VisibilityModes[s]; ok {
+func NormalizeTeamVisibility[T ~string](v T) structs.VisibleType {
+	if vt, ok := structs.VisibilityModes[structs.VisibilityString(v)]; ok {
 		return vt
 	}
 	return structs.VisibleTypePrivate
@@ -647,6 +647,10 @@ func (repo *Repository) DescriptionHTML(ctx context.Context) template.HTML {

 // CloneLink represents different types of clone URLs of repository.
 type CloneLink struct {
+	IsWikiRepo   bool
+	SupportSSH   bool
+	SupportHTTPS bool
+
 	SSH   string
 	HTTPS string
 	Tea   string
@@ -698,9 +702,12 @@ func ComposeTeaCloneCommand(ctx context.Context, owner, repo string) string {

 func (repo *Repository) cloneLink(ctx context.Context, doer *user_model.User, repoPathName string) *CloneLink {
 	return &CloneLink{
-		SSH:   ComposeSSHCloneURL(doer, repo.OwnerName, repoPathName),
-		HTTPS: ComposeHTTPSCloneURL(ctx, repo.OwnerName, repoPathName),
-		Tea:   ComposeTeaCloneCommand(ctx, repo.OwnerName, repoPathName),
+		IsWikiRepo:   strings.HasSuffix(repoPathName, ".wiki"),
+		SupportHTTPS: !setting.Repository.DisableHTTPGit,
+		SupportSSH:   !setting.SSH.Disabled && (doer != nil || setting.SSH.ExposeAnonymous),
+		SSH:          ComposeSSHCloneURL(doer, repo.OwnerName, repoPathName),
+		HTTPS:        ComposeHTTPSCloneURL(ctx, repo.OwnerName, repoPathName),
+		Tea:          ComposeTeaCloneCommand(ctx, repo.OwnerName, repoPathName),
 	}
 }

@@ -57,9 +57,14 @@ func NewInterpeter(
 	}

 	ee := &exprparser.EvaluationEnvironment{
-		Github:   gitCtx,
-		Env:      nil, // no need
-		Job:      nil, // no need
+		Github: gitCtx,
+		Env:    nil, // no need
+		// Job must be non-nil because cancelled() dereferences Job.Status unconditionally.
+		// See: https://gitea.com/gitea/runner/src/commit/ad967330a8788c9b8ab723abbc1a86d53c3bc5e6/act/exprparser/functions.go#L299
+		// TODO: The empty JobContext.Status is right for now because Gitea never checks `if` condition when the workflow run is cancelled.
+		// This is an implementation gap in Gitea Actions. When a workflow run is cancelled, Gitea should check the job's `if` condition,
+		// and if the condition is met (e.g. `if: ${{ cancelled() }}` ), the job should be executed rather than cancelled.
+		Job:      &model.JobContext{},
 		Steps:    nil, // no need
 		Runner:   nil, // no need
 		Secrets:  nil, // no need
@@ -464,3 +464,61 @@ func TestParseMappingNode(t *testing.T) {
 		})
 	}
 }
+
+func TestEvaluateJobIfExpression(t *testing.T) {
+	kases := []struct {
+		name       string
+		ifCond     string
+		needResult string
+		expected   bool
+	}{
+		{name: "empty need success", ifCond: "${{ 1 == 1 }}", needResult: "success", expected: true},
+		{name: "always", ifCond: "${{ always() }}", needResult: "failure", expected: true},
+		{name: "failure true", ifCond: "${{ failure() }}", needResult: "failure", expected: true},
+		{name: "failure false", ifCond: "${{ failure() }}", needResult: "success", expected: false},
+		{name: "success true", ifCond: "${{ success() }}", needResult: "success", expected: true},
+		// cancelled() is always false on the server: a cancelled run never evaluates a blocked job's `if:`
+		{name: "cancelled", ifCond: "${{ cancelled() }}", needResult: "success", expected: false},
+		{name: "not cancelled or failure", ifCond: "${{ !(cancelled() || failure()) }}", needResult: "success", expected: true},
+		{name: "not cancelled or failure, need failed", ifCond: "${{ !(cancelled() || failure()) }}", needResult: "failure", expected: false},
+	}
+	for _, kase := range kases {
+		t.Run(kase.name, func(t *testing.T) {
+			content := strings.ReplaceAll(`
+name: test
+on: push
+jobs:
+  job1:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo job1
+  job2:
+    runs-on: ubuntu-latest
+    needs: [job1]
+    if: IF_COND
+    steps:
+      - run: echo job2
+`, "IF_COND", kase.ifCond)
+
+			workflows, err := Parse([]byte(content))
+			require.NoError(t, err)
+
+			var job2 *Job
+			for _, wf := range workflows {
+				if id, job := wf.Job(); id == "job2" {
+					job2 = job
+				}
+			}
+			require.NotNil(t, job2)
+
+			// mirrors findJobNeedsAndFillJobResults: the needs' results plus a self entry carrying Needs
+			results := map[string]*JobResult{
+				"job1": {Result: kase.needResult},
+				"job2": {Needs: []string{"job1"}},
+			}
+			got, err := EvaluateJobIfExpression("job2", job2, map[string]any{}, results, nil, nil)
+			require.NoError(t, err)
+			assert.Equal(t, kase.expected, got)
+		})
+	}
+}
@@ -4,6 +4,8 @@
 package actions

 import (
+	"context"
+
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/log"
@@ -13,8 +15,8 @@ import (
 )

 // ListScopedWorkflows lists scoped workflow files (under SCOPED_WORKFLOW_DIRS) at the given commit.
-func ListScopedWorkflows(commit *git.Commit) (string, git.Entries, error) {
-	return listWorkflowsInDirs(commit, setting.Actions.ScopedWorkflowDirs)
+func ListScopedWorkflows(ctx context.Context, gitRepo *git.Repository, commit *git.Commit) (string, git.Entries, error) {
+	return listWorkflowsInDirs(ctx, gitRepo, commit, setting.Actions.ScopedWorkflowDirs)
 }

 // ParsedScopedWorkflow is one scoped workflow's source-side parse result
@@ -26,15 +28,15 @@ type ParsedScopedWorkflow struct {
 }

 // ParseScopedWorkflows lists and parses the scoped workflow files at sourceCommit (under SCOPED_WORKFLOW_DIRS).
-func ParseScopedWorkflows(sourceCommit *git.Commit) ([]*ParsedScopedWorkflow, error) {
-	_, entries, err := ListScopedWorkflows(sourceCommit)
+func ParseScopedWorkflows(ctx context.Context, gitRepo *git.Repository, sourceCommit *git.Commit) ([]*ParsedScopedWorkflow, error) {
+	_, entries, err := ListScopedWorkflows(ctx, gitRepo, sourceCommit)
 	if err != nil {
 		return nil, err
 	}

 	parsed := make([]*ParsedScopedWorkflow, 0, len(entries))
 	for _, entry := range entries {
-		content, err := GetContentFromEntry(entry)
+		content, err := GetContentFromEntry(gitRepo, entry)
 		if err != nil {
 			return nil, err
 		}
@@ -5,6 +5,7 @@ package actions

 import (
 	"bytes"
+	"context"
 	"fmt"
 	"path"
 	"slices"
@@ -69,16 +70,16 @@ func isWorkflowInDirs(path string, dirs []string) bool {
 	return false
 }

-func ListWorkflows(commit *git.Commit) (string, git.Entries, error) {
-	return listWorkflowsInDirs(commit, setting.Actions.WorkflowDirs)
+func ListWorkflows(ctx context.Context, gitRepo *git.Repository, commit *git.Commit) (string, git.Entries, error) {
+	return listWorkflowsInDirs(ctx, gitRepo, commit, setting.Actions.WorkflowDirs)
 }

-func listWorkflowsInDirs(commit *git.Commit, dirs []string) (string, git.Entries, error) {
+func listWorkflowsInDirs(ctx context.Context, gitRepo *git.Repository, commit *git.Commit, dirs []string) (string, git.Entries, error) {
 	var tree *git.Tree
 	var err error
 	var workflowDir string
 	for _, workflowDir = range dirs {
-		tree, err = commit.SubTree(workflowDir)
+		tree, err = commit.SubTree(ctx, gitRepo, workflowDir)
 		if err == nil {
 			break
 		}
@@ -90,7 +91,7 @@ func listWorkflowsInDirs(commit *git.Commit, dirs []string) (string, git.Entries
 		return "", nil, nil
 	}

-	entries, err := tree.ListEntriesRecursiveFast()
+	entries, err := tree.ListEntriesRecursiveFast(ctx, gitRepo)
 	if err != nil {
 		return "", nil, err
 	}
@@ -104,8 +105,8 @@ func listWorkflowsInDirs(commit *git.Commit, dirs []string) (string, git.Entries
 	return workflowDir, ret, nil
 }

-func GetContentFromEntry(entry *git.TreeEntry) ([]byte, error) {
-	f, err := entry.Blob().DataAsync()
+func GetContentFromEntry(gitRepo *git.Repository, entry *git.TreeEntry) ([]byte, error) {
+	f, err := entry.Blob(gitRepo).DataAsync()
 	if err != nil {
 		return nil, err
 	}
@@ -175,19 +176,20 @@ func ShouldEventCreateCommitStatus(event string) bool {
 }

 func DetectWorkflows(
+	ctx context.Context,
 	gitRepo *git.Repository,
 	commit *git.Commit,
 	triggedEvent webhook_module.HookEventType,
 	payload api.Payloader,
 	detectSchedule bool,
 ) (workflows, schedules, filtered []*DetectedWorkflow, err error) {
-	_, entries, err := ListWorkflows(commit)
+	_, entries, err := ListWorkflows(ctx, gitRepo, commit)
 	if err != nil {
 		return nil, nil, nil, err
 	}

 	for _, entry := range entries {
-		content, err := GetContentFromEntry(entry)
+		content, err := GetContentFromEntry(gitRepo, entry)
 		if err != nil {
 			return nil, nil, nil, err
 		}
@@ -229,15 +231,15 @@ func DetectWorkflows(
 	return workflows, schedules, filtered, nil
 }

-func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*DetectedWorkflow, error) {
-	_, entries, err := ListWorkflows(commit)
+func DetectScheduledWorkflows(ctx context.Context, gitRepo *git.Repository, commit *git.Commit) ([]*DetectedWorkflow, error) {
+	_, entries, err := ListWorkflows(ctx, gitRepo, commit)
 	if err != nil {
 		return nil, err
 	}

 	wfs := make([]*DetectedWorkflow, 0, len(entries))
 	for _, entry := range entries {
-		content, err := GetContentFromEntry(entry)
+		content, err := GetContentFromEntry(gitRepo, entry)
 		if err != nil {
 			return nil, err
 		}
@@ -284,7 +286,7 @@ func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEve

 	case // push
 		webhook_module.HookEventPush:
-		return matchPushEvent(commit, payload.(*api.PushPayload), evt)
+		return matchPushEvent(gitRepo, commit, payload.(*api.PushPayload), evt)

 	case // issues
 		webhook_module.HookEventIssues,
@@ -357,7 +359,7 @@ func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEve
 	}
 }

-func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) detectResult {
+func matchPushEvent(gitRepo *git.Repository, commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) detectResult {
 	// with no special filter parameters
 	if len(evt.Acts()) == 0 {
 		return detectMatched
@@ -423,7 +425,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 				matchTimes++
 				break
 			}
-			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
+			filesChanged, err := commit.GetFilesChangedSinceCommit(gitRepo, pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
 				return detectNotApplicable
@@ -440,7 +442,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 				matchTimes++
 				break
 			}
-			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
+			filesChanged, err := commit.GetFilesChangedSinceCommit(gitRepo, pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
 				return detectNotApplicable
@@ -590,7 +592,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 				matchTimes++
 			}
 		case "paths":
-			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
+			filesChanged, err := headCommit.GetFilesChangedSinceCommit(gitRepo, prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
 				return detectNotApplicable
@@ -603,7 +605,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 				matchTimes++
 			}
 		case "paths-ignore":
-			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
+			filesChanged, err := headCommit.GetFilesChangedSinceCommit(gitRepo, prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
 				return detectNotApplicable
@@ -3,7 +3,11 @@

 package fileicon

-import "gitea.dev/modules/git"
+import (
+	"context"
+
+	"gitea.dev/modules/git"
+)

 type EntryInfo struct {
 	BaseName      string
@@ -12,10 +16,10 @@ type EntryInfo struct {
 	IsOpen        bool
 }

-func EntryInfoFromGitTreeEntry(commit *git.Commit, fullPath string, gitEntry *git.TreeEntry) *EntryInfo {
+func EntryInfoFromGitTreeEntry(ctx context.Context, gitRepo *git.Repository, commit *git.Commit, fullPath string, gitEntry *git.TreeEntry) *EntryInfo {
 	ret := &EntryInfo{BaseName: gitEntry.Name(), EntryMode: gitEntry.Mode()}
 	if gitEntry.IsLink() {
-		if res, err := git.EntryFollowLink(commit, fullPath, gitEntry); err == nil && res.TargetEntry.IsDir() {
+		if res, err := git.EntryFollowLink(ctx, gitRepo, commit, fullPath, gitEntry); err == nil && res.TargetEntry.IsDir() {
 			ret.SymlinkToMode = res.TargetEntry.Mode()
 		}
 	}
@@ -17,17 +17,17 @@ import (

 // Commit represents a git commit.
 type Commit struct {
-	Tree // FIXME: bad design, this field can be nil if the commit is from "last commit cache"
-
 	CommitMessage

 	ID        ObjectID
+	TreeID    ObjectID
+	Parents   []ObjectID
 	Author    *Signature // never nil
 	Committer *Signature // never nil
 	Signature *CommitSignature

-	Parents        []ObjectID // ID strings
 	submoduleCache *ObjectCache[*SubModule]
+	treeCache      *Tree
 }

 // CommitSignature represents a git commit signature part.
@@ -46,12 +46,12 @@ func (c *Commit) ParentID(n int) (ObjectID, error) {
 }

 // Parent returns n-th parent (0-based index) of the commit.
-func (c *Commit) Parent(n int) (*Commit, error) {
+func (c *Commit) Parent(gitRepo *Repository, n int) (*Commit, error) {
 	id, err := c.ParentID(n)
 	if err != nil {
 		return nil, err
 	}
-	parent, err := c.repo.getCommit(id)
+	parent, err := gitRepo.getCommit(id)
 	if err != nil {
 		return nil, err
 	}
@@ -65,25 +65,44 @@ func (c *Commit) ParentCount() int {
 }

 // GetCommitByPath return the commit of relative path object.
-func (c *Commit) GetCommitByPath(relpath string) (*Commit, error) {
-	if c.repo.LastCommitCache != nil {
-		return c.repo.LastCommitCache.GetCommitByPath(c.ID.String(), relpath)
+func (c *Commit) GetCommitByPath(gitRepo *Repository, relpath string) (*Commit, error) {
+	if gitRepo.LastCommitCache != nil {
+		return gitRepo.LastCommitCache.GetCommitByPath(c.ID.String(), relpath)
 	}
-	return c.repo.getCommitByPathWithID(c.ID, relpath)
+	return gitRepo.getCommitByPathWithID(c.ID, relpath)
+}
+
+func (c *Commit) Tree() *Tree {
+	if c.treeCache == nil {
+		c.treeCache = newTree(c.TreeID)
+	}
+	return c.treeCache
+}
+
+func (c *Commit) GetBlobByPath(ctx context.Context, gitRepo *Repository, relpath string) (*Blob, error) {
+	return c.Tree().GetBlobByPath(ctx, gitRepo, relpath)
+}
+
+func (c *Commit) GetTreeEntryByPath(ctx context.Context, gitRepo *Repository, relpath string) (_ *TreeEntry, err error) {
+	return c.Tree().GetTreeEntryByPath(ctx, gitRepo, relpath)
+}
+
+func (c *Commit) SubTree(ctx context.Context, gitRepo *Repository, relpath string) (*Tree, error) {
+	return c.Tree().SubTree(ctx, gitRepo, relpath)
 }

 // CommitsByRange returns the specific page commits before current revision, every page's number default by CommitsRangeSize
-func (c *Commit) CommitsByRange(page, pageSize int, not, since, until string) ([]*Commit, error) {
-	return c.repo.commitsByRangeWithTime(c.ID, page, pageSize, not, since, until)
+func (c *Commit) CommitsByRange(gitRepo *Repository, page, pageSize int, not, since, until string) ([]*Commit, error) {
+	return gitRepo.commitsByRangeWithTime(c.ID, page, pageSize, not, since, until)
 }

 // CommitsBefore returns all the commits before current revision
-func (c *Commit) CommitsBefore() ([]*Commit, error) {
-	return c.repo.getCommitsBefore(c.ID)
+func (c *Commit) CommitsBefore(gitRepo *Repository) ([]*Commit, error) {
+	return gitRepo.getCommitsBefore(c.ID)
 }

 // HasPreviousCommit returns true if a given commitHash is contained in commit's parents
-func (c *Commit) HasPreviousCommit(objectID ObjectID) (bool, error) {
+func (c *Commit) HasPreviousCommit(ctx context.Context, gitRepo *Repository, objectID ObjectID) (bool, error) {
 	this := c.ID.String()
 	that := objectID.String()

@@ -93,8 +112,8 @@ func (c *Commit) HasPreviousCommit(objectID ObjectID) (bool, error) {

