Fix changelog typo (#26973 )

1.20.4 changelog (#26966 )
Improve LDAP group config documentation (#21227 ) (#26921 )
2023-09-08 16:35:37 +08:00 · 2023-09-08 12:17:00 +08:00 · 2023-09-05 22:41:10 -04:00 · 2023-09-05 19:06:35 +00:00 · 2023-09-03 19:37:42 +00:00 · 2023-09-03 18:45:37 +00:00
6660 changed files with 362071 additions and 483567 deletions
@@ -2,25 +2,12 @@ root = "."
 tmp_dir = ".air"

 [build]
-pre_cmd = ["killall -9 gitea 2>/dev/null || true"] # kill off potential zombie processes from previous runs
 cmd = "make --no-print-directory backend"
-entrypoint = ["./gitea"]
-delay = 2000
+bin = "gitea"
+delay = 1000
 include_ext = ["go", "tmpl"]
 include_file = ["main.go"]
 include_dir = ["cmd", "models", "modules", "options", "routers", "services"]
-exclude_dir = [
-  "models/fixtures",
-  "models/migrations/fixtures",
-  "modules/avatar/identicon/testdata",
-  "modules/avatar/testdata",
-  "modules/git/tests",
-  "modules/migration/file_format_testdata",
-  "routers/private/tests",
-  "services/gitdiff/testdata",
-]
+exclude_dir = ["modules/git/tests", "services/gitdiff/testdata", "modules/avatar/testdata", "models/fixtures", "models/migrations/fixtures", "modules/migration/file_format_testdata", "modules/avatar/identicon/testdata"]
 exclude_regex = ["_test.go$", "_gen.go$"]
 stop_on_error = true
-
-[log]
-main_only = true
@@ -13,44 +13,46 @@ groups:
  -
    name: BREAKING
    labels:
-      - pr/breaking
+      - kind/breaking
  -
    name: SECURITY
    labels:
-      - topic/security
+      - kind/security
  -
    name: FEATURES
    labels:
-      - type/feature
+      - kind/feature
+  -
+    name: API
+    labels:
+      - kind/api
  -
    name: ENHANCEMENTS
    labels:
-      - type/enhancement
-  -
-    name: PERFORMANCE
-    labels:
-      - performance/memory
-      - performance/speed
-      - performance/bigrepo
-      - performance/cpu
+      - kind/enhancement
+      - kind/refactor
+      - kind/ui
  -
    name: BUGFIXES
    labels:
-      - type/bug
-
+      - kind/bug
  -
    name: TESTING
    labels:
-      - type/testing
+      - kind/testing
+  -
+    name: TRANSLATION
+    labels:
+      - kind/translation
  -
    name: BUILD
    labels:
-      - topic/build
-      - topic/code-linting
+      - kind/build
+      - kind/lint
  -
    name: DOCS
    labels:
-      - type/docs
+      - kind/docs
  -
    name: MISC
    default: true
@@ -1,45 +0,0 @@
-{
-  "name": "Gitea DevContainer",
-  "image": "mcr.microsoft.com/devcontainers/go:1.26-trixie",
-  "containerEnv": {
-    // override "local" from packaged version
-    "GOTOOLCHAIN": "auto"
-  },
-  "features": {
-    // installs nodejs into container
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "latest"
-    },
-    "ghcr.io/devcontainers/features/git-lfs:1.2.5": {},
-    "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {},
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.14"
-    },
-    "ghcr.io/warrenbuckley/codespace-features/sqlite:1": {}
-  },
-  "customizations": {
-    "vscode": {
-      "settings": {},
-      "extensions": [
-        "editorconfig.editorconfig",
-        "dbaeumer.vscode-eslint",
-        "golang.go",
-        "stylelint.vscode-stylelint",
-        "DavidAnson.vscode-markdownlint",
-        "Vue.volar",
-        "ms-azuretools.vscode-docker",
-        "vitest.explorer",
-        "cweijan.vscode-database-client2",
-        "GitHub.vscode-pull-request-github",
-        "Azurite.azurite"
-      ]
-    }
-  },
-  "portsAttributes": {
-    "3000": {
-      "label": "Gitea Web",
-      "onAutoForward": "notify"
-    }
-  },
-  "postCreateCommand": "make deps"
-}
@@ -14,7 +14,7 @@ _test

 # MS VSCode
 .vscode
-__debug_bin*
+__debug_bin

 # Architecture specific extensions/prefixes
 *.[568vq]
@@ -36,11 +36,22 @@ _testmain.go
 coverage.all
 cpu.out

+/modules/migration/bindata.go
+/modules/migration/bindata.go.hash
+/modules/options/bindata.go
+/modules/options/bindata.go.hash
+/modules/public/bindata.go
+/modules/public/bindata.go.hash
+/modules/templates/bindata.go
+/modules/templates/bindata.go.hash
+
 *.db
 *.log

 /gitea
+/gitea-vet
 /debug
+/integrations.test

 /bin
 /dist
@@ -51,27 +62,39 @@ cpu.out
 /data
 /indexers
 /log
+/public/img/avatar
 /tests/integration/gitea-integration-*
+/tests/integration/indexers-*
+/tests/e2e/gitea-e2e-*
+/tests/e2e/indexers-*
+/tests/e2e/reports
+/tests/e2e/test-artifacts
+/tests/e2e/test-snapshots
 /tests/*.ini
 /node_modules
 /yarn.lock
 /yarn-error.log
 /npm-debug.log*
-/pnpm-debug.log*
-/public/assets/js
-/public/assets/css
-/public/assets/fonts
-/public/assets/img/avatar
+/public/js
+/public/css
+/public/fonts
+/public/img/webpack
 /vendor
+/web_src/fomantic/node_modules
+/web_src/fomantic/build/*
+!/web_src/fomantic/build/semantic.js
+!/web_src/fomantic/build/semantic.css
+!/web_src/fomantic/build/themes
+/web_src/fomantic/build/themes/*
+!/web_src/fomantic/build/themes/default
+/web_src/fomantic/build/themes/default/assets/*
+!/web_src/fomantic/build/themes/default/assets/fonts
+/web_src/fomantic/build/themes/default/assets/fonts/*
+!/web_src/fomantic/build/themes/default/assets/fonts/icons.woff2
+!/web_src/fomantic/build/themes/default/assets/fonts/outline-icons.woff2
 /VERSION
 /.air
 /.go-licenses
-/Dockerfile
-/Dockerfile.rootless
-/.venv
-
-# Files and folders that were previously generated
-/public/assets/img/webpack

 # Snapcraft
 snap/.snapcraft/
@@ -0,0 +1,426 @@
+---
+kind: pipeline
+name: release-version
+
+platform:
+  os: linux
+  arch: amd64
+
+workspace:
+  base: /source
+  path: /
+
+trigger:
+  event:
+    - tag
+
+volumes:
+  - name: deps
+    temp: {}
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git fetch --tags --force
+
+  - name: deps-frontend
+    image: node:20
+    pull: always
+    commands:
+      - make deps-frontend
+
+  - name: deps-backend
+    image: gitea/test_env:linux-1.20-amd64
+    pull: always
+    commands:
+      - make deps-backend
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: static
+    image: techknowlogick/xgo:go-1.20.x
+    pull: always
+    commands:
+      # Upgrade to node 20 once https://github.com/techknowlogick/xgo/issues/163 is resolved
+      - curl -sL https://deb.nodesource.com/setup_16.x | bash - && apt-get -qqy install nodejs
+      - export PATH=$PATH:$GOPATH/bin
+      - make release
+    environment:
+      GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
+      TAGS: bindata sqlite sqlite_unlock_notify
+      DEBIAN_FRONTEND: noninteractive
+    depends_on: [fetch-tags]
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: gpg-sign
+    image: plugins/gpgsign:1
+    pull: always
+    settings:
+      detach_sign: true
+      excludes:
+        - "dist/release/*.sha256"
+      files:
+        - "dist/release/*"
+    environment:
+      GPGSIGN_KEY:
+        from_secret: gpgsign_key
+      GPGSIGN_PASSPHRASE:
+        from_secret: gpgsign_passphrase
+    depends_on: [static]
+
+  - name: release-tag
+    image: woodpeckerci/plugin-s3:latest
+    pull: always
+    settings:
+      acl:
+        from_secret: aws_s3_acl
+      region:
+        from_secret: aws_s3_region
+      bucket:
+        from_secret: aws_s3_bucket
+      endpoint:
+        from_secret: aws_s3_endpoint
+      path_style:
+        from_secret: aws_s3_path_style
+      source: "dist/release/*"
+      strip_prefix: dist/release/
+      target: "/gitea/${DRONE_TAG##v}"
+    environment:
+      AWS_ACCESS_KEY_ID:
+        from_secret: aws_access_key_id
+      AWS_SECRET_ACCESS_KEY:
+        from_secret: aws_secret_access_key
+    depends_on: [gpg-sign]
+
+  - name: github
+    image: plugins/github-release:latest
+    pull: always
+    settings:
+      files:
+        - "dist/release/*"
+      file_exists: overwrite
+    environment:
+      GITHUB_TOKEN:
+        from_secret: github_token
+    depends_on: [gpg-sign]
+
+---
+kind: pipeline
+type: docker
+name: docker-linux-amd64-release-version
+
+platform:
+  os: linux
+  arch: amd64
+
+trigger:
+  ref:
+    include:
+      - "refs/tags/**"
+    exclude:
+      - "refs/tags/**-rc*"
+  paths:
+    exclude:
+      - "docs/**"
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git fetch --tags --force
+
+  - name: publish
+    image: plugins/docker:latest
+    pull: always
+    settings:
+      auto_tag: true
+      auto_tag_suffix: linux-amd64
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+  - name: publish-rootless
+    image: plugins/docker:latest
+    settings:
+      dockerfile: Dockerfile.rootless
+      auto_tag: true
+      auto_tag_suffix: linux-amd64-rootless
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+---
+
+kind: pipeline
+type: docker
+name: docker-linux-amd64-release-candidate-version
+
+platform:
+  os: linux
+  arch: amd64
+
+trigger:
+  ref:
+    - "refs/tags/**-rc*"
+  paths:
+    exclude:
+      - "docs/**"
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git fetch --tags --force
+
+  - name: publish
+    image: plugins/docker:latest
+    pull: always
+    settings:
+      tags: ${DRONE_TAG##v}-linux-amd64
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+  - name: publish-rootless
+    image: plugins/docker:latest
+    settings:
+      dockerfile: Dockerfile.rootless
+      tags: ${DRONE_TAG##v}-linux-amd64-rootless
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+---
+kind: pipeline
+type: docker
+name: docker-linux-arm64-release-version
+
+platform:
+  os: linux
+  arch: arm64
+
+trigger:
+  ref:
+    include:
+      - "refs/tags/**"
+    exclude:
+      - "refs/tags/**-rc*"
+  paths:
+    exclude:
+      - "docs/**"
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git fetch --tags --force
+
+  - name: publish
+    image: plugins/docker:latest
+    pull: always
+    settings:
+      auto_tag: true
+      auto_tag_suffix: linux-arm64
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+  - name: publish-rootless
+    image: plugins/docker:latest
+    settings:
+      dockerfile: Dockerfile.rootless
+      auto_tag: true
+      auto_tag_suffix: linux-arm64-rootless
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+---
+kind: pipeline
+type: docker
+name: docker-linux-arm64-release-candidate-version
+
+platform:
+  os: linux
+  arch: arm64
+
+trigger:
+  ref:
+    - "refs/tags/**-rc*"
+  paths:
+    exclude:
+      - "docs/**"
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git fetch --tags --force
+
+  - name: publish
+    image: plugins/docker:latest
+    pull: always
+    settings:
+      tags: ${DRONE_TAG##v}-linux-arm64
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+  - name: publish-rootless
+    image: plugins/docker:latest
+    settings:
+      dockerfile: Dockerfile.rootless
+      tags: ${DRONE_TAG##v}-linux-arm64-rootless
+      repo: gitea/gitea
+      build_args:
+        - GOPROXY=https://goproxy.io
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
+    when:
+      event:
+        exclude:
+        - pull_request
+
+---
+kind: pipeline
+type: docker
+name: docker-manifest-version
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: manifest-rootless
+    image: plugins/manifest
+    pull: always
+    settings:
+      auto_tag: true
+      ignore_missing: true
+      spec: docker/manifest.rootless.tmpl
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+
+  - name: manifest
+    image: plugins/manifest
+    settings:
+      auto_tag: true
+      ignore_missing: true
+      spec: docker/manifest.tmpl
+      password:
+        from_secret: docker_password
+      username:
+        from_secret: docker_username
+
+trigger:
+  ref:
+  - "refs/tags/**"
+  paths:
+    exclude:
+      - "docs/**"
+
+depends_on:
+  - docker-linux-amd64-release-version
+  - docker-linux-amd64-release-candidate-version
+  - docker-linux-arm64-release-version
+  - docker-linux-arm64-release-candidate-version
@@ -12,23 +12,15 @@ insert_final_newline = true
 [*.{go,tmpl,html}]
 indent_style = tab