 	_, _, err := gitcmd.NewCommand("merge-base", "--is-ancestor").
 		AddDynamicArguments(that, this).
-		WithDir(c.repo.Path).
-		RunStdString(c.repo.Ctx)
+		WithDir(gitRepo.Path).
+		RunStdString(ctx)
 	if err == nil {
 		return true, nil
 	}
@@ -108,8 +127,8 @@ func (c *Commit) HasPreviousCommit(objectID ObjectID) (bool, error) {
 }

 // IsForcePush returns true if a push from oldCommitHash to this is a force push
-func (c *Commit) IsForcePush(oldCommitID string) (bool, error) {
-	objectFormat, err := c.repo.GetObjectFormat()
+func (c *Commit) IsForcePush(ctx context.Context, gitRepo *Repository, oldCommitID string) (bool, error) {
+	objectFormat, err := gitRepo.GetObjectFormat()
 	if err != nil {
 		return false, err
 	}
@@ -117,22 +136,22 @@ func (c *Commit) IsForcePush(oldCommitID string) (bool, error) {
 		return false, nil
 	}

-	oldCommit, err := c.repo.GetCommit(oldCommitID)
+	oldCommit, err := gitRepo.GetCommit(oldCommitID)
 	if err != nil {
 		return false, err
 	}
-	hasPreviousCommit, err := c.HasPreviousCommit(oldCommit.ID)
+	hasPreviousCommit, err := c.HasPreviousCommit(ctx, gitRepo, oldCommit.ID)
 	return !hasPreviousCommit, err
 }

 // CommitsBeforeLimit returns num commits before current revision
-func (c *Commit) CommitsBeforeLimit(num int) ([]*Commit, error) {
-	return c.repo.getCommitsBeforeLimit(c.ID, num)
+func (c *Commit) CommitsBeforeLimit(gitRepo *Repository, num int) ([]*Commit, error) {
+	return gitRepo.getCommitsBeforeLimit(c.ID, num)
 }

 // CommitsBeforeUntil returns the commits in range "[cur, ref)"
-func (c *Commit) CommitsBeforeUntil(ref RefName) ([]*Commit, error) {
-	return c.repo.CommitsBetween(c.ID.RefName(), ref, -1)
+func (c *Commit) CommitsBeforeUntil(gitRepo *Repository, ref RefName) ([]*Commit, error) {
+	return gitRepo.CommitsBetween(c.ID.RefName(), ref, -1)
 }

 // SearchCommitsOptions specify the parameters for SearchCommits
@@ -175,39 +194,29 @@ func NewSearchCommitsOptions(searchString string, forAllRefs bool) SearchCommits
 }

 // SearchCommits returns the commits match the keyword before current revision
-func (c *Commit) SearchCommits(opts SearchCommitsOptions) ([]*Commit, error) {
-	return c.repo.searchCommits(c.ID, opts)
+func (c *Commit) SearchCommits(gitRepo *Repository, opts SearchCommitsOptions) ([]*Commit, error) {
+	return gitRepo.searchCommits(c.ID, opts)
 }

 // GetFilesChangedSinceCommit get all changed file names between pastCommit to current revision
-func (c *Commit) GetFilesChangedSinceCommit(pastCommit string) ([]string, error) {
-	return c.repo.GetFilesChangedBetween(pastCommit, c.ID.String())
+func (c *Commit) GetFilesChangedSinceCommit(gitRepo *Repository, pastCommit string) ([]string, error) {
+	return gitRepo.GetFilesChangedBetween(pastCommit, c.ID.String())
 }

 // FileChangedSinceCommit Returns true if the file given has changed since the past commit
 // YOU MUST ENSURE THAT pastCommit is a valid commit ID.
-func (c *Commit) FileChangedSinceCommit(filename, pastCommit string) (bool, error) {
-	return c.repo.FileChangedBetweenCommits(filename, pastCommit, c.ID.String())
-}
-
-// HasFile returns true if the file given exists on this commit
-// This does only mean it's there - it does not mean the file was changed during the commit.
-func (c *Commit) HasFile(filename string) (bool, error) {
-	_, err := c.GetBlobByPath(filename)
-	if err != nil {
-		return false, err
-	}
-	return true, nil
+func (c *Commit) FileChangedSinceCommit(gitRepo *Repository, filename, pastCommit string) (bool, error) {
+	return gitRepo.FileChangedBetweenCommits(filename, pastCommit, c.ID.String())
 }

 // GetFileContent reads a file content as a string or returns false if this was not possible
-func (c *Commit) GetFileContent(filename string, limit int) (string, error) {
-	entry, err := c.GetTreeEntryByPath(filename)
+func (c *Commit) GetFileContent(ctx context.Context, gitRepo *Repository, filename string, limit int) (string, error) {
+	entry, err := c.GetTreeEntryByPath(ctx, gitRepo, filename)
 	if err != nil {
 		return "", err
 	}

-	r, err := entry.Blob().DataAsync()
+	r, err := entry.Blob(gitRepo).DataAsync()
 	if err != nil {
 		return "", err
 	}
@@ -3,6 +3,8 @@

 package git

+import "context"
+
 // CommitInfo describes the first commit with the provided entry
 type CommitInfo struct {
 	Entry         *TreeEntry
@@ -10,8 +12,8 @@ type CommitInfo struct {
 	SubmoduleFile *CommitSubmoduleFile
 }

-func GetCommitInfoSubmoduleFile(repoLink, fullPath string, commit *Commit, refCommitID ObjectID) (*CommitSubmoduleFile, error) {
-	submodule, err := commit.GetSubModule(fullPath)
+func GetCommitInfoSubmoduleFile(ctx context.Context, repoLink, fullPath string, gitRepo *Repository, commit *Commit, refCommitID ObjectID) (*CommitSubmoduleFile, error) {
+	submodule, err := commit.GetSubModule(ctx, gitRepo, fullPath)
 	if err != nil {
 		return nil, err
 	}
@@ -17,7 +17,7 @@ import (
 )

 // GetCommitsInfo gets information of all commits that are corresponding to these entries
-func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *Commit, treePath string) ([]CommitInfo, *Commit, error) {
+func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, gitRepo *Repository, commit *Commit, treePath string) ([]CommitInfo, *Commit, error) {
 	entryPaths := make([]string, len(tes)+1)
 	// Get the commit for the treePath itself
 	entryPaths[0] = ""
@@ -25,25 +25,16 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 		entryPaths[i+1] = entry.Name()
 	}

-	commitNodeIndex, commitGraphFile := commit.repo.CommitNodeIndex()
-	if commitGraphFile != nil {
-		defer commitGraphFile.Close()
-	}
-
-	c, err := commitNodeIndex.Get(plumbing.Hash(commit.ID.RawValue()))
-	if err != nil {
-		return nil, nil, err
-	}
-
 	var revs map[string]*Commit
-	if commit.repo.LastCommitCache != nil {
+	var err error
+	if gitRepo.LastCommitCache != nil {
 		var unHitPaths []string
-		revs, unHitPaths, err = getLastCommitForPathsByCache(commit.ID.String(), treePath, entryPaths, commit.repo.LastCommitCache)
+		revs, unHitPaths, err = getLastCommitForPathsByCache(commit.ID.String(), treePath, entryPaths, gitRepo.LastCommitCache)
 		if err != nil {
 			return nil, nil, err
 		}
 		if len(unHitPaths) > 0 {
-			revs2, err := GetLastCommitForPaths(ctx, commit.repo.LastCommitCache, c, treePath, unHitPaths)
+			revs2, err := GetLastCommitForPaths(ctx, gitRepo, commit, treePath, unHitPaths)
 			if err != nil {
 				return nil, nil, err
 			}
@@ -51,13 +42,13 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 			maps.Copy(revs, revs2)
 		}
 	} else {
-		revs, err = GetLastCommitForPaths(ctx, nil, c, treePath, entryPaths)
+		revs, err = GetLastCommitForPaths(ctx, gitRepo, commit, treePath, entryPaths)
 	}
 	if err != nil {
 		return nil, nil, err
 	}

-	commit.repo.gogitStorage.Close()
+	gitRepo.gogitStorage.Close()

 	commitsInfo := make([]CommitInfo, len(tes))
 	for i, entry := range tes {
@@ -72,7 +63,7 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *

 		// If the entry is a submodule, add a submodule file for this
 		if entry.IsSubModule() {
-			commitsInfo[i].SubmoduleFile, err = GetCommitInfoSubmoduleFile(repoLink, path.Join(treePath, entry.Name()), commit, entry.ID)
+			commitsInfo[i].SubmoduleFile, err = GetCommitInfoSubmoduleFile(ctx, repoLink, path.Join(treePath, entry.Name()), gitRepo, commit, entry.ID)
 			if err != nil {
 				return nil, nil, err
 			}
@@ -83,11 +74,10 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 	// get it for free during the tree traversal and it's used for listing
 	// pages to display information about newest commit for a given path.
 	var treeCommit *Commit
-	var ok bool
 	if treePath == "" {
 		treeCommit = commit
-	} else if treeCommit, ok = revs[""]; ok {
-		treeCommit.repo = commit.repo
+	} else {
+		treeCommit = revs[""]
 	}
 	return commitsInfo, treeCommit, nil
 }
@@ -162,7 +152,20 @@ func getLastCommitForPathsByCache(commitID, treePath string, paths []string, cac
 }

 // GetLastCommitForPaths returns last commit information
-func GetLastCommitForPaths(ctx context.Context, cache *LastCommitCache, c cgobject.CommitNode, treePath string, paths []string) (map[string]*Commit, error) {
+func GetLastCommitForPaths(ctx context.Context, gitRepo *Repository, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
+	commitNodeIndex, commitGraphFile := gitRepo.CommitNodeIndex()
+	if commitGraphFile != nil {
+		defer commitGraphFile.Close()
+	}
+
+	c, err := commitNodeIndex.Get(plumbing.Hash(commit.ID.RawValue()))
+	if err != nil {
+		return nil, err
+	}
+	return getLastCommitForPathsByCommitNode(ctx, gitRepo, c, treePath, paths)
+}
+
+func getLastCommitForPathsByCommitNode(ctx context.Context, gitRepo *Repository, c cgobject.CommitNode, treePath string, paths []string) (map[string]*Commit, error) {
 	refSha := c.ID().String()

 	// We do a tree traversal with nodes sorted by commit time
@@ -243,7 +246,7 @@ heaploop:
 					//   match any of the hashes being merged. This is more common for directories,
 					//   but it can also happen if a file is changed through conflict resolution.
 					resultNodes[pth] = current.commit
-					if err := cache.Put(refSha, path.Join(treePath, pth), current.commit.ID().String()); err != nil {
+					if err := gitRepo.LastCommitCache.Put(refSha, path.Join(treePath, pth), current.commit.ID().String()); err != nil {
 						return nil, err
 					}
 				}
@@ -15,7 +15,7 @@ import (
 )

 // GetCommitsInfo gets information of all commits that are corresponding to these entries
-func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *Commit, treePath string) ([]CommitInfo, *Commit, error) {
+func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, gitRepo *Repository, commit *Commit, treePath string) ([]CommitInfo, *Commit, error) {
 	entryPaths := make([]string, len(tes)+1)
 	// Get the commit for the treePath itself
 	entryPaths[0] = ""
@@ -26,15 +26,15 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 	var err error

 	var revs map[string]*Commit
-	if commit.repo.LastCommitCache != nil {
+	if gitRepo.LastCommitCache != nil {
 		var unHitPaths []string
-		revs, unHitPaths, err = getLastCommitForPathsByCache(commit.ID.String(), treePath, entryPaths, commit.repo.LastCommitCache)
+		revs, unHitPaths, err = getLastCommitForPathsByCache(commit.ID.String(), treePath, entryPaths, gitRepo.LastCommitCache)
 		if err != nil {
 			return nil, nil, err
 		}
 		if len(unHitPaths) > 0 {
 			sort.Strings(unHitPaths)
-			commits, err := GetLastCommitForPaths(ctx, commit, treePath, unHitPaths)
+			commits, err := GetLastCommitForPaths(ctx, gitRepo, commit, treePath, unHitPaths)
 			if err != nil {
 				return nil, nil, err
 			}
@@ -43,7 +43,7 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 		}
 	} else {
 		sort.Strings(entryPaths)
-		revs, err = GetLastCommitForPaths(ctx, commit, treePath, entryPaths)
+		revs, err = GetLastCommitForPaths(ctx, gitRepo, commit, treePath, entryPaths)
 	}
 	if err != nil {
 		return nil, nil, err
@@ -64,7 +64,7 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *

 		// If the entry is a submodule, add a submodule file for this
 		if entry.IsSubModule() {
-			commitsInfo[i].SubmoduleFile, err = GetCommitInfoSubmoduleFile(repoLink, path.Join(treePath, entry.Name()), commit, entry.ID)
+			commitsInfo[i].SubmoduleFile, err = GetCommitInfoSubmoduleFile(ctx, repoLink, path.Join(treePath, entry.Name()), gitRepo, commit, entry.ID)
 			if err != nil {
 				return nil, nil, err
 			}
@@ -75,11 +75,10 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 	// get it for free during the tree traversal, and it's used for listing
 	// pages to display information about the newest commit for a given path.
 	var treeCommit *Commit
-	var ok bool
 	if treePath == "" {
 		treeCommit = commit
-	} else if treeCommit, ok = revs[""]; ok {
-		treeCommit.repo = commit.repo
+	} else {
+		treeCommit = revs[""]
 	}
 	return commitsInfo, treeCommit, nil
 }
@@ -104,9 +103,9 @@ func getLastCommitForPathsByCache(commitID, treePath string, paths []string, cac
 }

 // GetLastCommitForPaths returns last commit information
-func GetLastCommitForPaths(ctx context.Context, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
+func GetLastCommitForPaths(ctx context.Context, gitRepo *Repository, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
 	// We read backwards from the commit to obtain all of the commits
-	revs, err := walkGitLog(ctx, commit.repo, commit, treePath, paths...)
+	revs, err := walkGitLog(ctx, gitRepo, commit, treePath, paths...)
 	if err != nil {
 		return nil, err
 	}
@@ -126,7 +125,7 @@ func GetLastCommitForPaths(ctx context.Context, commit *Commit, treePath string,
 			continue
 		}

-		c, err := commit.repo.GetCommit(commitID) // Ensure the commit exists in the repository
+		c, err := gitRepo.GetCommit(commitID) // Ensure the commit exists in the repository
 		if err != nil {
 			return nil, err
 		}
@@ -24,7 +24,7 @@ func TestEntries_GetCommitsInfo_ContextErr(t *testing.T) {

 	commit, err := repo.GetCommit("feaf4ba6bc635fec442f46ddd4512416ec43c2c2")
 	require.NoError(t, err)
-	entries, err := commit.Tree.ListEntries()
+	entries, err := commit.Tree().ListEntries(t.Context(), repo)
 	require.NoError(t, err)

 	countCommitInfosCommit := func(infos []CommitInfo) (nilCommits, nonNilCommits int) {
@@ -39,14 +39,14 @@ func TestEntries_GetCommitsInfo_ContextErr(t *testing.T) {
 	defer test.MockVariableValue(&walkGitLogDebugBeforeNext)()

 	walkGitLogDebugBeforeNext = cancel
-	commitInfos, _, err := entries.GetCommitsInfo(ctx, "/any/repo-link", commit, "")
+	commitInfos, _, err := entries.GetCommitsInfo(ctx, "/any/repo-link", repo, commit, "")
 	assert.NoError(t, err)
 	nilCommits, nonNilCommits := countCommitInfosCommit(commitInfos)
 	assert.Equal(t, 0, nonNilCommits) // no commit info due to canceled (or deadline-exceeded) context
 	assert.Equal(t, 3, nilCommits)

 	walkGitLogDebugBeforeNext = nil
-	commitInfos, _, err = entries.GetCommitsInfo(t.Context(), "/any/repo-link", commit, "")
+	commitInfos, _, err = entries.GetCommitsInfo(t.Context(), "/any/repo-link", repo, commit, "")
 	assert.NoError(t, err)
 	nilCommits, nonNilCommits = countCommitInfosCommit(commitInfos)
 	assert.Equal(t, 3, nonNilCommits)
@@ -91,10 +91,9 @@ func testGetCommitsInfo(t *testing.T, repo1 *Repository) {
 			continue
 		}
 		assert.NotNil(t, commit)
-		assert.NotNil(t, commit.Tree)
-		assert.NotNil(t, commit.Tree.repo)
+		assert.NotNil(t, commit.TreeID)

-		tree, err := commit.Tree.SubTree(testCase.Path)
+		tree, err := commit.SubTree(t.Context(), repo1, testCase.Path)
 		if err != nil {
 			assert.NoError(t, err, "Unable to get subtree: %s of commit: %s from testcase due to error: %v", testCase.Path, testCase.CommitID, err)
 			// no point trying to do anything else for this test.
@@ -102,9 +101,8 @@ func testGetCommitsInfo(t *testing.T, repo1 *Repository) {
 		}

 		assert.NotNil(t, tree, "tree is nil for testCase CommitID %s in Path %s", testCase.CommitID, testCase.Path)
-		assert.NotNil(t, tree.repo, "repo is nil for testCase CommitID %s in Path %s", testCase.CommitID, testCase.Path)

-		entries, err := tree.ListEntries()
+		entries, err := tree.ListEntries(t.Context(), repo1)
 		if err != nil {
 			assert.NoError(t, err, "Unable to get entries of subtree: %s in commit: %s from testcase due to error: %v", testCase.Path, testCase.CommitID, err)
 			// no point trying to do anything else for this test.
@@ -112,7 +110,7 @@ func testGetCommitsInfo(t *testing.T, repo1 *Repository) {
 		}