-[go.*]
-indent_style = tab
-
 [templates/custom/*.tmpl]
 insert_final_newline = false

-[templates/swagger/*_json.tmpl]
+[templates/swagger/v1_json.tmpl]
 indent_style = space
-insert_final_newline = false

 [templates/user/auth/oidc_wellknown.tmpl]
 indent_style = space

-[templates/shared/actions/runner_badge_*.tmpl]
-# editconfig lint requires these XML-like files to have charset defined, but the files don't have.
-charset = unset
-
 [Makefile]
 indent_style = tab

@@ -1 +0,0 @@
-use flake
@@ -0,0 +1,752 @@
+root: true
+reportUnusedDisableDirectives: true
+
+ignorePatterns:
+  - /web_src/js/vendor
+
+parserOptions:
+  sourceType: module
+  ecmaVersion: latest
+
+plugins:
+  - "@eslint-community/eslint-plugin-eslint-comments"
+  - eslint-plugin-array-func
+  - eslint-plugin-custom-elements
+  - eslint-plugin-import
+  - eslint-plugin-jquery
+  - eslint-plugin-no-jquery
+  - eslint-plugin-no-use-extend-native
+  - eslint-plugin-regexp
+  - eslint-plugin-sonarjs
+  - eslint-plugin-unicorn
+  - eslint-plugin-wc
+
+env:
+  es2022: true
+  node: true
+
+globals:
+  __webpack_public_path__: true
+
+overrides:
+  - files: ["web_src/**/*", "docs/**/*"]
+    env:
+      browser: true
+      node: false
+  - files: ["web_src/**/*worker.*"]
+    env:
+      worker: true
+    rules:
+      no-restricted-globals: [2, addEventListener, blur, close, closed, confirm, defaultStatus, defaultstatus, error, event, external, find, focus, frameElement, frames, history, innerHeight, innerWidth, isFinite, isNaN, length, locationbar, menubar, moveBy, moveTo, name, onblur, onerror, onfocus, onload, onresize, onunload, open, opener, opera, outerHeight, outerWidth, pageXOffset, pageYOffset, parent, print, removeEventListener, resizeBy, resizeTo, screen, screenLeft, screenTop, screenX, screenY, scroll, scrollbars, scrollBy, scrollTo, scrollX, scrollY, status, statusbar, stop, toolbar, top]
+  - files: ["build/generate-images.js"]
+    rules:
+      import/no-unresolved: [0]
+      import/no-extraneous-dependencies: [0]
+  - files: ["*.config.*"]
+    rules:
+      import/no-unused-modules: [0]
+
+rules:
+  "@eslint-community/eslint-comments/disable-enable-pair": [2]
+  "@eslint-community/eslint-comments/no-aggregating-enable": [2]
+  "@eslint-community/eslint-comments/no-duplicate-disable": [2]
+  "@eslint-community/eslint-comments/no-restricted-disable": [0]
+  "@eslint-community/eslint-comments/no-unlimited-disable": [2]
+  "@eslint-community/eslint-comments/no-unused-disable": [2]
+  "@eslint-community/eslint-comments/no-unused-enable": [2]
+  "@eslint-community/eslint-comments/no-use": [0]
+  "@eslint-community/eslint-comments/require-description": [0]
+  accessor-pairs: [2]
+  array-bracket-newline: [0]
+  array-bracket-spacing: [2, never]
+  array-callback-return: [2, {checkForEach: true}]
+  array-element-newline: [0]
+  array-func/avoid-reverse: [2]
+  array-func/from-map: [2]
+  array-func/no-unnecessary-this-arg: [2]
+  array-func/prefer-array-from: [2]
+  array-func/prefer-flat-map: [0] # handled by unicorn/prefer-array-flat-map
+  array-func/prefer-flat: [0] # handled by unicorn/prefer-array-flat
+  arrow-body-style: [0]
+  arrow-parens: [2, always]
+  arrow-spacing: [2, {before: true, after: true}]
+  block-scoped-var: [2]
+  brace-style: [2, 1tbs, {allowSingleLine: true}]
+  camelcase: [0]
+  capitalized-comments: [0]
+  class-methods-use-this: [0]
+  comma-dangle: [2, only-multiline]
+  comma-spacing: [2, {before: false, after: true}]
+  comma-style: [2, last]
+  complexity: [0]
+  computed-property-spacing: [2, never]
+  consistent-return: [0]
+  consistent-this: [0]
+  constructor-super: [2]
+  curly: [0]
+  custom-elements/expose-class-on-global: [0]
+  custom-elements/extends-correct-class: [2]
+  custom-elements/file-name-matches-element: [2]
+  custom-elements/no-constructor: [2]
+  custom-elements/no-customized-built-in-elements: [2]
+  custom-elements/no-dom-traversal-in-attributechangedcallback: [2]
+  custom-elements/no-dom-traversal-in-connectedcallback: [2]
+  custom-elements/no-exports-with-element: [2]
+  custom-elements/no-method-prefixed-with-on: [2]
+  custom-elements/no-unchecked-define: [0]
+  custom-elements/one-element-per-file: [0]
+  custom-elements/tag-name-matches-class: [2]
+  custom-elements/valid-tag-name: [2]
+  default-case-last: [2]
+  default-case: [0]
+  default-param-last: [0]
+  dot-location: [2, property]
+  dot-notation: [0]
+  eol-last: [2]
+  eqeqeq: [2]
+  for-direction: [2]
+  func-call-spacing: [2, never]
+  func-name-matching: [2]
+  func-names: [0]
+  func-style: [0]
+  function-call-argument-newline: [0]
+  function-paren-newline: [0]
+  generator-star-spacing: [0]
+  getter-return: [2]
+  grouped-accessor-pairs: [2]
+  guard-for-in: [0]
+  id-blacklist: [0]
+  id-length: [0]
+  id-match: [0]
+  implicit-arrow-linebreak: [0]
+  import/consistent-type-specifier-style: [0]
+  import/default: [0]
+  import/dynamic-import-chunkname: [0]
+  import/export: [2]
+  import/exports-last: [0]
+  import/extensions: [2, always, {ignorePackages: true}]
+  import/first: [2]
+  import/group-exports: [0]
+  import/max-dependencies: [0]
+  import/named: [2]
+  import/namespace: [0]
+  import/newline-after-import: [0]
+  import/no-absolute-path: [0]
+  import/no-amd: [2]
+  import/no-anonymous-default-export: [0]
+  import/no-commonjs: [2]
+  import/no-cycle: [2, {ignoreExternal: true, maxDepth: 1}]
+  import/no-default-export: [0]
+  import/no-deprecated: [0]
+  import/no-dynamic-require: [0]
+  import/no-empty-named-blocks: [2]
+  import/no-extraneous-dependencies: [2]
+  import/no-import-module-exports: [0]
+  import/no-internal-modules: [0]
+  import/no-mutable-exports: [0]
+  import/no-named-as-default-member: [0]
+  import/no-named-as-default: [2]
+  import/no-named-default: [0]
+  import/no-named-export: [0]
+  import/no-namespace: [0]
+  import/no-nodejs-modules: [0]
+  import/no-relative-packages: [0]
+  import/no-relative-parent-imports: [0]
+  import/no-restricted-paths: [0]
+  import/no-self-import: [2]
+  import/no-unassigned-import: [0]
+  import/no-unresolved: [2, {commonjs: true, ignore: ["\\?.+$"]}]
+  import/no-unused-modules: [2, {unusedExports: true}]
+  import/no-useless-path-segments: [2, {commonjs: true}]
+  import/no-webpack-loader-syntax: [2]
+  import/order: [0]
+  import/prefer-default-export: [0]
+  import/unambiguous: [0]
+  indent: [2, 2, {SwitchCase: 1}]
+  init-declarations: [0]
+  jquery/no-ajax-events: [2]
+  jquery/no-ajax: [0]
+  jquery/no-animate: [2]
+  jquery/no-attr: [0]
+  jquery/no-bind: [2]
+  jquery/no-class: [0]
+  jquery/no-clone: [2]
+  jquery/no-closest: [0]
+  jquery/no-css: [0]
+  jquery/no-data: [0]
+  jquery/no-deferred: [2]
+  jquery/no-delegate: [2]
+  jquery/no-each: [0]
+  jquery/no-extend: [2]
+  jquery/no-fade: [0]
+  jquery/no-filter: [0]
+  jquery/no-find: [0]
+  jquery/no-global-eval: [2]
+  jquery/no-grep: [2]
+  jquery/no-has: [2]
+  jquery/no-hide: [2]
+  jquery/no-html: [0]
+  jquery/no-in-array: [2]
+  jquery/no-is-array: [2]
+  jquery/no-is-function: [2]
+  jquery/no-is: [0]
+  jquery/no-load: [2]
+  jquery/no-map: [0]
+  jquery/no-merge: [2]
+  jquery/no-param: [2]
+  jquery/no-parent: [0]
+  jquery/no-parents: [0]
+  jquery/no-parse-html: [2]
+  jquery/no-prop: [0]
+  jquery/no-proxy: [2]
+  jquery/no-ready: [2]
+  jquery/no-serialize: [2]
+  jquery/no-show: [2]
+  jquery/no-size: [2]
+  jquery/no-sizzle: [0]
+  jquery/no-slide: [0]
+  jquery/no-submit: [0]
+  jquery/no-text: [0]
+  jquery/no-toggle: [2]
+  jquery/no-trigger: [0]
+  jquery/no-trim: [2]
+  jquery/no-val: [0]
+  jquery/no-when: [2]
+  jquery/no-wrap: [2]
+  key-spacing: [2]
+  keyword-spacing: [2]
+  line-comment-position: [0]
+  linebreak-style: [2, unix]
+  lines-around-comment: [0]
+  lines-between-class-members: [0]
+  logical-assignment-operators: [0]
+  max-classes-per-file: [0]
+  max-depth: [0]
+  max-len: [0]
+  max-lines-per-function: [0]
+  max-lines: [0]
+  max-nested-callbacks: [0]
+  max-params: [0]
+  max-statements-per-line: [0]
+  max-statements: [0]
+  multiline-comment-style: [2, separate-lines]
+  multiline-ternary: [0]
+  new-cap: [0]
+  new-parens: [2]
+  newline-per-chained-call: [0]
+  no-alert: [0]
+  no-array-constructor: [2]
+  no-async-promise-executor: [0]
+  no-await-in-loop: [0]
+  no-bitwise: [0]
+  no-buffer-constructor: [0]
+  no-caller: [2]
+  no-case-declarations: [2]
+  no-class-assign: [2]
+  no-compare-neg-zero: [2]
+  no-cond-assign: [2, except-parens]
+  no-confusing-arrow: [0]
+  no-console: [1, {allow: [debug, info, warn, error]}]
+  no-const-assign: [2]
+  no-constant-binary-expression: [2]
+  no-constant-condition: [0]
+  no-constructor-return: [2]
+  no-continue: [0]
+  no-control-regex: [0]
+  no-debugger: [1]
+  no-delete-var: [2]
+  no-div-regex: [0]
+  no-dupe-args: [2]
+  no-dupe-class-members: [2]
+  no-dupe-else-if: [2]
+  no-dupe-keys: [2]
+  no-duplicate-case: [2]
+  no-duplicate-imports: [2]
+  no-else-return: [2]
+  no-empty-character-class: [2]
+  no-empty-function: [0]
+  no-empty-pattern: [2]
+  no-empty-static-block: [2]
+  no-empty: [2, {allowEmptyCatch: true}]
+  no-eq-null: [2]
+  no-eval: [2]
+  no-ex-assign: [2]
+  no-extend-native: [2]
+  no-extra-bind: [2]
+  no-extra-boolean-cast: [2]
+  no-extra-label: [0]
+  no-extra-parens: [0]
+  no-extra-semi: [2]
+  no-fallthrough: [2]
+  no-floating-decimal: [0]
+  no-func-assign: [2]
+  no-global-assign: [2]
+  no-implicit-coercion: [2]
+  no-implicit-globals: [0]
+  no-implied-eval: [2]
+  no-import-assign: [2]
+  no-inline-comments: [0]
+  no-inner-declarations: [2]
+  no-invalid-regexp: [2]
+  no-invalid-this: [0]
+  no-irregular-whitespace: [2]
+  no-iterator: [2]
+  no-jquery/no-ajax-events: [2]
+  no-jquery/no-ajax: [0]
+  no-jquery/no-and-self: [2]
+  no-jquery/no-animate-toggle: [2]
+  no-jquery/no-animate: [2]
+  no-jquery/no-append-html: [0]
+  no-jquery/no-attr: [0]
+  no-jquery/no-bind: [2]
+  no-jquery/no-box-model: [2]
+  no-jquery/no-browser: [2]
+  no-jquery/no-camel-case: [2]
+  no-jquery/no-class-state: [0]
+  no-jquery/no-class: [0]
+  no-jquery/no-clone: [2]
+  no-jquery/no-closest: [0]
+  no-jquery/no-constructor-attributes: [2]
+  no-jquery/no-contains: [2]
+  no-jquery/no-context-prop: [2]
+  no-jquery/no-css: [0]
+  no-jquery/no-data: [0]
+  no-jquery/no-deferred: [2]
+  no-jquery/no-delegate: [2]
+  no-jquery/no-each-collection: [0]
+  no-jquery/no-each-util: [0]
+  no-jquery/no-each: [0]
+  no-jquery/no-error-shorthand: [2]
+  no-jquery/no-error: [2]
+  no-jquery/no-escape-selector: [2]
+  no-jquery/no-event-shorthand: [2]
+  no-jquery/no-extend: [2]
+  no-jquery/no-fade: [2]
+  no-jquery/no-filter: [0]
+  no-jquery/no-find-collection: [0]
+  no-jquery/no-find-util: [2]
+  no-jquery/no-find: [0]
+  no-jquery/no-fx-interval: [2]
+  no-jquery/no-global-eval: [2]
+  no-jquery/no-global-selector: [0]
+  no-jquery/no-grep: [2]
+  no-jquery/no-has: [2]
+  no-jquery/no-hold-ready: [2]
+  no-jquery/no-html: [0]
+  no-jquery/no-in-array: [2]
+  no-jquery/no-is-array: [2]
+  no-jquery/no-is-empty-object: [2]
+  no-jquery/no-is-function: [2]
+  no-jquery/no-is-numeric: [2]
+  no-jquery/no-is-plain-object: [2]
+  no-jquery/no-is-window: [2]
+  no-jquery/no-is: [0]
+  no-jquery/no-jquery-constructor: [0]
+  no-jquery/no-live: [2]
+  no-jquery/no-load-shorthand: [2]
+  no-jquery/no-load: [2]
+  no-jquery/no-map-collection: [0]
+  no-jquery/no-map-util: [2]
+  no-jquery/no-map: [0]
+  no-jquery/no-merge: [2]
+  no-jquery/no-node-name: [2]
+  no-jquery/no-noop: [2]
+  no-jquery/no-now: [2]
+  no-jquery/no-on-ready: [2]
+  no-jquery/no-other-methods: [0]
+  no-jquery/no-other-utils: [2]
+  no-jquery/no-param: [2]
+  no-jquery/no-parent: [0]
+  no-jquery/no-parents: [0]
+  no-jquery/no-parse-html-literal: [0]
+  no-jquery/no-parse-html: [2]
+  no-jquery/no-parse-json: [2]
+  no-jquery/no-parse-xml: [2]
+  no-jquery/no-prop: [0]
+  no-jquery/no-proxy: [2]
+  no-jquery/no-ready-shorthand: [2]
+  no-jquery/no-ready: [2]
+  no-jquery/no-selector-prop: [2]
+  no-jquery/no-serialize: [2]
+  no-jquery/no-size: [2]
+  no-jquery/no-sizzle: [0]
+  no-jquery/no-slide: [2]
+  no-jquery/no-sub: [2]
+  no-jquery/no-support: [2]
+  no-jquery/no-text: [0]
+  no-jquery/no-trigger: [0]
+  no-jquery/no-trim: [2]
+  no-jquery/no-type: [2]
+  no-jquery/no-unique: [2]
+  no-jquery/no-unload-shorthand: [2]
+  no-jquery/no-val: [0]
+  no-jquery/no-visibility: [2]
+  no-jquery/no-when: [2]
+  no-jquery/no-wrap: [2]
+  no-jquery/variable-pattern: [0]
+  no-label-var: [2]
+  no-labels: [0] # handled by no-restricted-syntax
+  no-lone-blocks: [2]
+  no-lonely-if: [0]
+  no-loop-func: [0]
+  no-loss-of-precision: [2]
+  no-magic-numbers: [0]
+  no-misleading-character-class: [2]
+  no-mixed-operators: [0]
+  no-mixed-spaces-and-tabs: [2]
+  no-multi-assign: [0]
+  no-multi-spaces: [2, {ignoreEOLComments: true, exceptions: {Property: true}}]
+  no-multi-str: [2]
+  no-negated-condition: [0]
+  no-nested-ternary: [0]
+  no-new-func: [2]
+  no-new-native-nonconstructor: [2]
+  no-new-object: [2]
+  no-new-symbol: [2]
+  no-new-wrappers: [2]
+  no-new: [0]
+  no-nonoctal-decimal-escape: [2]
+  no-obj-calls: [2]
+  no-octal-escape: [2]
+  no-octal: [2]
+  no-param-reassign: [0]
+  no-plusplus: [0]
+  no-promise-executor-return: [0]
+  no-proto: [2]
+  no-prototype-builtins: [2]
+  no-redeclare: [2]
+  no-regex-spaces: [2]
+  no-restricted-exports: [0]
+  no-restricted-globals: [2, addEventListener, blur, close, closed, confirm, defaultStatus, defaultstatus, error, event, external, find, focus, frameElement, frames, history, innerHeight, innerWidth, isFinite, isNaN, length, location, locationbar, menubar, moveBy, moveTo, name, onblur, onerror, onfocus, onload, onresize, onunload, open, opener, opera, outerHeight, outerWidth, pageXOffset, pageYOffset, parent, print, removeEventListener, resizeBy, resizeTo, screen, screenLeft, screenTop, screenX, screenY, scroll, scrollbars, scrollBy, scrollTo, scrollX, scrollY, self, status, statusbar, stop, toolbar, top, __dirname, __filename]
+  no-restricted-imports: [0]
+  no-restricted-syntax: [2, WithStatement, ForInStatement, LabeledStatement]
+  no-return-assign: [0]
+  no-return-await: [0]
+  no-script-url: [2]
+  no-self-assign: [2, {props: true}]
+  no-self-compare: [2]
+  no-sequences: [2]
+  no-setter-return: [2]
+  no-shadow-restricted-names: [2]
+  no-shadow: [0]
+  no-sparse-arrays: [2]
+  no-tabs: [2]
+  no-template-curly-in-string: [2]
+  no-ternary: [0]
+  no-this-before-super: [2]
+  no-throw-literal: [2]
+  no-trailing-spaces: [2]
+  no-undef-init: [2]
+  no-undef: [2, {typeof: true}]
+  no-undefined: [0]
+  no-underscore-dangle: [0]
+  no-unexpected-multiline: [2]
+  no-unmodified-loop-condition: [2]
+  no-unneeded-ternary: [0]
+  no-unreachable-loop: [2]
+  no-unreachable: [2]
+  no-unsafe-finally: [2]
+  no-unsafe-negation: [2]
+  no-unused-expressions: [2]
+  no-unused-labels: [2]
+  no-unused-private-class-members: [2]
+  no-unused-vars: [2, {args: all, argsIgnorePattern: ^_, varsIgnorePattern: ^_, caughtErrorsIgnorePattern: ^_, destructuredArrayIgnorePattern: ^_, ignoreRestSiblings: false}]
+  no-use-before-define: [2, {functions: false, classes: true, variables: true, allowNamedExports: true}]
+  no-use-extend-native/no-use-extend-native: [2]
+  no-useless-backreference: [2]
+  no-useless-call: [2]
+  no-useless-catch: [2]
+  no-useless-computed-key: [2]
+  no-useless-concat: [2]
+  no-useless-constructor: [2]
+  no-useless-escape: [2]
+  no-useless-rename: [2]
+  no-useless-return: [2]
+  no-var: [2]
+  no-void: [2]
+  no-warning-comments: [0]
+  no-whitespace-before-property: [2]
+  no-with: [0] # handled by no-restricted-syntax
+  nonblock-statement-body-position: [2]
+  object-curly-newline: [0]
+  object-curly-spacing: [2, never]
+  object-shorthand: [2, always]
+  one-var-declaration-per-line: [0]
+  one-var: [0]
+  operator-assignment: [2, always]
+  operator-linebreak: [2, after]
+  padded-blocks: [2, never]
+  padding-line-between-statements: [0]
+  prefer-arrow-callback: [2, {allowNamedFunctions: true, allowUnboundThis: true}]
+  prefer-const: [2, {destructuring: all, ignoreReadBeforeAssign: true}]
+  prefer-destructuring: [0]
+  prefer-exponentiation-operator: [2]
+  prefer-named-capture-group: [0]
+  prefer-numeric-literals: [2]
+  prefer-object-has-own: [0]
+  prefer-object-spread: [2]
+  prefer-promise-reject-errors: [2, {allowEmptyReject: false}]
+  prefer-regex-literals: [2]
+  prefer-rest-params: [2]
+  prefer-spread: [2]
+  prefer-template: [2]
+  quote-props: [0]
+  quotes: [2, single, {avoidEscape: true, allowTemplateLiterals: true}]
+  radix: [2, as-needed]
+  regexp/confusing-quantifier: [2]
+  regexp/control-character-escape: [2]
+  regexp/hexadecimal-escape: [0]
+  regexp/letter-case: [0]
+  regexp/match-any: [2]
+  regexp/negation: [2]
+  regexp/no-contradiction-with-assertion: [0]
+  regexp/no-control-character: [0]
+  regexp/no-dupe-characters-character-class: [2]
+  regexp/no-dupe-disjunctions: [2]
+  regexp/no-empty-alternative: [2]
+  regexp/no-empty-capturing-group: [2]
+  regexp/no-empty-character-class: [0]
+  regexp/no-empty-group: [2]
+  regexp/no-empty-lookarounds-assertion: [2]
+  regexp/no-escape-backspace: [2]
+  regexp/no-extra-lookaround-assertions: [0]
+  regexp/no-invalid-regexp: [2]
+  regexp/no-invisible-character: [2]
+  regexp/no-lazy-ends: [2]
+  regexp/no-legacy-features: [2]
+  regexp/no-misleading-capturing-group: [0]
+  regexp/no-misleading-unicode-character: [0]
+  regexp/no-missing-g-flag: [2]
+  regexp/no-non-standard-flag: [2]
+  regexp/no-obscure-range: [2]
+  regexp/no-octal: [2]
+  regexp/no-optional-assertion: [2]
+  regexp/no-potentially-useless-backreference: [2]
+  regexp/no-standalone-backslash: [2]
+  regexp/no-super-linear-backtracking: [0]
+  regexp/no-super-linear-move: [0]
+  regexp/no-trivially-nested-assertion: [2]
+  regexp/no-trivially-nested-quantifier: [2]
+  regexp/no-unused-capturing-group: [0]
+  regexp/no-useless-assertions: [2]
+  regexp/no-useless-backreference: [2]
+  regexp/no-useless-character-class: [2]
+  regexp/no-useless-dollar-replacements: [2]
+  regexp/no-useless-escape: [2]
+  regexp/no-useless-flag: [2]
+  regexp/no-useless-lazy: [2]
+  regexp/no-useless-non-capturing-group: [2]
+  regexp/no-useless-quantifier: [2]
+  regexp/no-useless-range: [2]
+  regexp/no-useless-two-nums-quantifier: [2]
+  regexp/no-zero-quantifier: [2]
+  regexp/optimal-lookaround-quantifier: [2]
+  regexp/optimal-quantifier-concatenation: [0]
+  regexp/prefer-character-class: [0]
+  regexp/prefer-d: [0]
+  regexp/prefer-escape-replacement-dollar-char: [0]
+  regexp/prefer-lookaround: [0]
+  regexp/prefer-named-backreference: [0]
+  regexp/prefer-named-capture-group: [0]
+  regexp/prefer-named-replacement: [0]
+  regexp/prefer-plus-quantifier: [2]
+  regexp/prefer-predefined-assertion: [2]
+  regexp/prefer-quantifier: [0]
+  regexp/prefer-question-quantifier: [2]
+  regexp/prefer-range: [2]
+  regexp/prefer-regexp-exec: [2]
+  regexp/prefer-regexp-test: [2]
+  regexp/prefer-result-array-groups: [0]
+  regexp/prefer-star-quantifier: [2]
+  regexp/prefer-unicode-codepoint-escapes: [2]
+  regexp/prefer-w: [0]
+  regexp/require-unicode-regexp: [0]
+  regexp/sort-alternatives: [0]
+  regexp/sort-character-class-elements: [0]
+  regexp/sort-flags: [0]
+  regexp/strict: [2]
+  regexp/unicode-escape: [0]
+  regexp/use-ignore-case: [0]
+  require-atomic-updates: [0]
+  require-await: [0]
+  require-unicode-regexp: [0]
+  require-yield: [2]
+  rest-spread-spacing: [2, never]
+  semi-spacing: [2, {before: false, after: true}]
+  semi-style: [2, last]
+  semi: [2, always, {omitLastInOneLineBlock: true}]
+  sonarjs/cognitive-complexity: [0]
+  sonarjs/elseif-without-else: [0]
+  sonarjs/max-switch-cases: [0]
+  sonarjs/no-all-duplicated-branches: [2]
+  sonarjs/no-collapsible-if: [0]
+  sonarjs/no-collection-size-mischeck: [2]
+  sonarjs/no-duplicate-string: [0]
+  sonarjs/no-duplicated-branches: [0]
+  sonarjs/no-element-overwrite: [2]
+  sonarjs/no-empty-collection: [2]
+  sonarjs/no-extra-arguments: [2]
+  sonarjs/no-gratuitous-expressions: [2]
+  sonarjs/no-identical-conditions: [2]
+  sonarjs/no-identical-expressions: [2]
+  sonarjs/no-identical-functions: [2, 5]
+  sonarjs/no-ignored-return: [2]
+  sonarjs/no-inverted-boolean-check: [2]
+  sonarjs/no-nested-switch: [0]
+  sonarjs/no-nested-template-literals: [0]
+  sonarjs/no-one-iteration-loop: [2]
+  sonarjs/no-redundant-boolean: [2]
+  sonarjs/no-redundant-jump: [2]
+  sonarjs/no-same-line-conditional: [2]
+  sonarjs/no-small-switch: [0]
+  sonarjs/no-unused-collection: [2]
+  sonarjs/no-use-of-empty-return-value: [2]
+  sonarjs/no-useless-catch: [2]
+  sonarjs/non-existent-operator: [2]
+  sonarjs/prefer-immediate-return: [0]
+  sonarjs/prefer-object-literal: [0]
+  sonarjs/prefer-single-boolean-return: [0]
+  sonarjs/prefer-while: [2]
+  sort-imports: [0]
+  sort-keys: [0]
+  sort-vars: [0]
+  space-before-blocks: [2, always]
+  space-in-parens: [2, never]
+  space-infix-ops: [2]
+  space-unary-ops: [2]
+  spaced-comment: [2, always]
+  strict: [0]
+  switch-colon-spacing: [2]
+  symbol-description: [2]
+  template-curly-spacing: [2, never]
+  template-tag-spacing: [2, never]
+  unicode-bom: [2, never]
+  unicorn/better-regex: [0]
+  unicorn/catch-error-name: [0]
+  unicorn/consistent-destructuring: [2]
+  unicorn/consistent-function-scoping: [2]
+  unicorn/custom-error-definition: [0]
+  unicorn/empty-brace-spaces: [2]
+  unicorn/error-message: [0]
+  unicorn/escape-case: [0]
+  unicorn/expiring-todo-comments: [0]
+  unicorn/explicit-length-check: [0]
+  unicorn/filename-case: [0]
+  unicorn/import-index: [0]
+  unicorn/import-style: [0]
+  unicorn/new-for-builtins: [2]
+  unicorn/no-abusive-eslint-disable: [0]
+  unicorn/no-array-callback-reference: [0]
+  unicorn/no-array-for-each: [2]
+  unicorn/no-array-method-this-argument: [2]
+  unicorn/no-array-push-push: [2]
+  unicorn/no-array-reduce: [2]
+  unicorn/no-await-expression-member: [0]
+  unicorn/no-console-spaces: [0]
+  unicorn/no-document-cookie: [2]
+  unicorn/no-empty-file: [2]
+  unicorn/no-for-loop: [0]
+  unicorn/no-hex-escape: [0]
+  unicorn/no-instanceof-array: [0]
+  unicorn/no-invalid-remove-event-listener: [2]
+  unicorn/no-keyword-prefix: [0]
+  unicorn/no-lonely-if: [2]
+  unicorn/no-negated-condition: [0]
+  unicorn/no-nested-ternary: [0]
+  unicorn/no-new-array: [0]
+  unicorn/no-new-buffer: [0]
+  unicorn/no-null: [0]
+  unicorn/no-object-as-default-parameter: [0]
+  unicorn/no-process-exit: [0]
+  unicorn/no-static-only-class: [2]
+  unicorn/no-thenable: [2]
+  unicorn/no-this-assignment: [2]
+  unicorn/no-typeof-undefined: [2]
+  unicorn/no-unnecessary-await: [2]
+  unicorn/no-unreadable-array-destructuring: [0]
+  unicorn/no-unreadable-iife: [2]
+  unicorn/no-unsafe-regex: [0]
+  unicorn/no-unused-properties: [2]
+  unicorn/no-useless-fallback-in-spread: [2]
+  unicorn/no-useless-length-check: [2]
+  unicorn/no-useless-promise-resolve-reject: [2]
+  unicorn/no-useless-spread: [2]
+  unicorn/no-useless-switch-case: [2]
+  unicorn/no-useless-undefined: [0]
+  unicorn/no-zero-fractions: [2]
+  unicorn/number-literal-case: [0]
+  unicorn/numeric-separators-style: [0]
+  unicorn/prefer-add-event-listener: [2]
+  unicorn/prefer-array-find: [2]
+  unicorn/prefer-array-flat-map: [2]
+  unicorn/prefer-array-flat: [2]
+  unicorn/prefer-array-index-of: [2]
+  unicorn/prefer-array-some: [2]
+  unicorn/prefer-at: [0]
+  unicorn/prefer-blob-reading-methods: [2]
+  unicorn/prefer-code-point: [0]
+  unicorn/prefer-date-now: [2]
+  unicorn/prefer-default-parameters: [0]
+  unicorn/prefer-dom-node-append: [2]
+  unicorn/prefer-dom-node-dataset: [0]
+  unicorn/prefer-dom-node-remove: [2]
+  unicorn/prefer-dom-node-text-content: [2]
+  unicorn/prefer-event-target: [2]
+  unicorn/prefer-export-from: [2, {ignoreUsedVariables: true}]
+  unicorn/prefer-includes: [2]
+  unicorn/prefer-json-parse-buffer: [0]
+  unicorn/prefer-keyboard-event-key: [2]
+  unicorn/prefer-logical-operator-over-ternary: [2]
+  unicorn/prefer-math-trunc: [2]
+  unicorn/prefer-modern-dom-apis: [0]
+  unicorn/prefer-modern-math-apis: [2]
+  unicorn/prefer-module: [2]
+  unicorn/prefer-native-coercion-functions: [2]
+  unicorn/prefer-negative-index: [2]
+  unicorn/prefer-node-protocol: [2]
+  unicorn/prefer-number-properties: [0]
+  unicorn/prefer-object-from-entries: [2]
+  unicorn/prefer-object-has-own: [0]
+  unicorn/prefer-optional-catch-binding: [2]
+  unicorn/prefer-prototype-methods: [0]
+  unicorn/prefer-query-selector: [0]
+  unicorn/prefer-reflect-apply: [0]
+  unicorn/prefer-regexp-test: [2]
+  unicorn/prefer-set-has: [0]
+  unicorn/prefer-set-size: [2]
+  unicorn/prefer-spread: [0]
+  unicorn/prefer-string-replace-all: [0]
+  unicorn/prefer-string-slice: [0]
+  unicorn/prefer-string-starts-ends-with: [2]
+  unicorn/prefer-string-trim-start-end: [2]
+  unicorn/prefer-switch: [0]
+  unicorn/prefer-ternary: [0]
+  unicorn/prefer-text-content: [2]
+  unicorn/prefer-top-level-await: [0]
+  unicorn/prefer-type-error: [0]
+  unicorn/prevent-abbreviations: [0]
+  unicorn/relative-url-style: [2]
+  unicorn/require-array-join-separator: [2]
+  unicorn/require-number-to-fixed-digits-argument: [2]
+  unicorn/require-post-message-target-origin: [0]
+  unicorn/string-content: [0]
+  unicorn/switch-case-braces: [0]
+  unicorn/template-indent: [2]
+  unicorn/text-encoding-identifier-case: [0]
+  unicorn/throw-new-error: [2]
+  use-isnan: [2]
+  valid-typeof: [2, {requireStringLiterals: true}]
+  vars-on-top: [0]
+  wc/attach-shadow-constructor: [2]
+  wc/guard-super-call: [2]
+  wc/no-closed-shadow-root: [2]
+  wc/no-constructor-attributes: [2]
+  wc/no-constructor-params: [2]
+  wc/no-invalid-element-name: [0] # covered by custom-elements/valid-tag-name
+  wc/no-self-class: [2]
+  wc/no-typos: [2]
+  wc/require-listener-teardown: [2]
+  wrap-iife: [2, inside]
+  wrap-regex: [0]
+  yield-star-spacing: [2, after]
+  yoda: [2, never]
@@ -1,12 +1,10 @@
 * text=auto eol=lf
 *.tmpl linguist-language=Handlebars
-*.pb.go linguist-generated
 /assets/*.json linguist-generated
-/public/assets/img/svg/*.svg linguist-generated
+/public/img/svg/*.svg linguist-generated
 /templates/swagger/v1_json.tmpl linguist-generated