 		// FIXME: Context.TODO() - if graceful has started we should use its Shutdown context otherwise use install signals in TestMain.
-		commitsInfo, treeCommit, err := entries.GetCommitsInfo(t.Context(), "/any/repo-link", commit, testCase.Path)
+		commitsInfo, treeCommit, err := entries.GetCommitsInfo(t.Context(), "/any/repo-link", repo1, commit, testCase.Path)
 		assert.NoError(t, err, "Unable to get commit information for entries of subtree: %s in commit: %s from testcase due to error: %v", testCase.Path, testCase.CommitID, err)
 		if err != nil {
 			t.FailNow()
@@ -127,7 +125,7 @@ func testGetCommitsInfo(t *testing.T, repo1 *Repository) {
 				continue
 			}
 			assert.Equal(t, expectedInfo.CommitID, commit.ID.String())
-			assert.Equal(t, expectedInfo.Size, entry.Size(), entry.Name())
+			assert.Equal(t, expectedInfo.Size, entry.GetSize(t.Context(), repo1), entry.Name())
 		}
 	}
 }
@@ -155,9 +153,9 @@ func TestEntries_GetCommitsInfo(t *testing.T) {
 	t.Run("NonExistingSubmoduleAsNil", func(t *testing.T) {
 		commit, err := bareRepo1.GetCommit("HEAD")
 		require.NoError(t, err)
-		treeEntry, err := commit.GetTreeEntryByPath("file1.txt")
+		treeEntry, err := commit.GetTreeEntryByPath(t.Context(), bareRepo1, "file1.txt")
 		require.NoError(t, err)
-		cisf, err := GetCommitInfoSubmoduleFile("/any/repo-link", "file1.txt", commit, treeEntry.ID)
+		cisf, err := GetCommitInfoSubmoduleFile(t.Context(), "/any/repo-link", "file1.txt", bareRepo1, commit, treeEntry.ID)
 		require.NoError(t, err)
 		assert.Equal(t, &CommitSubmoduleFile{
 			repoLink: "/any/repo-link",
@@ -169,52 +167,3 @@ func TestEntries_GetCommitsInfo(t *testing.T) {
 		assert.Nil(t, cisf.SubmoduleWebLinkTree(t.Context()))
 	})
 }
-
-func BenchmarkEntries_GetCommitsInfo(b *testing.B) {
-	type benchmarkType struct {
-		url  string
-		name string
-	}
-
-	benchmarks := []benchmarkType{
-		{url: "https://github.com/go-gitea/gitea.git", name: "gitea"},
-		{url: "https://github.com/ethantkoenig/manyfiles.git", name: "manyfiles"},
-		{url: "https://github.com/moby/moby.git", name: "moby"},
-		{url: "https://github.com/golang/go.git", name: "go"},
-		{url: "https://github.com/torvalds/linux.git", name: "linux"},
-	}
-
-	doBenchmark := func(benchmark benchmarkType) {
-		var commit *Commit
-		var entries Entries
-		var repo *Repository
-		repoPath, err := cloneRepo(b, benchmark.url)
-		if err != nil {
-			b.Fatal(err)
-		}
-
-		if repo, err = OpenRepository(b.Context(), repoPath); err != nil {
-			b.Fatal(err)
-		}
-		defer repo.Close()
-
-		if commit, err = repo.GetBranchCommit("master"); err != nil {
-			b.Fatal(err)
-		} else if entries, err = commit.Tree.ListEntries(); err != nil {
-			b.Fatal(err)
-		}
-		b.ResetTimer()
-		b.Run(benchmark.name, func(b *testing.B) {
-			for b.Loop() {
-				_, _, err := entries.GetCommitsInfo(b.Context(), "/any/repo-link", commit, "")
-				if err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-	}
-
-	for _, benchmark := range benchmarks {
-		doBenchmark(benchmark)
-	}
-}
@@ -15,7 +15,7 @@ const (
 	commitHeaderGpgsigSha256 = "gpgsig-sha256"
 )

-func assignCommitFields(gitRepo *Repository, commit *Commit, headerKey string, headerValue []byte) error {
+func assignCommitFields(commit *Commit, headerKey string, headerValue []byte) error {
 	if len(headerValue) > 0 && headerValue[len(headerValue)-1] == '\n' {
 		headerValue = headerValue[:len(headerValue)-1] // remove trailing newline
 	}
@@ -25,7 +25,7 @@ func assignCommitFields(gitRepo *Repository, commit *Commit, headerKey string, h
 		if err != nil {
 			return fmt.Errorf("invalid tree ID %q: %w", string(headerValue), err)
 		}
-		commit.Tree = *NewTree(gitRepo, objID)
+		commit.TreeID = objID
 	case "parent":
 		objID, err := NewIDFromString(string(headerValue))
 		if err != nil {
@@ -48,7 +48,7 @@ func assignCommitFields(gitRepo *Repository, commit *Commit, headerKey string, h
 // We need this to interpret commits from cat-file or cat-file --batch
 //
 // If used as part of a cat-file --batch stream you need to limit the reader to the correct size
-func CommitFromReader(gitRepo *Repository, objectID ObjectID, reader io.Reader) (*Commit, error) {
+func CommitFromReader(objectID ObjectID, reader io.Reader) (*Commit, error) {
 	commit := &Commit{
 		ID:        objectID,
 		Author:    &Signature{},
@@ -74,7 +74,7 @@ func CommitFromReader(gitRepo *Repository, objectID ObjectID, reader io.Reader)
 			k, v, _ := bytes.Cut(line, []byte{' '})
 			if len(k) != 0 || !inHeader {
 				if headerKey != "" {
-					if err = assignCommitFields(gitRepo, commit, headerKey, headerValue); err != nil {
+					if err = assignCommitFields(commit, headerKey, headerValue); err != nil {
 						return nil, fmt.Errorf("unable to parse commit %q: %w", objectID.String(), err)
 					}
 				}
@@ -65,7 +65,7 @@ signed commit`
 	assert.NotNil(t, gitRepo)
 	defer gitRepo.Close()

-	commitFromReader, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString))
+	commitFromReader, err := CommitFromReader(sha, strings.NewReader(commitString))
 	assert.NoError(t, err)
 	require.NotNil(t, commitFromReader)
 	assert.EqualValues(t, sha, commitFromReader.ID)
@@ -93,7 +93,7 @@ committer Adam Majer <amajer@suse.de> 1698676906 +0100
 signed commit`, commitFromReader.Signature.Payload)
 	assert.Equal(t, "Adam Majer <amajer@suse.de>", commitFromReader.Author.String())

-	commitFromReader2, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString+"\n\n"))
+	commitFromReader2, err := CommitFromReader(sha, strings.NewReader(commitString+"\n\n"))
 	assert.NoError(t, err)
 	commitFromReader.CommitMessage.MessageRaw += "\n\n"
 	commitFromReader.Signature.Payload += "\n\n"
@@ -118,15 +118,15 @@ func TestHasPreviousCommitSha256(t *testing.T) {
 	assert.Equal(t, objectFormat, parentSHA.Type())
 	assert.Equal(t, "sha256", objectFormat.Name())

-	haz, err := commit.HasPreviousCommit(parentSHA)
+	haz, err := commit.HasPreviousCommit(t.Context(), repo, parentSHA)
 	assert.NoError(t, err)
 	assert.True(t, haz)

-	hazNot, err := commit.HasPreviousCommit(notParentSHA)
+	hazNot, err := commit.HasPreviousCommit(t.Context(), repo, notParentSHA)
 	assert.NoError(t, err)
 	assert.False(t, hazNot)

-	selfNot, err := commit.HasPreviousCommit(commit.ID)
+	selfNot, err := commit.HasPreviousCommit(t.Context(), repo, commit.ID)
 	assert.NoError(t, err)
 	assert.False(t, selfNot)
 }
@@ -3,17 +3,19 @@

 package git

+import "context"
+
 type SubmoduleWebLink struct {
 	RepoWebLink, CommitWebLink string
 }

 // GetSubModules get all the submodules of current revision git tree
-func (c *Commit) GetSubModules() (*ObjectCache[*SubModule], error) {
+func (c *Commit) GetSubModules(ctx context.Context, gitRepo *Repository) (*ObjectCache[*SubModule], error) {
 	if c.submoduleCache != nil {
 		return c.submoduleCache, nil
 	}

-	entry, err := c.GetTreeEntryByPath(".gitmodules")
+	entry, err := c.GetTreeEntryByPath(ctx, gitRepo, ".gitmodules")
 	if err != nil {
 		if _, ok := err.(ErrNotExist); ok {
 			return nil, nil //nolint:nilnil // return nil to indicate that the submodule does not exist
@@ -21,7 +23,7 @@ func (c *Commit) GetSubModules() (*ObjectCache[*SubModule], error) {
 		return nil, err
 	}

-	rd, err := entry.Blob().DataAsync()
+	rd, err := entry.Blob(gitRepo).DataAsync()
 	if err != nil {
 		return nil, err
 	}
@@ -37,8 +39,8 @@ func (c *Commit) GetSubModules() (*ObjectCache[*SubModule], error) {

 // GetSubModule gets the submodule by the entry name.
 // It returns "nil, nil" if the submodule does not exist, caller should always remember to check the "nil"
-func (c *Commit) GetSubModule(entryName string) (*SubModule, error) {
-	modules, err := c.GetSubModules()
+func (c *Commit) GetSubModule(ctx context.Context, gitRepo *Repository, entryName string) (*SubModule, error) {
+	modules, err := c.GetSubModules(ctx, gitRepo)
 	if err != nil {
 		return nil, err
 	}
@@ -61,7 +61,7 @@ empty commit`
 	assert.NotNil(t, gitRepo)
 	defer gitRepo.Close()

-	commitFromReader, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString))
+	commitFromReader, err := CommitFromReader(sha, strings.NewReader(commitString))
 	assert.NoError(t, err)
 	require.NotNil(t, commitFromReader)
 	assert.EqualValues(t, sha, commitFromReader.ID)
@@ -89,7 +89,7 @@ committer silverwind <me@silverwind.io> 1563741793 +0200
 empty commit`, commitFromReader.Signature.Payload)
 	assert.Equal(t, "silverwind <me@silverwind.io>", commitFromReader.Author.String())

-	commitFromReader2, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString+"\n\n"))
+	commitFromReader2, err := CommitFromReader(sha, strings.NewReader(commitString+"\n\n"))
 	assert.NoError(t, err)
 	commitFromReader.CommitMessage.MessageRaw += "\n\n"
 	commitFromReader.Signature.Payload += "\n\n"
@@ -125,7 +125,7 @@ ISO-8859-1`
 	assert.NotNil(t, gitRepo)
 	defer gitRepo.Close()

-	commitFromReader, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString))
+	commitFromReader, err := CommitFromReader(sha, strings.NewReader(commitString))
 	assert.NoError(t, err)
 	require.NotNil(t, commitFromReader)
 	assert.EqualValues(t, sha, commitFromReader.ID)
@@ -152,7 +152,7 @@ encoding ISO-8859-1
 ISO-8859-1`, commitFromReader.Signature.Payload)
 	assert.Equal(t, "KN4CK3R <admin@oldschoolhack.me>", commitFromReader.Author.String())

-	commitFromReader2, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString+"\n\n"))
+	commitFromReader2, err := CommitFromReader(sha, strings.NewReader(commitString+"\n\n"))
 	assert.NoError(t, err)
 	commitFromReader.CommitMessage.MessageRaw += "\n\n"
 	commitFromReader.Signature.Payload += "\n\n"
@@ -172,15 +172,15 @@ func TestHasPreviousCommit(t *testing.T) {
 	parentSHA := MustIDFromString("8d92fc957a4d7cfd98bc375f0b7bb189a0d6c9f2")
 	notParentSHA := MustIDFromString("2839944139e0de9737a044f78b0e4b40d989a9e3")

-	haz, err := commit.HasPreviousCommit(parentSHA)
+	haz, err := commit.HasPreviousCommit(t.Context(), repo, parentSHA)
 	assert.NoError(t, err)
 	assert.True(t, haz)

-	hazNot, err := commit.HasPreviousCommit(notParentSHA)
+	hazNot, err := commit.HasPreviousCommit(t.Context(), repo, notParentSHA)
 	assert.NoError(t, err)
 	assert.False(t, hazNot)

-	selfNot, err := commit.HasPreviousCommit(commit.ID)
+	selfNot, err := commit.HasPreviousCommit(t.Context(), repo, commit.ID)
 	assert.NoError(t, err)
 	assert.False(t, selfNot)
 }
@@ -75,7 +75,7 @@ func getRepoRawDiffForFileCmd(_ context.Context, repo *Repository, startCommit,
 		} else if commit.ParentCount() == 0 {
 			cmd.AddArguments("show").AddDynamicArguments(endCommit).AddDashesAndList(files...)
 		} else {
-			c, err := commit.Parent(0)
+			c, err := commit.Parent(repo, 0)
 			if err != nil {
 				return nil, err
 			}
@@ -90,7 +90,7 @@ func getRepoRawDiffForFileCmd(_ context.Context, repo *Repository, startCommit,
 		} else if commit.ParentCount() == 0 {
 			cmd.AddArguments("format-patch", "--no-signature", "--stdout", "--root").AddDynamicArguments(endCommit).AddDashesAndList(files...)
 		} else {
-			c, err := commit.Parent(0)
+			c, err := commit.Parent(repo, 0)
 			if err != nil {
 				return nil, err
 			}
@@ -7,6 +7,7 @@ package languagestats

 import (
 	"bytes"
+	"context"
 	"io"

 	"gitea.dev/modules/analyze"
@@ -21,7 +22,7 @@ import (
 )

 // GetLanguageStats calculates language stats for git repository at specified commit
-func GetLanguageStats(repo *git_module.Repository, commitID string) (map[string]int64, error) {
+func GetLanguageStats(_ context.Context, repo *git_module.Repository, commitID string) (map[string]int64, error) {
 	r, err := git.PlainOpen(repo.Path)
 	if err != nil {
 		return nil, err
@@ -7,6 +7,7 @@ package languagestats

 import (
 	"bytes"
+	"context"
 	"io"

 	"gitea.dev/modules/analyze"
@@ -19,10 +20,10 @@ import (
 )

 // GetLanguageStats calculates language stats for git repository at specified commit
-func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64, error) {
+func GetLanguageStats(ctx context.Context, repo *git.Repository, commitID string) (map[string]int64, error) {
 	// We will feed the commit IDs in order into cat-file --batch, followed by blobs as necessary.
 	// so let's create a batch stdin and stdout
-	batch, cancel, err := repo.CatFileBatch(repo.Ctx)
+	batch, cancel, err := repo.CatFileBatch(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -43,7 +44,7 @@ func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64,
 		return nil, git.ErrNotExist{ID: commitID}
 	}

-	commit, err := git.CommitFromReader(repo, sha, io.LimitReader(batchReader, commitInfo.Size))
+	commit, err := git.CommitFromReader(sha, io.LimitReader(batchReader, commitInfo.Size))
 	if err != nil {
 		log.Debug("Unable to get commit for: %s. Err: %v", commitID, err)
 		return nil, err
@@ -52,9 +53,7 @@ func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64,
 		return nil, err
 	}

-	tree := commit.Tree
-
-	entries, err := tree.ListEntriesRecursiveWithSize()
+	entries, err := commit.Tree().ListEntriesRecursiveWithSize(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
@@ -81,13 +80,15 @@ func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64,
 		select {
 		case <-repo.Ctx.Done():
 			return sizes, repo.Ctx.Err()
+		case <-ctx.Done():
+			return sizes, ctx.Err()
 		default:
 		}

 		contentBuf.Reset()
 		content = contentBuf.Bytes()

-		if f.Size() == 0 {
+		if f.GetSize(ctx, repo) == 0 {
 			continue
 		}

@@ -124,7 +125,7 @@ func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64,
 				}

 				// this language will always be added to the size
-				sizes[language] += f.Size()
+				sizes[language] += f.GetSize(ctx, repo)
 				continue
 			}
 		}
@@ -138,7 +139,7 @@ func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64,

 		// If content can not be read or file is too big just do detection by filename

-		if f.Size() <= bigFileSize {
+		if f.GetSize(ctx, repo) <= bigFileSize {
 			info, _, err := batch.QueryContent(f.ID.String())
 			if err != nil {
 				return nil, err
@@ -192,10 +193,10 @@ func GetLanguageStats(repo *git.Repository, commitID string) (map[string]int64,
 			includedLanguage[language] = included
 		}
 		if included || isDetectable.ValueOrDefault(false) {
-			sizes[language] += f.Size()
+			sizes[language] += f.GetSize(ctx, repo)
 		} else if len(sizes) == 0 && (firstExcludedLanguage == "" || firstExcludedLanguage == language) {
 			firstExcludedLanguage = language
-			firstExcludedLanguageSize += f.Size()
+			firstExcludedLanguageSize += f.GetSize(ctx, repo)
 		}
 	}

@@ -22,7 +22,7 @@ func TestRepository_GetLanguageStats(t *testing.T) {
 	require.NoError(t, err)
 	defer gitRepo.Close()

-	stats, err := GetLanguageStats(gitRepo, "8fee858da5796dfb37704761701bb8e800ad9ef3")
+	stats, err := GetLanguageStats(t.Context(), gitRepo, "8fee858da5796dfb37704761701bb8e800ad9ef3")
 	require.NoError(t, err)

 	assert.Equal(t, map[string]int64{
@@ -13,26 +13,26 @@ import (
 )