-/templates/swagger/v1_openapi3_json.tmpl linguist-generated
-/options/fileicon/** linguist-generated
 /vendor/** -text -eol linguist-vendored
+/web_src/fomantic/build/** linguist-generated
+/web_src/fomantic/_site/globals/site.variables linguist-language=Less
 /web_src/js/vendor/** -text -eol linguist-vendored
 Dockerfile.* linguist-language=Dockerfile
-Makefile.* linguist-language=Makefile
@@ -0,0 +1,42 @@
+<!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue -->
+
+<!--
+    1. Please speak English, this is the language all maintainers can speak and write.
+    2. Please ask questions or configuration/deploy problems on our Discord
+       server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
+    3. Please take a moment to check that your issue doesn't already exist.
+    4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
+    5. Please give all relevant information below for bug reports, because
+       incomplete details will be handled as an invalid report.
+-->
+
+- Gitea version (or commit ref):
+- Git version:
+- Operating system:
+  <!-- Please include information on whether you built gitea yourself, used one of our downloads or are using some other package -->
+  <!-- Please also tell us how you are running gitea, e.g. if it is being run from docker, a command-line, systemd etc. --->
+  <!-- If you are using a package or systemd tell us what distribution you are using -->
+- Database (use `[x]`):
+  - [ ] PostgreSQL
+  - [ ] MySQL
+  - [ ] MSSQL
+  - [ ] SQLite
+- Can you reproduce the bug at https://try.gitea.io:
+  - [ ] Yes (provide example URL)
+  - [ ] No
+- Log gist:
+<!-- It really is important to provide pertinent logs -->
+<!-- Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help -->
+<!-- In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini -->
+
+## Description
+<!-- If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please
+     disable the proxy/CDN fully and connect to gitea directly to confirm
+     the issue still persists without those services. -->
+
+...
+
+
+## Screenshots
+
+<!-- **If this issue involves the Web Interface, please include a screenshot** -->
@@ -1 +1,2 @@
 open_collective: gitea
+custom: https://www.bountysource.com/teams/gitea
@@ -1,28 +1,91 @@
 name: Bug Report
-description: Something isn't working as expected.
-labels: ["type/bug"]
+description: Found something you weren't expecting? Report it here!
+labels: ["kind/bug"]
 body:
-  - type: markdown
-    attributes:
-      value: |
-        - **Security issue?** Email security@gitea.io instead of opening a public issue.
-        - **Need help** with setup or configuration? Ask on [Discord](https://discord.gg/Gitea) or the [forum](https://forum.gitea.com).
-        - Search [existing issues](https://github.com/go-gitea/gitea/issues?q=is%3Aissue) first.
-  - type: input
-    id: gitea-ver
-    attributes:
-      label: Gitea Version
-    validations:
-      required: true
-  - type: textarea
-    id: description
-    attributes:
-      label: What happened?
-      description: What you did, what you expected to happen, and what happened instead. Include logs if relevant.
-    validations:
-      required: true
-  - type: textarea
-    id: environment
-    attributes:
-      label: How are you running Gitea?
-      description: Install method (binary, Docker, package), operating system, and database.
+- type: markdown
+  attributes:
+    value: |
+      NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.
+- type: markdown
+  attributes:
+    value: |
+      1. Please speak English, this is the language all maintainers can speak and write.
+      2. Please ask questions or configuration/deploy problems on our Discord
+         server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
+      3. Make sure you are using the latest release and
+         take a moment to check that your issue hasn't been reported before.
+      4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
+      5. It's really important to provide pertinent details and logs (https://docs.gitea.com/help/support),
+         incomplete details will be handled as an invalid report.
+- type: textarea
+  id: description
+  attributes:
+    label: Description
+    description: |
+      Please provide a description of your issue here, with a URL if you were able to reproduce the issue (see below)
+      If you are using a proxy or a CDN (e.g. Cloudflare) in front of Gitea, please disable the proxy/CDN fully and access Gitea directly to confirm the issue still persists without those services.
+- type: input
+  id: gitea-ver
+  attributes:
+    label: Gitea Version
+    description: Gitea version (or commit reference) of your instance
+  validations:
+    required: true
+- type: dropdown
+  id: can-reproduce
+  attributes:
+    label: Can you reproduce the bug on the Gitea demo site?
+    description: |
+      If so, please provide a URL in the Description field
+      URL of Gitea demo: https://try.gitea.io
+    options:
+    - "Yes"
+    - "No"
+  validations:
+    required: true
+- type: markdown
+  attributes:
+    value: |
+      It's really important to provide pertinent logs
+      Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help
+      In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini
+- type: input
+  id: logs
+  attributes:
+    label: Log Gist
+    description: Please provide a gist URL of your logs, with any sensitive information (e.g. API keys) removed/hidden
+- type: textarea
+  id: screenshots
+  attributes:
+    label: Screenshots
+    description: If this issue involves the Web Interface, please provide one or more screenshots
+- type: input
+  id: git-ver
+  attributes:
+    label: Git Version
+    description: The version of git running on the server
+- type: input
+  id: os-ver
+  attributes:
+    label: Operating System
+    description: The operating system you are using to run Gitea
+- type: textarea
+  id: run-info
+  attributes:
+    label: How are you running Gitea?
+    description: |
+      Please include information on whether you built Gitea yourself, used one of our downloads, are using https://try.gitea.io or are using some other package
+      Please also tell us how you are running Gitea, e.g. if it is being run from docker, a command-line, systemd etc.
+      If you are using a package or systemd tell us what distribution you are using
+  validations:
+    required: true
+- type: dropdown
+  id: database
+  attributes:
+    label: Database
+    description: What database system are you running?
+    options:
+    - PostgreSQL
+    - MySQL/MariaDB
+    - MSSQL
+    - SQLite
@@ -7,11 +7,11 @@ contact_links:
    url: https://discord.gg/Gitea
    about: Please ask questions and discuss configuration or deployment problems here.
  - name: Discourse Forum
-    url: https://forum.gitea.com
+    url: https://discourse.gitea.io
    about: Questions and configuration or deployment problems can also be discussed on our forum.
  - name: Frequently Asked Questions
    url: https://docs.gitea.com/help/faq
    about: Please check if your question isn't mentioned here.
  - name: Crowdin Translations
-    url: https://translate.gitea.com
+    url: https://crowdin.com/project/gitea
    about: Translations are managed here.
@@ -1,20 +1,24 @@
 name: Feature Request
-description: Suggest an idea for Gitea.
-labels: ["type/proposal"]
+description: Got an idea for a feature that Gitea doesn't have currently?  Submit your idea here!
+labels: ["kind/feature", "kind/proposal"]
 body:
-  - type: markdown
-    attributes:
-      value: |
-        Search [existing issues](https://github.com/go-gitea/gitea/issues?q=is%3Aissue) first.
-  - type: textarea
-    id: problem
-    attributes:
-      label: What problem would this solve?
-    validations:
-      required: true
-  - type: textarea
-    id: proposal
-    attributes:
-      label: What do you propose?
-    validations:
-      required: true
+- type: markdown
+  attributes:
+    value: |
+      1. Please speak English, this is the language all maintainers can speak and write.
+      2. Please ask questions or configuration/deploy problems on our Discord
+         server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
+      3. Please take a moment to check that your feature hasn't already been suggested.
+- type: textarea
+  id: description
+  attributes:
+    label: Feature Description
+    placeholder: |
+      I think it would be great if Gitea had...
+  validations:
+    required: true
+- type: textarea
+  id: screenshots
+  attributes:
+    label: Screenshots
+    description: If you can, provide screenshots of an implementation on another site e.g. GitHub
@@ -0,0 +1,66 @@
+name: Web Interface Bug Report
+description: Something doesn't look quite as it should?  Report it here!
+labels: ["kind/bug", "kind/ui"]
+body:
+- type: markdown
+  attributes:
+    value: |
+      NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.
+- type: markdown
+  attributes:
+    value: |
+      1. Please speak English, this is the language all maintainers can speak and write.
+      2. Please ask questions or configuration/deploy problems on our Discord
+         server (https://discord.gg/gitea) or forum (https://discourse.gitea.io).
+      3. Please take a moment to check that your issue doesn't already exist.
+      4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
+      5. Please give all relevant information below for bug reports, because
+         incomplete details will be handled as an invalid report.
+      6. In particular it's really important to provide pertinent logs. If you are certain that this is a javascript
+         error, show us the javascript console. If the error appears to relate to Gitea the server you must also give us
+         DEBUG level logs. (See https://docs.gitea.com/administration/logging-config#collecting-logs-for-help)
+- type: textarea
+  id: description
+  attributes:
+    label: Description
+    description: |
+      Please provide a description of your issue here, with a URL if you were able to reproduce the issue (see below)
+      If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please disable the proxy/CDN fully and connect to gitea directly to confirm the issue still persists without those services.
+- type: textarea
+  id: screenshots
+  attributes:
+    label: Screenshots
+    description: Please provide at least 1 screenshot showing the issue.
+  validations:
+    required: true
+- type: input
+  id: gitea-ver
+  attributes:
+    label: Gitea Version
+    description: Gitea version (or commit reference) your instance is running
+  validations:
+    required: true
+- type: dropdown
+  id: can-reproduce
+  attributes:
+    label: Can you reproduce the bug on the Gitea demo site?
+    description: |
+      If so, please provide a URL in the Description field
+      URL of Gitea demo: https://try.gitea.io
+    options:
+    - "Yes"
+    - "No"
+  validations:
+    required: true
+- type: input
+  id: os-ver
+  attributes:
+    label: Operating System
+    description: The operating system you are using to access Gitea
+- type: input
+  id: browser-ver
+  attributes:
+    label: Browser Version
+    description: The browser and version that you are using to access Gitea
+  validations:
+    required: true
@@ -1,7 +0,0 @@
-self-hosted-runner:
-  labels:
-    - actuated-4cpu-8gb
-    - actuated-4cpu-16gb
-    - nscloud
-    - namespace-profile-gitea-release-docker
-    - namespace-profile-gitea-release-binary
@@ -1,29 +0,0 @@
-name: docker-dryrun
-description: Composite action that performs the container build steps for a single platform.
-
-inputs:
-  platform:
-    description: "The target platform: linux/amd64, linux/arm64, linux/riscv64."
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-    - name: Build regular image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-      with:
-        context: .
-        platforms: ${{ inputs.platform }}
-        push: false
-        file: Dockerfile
-        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
-    - name: Build rootless image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-      with:
-        context: .
-        platforms: ${{ inputs.platform }}
-        push: false
-        file: Dockerfile.rootless
-        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
@@ -1,17 +0,0 @@
-name: free-disk-space
-description: Free space on / before large cache restores
-
-# Delete preinstalled toolchains which gitea doesn't use and show disk space usage
-runs:
-  using: composite
-  steps:
-    - shell: bash
-      run: |
-        echo "free space before cleanup:"
-        df -h /
-        for dir in /usr/local/lib/android /usr/local/.ghcup /opt/ghc /usr/share/dotnet; do
-          sudo rm -rf "$dir" &
-        done
-        wait
-        echo "free space after cleanup:"
-        df -h /
@@ -1,50 +0,0 @@
-name: go-caches
-description: Restore the go module, build, and golangci-lint caches. Save only on the cache-seeder workflow.
-
-# Only the cache-seeder workflow saves; rename requires updating cache-seeder.yml.