 // CacheCommit will cache the commit from the gitRepository
-func (c *Commit) CacheCommit(ctx context.Context) error {
-	if c.repo.LastCommitCache == nil {
+func (c *Commit) CacheCommit(ctx context.Context, gitRepo *Repository) error {
+	if gitRepo.LastCommitCache == nil {
 		return nil
 	}
-	commitNodeIndex, _ := c.repo.CommitNodeIndex()
+	commitNodeIndex, _ := gitRepo.CommitNodeIndex()

 	index, err := commitNodeIndex.Get(plumbing.Hash(c.ID.RawValue()))
 	if err != nil {
 		return err
 	}

-	return c.recursiveCache(ctx, index, &c.Tree, "", 1)
+	return c.recursiveCache(ctx, gitRepo, index, c.Tree(), "", 1)
 }

-func (c *Commit) recursiveCache(ctx context.Context, index cgobject.CommitNode, tree *Tree, treePath string, level int) error {
+func (c *Commit) recursiveCache(ctx context.Context, gitRepo *Repository, index cgobject.CommitNode, tree *Tree, treePath string, level int) error {
 	if level == 0 {
 		return nil
 	}

-	entries, err := tree.ListEntries()
+	entries, err := tree.ListEntries(ctx, gitRepo)
 	if err != nil {
 		return err
 	}
@@ -44,18 +44,18 @@ func (c *Commit) recursiveCache(ctx context.Context, index cgobject.CommitNode,
 		entryMap[entry.Name()] = entry
 	}

-	commits, err := GetLastCommitForPaths(ctx, c.repo.LastCommitCache, index, treePath, entryPaths)
+	commits, err := getLastCommitForPathsByCommitNode(ctx, gitRepo, index, treePath, entryPaths)
 	if err != nil {
 		return err
 	}

 	for entry := range commits {
 		if entryMap[entry].IsDir() {
-			subTree, err := tree.SubTree(entry)
+			subTree, err := tree.SubTree(ctx, gitRepo, entry)
 			if err != nil {
 				return err
 			}
-			if err := c.recursiveCache(ctx, index, subTree, entry, level-1); err != nil {
+			if err := c.recursiveCache(ctx, gitRepo, index, subTree, entry, level-1); err != nil {
 				return err
 			}
 		}
@@ -10,19 +10,18 @@ import (
 )

 // CacheCommit will cache the commit from the gitRepository
-func (c *Commit) CacheCommit(ctx context.Context) error {
-	if c.repo.LastCommitCache == nil {
+func (c *Commit) CacheCommit(ctx context.Context, gitRepo *Repository) error {
+	if gitRepo.LastCommitCache == nil {
 		return nil
 	}
-	return c.recursiveCache(ctx, &c.Tree, "", 1)
+	return c.recursiveCache(ctx, gitRepo, c.Tree(), "", 1)
 }

-func (c *Commit) recursiveCache(ctx context.Context, tree *Tree, treePath string, level int) error {
+func (c *Commit) recursiveCache(ctx context.Context, gitRepo *Repository, tree *Tree, treePath string, level int) error {
 	if level == 0 {
 		return nil
 	}
-
-	entries, err := tree.ListEntries()
+	entries, err := tree.ListEntries(ctx, gitRepo)
 	if err != nil {
 		return err
 	}
@@ -32,7 +31,7 @@ func (c *Commit) recursiveCache(ctx context.Context, tree *Tree, treePath string
 		entryPaths[i] = entry.Name()
 	}

-	_, err = walkGitLog(ctx, c.repo, c, treePath, entryPaths...)
+	_, err = walkGitLog(ctx, gitRepo, c, treePath, entryPaths...)
 	if err != nil {
 		return err
 	}
@@ -40,11 +39,11 @@ func (c *Commit) recursiveCache(ctx context.Context, tree *Tree, treePath string
 	for _, treeEntry := range entries {
 		// entryMap won't contain "" therefore skip this.
 		if treeEntry.IsDir() {
-			subTree, err := tree.SubTree(treeEntry.Name())
+			subTree, err := tree.SubTree(ctx, gitRepo, treeEntry.Name())
 			if err != nil {
 				return err
 			}
-			if err := c.recursiveCache(ctx, subTree, treeEntry.Name(), level-1); err != nil {
+			if err := c.recursiveCache(ctx, gitRepo, subTree, treeEntry.Name(), level-1); err != nil {
 				return err
 			}
 		}
@@ -263,13 +263,12 @@ var walkGitLogDebugBeforeNext func() // is used to simulate various edge git pro
 // walkGitLog walks the git log --name-status for the head commit in the provided treepath and files
 func walkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
 	headRef := head.ID.String()
-
-	tree, err := head.SubTree(treepath)
+	tree, err := head.SubTree(ctx, repo, treepath)
 	if err != nil {
 		return nil, err
 	}

-	entries, err := tree.ListEntries()
+	entries, err := tree.ListEntries(ctx, repo)
 	if err != nil {
 		return nil, err
 	}
@@ -3,6 +3,14 @@

 package git

+import (
+	"context"
+	"io"
+	"strings"
+
+	"gitea.dev/modules/log"
+)
+
 // NotesRef is the git ref where Gitea will look for git-notes data.
 // The value ("refs/notes/commits") is the default ref used by git-notes.
 const NotesRef = "refs/notes/commits"
@@ -12,3 +20,80 @@ type Note struct {
 	Message []byte
 	Commit  *Commit
 }
+
+// GetNote retrieves the git-notes data for a given commit.
+// FIXME: Add LastCommitCache support
+func GetNote(ctx context.Context, repo *Repository, commitID string, note *Note) error {
+	log.Trace("Searching for git note corresponding to the commit %q in the repository %q", commitID, repo.Path)
+	notes, err := repo.GetCommit(NotesRef)
+	if err != nil {
+		if IsErrNotExist(err) {
+			return err
+		}
+		log.Error("Unable to get commit from ref %q. Error: %v", NotesRef, err)
+		return err
+	}
+
+	path := ""
+
+	tree := notes.Tree()
+	log.Trace("Found tree with ID %q while searching for git note corresponding to the commit %q", tree.ID, commitID)
+
+	var entry *TreeEntry
+	originalCommitID := commitID
+	for len(commitID) > 2 {
+		entry, err = tree.GetTreeEntryByPath(ctx, repo, commitID)
+		if err == nil {
+			path += commitID
+			break
+		}
+		if IsErrNotExist(err) {
+			tree, err = tree.SubTree(ctx, repo, commitID[0:2])
+			path += commitID[0:2] + "/"
+			commitID = commitID[2:]
+		}
+		if err != nil {
+			// Err may have been updated by the SubTree we need to recheck if it's again an ErrNotExist
+			if !IsErrNotExist(err) {
+				log.Error("Unable to find git note corresponding to the commit %q. Error: %v", originalCommitID, err)
+			}
+			return err
+		}
+	}
+
+	blob := entry.Blob(repo)
+	dataRc, err := blob.DataAsync()
+	if err != nil {
+		log.Error("Unable to read blob with ID %q. Error: %v", blob.ID, err)
+		return err
+	}
+	closed := false
+	defer func() {
+		if !closed {
+			_ = dataRc.Close()
+		}
+	}()
+	d, err := io.ReadAll(dataRc)
+	if err != nil {
+		log.Error("Unable to read blob with ID %q. Error: %v", blob.ID, err)
+		return err
+	}
+	_ = dataRc.Close()
+	closed = true
+	note.Message = d
+
+	treePath := ""
+	if idx := strings.LastIndex(path, "/"); idx > -1 {
+		treePath = path[:idx]
+		path = path[idx+1:]
+	}
+
+	lastCommits, err := GetLastCommitForPaths(ctx, repo, notes, treePath, []string{path})
+	if err != nil {
+		log.Error("Unable to get the commit for the path %q. Error: %v", treePath, err)
+		return err
+	}
+	note.Commit = lastCommits[path]
+
+	return nil
+}
@@ -1,95 +0,0 @@
-// Copyright 2019 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build gogit
-
-package git
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"strings"
-
-	"gitea.dev/modules/log"
-
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/object"
-)
-
-// GetNote retrieves the git-notes data for a given commit.
-// FIXME: Add LastCommitCache support
-func GetNote(ctx context.Context, repo *Repository, commitID string, note *Note) error {
-	log.Trace("Searching for git note corresponding to the commit %q in the repository %q", commitID, repo.Path)
-	notes, err := repo.GetCommit(NotesRef)
-	if err != nil {
-		if IsErrNotExist(err) {
-			return err
-		}
-		log.Error("Unable to get commit from ref %q. Error: %v", NotesRef, err)
-		return err
-	}
-
-	remainingCommitID := commitID
-	var path strings.Builder
-	currentTree, err := notes.Tree.gogitTreeObject()
-	if err != nil {
-		return fmt.Errorf("unable to get tree object for notes commit %q: %w", notes.ID.String(), err)
-	}
-
-	log.Trace("Found tree with ID %q while searching for git note corresponding to the commit %q", currentTree.Entries[0].Name, commitID)
-	var file *object.File
-	for len(remainingCommitID) > 2 {
-		file, err = currentTree.File(remainingCommitID)
-		if err == nil {
-			path.WriteString(remainingCommitID)
-			break
-		}
-		if err == object.ErrFileNotFound {
-			currentTree, err = currentTree.Tree(remainingCommitID[0:2])
-			path.WriteString(remainingCommitID[0:2] + "/")
-			remainingCommitID = remainingCommitID[2:]
-		}
-		if err != nil {
-			if err == object.ErrDirectoryNotFound {
-				return ErrNotExist{ID: remainingCommitID, RelPath: path.String()}
-			}
-			log.Error("Unable to find git note corresponding to the commit %q. Error: %v", commitID, err)
-			return err
-		}
-	}
-
-	blob := file.Blob
-	dataRc, err := blob.Reader()
-	if err != nil {
-		log.Error("Unable to read blob with ID %q. Error: %v", blob.ID, err)
-		return err
-	}
-
-	defer dataRc.Close()
-	d, err := io.ReadAll(dataRc)
-	if err != nil {
-		log.Error("Unable to read blob with ID %q. Error: %v", blob.ID, err)
-		return err
-	}
-	note.Message = d
-
-	commitNodeIndex, commitGraphFile := repo.CommitNodeIndex()
-	if commitGraphFile != nil {
-		defer commitGraphFile.Close()
-	}
-
-	commitNode, err := commitNodeIndex.Get(plumbing.Hash(notes.ID.RawValue()))
-	if err != nil {
-		return err
-	}
-
-	lastCommits, err := GetLastCommitForPaths(ctx, nil, commitNode, "", []string{path.String()})
-	if err != nil {
-		log.Error("Unable to get the commit for the path %q. Error: %v", path.String(), err)
-		return err
-	}
-	note.Commit = lastCommits[path.String()]
-
-	return nil
-}
@@ -1,91 +0,0 @@
-// Copyright 2019 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !gogit
-
-package git
-
-import (
-	"context"
-	"io"
-	"strings"
-
-	"gitea.dev/modules/log"
-)
-
-// GetNote retrieves the git-notes data for a given commit.
-// FIXME: Add LastCommitCache support
-func GetNote(ctx context.Context, repo *Repository, commitID string, note *Note) error {
-	log.Trace("Searching for git note corresponding to the commit %q in the repository %q", commitID, repo.Path)
-	notes, err := repo.GetCommit(NotesRef)
-	if err != nil {
-		if IsErrNotExist(err) {
-			return err
-		}
-		log.Error("Unable to get commit from ref %q. Error: %v", NotesRef, err)
-		return err
-	}
-
-	path := ""
-
-	tree := &notes.Tree
-	log.Trace("Found tree with ID %q while searching for git note corresponding to the commit %q", tree.ID, commitID)
-
-	var entry *TreeEntry
-	originalCommitID := commitID
-	for len(commitID) > 2 {
-		entry, err = tree.GetTreeEntryByPath(commitID)
-		if err == nil {
-			path += commitID
-			break
-		}
-		if IsErrNotExist(err) {
-			tree, err = tree.SubTree(commitID[0:2])
-			path += commitID[0:2] + "/"
-			commitID = commitID[2:]
-		}
-		if err != nil {
-			// Err may have been updated by the SubTree we need to recheck if it's again an ErrNotExist
-			if !IsErrNotExist(err) {
-				log.Error("Unable to find git note corresponding to the commit %q. Error: %v", originalCommitID, err)
-			}
-			return err
-		}
-	}
-
-	blob := entry.Blob()
-	dataRc, err := blob.DataAsync()
-	if err != nil {
-		log.Error("Unable to read blob with ID %q. Error: %v", blob.ID, err)
-		return err
-	}
-	closed := false
-	defer func() {
-		if !closed {
-			_ = dataRc.Close()
-		}
-	}()
-	d, err := io.ReadAll(dataRc)
-	if err != nil {
-		log.Error("Unable to read blob with ID %q. Error: %v", blob.ID, err)
-		return err
-	}
-	_ = dataRc.Close()
-	closed = true
-	note.Message = d
-
-	treePath := ""
-	if idx := strings.LastIndex(path, "/"); idx > -1 {
-		treePath = path[:idx]
-		path = path[idx+1:]
-	}
-
-	lastCommits, err := GetLastCommitForPaths(ctx, notes, treePath, []string{path})
-	if err != nil {
-		log.Error("Unable to get the commit for the path %q. Error: %v", treePath, err)
-		return err
-	}
-	note.Commit = lastCommits[path]
-
-	return nil
-}
@@ -10,10 +10,10 @@ import (
 	"strconv"
 )

-// sha1Pattern can be used to determine if a string is an valid sha
+// sha1Pattern can be used to determine if a string is a valid sha
 var sha1Pattern = regexp.MustCompile(`^[0-9a-f]{4,40}$`)

-// sha256Pattern can be used to determine if a string is an valid sha
+// sha256Pattern can be used to determine if a string is a valid sha
 var sha256Pattern = regexp.MustCompile(`^[0-9a-f]{4,64}$`)

 type ObjectFormat interface {
@@ -72,7 +72,7 @@ func findLFSFileFunc(repo *git.Repository, objectID git.ObjectID, revListReader
 				continue
 			case "commit":
 				// Read in the commit to get its tree and in case this is one of the last used commits
-				curCommit, err = git.CommitFromReader(repo, git.MustIDFromString(commitID), io.LimitReader(batchReader, info.Size))
+				curCommit, err = git.CommitFromReader(git.MustIDFromString(commitID), io.LimitReader(batchReader, info.Size))
 				if err != nil {
 					return nil, err
 				}
@@ -80,7 +80,7 @@ func findLFSFileFunc(repo *git.Repository, objectID git.ObjectID, revListReader
 					return nil, err
 				}

-				if info, _, err = batch.QueryContent(curCommit.Tree.ID.String()); err != nil {
+				if info, _, err = batch.QueryContent(curCommit.TreeID.String()); err != nil {
 					return nil, err
 				}
 				curPath = ""
@@ -92,15 +92,14 @@ func (repo *Repository) getCommit(id ObjectID) (*Commit, error) {
 	}

 	commit := convertCommit(gogitCommit)
-	commit.repo = repo

 	tree, err := gogitCommit.Tree()
 	if err != nil {
 		return nil, err
 	}

-	commit.Tree.ID = ParseGogitHash(tree.Hash)
-	commit.Tree.resolvedGogitTreeObject = tree
+	commit.TreeID = ParseGogitHash(tree.Hash)
+	commit.Tree().resolvedGogitTreeObject = tree

 	return commit, nil
 }
@@ -88,7 +88,7 @@ func (repo *Repository) getCommitWithBatch(batch CatFileBatch, id ObjectID) (*Co
 		}
 		return repo.getCommitWithBatch(batch, tag.Object)
 	case "commit":
-		commit, err := CommitFromReader(repo, id, io.LimitReader(rd, info.Size))
+		commit, err := CommitFromReader(id, io.LimitReader(rd, info.Size))
 		if err != nil {
 			return nil, err
 		}
@@ -149,5 +149,5 @@ func (repo *Repository) WriteTree() (*Tree, error) {
 	if err != nil {
 		return nil, err
 	}
-	return NewTree(repo, id), nil
+	return newTree(id), nil
 }
@@ -25,7 +25,7 @@ func (repo *Repository) getTree(id ObjectID) (*Tree, error) {
 		return nil, err
 	}

-	tree := NewTree(repo, id)
+	tree := newTree(id)
 	tree.resolvedGogitTreeObject = gogitTree
 	return tree, nil
 }
@@ -53,7 +53,6 @@ func (repo *Repository) GetTree(idStr string) (*Tree, error) {
 	if err != nil {
 		return nil, err
 	}
-	resolvedID := id
 	commitObject, err := repo.gogitRepo.CommitObject(plumbing.Hash(id.RawValue()))
 	if err == nil {
 		id = ParseGogitHash(commitObject.TreeHash)
@@ -62,6 +61,5 @@ func (repo *Repository) GetTree(idStr string) (*Tree, error) {
 	if err != nil {
 		return nil, err
 	}
-	treeObject.ResolvedID = resolvedID
 	return treeObject, nil
 }
@@ -23,7 +23,6 @@ func (repo *Repository) getTree(id ObjectID) (*Tree, error) {

 	switch info.Type {
 	case "tag":
-		resolvedID := id
 		data, err := io.ReadAll(io.LimitReader(rd, info.Size))
 		if err != nil {
 			return nil, err
@@ -37,21 +36,20 @@ func (repo *Repository) getTree(id ObjectID) (*Tree, error) {
 		if err != nil {
 			return nil, err
 		}
-		commit.Tree.ResolvedID = resolvedID
-		return &commit.Tree, nil
+		tree := commit.Tree()
+		return tree, nil
 	case "commit":
-		commit, err := CommitFromReader(repo, id, io.LimitReader(rd, info.Size))
+		commit, err := CommitFromReader(id, io.LimitReader(rd, info.Size))
 		if err != nil {
 			return nil, err
 		}
 		if _, err := rd.Discard(1); err != nil {
 			return nil, err
 		}
-		commit.Tree.ResolvedID = commit.ID
-		return &commit.Tree, nil
+		tree := commit.Tree()
+		return tree, nil
 	case "tree":
-		tree := NewTree(repo, id)
-		tree.ResolvedID = id
+		tree := newTree(id)
 		objectFormat, err := repo.GetObjectFormat()
 		if err != nil {
 			return nil, err
@@ -6,31 +6,22 @@ package git

 import (
 	"bytes"
+	"context"
 	"strings"

 	"gitea.dev/modules/git/gitcmd"
 )

 type TreeCommon struct {
-	ID         ObjectID
-	ResolvedID ObjectID
-
-	repo  *Repository
-	ptree *Tree // parent tree
+	ID ObjectID
 }

-// NewTree create a new tree according the repository and tree id
-func NewTree(repo *Repository, id ObjectID) *Tree {
-	return &Tree{
-		TreeCommon: TreeCommon{
-			ID:   id,
-			repo: repo,
-		},
-	}
+func newTree(id ObjectID) *Tree {
+	return &Tree{TreeCommon: TreeCommon{ID: id}}
 }

 // SubTree get a subtree by the sub dir path
-func (t *Tree) SubTree(rpath string) (*Tree, error) {
+func (t *Tree) SubTree(ctx context.Context, gitRepo *Repository, rpath string) (*Tree, error) {
 	if len(rpath) == 0 {
 		return t, nil
 	}
@@ -43,16 +34,15 @@ func (t *Tree) SubTree(rpath string) (*Tree, error) {
 		te  *TreeEntry
 	)
 	for _, name := range paths {
-		te, err = p.GetTreeEntryByPath(name)
+		te, err = p.GetTreeEntryByPath(ctx, gitRepo, name)
 		if err != nil {
 			return nil, err
 		}

-		g, err = t.repo.getTree(te.ID)
+		g, err = gitRepo.getTree(te.ID)
 		if err != nil {
 			return nil, err
 		}
-		g.ptree = p
 		p = g
 	}
 	return g, nil
@@ -4,15 +4,17 @@

 package git

+import "context"
+
 // GetBlobByPath get the blob object according the path
-func (t *Tree) GetBlobByPath(relpath string) (*Blob, error) {
-	entry, err := t.GetTreeEntryByPath(relpath)
+func (t *Tree) GetBlobByPath(ctx context.Context, gitRepo *Repository, relpath string) (*Blob, error) {
+	entry, err := t.GetTreeEntryByPath(ctx, gitRepo, relpath)
 	if err != nil {
 		return nil, err
 	}

 	if !entry.IsDir() && !entry.IsSubModule() {
-		return entry.Blob(), nil
+		return entry.Blob(gitRepo), nil
 	}

 	return nil, ErrNotExist{"", relpath}
@@ -7,6 +7,7 @@
 package git

 import (
+	"context"
 	"path"
 	"strings"

@@ -14,7 +15,7 @@ import (
 )

 // GetTreeEntryByPath get the tree entries according the sub dir
-func (t *Tree) GetTreeEntryByPath(relpath string) (*TreeEntry, error) {
+func (t *Tree) GetTreeEntryByPath(ctx context.Context, gitRepo *Repository, relpath string) (*TreeEntry, error) {
 	if len(relpath) == 0 {
 		return &TreeEntry{
 			ID:        t.ID,
@@ -30,7 +31,7 @@ func (t *Tree) GetTreeEntryByPath(relpath string) (*TreeEntry, error) {
 	tree := t
 	for i, name := range parts {
 		if i == len(parts)-1 {
-			entries, err := tree.ListEntries()
+			entries, err := tree.ListEntries(ctx, gitRepo)
 			if err != nil {
 				if err == plumbing.ErrObjectNotFound {
 					return nil, ErrNotExist{
@@ -45,7 +46,7 @@ func (t *Tree) GetTreeEntryByPath(relpath string) (*TreeEntry, error) {
 				}
 			}
 		} else {
-			tree, err = tree.SubTree(name)
+			tree, err = tree.SubTree(ctx, gitRepo, name)
 			if err != nil {
 				if err == plumbing.ErrObjectNotFound {
 					return nil, ErrNotExist{
@@ -6,12 +6,13 @@
 package git

 import (
+	"context"
 	"path"
 	"strings"
 )

 // GetTreeEntryByPath get the tree entries according the sub dir
-func (t *Tree) GetTreeEntryByPath(relpath string) (_ *TreeEntry, err error) {
+func (t *Tree) GetTreeEntryByPath(ctx context.Context, gitRepo *Repository, relpath string) (_ *TreeEntry, err error) {
 	if len(relpath) == 0 {
 		return &TreeEntry{
 			ptree:     t,
@@ -26,14 +27,14 @@ func (t *Tree) GetTreeEntryByPath(relpath string) (_ *TreeEntry, err error) {

 	tree := t
 	for _, name := range parts[:len(parts)-1] {
-		tree, err = tree.SubTree(name)
+		tree, err = tree.SubTree(ctx, gitRepo, name)
 		if err != nil {
 			return nil, err
 		}
 	}

 	name := parts[len(parts)-1]
-	entries, err := tree.ListEntries()
+	entries, err := tree.ListEntries(ctx, gitRepo)
 	if err != nil {
 		return nil, err
 	}
@@ -5,6 +5,7 @@
 package git

 import (
+	"context"
 	"path"
 	"slices"
 	"strings"
@@ -78,18 +79,18 @@ type EntryFollowResult struct {
 	TargetEntry    *TreeEntry
 }

-func EntryFollowLink(commit *Commit, fullPath string, te *TreeEntry) (*EntryFollowResult, error) {
+func EntryFollowLink(ctx context.Context, gitRepo *Repository, commit *Commit, fullPath string, te *TreeEntry) (*EntryFollowResult, error) {
 	if !te.IsLink() {
 		return nil, util.ErrorWrap(util.ErrUnprocessableContent, "%q is not a symlink", fullPath)
 	}

 	// git's filename max length is 4096, hopefully a link won't be longer than multiple of that
 	const maxSymlinkSize = 20 * 4096
-	if te.Blob().Size() > maxSymlinkSize {
+	if te.Blob(gitRepo).Size() > maxSymlinkSize {
 		return nil, util.ErrorWrap(util.ErrUnprocessableContent, "%q content exceeds symlink limit", fullPath)
 	}

-	link, err := te.Blob().GetBlobContent(maxSymlinkSize)
+	link, err := te.Blob(gitRepo).GetBlobContent(maxSymlinkSize)
 	if err != nil {
 		return nil, err
 	}
@@ -99,18 +100,18 @@ func EntryFollowLink(commit *Commit, fullPath string, te *TreeEntry) (*EntryFoll
 	}

 	targetFullPath := path.Join(path.Dir(fullPath), link)
-	targetEntry, err := commit.GetTreeEntryByPath(targetFullPath)
+	targetEntry, err := commit.GetTreeEntryByPath(ctx, gitRepo, targetFullPath)
 	if err != nil {
 		return &EntryFollowResult{SymlinkContent: link}, err
 	}
 	return &EntryFollowResult{SymlinkContent: link, TargetFullPath: targetFullPath, TargetEntry: targetEntry}, nil
 }

-func EntryFollowLinks(commit *Commit, firstFullPath string, firstTreeEntry *TreeEntry, optLimit ...int) (res *EntryFollowResult, err error) {
+func EntryFollowLinks(ctx context.Context, gitRepo *Repository, commit *Commit, firstFullPath string, firstTreeEntry *TreeEntry, optLimit ...int) (res *EntryFollowResult, err error) {
 	limit := util.OptionalArg(optLimit, 10)
 	treeEntry, fullPath := firstTreeEntry, firstFullPath
 	for range limit {
-		res, err = EntryFollowLink(commit, fullPath, treeEntry)
+		res, err = EntryFollowLink(ctx, gitRepo, commit, fullPath, treeEntry)
 		if err != nil {
 			return res, err
 		}
@@ -125,28 +126,26 @@ func EntryFollowLinks(commit *Commit, firstFullPath string, firstTreeEntry *Tree
 	return res, nil
 }

-// returns the Tree pointed to by this TreeEntry, or nil if this is not a tree
-func (te *TreeEntry) Tree() *Tree {
-	t, err := te.ptree.repo.getTree(te.ID)
+func (te *TreeEntry) Tree(gitRepo *Repository) *Tree {
+	t, err := gitRepo.getTree(te.ID)
 	if err != nil {
 		return nil
 	}
-	t.ptree = te.ptree
 	return t
 }

 // GetSubJumpablePathName return the full path of subdirectory jumpable ( contains only one directory )
-func (te *TreeEntry) GetSubJumpablePathName() string {
+func (te *TreeEntry) GetSubJumpablePathName(ctx context.Context, gitRepo *Repository) string {
 	if te.IsSubModule() || !te.IsDir() {
 		return ""
 	}
-	tree, err := te.ptree.SubTree(te.Name())
+	tree, err := te.ptree.SubTree(ctx, gitRepo, te.Name())
 	if err != nil {
 		return te.Name()
 	}
-	entries, _ := tree.ListEntries()
+	entries, _ := tree.ListEntries(ctx, gitRepo)
 	if len(entries) == 1 && entries[0].IsDir() {
-		name := entries[0].GetSubJumpablePathName()
+		name := entries[0].GetSubJumpablePathName(ctx, gitRepo)
 		if name != "" {
 			return te.Name() + "/" + name
 		}
@@ -23,12 +23,12 @@ func TestFollowLink(t *testing.T) {
 	// get the symlink
 	{
 		lnkFullPath := "foo/bar/link_to_hello"
-		lnk, err := commit.Tree.GetTreeEntryByPath("foo/bar/link_to_hello")
+		lnk, err := commit.Tree().GetTreeEntryByPath(t.Context(), r, "foo/bar/link_to_hello")
 		require.NoError(t, err)
 		assert.True(t, lnk.IsLink())

 		// should be able to dereference to target
-		res, err := EntryFollowLink(commit, lnkFullPath, lnk)
+		res, err := EntryFollowLink(t.Context(), r, commit, lnkFullPath, lnk)
 		require.NoError(t, err)
 		assert.Equal(t, "hello", res.TargetEntry.Name())
 		assert.Equal(t, "foo/nar/hello", res.TargetFullPath)
@@ -38,38 +38,38 @@ func TestFollowLink(t *testing.T) {

 	{
 		// should error when called on a normal file
-		entry, err := commit.Tree.GetTreeEntryByPath("file1.txt")
+		entry, err := commit.Tree().GetTreeEntryByPath(t.Context(), r, "file1.txt")
 		require.NoError(t, err)
-		res, err := EntryFollowLink(commit, "file1.txt", entry)
+		res, err := EntryFollowLink(t.Context(), r, commit, "file1.txt", entry)
 		assert.ErrorIs(t, err, util.ErrUnprocessableContent)
 		assert.Nil(t, res)
 	}

 	{
 		// should error for broken links
-		entry, err := commit.Tree.GetTreeEntryByPath("foo/broken_link")
+		entry, err := commit.Tree().GetTreeEntryByPath(t.Context(), r, "foo/broken_link")
 		require.NoError(t, err)
 		assert.True(t, entry.IsLink())
-		res, err := EntryFollowLink(commit, "foo/broken_link", entry)
+		res, err := EntryFollowLink(t.Context(), r, commit, "foo/broken_link", entry)
 		assert.ErrorIs(t, err, util.ErrNotExist)
 		assert.Equal(t, "nar/broken_link", res.SymlinkContent)
 	}

 	{
 		// should error for external links
-		entry, err := commit.Tree.GetTreeEntryByPath("foo/outside_repo")
+		entry, err := commit.Tree().GetTreeEntryByPath(t.Context(), r, "foo/outside_repo")
 		require.NoError(t, err)
 		assert.True(t, entry.IsLink())
-		res, err := EntryFollowLink(commit, "foo/outside_repo", entry)
+		res, err := EntryFollowLink(t.Context(), r, commit, "foo/outside_repo", entry)
 		assert.ErrorIs(t, err, util.ErrNotExist)
 		assert.Equal(t, "../../outside_repo", res.SymlinkContent)
 	}

 	{
 		// testing fix for short link bug
-		entry, err := commit.Tree.GetTreeEntryByPath("foo/link_short")
+		entry, err := commit.Tree().GetTreeEntryByPath(t.Context(), r, "foo/link_short")
 		require.NoError(t, err)
-		res, err := EntryFollowLink(commit, "foo/link_short", entry)
+		res, err := EntryFollowLink(t.Context(), r, commit, "foo/link_short", entry)
 		assert.ErrorIs(t, err, util.ErrNotExist)
 		assert.Equal(t, "a", res.SymlinkContent)
 	}
@@ -7,6 +7,8 @@
 package git

 import (
+	"context"
+
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/object"
@@ -29,15 +31,15 @@ func (te *TreeEntry) toGogitTreeEntry() *object.TreeEntry {
 	}
 }

-// Size returns the size of the entry
-func (te *TreeEntry) Size() int64 {
+// GetSize returns the size of the entry
+func (te *TreeEntry) GetSize(ctx context.Context, gitRepo *Repository) int64 {
 	if te.IsDir() {
 		return 0
 	} else if te.sized {
 		return te.size
 	}

-	ptreeGogitTree, err := te.ptree.gogitTreeObject()
+	ptreeGogitTree, err := te.ptree.gogitTreeObject(gitRepo)
 	if err != nil {
 		return 0
 	}
@@ -52,10 +54,10 @@ func (te *TreeEntry) Size() int64 {
 }

 // Blob returns the blob object the entry
-func (te *TreeEntry) Blob() *Blob {
+func (te *TreeEntry) Blob(gitRepo *Repository) *Blob {
 	return &Blob{
 		ID:   te.ID,
-		repo: te.ptree.repo,
+		repo: gitRepo,
 		name: te.Name(),
 	}
 }
@@ -5,25 +5,28 @@

 package git

-import "gitea.dev/modules/log"
+import (
+	"context"

-// Size returns the size of the entry
-func (te *TreeEntry) Size() int64 {
+	"gitea.dev/modules/log"
+)
+
+func (te *TreeEntry) GetSize(ctx context.Context, gitRepo *Repository) int64 {
 	if te.IsDir() {
 		return 0
 	} else if te.sized {
 		return te.size
 	}

-	batch, cancel, err := te.ptree.repo.CatFileBatch(te.ptree.repo.Ctx)
+	batch, cancel, err := gitRepo.CatFileBatch(ctx)
 	if err != nil {
-		log.Debug("error whilst reading size for %s in %s. Error: %v", te.ID.String(), te.ptree.repo.Path, err)
+		log.Debug("error whilst reading size for %s in %s. Error: %v", te.ID.String(), gitRepo.Path, err)
 		return 0
 	}
 	defer cancel()
 	info, err := batch.QueryInfo(te.ID.String())
 	if err != nil {
-		log.Debug("error whilst reading size for %s in %s. Error: %v", te.ID.String(), te.ptree.repo.Path, err)
+		log.Debug("error whilst reading size for %s in %s. Error: %v", te.ID.String(), gitRepo.Path, err)
 		return 0
 	}

@@ -33,12 +36,12 @@ func (te *TreeEntry) Size() int64 {
 }

 // Blob returns the blob object the entry
-func (te *TreeEntry) Blob() *Blob {
+func (te *TreeEntry) Blob(gitRepo *Repository) *Blob {
 	return &Blob{
 		ID:      te.ID,
 		name:    te.Name(),
 		size:    te.size,
 		gotSize: te.sized,
-		repo:    te.ptree.repo,
+		repo:    gitRepo,
 	}
 }
@@ -7,6 +7,7 @@
 package git

 import (
+	"context"
 	"io"

 	"github.com/go-git/go-git/v5/plumbing"
@@ -20,9 +21,9 @@ type Tree struct {
 	resolvedGogitTreeObject *object.Tree
 }

-func (t *Tree) gogitTreeObject() (_ *object.Tree, err error) {
+func (t *Tree) gogitTreeObject(gitRepo *Repository) (_ *object.Tree, err error) {
 	if t.resolvedGogitTreeObject == nil {
-		t.resolvedGogitTreeObject, err = t.repo.gogitRepo.TreeObject(plumbing.Hash(t.ID.RawValue()))
+		t.resolvedGogitTreeObject, err = gitRepo.gogitRepo.TreeObject(plumbing.Hash(t.ID.RawValue()))
 		if err != nil {
 			return nil, err
 		}
@@ -31,8 +32,8 @@ func (t *Tree) gogitTreeObject() (_ *object.Tree, err error) {
 }