-# The lint job restores but does not save the gobuild cache, so only one writer
-# (the gobuild job) populates it and there is no contention on the cache key.
-# Seeder restores by exact key only (no restore-keys) so each go.sum seeds a clean
-# cache and size stays bounded; do not add restore-keys here. PR runs keep them.
-
-inputs:
-  lint-cache:
-    description: Restore (and save in cache-seeder) ~/.cache/golangci-lint
-    default: "false"
-
-runs:
-  using: composite
-  steps:
-    - if: ${{ github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/go/pkg/mod
-        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-    - if: ${{ github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/go/pkg/mod
-        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
-    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
-    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.cache/golangci-lint
-        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
-    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.cache/golangci-lint
-        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
-        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}
@@ -1,24 +0,0 @@
-name: go-setup
-description: Set up go and restore caches
-
-inputs:
-  cache:
-    description: Restore go caches
-    default: "true"
-  lint-cache:
-    description: Also restore the golangci-lint cache
-    default: "false"
-
-runs:
-  using: composite
-  steps:
-    - uses: ./.github/actions/free-disk-space
-    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-      with:
-        go-version-file: go.mod
-        check-latest: true
-        cache: false
-    - if: ${{ inputs.cache == 'true' }}
-      uses: ./.github/actions/go-cache
-      with:
-        lint-cache: ${{ inputs.lint-cache }}
@@ -1,22 +0,0 @@
-name: node-setup
-description: Set up pnpm and node and restore caches
-
-inputs:
-  cache:
-    description: Cache pnpm downloads
-    default: "true"
-
-runs:
-  using: composite
-  steps:
-    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-    - if: ${{ inputs.cache == 'true' }}
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 24
-        cache: pnpm
-        cache-dependency-path: pnpm-lock.yaml
-    - if: ${{ inputs.cache != 'true' }}
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 24
@@ -1,40 +0,0 @@
-name: pgsql-shard
-description: Run one pgsql integration test shard
-
-inputs:
-  shard:
-    description: Shard index
-    required: true
-  total-shards:
-    description: Total shard count
-    required: true
-  run-migration:
-    description: Also run migration tests
-    default: "false"
-
-runs:
-  using: composite
-  steps:
-    - name: Add hosts to /etc/hosts
-      shell: bash
-      run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
-    - shell: bash
-      run: make deps-backend
-    - shell: bash
-      run: make backend
-      env:
-        TAGS: bindata
-    - name: run migration tests
-      if: ${{ inputs.run-migration == 'true' }}
-      shell: bash
-      run: GITEA_TEST_DATABASE=pgsql make test-migration
-    - name: run tests
-      shell: bash
-      run: GITEA_TEST_DATABASE=pgsql make test-integration
-      env:
-        # pgsql is chosen to be the unlucky one to run with the slow "race detector", it is about 60% slower.
-        GOTEST_FLAGS: -race -timeout=40m
-        TAGS: bindata gogit
-        TEST_LDAP: 1
-        TEST_SHARD: ${{ inputs.shard }}
-        TEST_TOTAL_SHARDS: ${{ inputs.total-shards }}
@@ -1,14 +0,0 @@
-docs-update-needed:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "custom/conf/app.example.ini"
-
-topic/code-linting:
-  - changed-files:
-      - any-glob-to-any-file:
-          - ".golangci.yml"
-          - ".markdownlint.yaml"
-          - ".spectral.yaml"
-          - ".yamllint.yaml"
-          - "eslint*.config.*"
-          - "stylelint.config.*"
@@ -1,9 +1,9 @@
-<!--
-Before submitting:
- Target the `main` branch; release branches are for backports only.
- Use a Conventional Commits title, e.g. `fix(repo): handle empty branch names`.
- Read the contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md
- Documentation changes go to https://gitea.com/gitea/docs
-
-Describe your change below and link any issue it fixes.
-->
+<!-- start tips --> 
+Please check the following:
+1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for backports.
+2. Make sure you have read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md .
+3. Describe what your pull request does and which issue you're targeting (if any).
+4. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
+5. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
+6. Delete all these tips before posting.
+<!-- end tips -->
@@ -0,0 +1,54 @@
+# Configuration for probot-stale - https://github.com/probot/stale
+
+# Number of days of inactivity before an Issue or Pull Request becomes stale
+daysUntilStale: 60
+
+# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
+# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
+daysUntilClose: 14
+
+# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
+exemptLabels:
+  - status/blocked 
+  - kind/security 
+  - lgtm/done
+  - reviewed/confirmed
+  - priority/critical
+  - kind/proposal
+
+# Set to true to ignore issues in a project (defaults to false)
+exemptProjects: false
+
+# Set to true to ignore issues in a milestone (defaults to false)
+exemptMilestones: false
+
+# Label to use when marking as stale
+staleLabel: stale
+
+# Comment to post when marking as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had recent activity. 
+  I am here to help clear issues left open even if solved or waiting for more insight.
+  This issue will be closed if no further activity occurs during the next 2 weeks.
+  If the issue is still valid just add a comment to keep it alive.
+  Thank you for your contributions.
+
+# Comment to post when closing a stale Issue or Pull Request.
+closeComment: >
+  This issue has been automatically closed because of inactivity.
+  You can re-open it if needed.
+
+# Limit the number of actions per hour, from 1-30. Default is 30
+limitPerRun: 1
+
+# Optionally, specify configuration settings that are specific to just 'issues' or 'pulls':
+pulls:
+  daysUntilStale: 60
+  daysUntilClose: 60
+  markComment: >
+    This pull request has been automatically marked as stale because it has not had
+    recent activity. It will be closed if no further activity occurs during the next 2 months. Thank you
+    for your contributions.
+  closeComment: >
+    This pull request has been automatically closed because of inactivity.
+    You can re-open it if needed.
@@ -1,113 +0,0 @@
-name: AgentScan
-
-on:
-  # jobs only use pinned actions and never checkout code
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types: [opened, reopened, synchronize, edited]
-
-concurrency:
-  group: agent-scan-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  agentscan:
-    runs-on: ubuntu-latest
-    steps:
-      - name: AgentScan
-        id: agentscan
-        uses: MatteoGabriele/agentscan-action@0a0c88109b5153dff2805f969f5060441efb7b65
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          skip-members: "dependabot[bot],renovate[bot], giteabot (backports)"
-          agent-scan-comment: false
-
-      - name: Handle flagged PR
-        if: contains(fromJSON('["automation","mixed"]'), steps.agentscan.outputs.classification) || steps.agentscan.outputs.community-flagged == 'true'
-        env:
-          CLASSIFICATION: ${{ steps.agentscan.outputs.classification }}
-          COMMUNITY_FLAGGED: ${{ steps.agentscan.outputs.community-flagged }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
-        with:
-          script: |
-            const core = require('@actions/core');
-            const prNumber = context.payload.pull_request.number;
-            const classification = process.env.CLASSIFICATION;
-            const communityFlagged = process.env.COMMUNITY_FLAGGED === 'true';
-            const shouldClose = classification === 'automation' || communityFlagged;
-
-            const issue = context.payload.pull_request;
-            const labels = issue.labels?.map(l => l.name) || [];
-
-            if (!labels.includes('possible bot')) {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                labels: ['possible bot'],
-              });
-            }
-
-            const comments = await github.paginate(github.rest.issues.listComments, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: prNumber,
-              per_page: 100,
-            });
-
-            const alreadyCommented = comments.some(c => c.user.type === 'Bot' && c.body.includes('AI Contribution Policy'));
-
-            if (!alreadyCommented) {
-              const closingNote = shouldClose
-                ? "We're closing this for now as the account looks automated. If we got that wrong, please just reopen the PR and we'll take another look."
-                : 'If this was flagged in error, we apologise! 😳 Just let us know. 🙏';
-
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                body: [
-                  "We've flagged this pull request as potentially AI-assisted.",
-                  '',
-                  'Gitea welcomes the thoughtful use of AI tools, but contributors must use them responsibly and clearly disclose any assistance. Please follow the AI Contribution Policy in `CONTRIBUTING.md` and update this PR accordingly:',
-                  '',
-                  'Maintainers may close PRs that do not disclose AI assistance, appear to be low-quality AI-generated content, or where the contributor cannot explain the changes.',
-                  '',
-                  'See: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md#ai-contribution-policy',
-                  '',
-                  closingNote,
-                ].join('\n'),
-              });
-            } else {
-              core.info('Possible-bot comment already exists - skipping comment.');
-            }
-
-            if (shouldClose && issue.state === 'open' && !alreadyCommented) {
-              await github.rest.pulls.update({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: prNumber,
-                state: 'closed',
-                title: '🚨 unwelcome pr from bot 🚨',
-              });
-            }
-
-            const actionTaken = [
-              'Added `possible bot` label',
-              alreadyCommented ? null : 'posted policy comment',
-              shouldClose && !alreadyCommented ? 'closed PR' : null,
-            ].filter(Boolean).join(', ');
-
-            core.summary
-              .addHeading('AgentScan: Possible Bot Flag', 2)
-              .addTable([
-                [{ data: 'Property', header: true }, { data: 'Value', header: true }],
-                ['Pull Request', `#${prNumber}`],
-                ['Classification', classification],
-                ['Community flagged', String(communityFlagged)],
-                ['Action', actionTaken || 'No action (already handled)'],
-              ])
-              .write();
@@ -1,72 +0,0 @@
-# Populates main's cache scope so PR runs warm-start from it. Saves the go
-# module, go build (incl. test compile), and golangci-lint caches.
-#
-# Caches are ref-scoped: PR runs read their own scope then fall back to the
-# base branch. Per .github/actions/go-cache/action.yml, PRs are restore-only,
-# so push-to-main is the only opportunity to populate the fallback scope.
-
-name: cache-seeder
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "go.sum"
-      - ".golangci.yml"
-      - ".github/actions/go-cache/action.yml"
-      - ".github/actions/go-setup/action.yml"
-      - ".github/workflows/cache-seeder.yml"
-
-concurrency:
-  group: cache-seeder
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  gobuild:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-      - run: make deps-backend deps-tools
-      - run: TAGS="bindata" make backend
-      - run: TAGS="bindata gogit" GOEXPERIMENT="" make backend
-      - name: warm test compile cache (bindata)
-        env:
-          TAGS: bindata
-          GOTEST_FLAGS: -race -list=^$$ -count=1
-        run: make test-backend
-      - name: warm test compile cache (bindata gogit)
-        env:
-          TAGS: bindata gogit
-          GOEXPERIMENT:
-          GOTEST_FLAGS: -race -list=^$$ -count=1
-        run: make test-backend
-      - name: warm integration compile cache
-        run: |
-          TAGS="bindata" make test-integration-compile
-          TAGS="bindata gogit" GOEXPERIMENT="" make test-integration-compile
-          TAGS="bindata gogit" GOTEST_FLAGS="-race" make test-integration-compile
-
-  lint:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { tags: "bindata", target: "lint-backend" }
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-        with:
-          lint-cache: "true"
-      - run: make deps-backend deps-tools
-      - run: make generate-go
-        env:
-          TAGS: ${{ matrix.tags }}
-      - run: make ${{ matrix.target }}
-        env:
-          TAGS: ${{ matrix.tags }}
@@ -1,26 +1,23 @@
 name: cron-licenses