 // ListEntries returns all entries of current tree.
-func (t *Tree) ListEntries() (Entries, error) {
-	gogitTree, err := t.gogitTreeObject()
+func (t *Tree) ListEntries(_ context.Context, gitRepo *Repository) (Entries, error) {
+	gogitTree, err := t.gogitTreeObject(gitRepo)
 	if err != nil {
 		return nil, err
 	}
@@ -50,8 +51,8 @@ func (t *Tree) ListEntries() (Entries, error) {
 }

 // ListEntriesRecursiveWithSize returns all entries of current tree recursively including all subtrees
-func (t *Tree) ListEntriesRecursiveWithSize() (entries Entries, _ error) {
-	gogitTree, err := t.gogitTreeObject()
+func (t *Tree) ListEntriesRecursiveWithSize(_ context.Context, gitRepo *Repository) (entries Entries, _ error) {
+	gogitTree, err := t.gogitTreeObject(gitRepo)
 	if err != nil {
 		return nil, err
 	}
@@ -76,6 +77,6 @@ func (t *Tree) ListEntriesRecursiveWithSize() (entries Entries, _ error) {
 }

 // ListEntriesRecursiveFast is the alias of ListEntriesRecursiveWithSize for the gogit version
-func (t *Tree) ListEntriesRecursiveFast() (Entries, error) {
-	return t.ListEntriesRecursiveWithSize()
+func (t *Tree) ListEntriesRecursiveFast(ctx context.Context, gitRepo *Repository) (Entries, error) {
+	return t.ListEntriesRecursiveWithSize(ctx, gitRepo)
 }
@@ -6,6 +6,7 @@
 package git

 import (
+	"context"
 	"io"

 	"gitea.dev/modules/git/gitcmd"
@@ -20,49 +21,47 @@ type Tree struct {
 }

 // ListEntries returns all entries of current tree.
-func (t *Tree) ListEntries() (Entries, error) {
+func (t *Tree) ListEntries(ctx context.Context, gitRepo *Repository) (Entries, error) {
 	if t.entriesParsed {
 		return t.entries, nil
 	}

-	if t.repo != nil {
-		batch, cancel, err := t.repo.CatFileBatch(t.repo.Ctx)
-		if err != nil {
+	batch, cancel, err := gitRepo.CatFileBatch(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer cancel()
+
+	info, rd, err := batch.QueryContent(t.ID.String())
+	if err != nil {
+		return nil, err
+	}
+
+	if info.Type == "commit" {
+		treeID, err := ReadTreeID(rd, info.Size)
+		if err != nil && err != io.EOF {
 			return nil, err
 		}
-		defer cancel()
-
-		info, rd, err := batch.QueryContent(t.ID.String())
+		info, rd, err = batch.QueryContent(treeID)
 		if err != nil {
 			return nil, err
 		}
-
-		if info.Type == "commit" {
-			treeID, err := ReadTreeID(rd, info.Size)
-			if err != nil && err != io.EOF {
-				return nil, err
-			}
-			info, rd, err = batch.QueryContent(treeID)
-			if err != nil {
-				return nil, err
-			}
-		}
-		if info.Type == "tree" {
-			t.entries, err = catBatchParseTreeEntries(t.ID.Type(), t, rd, info.Size)
-			if err != nil {
-				return nil, err
-			}
-			t.entriesParsed = true
-			return t.entries, nil
-		}
-
-		// Not a tree just use ls-tree instead
-		if err := DiscardFull(rd, info.Size+1); err != nil {
+	}
+	if info.Type == "tree" {
+		t.entries, err = catBatchParseTreeEntries(t.ID.Type(), t, rd, info.Size)
+		if err != nil {
 			return nil, err
 		}
+		t.entriesParsed = true
+		return t.entries, nil
 	}

-	stdout, _, runErr := gitcmd.NewCommand("ls-tree", "-l").AddDynamicArguments(t.ID.String()).WithDir(t.repo.Path).RunStdBytes(t.repo.Ctx)
+	// Not a tree just use ls-tree instead
+	if err := DiscardFull(rd, info.Size+1); err != nil {
+		return nil, err
+	}
+
+	stdout, _, runErr := gitcmd.NewCommand("ls-tree", "-l").AddDynamicArguments(t.ID.String()).WithDir(gitRepo.Path).RunStdBytes(ctx)
 	if runErr != nil {
 		if gitcmd.IsStderr(runErr, gitcmd.StderrNotValidObjectName) || gitcmd.IsStderr(runErr, gitcmd.StderrNotTreeObject) {
 			return nil, ErrNotExist{
@@ -72,7 +71,6 @@ func (t *Tree) ListEntries() (Entries, error) {
 		return nil, runErr
 	}

-	var err error
 	t.entries, err = parseTreeEntries(stdout, t)
 	if err == nil {
 		t.entriesParsed = true
@@ -83,12 +81,12 @@ func (t *Tree) ListEntries() (Entries, error) {

 // listEntriesRecursive returns all entries of current tree recursively including all subtrees
 // extraArgs could be "-l" to get the size, which is slower
-func (t *Tree) listEntriesRecursive(extraArgs gitcmd.TrustedCmdArgs) (Entries, error) {
+func (t *Tree) listEntriesRecursive(ctx context.Context, gitRepo *Repository, extraArgs gitcmd.TrustedCmdArgs) (Entries, error) {
 	stdout, _, runErr := gitcmd.NewCommand("ls-tree", "-t", "-r").
 		AddArguments(extraArgs...).
 		AddDynamicArguments(t.ID.String()).
-		WithDir(t.repo.Path).
-		RunStdBytes(t.repo.Ctx)
+		WithDir(gitRepo.Path).
+		RunStdBytes(ctx)
 	if runErr != nil {
 		return nil, runErr
 	}
@@ -99,11 +97,11 @@ func (t *Tree) listEntriesRecursive(extraArgs gitcmd.TrustedCmdArgs) (Entries, e
 }

 // ListEntriesRecursiveFast returns all entries of current tree recursively including all subtrees, no size
-func (t *Tree) ListEntriesRecursiveFast() (Entries, error) {
-	return t.listEntriesRecursive(nil)
+func (t *Tree) ListEntriesRecursiveFast(ctx context.Context, gitRepo *Repository) (Entries, error) {
+	return t.listEntriesRecursive(ctx, gitRepo, nil)
 }

 // ListEntriesRecursiveWithSize returns all entries of current tree recursively including all subtrees, with size
-func (t *Tree) ListEntriesRecursiveWithSize() (Entries, error) {
-	return t.listEntriesRecursive(gitcmd.TrustedCmdArgs{"--long"})
+func (t *Tree) ListEntriesRecursiveWithSize(ctx context.Context, gitRepo *Repository) (Entries, error) {
+	return t.listEntriesRecursive(ctx, gitRepo, gitcmd.TrustedCmdArgs{"--long"})
 }
@@ -20,7 +20,7 @@ func TestSubTree_Issue29101(t *testing.T) {

 	// old code could produce a different error if called multiple times
 	for range 10 {
-		_, err = commit.SubTree("file1.txt")
+		_, err = commit.SubTree(t.Context(), repo, "file1.txt")
 		assert.Error(t, err)
 		assert.True(t, IsErrNotExist(err))
 	}
@@ -139,7 +139,7 @@ func (r *BlameReader) cleanup() {
 }

 // CreateBlameReader creates reader for given repository, commit and file
-func CreateBlameReader(ctx context.Context, objectFormat git.ObjectFormat, repo Repository, commit *git.Commit, file string, bypassBlameIgnore bool) (rd *BlameReader, retErr error) {
+func CreateBlameReader(ctx context.Context, objectFormat git.ObjectFormat, repo Repository, gitRepo *git.Repository, commit *git.Commit, file string, bypassBlameIgnore bool) (rd *BlameReader, retErr error) {
 	defer func() {
 		if retErr != nil {
 			rd.cleanup()
@@ -158,7 +158,7 @@ func CreateBlameReader(ctx context.Context, objectFormat git.ObjectFormat, repo
 	rd.cleanupFuncs = append(rd.cleanupFuncs, stdoutReaderClose)

 	if git.DefaultFeatures().CheckVersionAtLeast("2.23") && !bypassBlameIgnore {
-		ignoreRevsFileName, ignoreRevsFileCleanup, err := tryCreateBlameIgnoreRevsFile(commit)
+		ignoreRevsFileName, ignoreRevsFileCleanup, err := tryCreateBlameIgnoreRevsFile(ctx, gitRepo, commit)
 		if err != nil && !git.IsErrNotExist(err) {
 			return nil, err
 		} else if err == nil {
@@ -180,13 +180,13 @@ func CreateBlameReader(ctx context.Context, objectFormat git.ObjectFormat, repo
 	return rd, nil
 }

-func tryCreateBlameIgnoreRevsFile(commit *git.Commit) (string, func(), error) {
-	entry, err := commit.GetTreeEntryByPath(".git-blame-ignore-revs")
+func tryCreateBlameIgnoreRevsFile(ctx context.Context, gitRepo *git.Repository, commit *git.Commit) (string, func(), error) {
+	entry, err := commit.GetTreeEntryByPath(ctx, gitRepo, ".git-blame-ignore-revs")
 	if err != nil {
 		return "", nil, err
 	}

-	r, err := entry.Blob().DataAsync()
+	r, err := entry.Blob(gitRepo).DataAsync()
 	if err != nil {
 		return "", nil, err
 	}
@@ -49,7 +49,7 @@ func TestReadingBlameOutputSha256(t *testing.T) {
 		}

 		for _, bypass := range []bool{false, true} {
-			blameReader, err := CreateBlameReader(ctx, git.Sha256ObjectFormat, storage, commit, "README.md", bypass)
+			blameReader, err := CreateBlameReader(ctx, git.Sha256ObjectFormat, storage, repo, commit, "README.md", bypass)
 			assert.NoError(t, err)
 			assert.NotNil(t, blameReader)
 			defer blameReader.Close()
@@ -134,7 +134,7 @@ func TestReadingBlameOutputSha256(t *testing.T) {
 		for _, c := range cases {
 			commit, err := repo.GetCommit(c.CommitID)
 			assert.NoError(t, err)
-			blameReader, err := CreateBlameReader(ctx, objectFormat, storage, commit, "blame.txt", c.Bypass)
+			blameReader, err := CreateBlameReader(ctx, objectFormat, storage, repo, commit, "blame.txt", c.Bypass)
 			assert.NoError(t, err)
 			assert.NotNil(t, blameReader)
 			defer blameReader.Close()
@@ -43,7 +43,7 @@ func TestReadingBlameOutput(t *testing.T) {
 		}

 		for _, bypass := range []bool{false, true} {
-			blameReader, err := CreateBlameReader(ctx, git.Sha1ObjectFormat, storage, commit, "README.md", bypass)
+			blameReader, err := CreateBlameReader(ctx, git.Sha1ObjectFormat, storage, repo, commit, "README.md", bypass)
 			assert.NoError(t, err)
 			assert.NotNil(t, blameReader)
 			defer blameReader.Close()
@@ -129,7 +129,7 @@ func TestReadingBlameOutput(t *testing.T) {
 			commit, err := repo.GetCommit(c.CommitID)
 			assert.NoError(t, err)

-			blameReader, err := CreateBlameReader(ctx, objectFormat, storage, commit, "blame.txt", c.Bypass)
+			blameReader, err := CreateBlameReader(ctx, objectFormat, storage, repo, commit, "blame.txt", c.Bypass)
 			assert.NoError(t, err)
 			assert.NotNil(t, blameReader)
 			defer blameReader.Close()
@@ -26,7 +26,7 @@ func getDefaultBranchSha(ctx context.Context, repo *repo_model.Repository) (stri
 }

 // getRepoChanges returns changes to repo since last indexer update
-func getRepoChanges(ctx context.Context, repo *repo_model.Repository, revision string) (*internal.RepoChanges, error) {
+func getRepoChanges(ctx context.Context, repo *repo_model.Repository, gitRepo *git.Repository, revision string) (*internal.RepoChanges, error) {
 	status, err := repo_model.GetIndexerStatus(ctx, repo, repo_model.RepoIndexerTypeCode)
 	if err != nil {
 		return nil, err
@@ -40,9 +40,9 @@ func getRepoChanges(ctx context.Context, repo *repo_model.Repository, revision s
 	}

 	if needGenesis {
-		return genesisChanges(ctx, repo, revision)
+		return genesisChanges(ctx, repo, gitRepo, revision)
 	}
-	return nonGenesisChanges(ctx, repo, revision)
+	return nonGenesisChanges(ctx, repo, gitRepo, revision)
 }

 func isIndexable(entry *git.TreeEntry) bool {
@@ -64,7 +64,7 @@ func isIndexable(entry *git.TreeEntry) bool {
 }

 // parseGitLsTreeOutput parses the output of a `git ls-tree -r --full-name` command
-func parseGitLsTreeOutput(stdout []byte) ([]internal.FileUpdate, error) {
+func parseGitLsTreeOutput(ctx context.Context, gitRepo *git.Repository, stdout []byte) ([]internal.FileUpdate, error) {
 	entries, err := git.ParseTreeEntries(stdout)
 	if err != nil {
 		return nil, err
@@ -76,7 +76,7 @@ func parseGitLsTreeOutput(stdout []byte) ([]internal.FileUpdate, error) {
 			updates[idxCount] = internal.FileUpdate{
 				Filename: entry.Name(),
 				BlobSha:  entry.ID.String(),
-				Size:     entry.Size(),
+				Size:     entry.GetSize(ctx, gitRepo),
 				Sized:    true,
 			}
 			idxCount++
@@ -86,7 +86,7 @@ func parseGitLsTreeOutput(stdout []byte) ([]internal.FileUpdate, error) {
 }

 // genesisChanges get changes to add repo to the indexer for the first time
-func genesisChanges(ctx context.Context, repo *repo_model.Repository, revision string) (*internal.RepoChanges, error) {
+func genesisChanges(ctx context.Context, repo *repo_model.Repository, gitRepo *git.Repository, revision string) (*internal.RepoChanges, error) {
 	var changes internal.RepoChanges
 	stdout, _, runErr := gitrepo.RunCmdBytes(ctx, repo, gitcmd.NewCommand("ls-tree", "--full-tree", "-l", "-r").AddDynamicArguments(revision))
 	if runErr != nil {
@@ -94,12 +94,12 @@ func genesisChanges(ctx context.Context, repo *repo_model.Repository, revision s
 	}

 	var err error
-	changes.Updates, err = parseGitLsTreeOutput(stdout)
+	changes.Updates, err = parseGitLsTreeOutput(ctx, gitRepo, stdout)
 	return &changes, err
 }

 // nonGenesisChanges get changes since the previous indexer update
-func nonGenesisChanges(ctx context.Context, repo *repo_model.Repository, revision string) (*internal.RepoChanges, error) {
+func nonGenesisChanges(ctx context.Context, repo *repo_model.Repository, gitRepo *git.Repository, revision string) (*internal.RepoChanges, error) {
 	diffCmd := gitcmd.NewCommand("diff", "--name-status").AddDynamicArguments(repo.CodeIndexerStatus.CommitSha, revision)
 	stdout, _, runErr := gitrepo.RunCmdString(ctx, repo, diffCmd)
 	if runErr != nil {
@@ -109,7 +109,7 @@ func nonGenesisChanges(ctx context.Context, repo *repo_model.Repository, revisio
 		if err := (*globalIndexer.Load()).Delete(ctx, repo.ID); err != nil {
 			return nil, err
 		}
-		return genesisChanges(ctx, repo, revision)
+		return genesisChanges(ctx, repo, gitRepo, revision)
 	}

 	var changes internal.RepoChanges
@@ -124,7 +124,7 @@ func nonGenesisChanges(ctx context.Context, repo *repo_model.Repository, revisio
 			return err
 		}

-		updates, err1 := parseGitLsTreeOutput(lsTreeStdout)
+		updates, err1 := parseGitLsTreeOutput(ctx, gitRepo, lsTreeStdout)
 		if err1 != nil {
 			return err1
 		}
@@ -13,6 +13,7 @@ import (

 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
 	"gitea.dev/modules/graceful"
 	"gitea.dev/modules/indexer"
 	"gitea.dev/modules/indexer/code/bleve"
@@ -73,11 +74,17 @@ func index(ctx context.Context, indexer internal.Indexer, repoID int64) error {
 		return nil
 	}

+	gitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, repo)
+	if err != nil {
+		return err
+	}
+	defer closer.Close()
+
 	sha, err := getDefaultBranchSha(ctx, repo)
 	if err != nil {
 		return err
 	}
-	changes, err := getRepoChanges(ctx, repo, sha)
+	changes, err := getRepoChanges(ctx, repo, gitRepo, sha)
 	if err != nil {
 		return err
 	} else if changes == nil {
@@ -63,7 +63,7 @@ func (db *DBIndexer) Index(id int64) error {
 	}