 on:
-  # schedule:
-  #   - cron: "7 0 * * 1" # every Monday at 00:07 UTC
+  schedule:
+    - cron: "7 0 * * 1" # every Monday at 00:07 UTC
  workflow_dispatch:

 jobs:
  cron-licenses:
    runs-on: ubuntu-latest
    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
        with:
-          go-version-file: go.mod
-          check-latest: true
-      - run: make generate-gitignore
+          go-version: ">=1.20.1"
+      - run: make generate-license generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
-        uses: appleboy/git-push-action@3b2c8661652360dbf1afe1b319a49dbb739c39f1 # v1.2.0
+        uses: appleboy/git-push-action@v0.0.2
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -0,0 +1,22 @@
+name: cron-lock
+
+on:
+  schedule:
+    - cron: "0 0 * * *" # every day at 00:00 UTC
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    if: github.repository == 'go-gitea/gitea'
+    steps:
+      - uses: dessant/lock-threads@v4
+        with:
+          issue-inactive-days: 45
@@ -1,32 +0,0 @@
-name: cron-renovate
-
-on:
-  schedule:
-    - cron: "23 * * * *" # hourly at :23
-  workflow_dispatch:
-
-concurrency:
-  group: cron-renovate
-
-env:
-  RENOVATE_VERSION: 43.141.5 # renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
-
-permissions:
-  contents: read
-
-jobs:
-  cron-renovate:
-    runs-on: ubuntu-latest
-    if: github.repository == 'go-gitea/gitea' # prevent running on forks
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
-        with:
-          renovate-version: ${{ env.RENOVATE_VERSION }}
-          configurationFile: renovate.json5
-          token: ${{ secrets.RENOVATE_TOKEN }}
-        env:
-          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
-          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -9,27 +9,20 @@ jobs:
  crowdin-pull:
    runs-on: ubuntu-latest
    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
-        with:
-          upload_sources: true
-          upload_translations: false
-          download_sources: false
-          download_translations: true
-          push_translations: false
-          push_sources: false
-          create_pull_request: false
-          config: crowdin.yml
+      - uses: actions/checkout@v3
+      - name: download from crowdin
+        uses: docker://jonasfranz/crowdin
        env:
-          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
          CROWDIN_KEY: ${{ secrets.CROWDIN_KEY }}
+          PLUGIN_DOWNLOAD: true
+          PLUGIN_EXPORT_DIR: options/locale/
+          PLUGIN_IGNORE_BRANCH: true
+          PLUGIN_PROJECT_IDENTIFIER: gitea
      - name: update locales
        run: ./build/update-locales.sh
      - name: push translations to repo
-        uses: appleboy/git-push-action@3b2c8661652360dbf1afe1b319a49dbb739c39f1 # v1.2.0
+        uses: appleboy/git-push-action@v0.0.2
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -38,3 +31,19 @@ jobs:
          commit_message: "[skip ci] Updated translations via Crowdin"
          remote: "git@github.com:go-gitea/gitea.git"
          ssh_key: ${{ secrets.DEPLOY_KEY }}
+  crowdin-push:
+    runs-on: ubuntu-latest
+    if: github.repository == 'go-gitea/gitea'
+    steps:
+      - uses: actions/checkout@v3
+      - name: push translations to crowdin
+        uses: docker://jonasfranz/crowdin
+        env:
+          CROWDIN_KEY: ${{ secrets.CROWDIN_KEY }}
+          PLUGIN_UPLOAD: true
+          PLUGIN_EXPORT_DIR: options/locale/
+          PLUGIN_IGNORE_BRANCH: true
+          PLUGIN_PROJECT_IDENTIFIER: gitea
+          PLUGIN_FILES: |
+            locale_en-US.ini: options/locale/locale_en-US.ini
+          PLUGIN_BRANCH: main
@@ -4,139 +4,50 @@ on:
  workflow_call:
    outputs:
      backend:
+        description: "whether backend files changed"
        value: ${{ jobs.detect.outputs.backend }}
      frontend:
+        description: "whether frontend files changed"
        value: ${{ jobs.detect.outputs.frontend }}
      docs:
+        description: "whether docs files changed"
        value: ${{ jobs.detect.outputs.docs }}
      actions:
+        description: "whether actions files changed"
        value: ${{ jobs.detect.outputs.actions }}
-      templates:
-        value: ${{ jobs.detect.outputs.templates }}
-      docker:
-        value: ${{ jobs.detect.outputs.docker }}
-      dockerfile:
-        value: ${{ jobs.detect.outputs.dockerfile }}
-      swagger:
-        value: ${{ jobs.detect.outputs.swagger }}
-      yaml:
-        value: ${{ jobs.detect.outputs.yaml }}
-      json:
-        value: ${{ jobs.detect.outputs.json }}
-      e2e:
-        value: ${{ jobs.detect.outputs.e2e }}
-      shell:
-        value: ${{ jobs.detect.outputs.shell }}
-
-permissions:
-  contents: read