 	// Calculate and save language statistics to database
-	stats, err := languagestats.GetLanguageStats(gitRepo, commitID)
+	stats, err := languagestats.GetLanguageStats(ctx, gitRepo, commitID)
 	if err != nil {
 		if !setting.IsInTesting {
 			log.Error("Unable to get language stats for ID %s for default branch %s in %s. Error: %v", commitID, repo.DefaultBranch, repo.FullName(), err)
@@ -167,7 +167,7 @@ func validateOptions(field *api.IssueFormField, idx int) error {

 	options, ok := field.Attributes["options"].([]any)
 	if !ok || len(options) == 0 {
-		return position.Errorf("'options' is required and should be a array")
+		return position.Errorf("'options' is required and should be an array")
 	}

 	for optIdx, option := range options {
@@ -270,7 +270,7 @@ func validateDropdownDefault(position errorPosition, attributes map[string]any)
 	options, ok := attributes["options"].([]any)
 	if !ok {
 		// should not happen
-		return position.Errorf("'options' is required and should be a array")
+		return position.Errorf("'options' is required and should be an array")
 	}
 	if defaultValue < 0 || defaultValue >= len(options) {
 		return position.Errorf("the value of 'default' is out of range")
@@ -268,7 +268,7 @@ body:
    attributes:
      label: "a"
 `,
-			wantErr: "body[0](dropdown): 'options' is required and should be a array",
+			wantErr: "body[0](dropdown): 'options' is required and should be an array",
 		},
 		{
 			name: "dropdown invalid options",
@@ -4,6 +4,7 @@
 package template

 import (
+	"context"
 	"fmt"
 	"path"
 	"strconv"
@@ -41,35 +42,35 @@ func Unmarshal(filename string, content []byte) (*api.IssueTemplate, error) {
 }

 // UnmarshalFromEntry parses out a valid template from the blob in entry
-func UnmarshalFromEntry(entry *git.TreeEntry, dir string) (*api.IssueTemplate, error) {
-	return unmarshalFromEntry(entry, path.Join(dir, entry.Name())) // Filepaths in Git are ALWAYS '/' separated do not use filepath here
+func UnmarshalFromEntry(gitRepo *git.Repository, entry *git.TreeEntry, dir string) (*api.IssueTemplate, error) {
+	return unmarshalFromEntry(gitRepo, entry, path.Join(dir, entry.Name())) // Filepaths in Git are ALWAYS '/' separated do not use filepath here
 }

 // UnmarshalFromCommit parses out a valid template from the commit
-func UnmarshalFromCommit(commit *git.Commit, filename string) (*api.IssueTemplate, error) {
-	entry, err := commit.GetTreeEntryByPath(filename)
+func UnmarshalFromCommit(ctx context.Context, gitRepo *git.Repository, commit *git.Commit, filename string) (*api.IssueTemplate, error) {
+	entry, err := commit.GetTreeEntryByPath(ctx, gitRepo, filename)
 	if err != nil {
 		return nil, fmt.Errorf("get entry for %q: %w", filename, err)
 	}
-	return unmarshalFromEntry(entry, filename)
+	return unmarshalFromEntry(gitRepo, entry, filename)
 }

 // UnmarshalFromRepo parses out a valid template from the head commit of the branch
-func UnmarshalFromRepo(repo *git.Repository, branch, filename string) (*api.IssueTemplate, error) {
+func UnmarshalFromRepo(ctx context.Context, repo *git.Repository, branch, filename string) (*api.IssueTemplate, error) {
 	commit, err := repo.GetBranchCommit(branch)
 	if err != nil {
 		return nil, fmt.Errorf("get commit on branch %q: %w", branch, err)
 	}

-	return UnmarshalFromCommit(commit, filename)
+	return UnmarshalFromCommit(ctx, repo, commit, filename)
 }

-func unmarshalFromEntry(entry *git.TreeEntry, filename string) (*api.IssueTemplate, error) {
-	if size := entry.Blob().Size(); size > setting.UI.MaxDisplayFileSize {
+func unmarshalFromEntry(gitRepo *git.Repository, entry *git.TreeEntry, filename string) (*api.IssueTemplate, error) {
+	if size := entry.Blob(gitRepo).Size(); size > setting.UI.MaxDisplayFileSize {
 		return nil, fmt.Errorf("too large: %v > MaxDisplayFileSize", size)
 	}

-	r, err := entry.Blob().DataAsync()
+	r, err := entry.Blob(gitRepo).DataAsync()
 	if err != nil {
 		return nil, fmt.Errorf("data async: %w", err)
 	}
@@ -51,7 +51,7 @@ var globalVars = sync.OnceValue(func() *globalVarsType {
 	v := &globalVarsType{}
 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and lead to false positives.
+	// While fast, this is also incorrect and leads to false positives.
 	// TODO: fix invalid linking issue (update: stale TODO, what issues? maybe no TODO anymore)

 	// valid chars in encoded path and parameter: [-+~_%.a-zA-Z0-9/]
@@ -54,7 +54,7 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 	// Allow 'color' and 'background-color' properties for the style attribute on text elements.
 	policy.AllowStyles("color", "background-color").OnElements("div", "span", "p", "tr", "th", "td")

-	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
+	policy.AllowAttrs("src", "autoplay", "controls", "muted", "loop", "playsinline").OnElements("video")

 	// Native support of "<picture><source media=... srcset=...><img src=...></picture>"
 	// ATTENTION: it only works with "auto" theme, because "media" query doesn't work with the theme chosen by end user manually.
@@ -24,7 +24,7 @@ var (

 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and lead to false positives.
+	// While fast, this is also incorrect and leads to false positives.
 	// TODO: fix invalid linking issue

 	// mentionPattern matches all mentions in the form of "@user" or "@org/team"
@@ -22,6 +22,7 @@ const (
 const (
 	RepoPRTitleSourceFirstCommit = "first-commit"
 	RepoPRTitleSourceAuto        = "auto"
+	RepoPRTitleSourceBranchName  = "branch-name"
 )

 // ItemsPerPage maximum items per page in forks, watchers and stars of a repo
@@ -25,12 +25,9 @@ const (

 // Service settings
 var Service = struct {
-	DefaultUserVisibility                   string
-	DefaultUserVisibilityMode               structs.VisibleType
-	AllowedUserVisibilityModes              []string
-	AllowedUserVisibilityModesSlice         AllowedVisibility `ini:"-"`
-	DefaultOrgVisibility                    string
-	DefaultOrgVisibilityMode                structs.VisibleType
+	DefaultUserVisibilityMode               structs.VisibleType `ini:"-"`
+	AllowedUserVisibilityModesSlice         AllowedVisibility   `ini:"-"`
+	DefaultOrgVisibilityMode                structs.VisibleType `ini:"-"`
 	ActiveCodeLives                         int
 	ResetPwdCodeLives                       int
 	RegisterEmailConfirm                    bool
@@ -217,36 +214,35 @@ func loadServiceFrom(rootCfg ConfigProvider) {
 	Service.EnableUserHeatmap = sec.Key("ENABLE_USER_HEATMAP").MustBool(true)
 	Service.AutoWatchNewRepos = sec.Key("AUTO_WATCH_NEW_REPOS").MustBool(true)
 	Service.AutoWatchOnChanges = sec.Key("AUTO_WATCH_ON_CHANGES").MustBool(false)
-	modes := sec.Key("ALLOWED_USER_VISIBILITY_MODES").Strings(",")
-	if len(modes) != 0 {
-		Service.AllowedUserVisibilityModes = []string{}
-		Service.AllowedUserVisibilityModesSlice = []bool{false, false, false}
-		for _, sMode := range modes {
-			if tp, ok := structs.VisibilityModes[sMode]; ok { // remove unsupported modes
-				Service.AllowedUserVisibilityModes = append(Service.AllowedUserVisibilityModes, sMode)
-				Service.AllowedUserVisibilityModesSlice[tp] = true
-			} else {
-				log.Warn("ALLOWED_USER_VISIBILITY_MODES %s is unsupported", sMode)
-			}
+
+	Service.AllowedUserVisibilityModesSlice = AllowedVisibility{false, false, false}
+	var allowedUserVisibilityModes []structs.VisibilityString
+	for _, allowedMode := range sec.Key("ALLOWED_USER_VISIBILITY_MODES").Strings(",") {
+		if tp, ok := structs.VisibilityModes[structs.VisibilityString(allowedMode)]; ok { // remove unsupported modes
+			allowedUserVisibilityModes = append(allowedUserVisibilityModes, structs.VisibilityString(allowedMode))
+			Service.AllowedUserVisibilityModesSlice[tp] = true
+		} else {
+			log.Warn("ALLOWED_USER_VISIBILITY_MODES %s is unsupported", allowedMode)
 		}
 	}
-
-	if len(Service.AllowedUserVisibilityModes) == 0 {
-		Service.AllowedUserVisibilityModes = []string{"public", "limited", "private"}
-		Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
+	if len(allowedUserVisibilityModes) == 0 {
+		allowedUserVisibilityModes = []structs.VisibilityString{structs.VisibilityStringPublic, structs.VisibilityStringLimited, structs.VisibilityStringPrivate}
+		Service.AllowedUserVisibilityModesSlice = AllowedVisibility{true, true, true}
 	}

-	Service.DefaultUserVisibility = sec.Key("DEFAULT_USER_VISIBILITY").String()
-	if Service.DefaultUserVisibility == "" {
-		Service.DefaultUserVisibility = Service.AllowedUserVisibilityModes[0]
-	} else if !Service.AllowedUserVisibilityModesSlice[structs.VisibilityModes[Service.DefaultUserVisibility]] {
-		log.Warn("DEFAULT_USER_VISIBILITY %s is wrong or not in ALLOWED_USER_VISIBILITY_MODES, using first allowed", Service.DefaultUserVisibility)
-		Service.DefaultUserVisibility = Service.AllowedUserVisibilityModes[0]
+	defaultUserVisibility := structs.VisibilityString(sec.Key("DEFAULT_USER_VISIBILITY").String())
+	if defaultUserVisibility == "" {
+		defaultUserVisibility = allowedUserVisibilityModes[0]
+	} else if vt, ok := structs.VisibilityModes[defaultUserVisibility]; !ok || !Service.AllowedUserVisibilityModesSlice[vt] {
+		log.Warn("DEFAULT_USER_VISIBILITY %s is wrong or not in ALLOWED_USER_VISIBILITY_MODES, using first allowed", defaultUserVisibility)
+		defaultUserVisibility = allowedUserVisibilityModes[0]
 	}
-	Service.DefaultUserVisibilityMode = structs.VisibilityModes[Service.DefaultUserVisibility]
-	Service.DefaultOrgVisibility = sec.Key("DEFAULT_ORG_VISIBILITY").In("public", structs.ExtractKeysFromMapString(structs.VisibilityModes))
-	Service.DefaultOrgVisibilityMode = structs.VisibilityModes[Service.DefaultOrgVisibility]
+	Service.DefaultUserVisibilityMode = structs.VisibilityModes[defaultUserVisibility]
+
+	defaultOrgVisibility := structs.VisibilityString(sec.Key("DEFAULT_ORG_VISIBILITY").In("public", structs.VisibilityModeKeys()))
+	Service.DefaultOrgVisibilityMode = structs.VisibilityModes[defaultOrgVisibility]
 	Service.DefaultOrgMemberVisible = sec.Key("DEFAULT_ORG_MEMBER_VISIBLE").MustBool()
+
 	Service.UserDeleteWithCommentsMaxTime = sec.Key("USER_DELETE_WITH_COMMENTS_MAX_TIME").MustDuration(0)
 	sec.Key("VALID_SITE_URL_SCHEMES").MustString("http,https")
 	Service.ValidSiteURLSchemes = sec.Key("VALID_SITE_URL_SCHEMES").Strings(",")
@@ -48,80 +48,83 @@ EMAIL_DOMAIN_BLOCKLIST = d3, *.b
 func TestLoadServiceVisibilityModes(t *testing.T) {
 	defer test.MockVariableValue(&Service)()

-	kases := map[string]func(){
+	visibleTypeSlice := func(s ...structs.VisibilityString) (ret []structs.VisibleType) {
+		for _, v := range s {
+			ret = append(ret, structs.VisibilityModes[v])
+		}
+		return ret
+	}
+	testCases := map[string]func(){
 		`
 [service]
 DEFAULT_USER_VISIBILITY = public
 ALLOWED_USER_VISIBILITY_MODES = public,limited,private
 `: func() {
-			assert.Equal(t, "public", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypePublic, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"public", "limited", "private"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("public", "limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 		`
 		[service]
 		DEFAULT_USER_VISIBILITY = public
 		`: func() {
-			assert.Equal(t, "public", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypePublic, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"public", "limited", "private"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("public", "limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 		`
 		[service]
 		DEFAULT_USER_VISIBILITY = limited
 		`: func() {
-			assert.Equal(t, "limited", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypeLimited, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"public", "limited", "private"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("public", "limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 		`
 [service]
 ALLOWED_USER_VISIBILITY_MODES = public,limited,private
 `: func() {
-			assert.Equal(t, "public", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypePublic, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"public", "limited", "private"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("public", "limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 		`
 [service]
 DEFAULT_USER_VISIBILITY = public
 ALLOWED_USER_VISIBILITY_MODES = limited,private
 `: func() {
-			assert.Equal(t, "limited", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypeLimited, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"limited", "private"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 		`
 [service]
 DEFAULT_USER_VISIBILITY = my_type
 ALLOWED_USER_VISIBILITY_MODES = limited,private
 `: func() {
-			assert.Equal(t, "limited", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypeLimited, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"limited", "private"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
+		},
+		`
+[service]
+DEFAULT_USER_VISIBILITY = my_type
+`: func() {
+			assert.Equal(t, structs.VisibleTypePublic, Service.DefaultUserVisibilityMode)
+			assert.Equal(t, visibleTypeSlice("public", "limited", "private"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 		`
 [service]
 DEFAULT_USER_VISIBILITY = public
 ALLOWED_USER_VISIBILITY_MODES = public, limit, privated
 `: func() {
-			assert.Equal(t, "public", Service.DefaultUserVisibility)
 			assert.Equal(t, structs.VisibleTypePublic, Service.DefaultUserVisibilityMode)
-			assert.Equal(t, []string{"public"}, Service.AllowedUserVisibilityModes)
+			assert.Equal(t, visibleTypeSlice("public"), Service.AllowedUserVisibilityModesSlice.ToVisibleTypeSlice())
 		},
 	}

-	for kase, fun := range kases {
-		t.Run(kase, func(t *testing.T) {
-			cfg, err := NewConfigProviderFromData(kase)
+	for tc, fn := range testCases {
+		t.Run(tc, func(t *testing.T) {
+			Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
+			Service.DefaultUserVisibilityMode = structs.VisibleTypePublic
+			cfg, err := NewConfigProviderFromData(tc)
 			assert.NoError(t, err)
 			loadServiceFrom(cfg)
-			fun()
-			// reset
-			Service.AllowedUserVisibilityModesSlice = []bool{true, true, true}
-			Service.AllowedUserVisibilityModes = []string{}
-			Service.DefaultUserVisibility = ""
-			Service.DefaultUserVisibilityMode = structs.VisibleTypePublic
+			fn()
 		})
 	}
 }
@@ -19,7 +19,6 @@ type CreateUserOption struct {
 	// The full display name of the user
 	FullName string `json:"full_name" binding:"MaxSize(100)"`
 	// required: true
-	// swagger:strfmt email
 	Email string `json:"email" binding:"Required;Email;MaxSize(254)"`
 	// The plain text password for the user
 	Password string `json:"password" binding:"MaxSize(255)"`
@@ -30,7 +29,7 @@ type CreateUserOption struct {
 	// Whether the user has restricted access privileges
 	Restricted *bool `json:"restricted"`
 	// User visibility level: public, limited, or private
-	Visibility UserVisibility `json:"visibility" binding:"In(,public,limited,private)"`
+	Visibility VisibilityString `json:"visibility" binding:"In(,public,limited,private)"`

 	// For explicitly setting the user creation timestamp. Useful when users are
 	// migrated from other systems. When omitted, the user's creation timestamp
@@ -79,5 +78,5 @@ type EditUserOption struct {
 	// Whether the user has restricted access privileges
 	Restricted *bool `json:"restricted"`
 	// User visibility level: public, limited, or private
-	Visibility UserVisibility `json:"visibility" binding:"In(,public,limited,private)"`
+	Visibility VisibilityString `json:"visibility" binding:"In(,public,limited,private)"`
 }
@@ -133,7 +133,6 @@ type IssueAssigneesOption struct {
 // EditDeadlineOption options for creating a deadline
 type EditDeadlineOption struct {
 	// required:true
-	// swagger:strfmt date-time
 	Deadline *time.Time `json:"due_date"`
 }