 jobs:
  detect:
+    name: detect which files changed
    runs-on: ubuntu-latest
    timeout-minutes: 3
+    # Map a step output to a job output
    outputs:
      backend: ${{ steps.changes.outputs.backend }}
      frontend: ${{ steps.changes.outputs.frontend }}
      docs: ${{ steps.changes.outputs.docs }}
      actions: ${{ steps.changes.outputs.actions }}
-      templates: ${{ steps.changes.outputs.templates }}
-      docker: ${{ steps.changes.outputs.docker }}
-      dockerfile: ${{ steps.changes.outputs.dockerfile }}
-      swagger: ${{ steps.changes.outputs.swagger }}
-      yaml: ${{ steps.changes.outputs.yaml }}
-      json: ${{ steps.changes.outputs.json }}
-      e2e: ${{ steps.changes.outputs.e2e }}
-      shell: ${{ steps.changes.outputs.shell }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: actions/checkout@v3
+      - uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
            backend:
              - "**/*.go"
-              - "templates/**/*.tmpl"
-              - "assets/emoji.json"
+              - "**/*.tmpl"
              - "go.mod"
              - "go.sum"
-              - "Makefile"
-              - ".golangci.yml"
-              - ".editorconfig"
-              - "options/locale/locale_en-US.json"
-              - "models/fixtures/**"
-              - "tests/*.ini.tmpl"
-              - "tests/gitea-repositories-meta/**"
-              - "tests/testdata/**"
-              - "tools/test-integration.sh"