@@ -68,7 +68,7 @@ const (
 type NotifySubjectType string

 const (
-	// NotifySubjectIssue a issue is subject of an notification
+	// NotifySubjectIssue an issue is subject of a notification
 	NotifySubjectIssue NotifySubjectType = "Issue"
 	// NotifySubjectPull a pull is subject of an notification
 	NotifySubjectPull NotifySubjectType = "Pull"
@@ -22,7 +22,7 @@ type Organization struct {
 	// The location of the organization
 	Location string `json:"location"`
 	// The visibility level of the organization (public, limited, private)
-	Visibility UserVisibility `json:"visibility"`
+	Visibility VisibilityString `json:"visibility"`
 	// Whether repository administrators can change team access
 	RepoAdminChangeTeamAccess bool `json:"repo_admin_change_team_access"`
 	// username of the organization
@@ -60,7 +60,7 @@ type CreateOrgOption struct {
 	// The location of the organization
 	Location string `json:"location" binding:"MaxSize(50)"`
 	// possible values are `public` (default), `limited` or `private`
-	Visibility UserVisibility `json:"visibility" binding:"In(,public,limited,private)"`
+	Visibility VisibilityString `json:"visibility" binding:"In(,public,limited,private)"`
 	// Whether repository administrators can change team access
 	RepoAdminChangeTeamAccess bool `json:"repo_admin_change_team_access"`
 }
@@ -78,7 +78,7 @@ type EditOrgOption struct {
 	// The location of the organization
 	Location *string `json:"location" binding:"MaxSize(50)"`
 	// possible values are `public`, `limited` or `private`
-	Visibility *UserVisibility `json:"visibility" binding:"In(,public,limited,private)"`
+	Visibility *VisibilityString `json:"visibility" binding:"In(,public,limited,private)"`
 	// Whether repository administrators can change team access
 	RepoAdminChangeTeamAccess *bool `json:"repo_admin_change_team_access"`
 }
@@ -54,10 +54,10 @@ type CreateTeamOption struct {
 	// Whether the team has access to all repositories in the organization
 	IncludesAllRepositories bool                `json:"includes_all_repositories"`
 	Permission              RepoWritePermission `json:"permission"`
-	// example: ["repo.actions","repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.ext_wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"]
+	// example: ["repo.actions","repo.packages","repo.code","repo.issues","repo.ext_issues","repo.wiki","repo.pulls","repo.releases","repo.projects","repo.ext_wiki"]
 	// Deprecated: This variable should be replaced by UnitsMap and will be dropped in later versions.
 	Units []string `json:"units"`
-	// example: {"repo.actions","repo.packages","repo.code":"read","repo.issues":"write","repo.ext_issues":"none","repo.wiki":"admin","repo.pulls":"owner","repo.releases":"none","repo.projects":"none","repo.ext_wiki":"none"}
+	// example: {"repo.actions":"read","repo.packages":"read","repo.code":"read","repo.issues":"write","repo.ext_issues":"none","repo.wiki":"admin","repo.pulls":"owner","repo.releases":"none","repo.projects":"none","repo.ext_wiki":"none"}
 	UnitsMap map[string]string `json:"units_map"`
 	// Whether the team can create repositories in the organization
 	CanCreateOrgRepo bool `json:"can_create_org_repo"`
@@ -51,7 +51,7 @@ type User struct {
 	// the user's description
 	Description string `json:"description"`
 	// User visibility level option: public, limited, private
-	Visibility UserVisibility `json:"visibility"`
+	Visibility VisibilityString `json:"visibility"`

 	// user counts
 	Followers    int `json:"followers_count"`
@@ -18,10 +18,10 @@ const (
 )

 // VisibilityModes is a map of Visibility types
-var VisibilityModes = map[string]VisibleType{
-	"public":  VisibleTypePublic,
-	"limited": VisibleTypeLimited,
-	"private": VisibleTypePrivate,
+var VisibilityModes = map[VisibilityString]VisibleType{
+	VisibilityStringPublic:  VisibleTypePublic,
+	VisibilityStringLimited: VisibleTypeLimited,
+	VisibilityStringPrivate: VisibleTypePrivate,
 }

 // IsPublic returns true if VisibleType is public
@@ -43,27 +43,27 @@ func (vt VisibleType) IsPrivate() bool {
 func (vt VisibleType) String() string {
 	for k, v := range VisibilityModes {
 		if vt == v {
-			return k
+			return string(k)
 		}
 	}
 	return ""
 }

-// ExtractKeysFromMapString provides a slice of keys from map
-func ExtractKeysFromMapString(in map[string]VisibleType) (keys []string) {
-	for k := range in {
-		keys = append(keys, k)
+// VisibilityModeKeys returns the visibility mode names (public, limited, private)
+func VisibilityModeKeys() (keys []string) {
+	for k := range VisibilityModes {
+		keys = append(keys, string(k))
 	}
 	return keys
 }

-// UserVisibility defines the visibility level of a user or organization as
-// rendered in API payloads. The DB representation is VisibleType (int).
-// swagger:enum UserVisibility
-type UserVisibility string
+// VisibilityString defines the visibility level of a user/organization/team as
+// rendered in API and config payloads. The DB representation is VisibleType (int).
+// swagger:enum VisibilityString
+type VisibilityString string

 const (
-	UserVisibilityPublic  UserVisibility = "public"
-	UserVisibilityLimited UserVisibility = "limited"
-	UserVisibilityPrivate UserVisibility = "private"
+	VisibilityStringPublic  VisibilityString = "public"
+	VisibilityStringLimited VisibilityString = "limited"
+	VisibilityStringPrivate VisibilityString = "private"
 )
@@ -1950,7 +1950,6 @@
  "repo.settings.webhook_deletion": "Odstranit webový háček",
  "repo.settings.webhook_deletion_desc": "Odstranění webového háčku smaže jeho nastavení a historii doručení. Pokračovat?",
  "repo.settings.webhook_deletion_success": "Webový háček byl smazán.",
-  "repo.settings.webhook.test_delivery_desc_disabled": "Chcete-li tento webový háček otestovat s falešnou událostí, aktivujte ho.",
  "repo.settings.webhook.request": "Požadavek",
  "repo.settings.webhook.response": "Odpověď",
  "repo.settings.webhook.headers": "Hlavičky",
@@ -2827,7 +2826,6 @@
  "admin.config.default_enable_timetracking": "Povolit sledování času ve výchozím nastavení",
  "admin.config.default_allow_only_contributors_to_track_time": "Povolit sledování času pouze přispěvatelům",
  "admin.config.no_reply_address": "Skrytá e-mailová doména",
-  "admin.config.default_visibility_organization": "Výchozí viditelnost pro nové organizace",
  "admin.config.default_enable_dependencies": "Povolit závislosti úkolů ve výchozím stavu",
  "admin.config.webhook_config": "Nastavení webových háčků",
  "admin.config.queue_length": "Délka fronty",
@@ -74,7 +74,7 @@
  "forks": "Forks",
  "activities": "Aktivitäten",
  "pull_requests": "Pull-Requests",
-  "issues": "Probleme",
+  "issues": "Issues",
  "milestones": "Meilensteine",
  "ok": "OK",
  "cancel": "Abbrechen",
@@ -1101,7 +1101,7 @@
  "repo.migrate_items_wiki": "Wiki",
  "repo.migrate_items_milestones": "Meilensteine",
  "repo.migrate_items_labels": "Labels",
-  "repo.migrate_items_issues": "Probleme",
+  "repo.migrate_items_issues": "Issues",
  "repo.migrate_items_pullrequests": "Pull-Requests",
  "repo.migrate_items_merge_requests": "Merge-Requests",
  "repo.migrate_items_releases": "Veröffentlichungen",
@@ -1178,7 +1178,7 @@
  "repo.find_tag": "Tag finden",
  "repo.branches": "Branches",
  "repo.tags": "Tags",
-  "repo.issues": "Probleme",
+  "repo.issues": "Issues",
  "repo.pulls": "Pull-Requests",
  "repo.projects": "Projekte",
  "repo.packages": "Pakete",
@@ -1673,7 +1673,7 @@
  "repo.issues.due_date_not_writer": "Du musst Schreibrechte für dieses Repository haben, um das Fälligkeitsdatum zu ändern.",
  "repo.issues.due_date_not_set": "Kein Fälligkeitsdatum gesetzt.",
  "repo.issues.due_date_added": "hat %[2]s das Fälligkeitsdatum %[1]s hinzugefügt",
-  "repo.issues.due_date_modified": "ändert das Abgabedatum von %[2]s auf %[1]s %[3]s s",
+  "repo.issues.due_date_modified": "ändert das Abgabedatum von %[2]s auf %[1]s %[3]s",
  "repo.issues.due_date_remove": "hat %[2]s das Fälligkeitsdatum %[1]s entfernt",
  "repo.issues.due_date_overdue": "Überfällig",
  "repo.issues.due_date_invalid": "Das Fälligkeitsdatum ist ungültig oder außerhalb des zulässigen Bereichs. Bitte verwende das Format „jjjj-mm-tt“.",
@@ -2251,7 +2251,6 @@
  "repo.settings.webhook_deletion_success": "Webhook wurde entfernt.",
  "repo.settings.webhook.test_delivery": "Test Push Ereignis",
  "repo.settings.webhook.test_delivery_desc": "Teste diesen Webhook mit einem Fake-Push-Event.",
-  "repo.settings.webhook.test_delivery_desc_disabled": "Um diesen Webhook mit einem Fake-Event zu testen, aktiviere ihn.",
  "repo.settings.webhook.request": "Anfrage",
  "repo.settings.webhook.response": "Antwort",
  "repo.settings.webhook.headers": "Kopfzeilen",
@@ -2300,7 +2299,7 @@
  "repo.settings.event_repository": "Repository",
  "repo.settings.event_repository_desc": "Repository erstellt oder gelöscht.",
  "repo.settings.event_header_issue": "Issue Ereignisse",
-  "repo.settings.event_issues": "Probleme",
+  "repo.settings.event_issues": "Issues",
  "repo.settings.event_issues_desc": "Issue geöffnet, geschlossen, wieder geöffnet, bearbeitet oder gelöscht.",
  "repo.settings.event_issue_assign": "Issue zugewiesen",
  "repo.settings.event_issue_assign_desc": "Issue zugewiesen oder Zuweisung entfernt.",
@@ -3104,7 +3103,7 @@
  "admin.repos.owner": "Besitzer",
  "admin.repos.name": "Name",
  "admin.repos.private": "Privat",
-  "admin.repos.issues": "Probleme",
+  "admin.repos.issues": "Issues",
  "admin.repos.size": "Größe",
  "admin.repos.lfs_size": "LFS-Größe",
  "admin.packages.package_manage_panel": "Paketverwaltung",
@@ -3306,7 +3305,6 @@
  "admin.config.default_enable_timetracking": "Zeiterfassung standardmäßig aktivieren",
  "admin.config.default_allow_only_contributors_to_track_time": "Nur Mitarbeitern erlauben, die Zeiterfassung zu nutzen",
  "admin.config.no_reply_address": "Versteckte E-Mail-Domain",
-  "admin.config.default_visibility_organization": "Standard-Sichtbarkeit für neue Organisationen",
  "admin.config.default_enable_dependencies": "Issue-Abhängigkeiten standardmäßig aktivieren",
  "admin.config.webhook_config": "Webhook-Konfiguration",
  "admin.config.queue_length": "Warteschlangenlänge",
@@ -3779,6 +3777,7 @@
  "actions.runs.commit": "Commit",
  "actions.runs.run_details": "Run Details",
  "actions.runs.workflow_file": "Workflow-Datei",
+  "actions.runs.workflow_file_no_permission": "Keine Berechtigung zum Anzeigen der Workflow-Datei",
  "actions.runs.scheduled": "Geplant",
  "actions.runs.pushed_by": "gepusht von",
  "actions.runs.invalid_workflow_helper": "Die Workflow-Konfigurationsdatei ist ungültig. Bitte überprüfe Deine Konfigurationsdatei: %s",
@@ -3835,7 +3834,33 @@
  "actions.workflow.scope_owner": "Besitzer",
  "actions.workflow.scope_global": "Global",
  "actions.workflow.required": "Erforderlich",
+  "actions.workflow.scoped_required_cannot_disable": "Dieser Scoped Workflow ist erforderlich und kann nicht deaktiviert werden.",
+  "actions.scoped_workflows": "Scoped Workflows",
+  "actions.scoped_workflows.desc_org": "Repositories als Scoped Workflow Quellen registrieren. Workflow-Dateien unter den Workflow-Verzeichnissen eines Quell-Repositorys laufen in jedem Projektarchiv dieser Organisation, im eigenen Kontext des Projektarchivs.",
+  "actions.scoped_workflows.desc_user": "Repositories als Scoped Workflow Quellen registrieren. Workflow-Dateien unter den Workflow-Verzeichnissen eines Quell-Repositorys laufen in jedem Projektarchiv dieser Organisation, im eigenen Kontext des Projektarchivs.",
+  "actions.scoped_workflows.desc_global": "Repositories als Scoped Workflow-Quellen registrieren. Workflow-Dateien unter den Workflow-Verzeichnissen eines Quellcode-Repositorys laufen auf jedem Projektarchiv in dieser Instanz im eigenen Kontext des Projektarchivs. Da Quellen auf Instanzenebene auf den Ereignissen jedes Projektarchivs ausgewertet werden, kann die Registrierung bei großen Instanzen Overhead hinzufügen.",
+  "actions.scoped_workflows.add_help": "Um Scoped Workflows aus einem Repository zu erstellen, übertrage die Workflow-Dateien unter <code>%s</code> in seinem Standard Branch, dann registrieren Sie das Projektarchiv als Quelle unten.",
+  "actions.scoped_workflows.security_note": "Der Workflow-Inhalt eines Quell-Repositorys wird in jedem Repository ausgeführt, für das er gilt. Die Skripte der einzelnen Schritte sowie deren Ausgabe werden in den Actions-Logs des jeweiligen Repositorys gespeichert und sind für alle sichtbar, die die Actions des konsumierenden Repositorys einsehen können. Das Registrieren eines privaten Repositorys als Quelle legt daher dessen Workflow-Logik über diese Logs offen. Registriere nur Repositorys, deren Workflow-Inhalte mit allen konsumierenden Repositorys geteilt werden dürfen. Wenn ein scoped Workflow einen wiederverwendbaren Workflow aus einem privaten Repository referenziert, stelle sicher, dass jedes konsumierende Repository darauf Lesezugriff hat – andernfalls schlägt der Workflow dort fehl.",
+  "actions.scoped_workflows.source.add": "Quell-Repository hinzufügen",
+  "actions.scoped_workflows.source.add_success": "Quell-Repository hinzugefügt.",
+  "actions.scoped_workflows.source.remove_success": "Quell-Repository entfernt.",
+  "actions.scoped_workflows.source.not_found": "Repository nicht gefunden.",
+  "actions.scoped_workflows.required.update_success": "Erforderliche Workflows aktualisiert.",
+  "actions.scoped_workflows.required.label": "Workflows als erforderlich markieren (ein erforderlicher Workflow kann nicht durch Repositories deaktiviert werden):",
+  "actions.scoped_workflows.required.patterns": "Erforderliche Statusüberprüfungsmuster",
+  "actions.scoped_workflows.required.patterns_aria": "Erforderliche Statusüberprüfungsmuster für %s",
+  "actions.scoped_workflows.required.patterns_note": "nur erzwungen während der Workflow benötigt wird",
+  "actions.scoped_workflows.required.patterns_hint": "Markieren Sie den Workflow als erforderlich, um seine Statusüberprüfungsmuster zu konfigurieren.",
+  "actions.scoped_workflows.required.patterns_help": "Ein Statusüberprüfungsmuster (glob) pro Zeile. Ein Pull-Request kann erst zusammengeführt werden, wenn ein Status mit jedem Muster übereinstimmt. Dies wird für jeden Zielzweig erzwungen, der eine Schutzregel hat, auch für einen mit einer eigenen Statusüberprüfung; ein Zielzweig ohne Schutzregel ist nicht ausgeschaltet.",
+  "actions.scoped_workflows.required.patterns_empty": "Jeder benötigte Workflow benötigt mindestens ein Statusüberprüfungsmuster.",
+  "actions.scoped_workflows.required.missing_file": "nicht mehr im Quelltext",
+  "actions.scoped_workflows.required.expected_contexts": "Erwartete Statusüberprüfung (eine Prüfung, die zu einem Muster passt)",
+  "actions.scoped_workflows.required.no_status_contexts": "Dieser Workflow postet keine Status Checks, ihn als Anforderung zu markieren würde jede Pull Request blockieren. Deaktiviere die Anforderung.",
+  "actions.scoped_workflows.no_files": "Im Standard-Branch wurden keine Scoped Workflow-Dateien gefunden.",
  "actions.workflow.run": "Workflow ausführen",
+  "actions.workflow.create_status_badge": "Status Badge erstellen",
+  "actions.workflow.status_badge": "Status Badge",
+  "actions.workflow.status_badge_url": "Badge-URL",
  "actions.workflow.not_found": "Workflow '%s' wurde nicht gefunden.",
  "actions.workflow.run_success": "Workflow '%s' erfolgreich ausgeführt.",
  "actions.workflow.from_ref": "Nutze Workflow von",
@@ -1781,7 +1781,6 @@
  "repo.settings.webhook_deletion": "Αφαίρεση Webhook",
  "repo.settings.webhook_deletion_desc": "Η αφαίρεση ενός webhook διαγράφει τις ρυθμίσεις και το ιστορικό παραδόσεων. Συνέχεια;",
  "repo.settings.webhook_deletion_success": "Το webhook έχει αφαιρεθεί.",
-  "repo.settings.webhook.test_delivery_desc_disabled": "Για να δοκιμάσετε αυτό το webhook με μια ψεύτικη κλήση, ενεργοποιήστε το.",
  "repo.settings.webhook.request": "Αίτημα",
  "repo.settings.webhook.response": "Απάντηση",
  "repo.settings.webhook.headers": "Κεφαλίδες",
@@ -2561,7 +2560,6 @@
  "admin.config.default_enable_timetracking": "Ενεργοποίηση Καταγραφής Χρόνου σαν Προεπιλογή",
  "admin.config.default_allow_only_contributors_to_track_time": "Επιτρέπονται Μόνο οι Συμμετέχοντες να Καταγράφουν Χρόνο",
  "admin.config.no_reply_address": "Κρυφό Email Domain",
-  "admin.config.default_visibility_organization": "Προεπιλεγμένη ορατότητα για νέους οργανισμούς",
  "admin.config.default_enable_dependencies": "Ενεργοποίηση Εξαρτήσεων Ζητημάτων από Προεπιλογή",
  "admin.config.webhook_config": "Ρύθμιση Webhook",
  "admin.config.queue_length": "Μέγεθος Ουράς",
--- a/Show More
+++ b/Show More