            frontend:
-              - "*.ts"
+              - "**/*.js"
              - "web_src/**"
-              - "tools/generate-svg.ts"
-              - "tools/generate-svg-vscode-extensions.json"
-              - "tsconfig.json"
-              - "assets/emoji.json"
              - "package.json"
-              - "pnpm-lock.yaml"
-              - "pnpm-workspace.yaml"
-              - "Makefile"
+              - "package-lock.json"

            docs:
              - "**/*.md"
-              - ".markdownlint.yaml"
-              - "package.json"
-              - "pnpm-lock.yaml"
-              - "pnpm-workspace.yaml"
+              - "docs/**"

            actions:
              - ".github/workflows/*"
-              - ".github/actions/**"
-              - "Makefile"
-
-            templates:
-              - "tools/lint-templates-*.ts"
-              - "templates/**/*.tmpl"
-              - "pyproject.toml"
-              - "uv.lock"
-
-            docker:
-              - ".github/workflows/pull-docker-dryrun.yml"
-              - ".github/actions/docker-dryrun/**"
-              - "Dockerfile"
-              - "Dockerfile.rootless"
-              - "docker/**"
-              - "Makefile"
-
-            dockerfile:
-              - "Dockerfile"
-              - "Dockerfile.rootless"
-
-            swagger:
-              - "templates/swagger/v1_json.tmpl"
-              - "templates/swagger/v1_input.json"
-              - "Makefile"
-              - "package.json"
-              - "pnpm-lock.yaml"
-              - "pnpm-workspace.yaml"
-              - ".spectral.yaml"
-
-            yaml:
-              - "**/*.yml"
-              - "**/*.yaml"
-              - ".yamllint.yaml"
-              - "pyproject.toml"
-
-            json:
-              - "**/*.json"
-              - "**/*.json5"
-              - "eslint.json.config.ts"
-
-            e2e:
-              - "tests/e2e/**"
-              - "tools/test-e2e.sh"
-              - "playwright.config.ts"
-
-            shell:
-              - "**/*.sh"
-              - ".shellcheckrc"
@@ -1,26 +0,0 @@
-name: giteabot backport
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-jobs:
-  giteabot:
-    if: github.repository == 'go-gitea/gitea'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
-        with:
-          github_token: ${{ secrets.GITEABOT_TOKEN }}
-          gitea_fork: giteabot/gitea
-          checks: backport
@@ -1,51 +0,0 @@
-name: giteabot
-
-on:
-  # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
-  # forks, which the bot needs to write labels, statuses and comments. Safe here
-  # because the job only runs a pinned action and never checks out PR HEAD.
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types:
-      - opened
-      - synchronize
-      - labeled
-      - unlabeled
-      - closed
-      - review_requested
-      - review_request_removed
-  pull_request_review:
-    types:
-      - submitted
-      - edited
-      - dismissed
-  schedule:
-    - cron: "15 3 * * *"
-  workflow_dispatch:
-    inputs:
-      checks:
-        description: Comma-separated list of non-backport checks to run
-        required: false
-        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-  statuses: write
-
-concurrency:
-  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
-  cancel-in-progress: false
-
-jobs:
-  giteabot:
-    if: github.repository == 'go-gitea/gitea'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      # pull_request_review runs without repository secrets on fork PRs, so fall
-      # back to the workflow token for the non-backport checks handled here.
-      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
-        with:
-          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
-          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
@@ -7,9 +7,6 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
@@ -19,51 +16,58 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
        with:
-          lint-cache: "true"
+          go-version: ">=1.20"
+          check-latest: true
      - run: make deps-backend deps-tools
-      - run: TAGS="bindata" make generate-go # lint-go also lints with "bindata" tags which requires "_bindata.go"
      - run: make lint-backend
+        env:
+          TAGS: bindata sqlite sqlite_unlock_notify

-  lint-on-demand:
+  lint-go-windows:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
        with:
-          cache: "false"
-      - uses: ./.github/actions/node-setup
+          go-version: ">=1.20"
+          check-latest: true
+      - run: make deps-backend deps-tools
+      - run: make lint-go-windows lint-go-vet
+        env:
+          TAGS: bindata sqlite sqlite_unlock_notify
+          GOOS: windows
+          GOARCH: amd64
+
+  lint-go-gogit:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
        with:
-          cache: "false"
-
-      - run: make lint-spell
-
-      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          python-version: 3.14
-      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
-        run: make deps-py lint-templates lint-yaml
-
-      - if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.swagger == 'true' || needs.files-changed.outputs.json == 'true'
-        run: make deps-frontend lint-md lint-swagger lint-json
-
-      - if: needs.files-changed.outputs.actions == 'true'
-        run: make lint-actions
-
-      - if: needs.files-changed.outputs.shell == 'true'
-        run: make lint-shell
+          go-version: ">=1.20"
+          check-latest: true
+      - run: make deps-backend deps-tools
+      - run: make lint-go
+        env:
+          TAGS: bindata gogit sqlite sqlite_unlock_notify

  checks-backend:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20"
+          check-latest: true
      - run: make deps-backend deps-tools
      - run: make --always-make checks-backend # ensure the "go-licenses" make target runs

@@ -72,12 +76,13 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/node-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
-      - run: make test-frontend
      - run: make frontend

  backend:
@@ -85,13 +90,17 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-      - run: make deps-backend generate-go
-      # no frontend build here as backend should be able to build, even without any frontend files
-      # CGO is not used when cross-compile, so these steps also test if the code is compatible with CGO disabled
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20"
+          check-latest: true
+      # no frontend build here as backend should be able to build
+      # even without any frontend files
+      - run: make deps-backend deps-tools
+      - run: go build -o gitea_no_gcc # test if build succeeds without the sqlite tag
      - name: build-backend-arm64
-        run: go build -o gitea_linux_arm64
+        run: make backend # test cross compile
        env:
          GOOS: linux
          GOARCH: arm64
@@ -103,7 +112,29 @@ jobs:
          GOARCH: amd64
          TAGS: bindata gogit
      - name: build-backend-386
-        run: go build -o gitea_linux_386
+        run: go build -o gitea_linux_386 # test if compatible with 32 bit
        env:
          GOOS: linux
          GOARCH: 386
+
+  docs:
+    if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - run: make deps-frontend
+      - run: make lint-md
+      - run: make docs # test if build could succeed
+
+  actions:
+    if: needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+      - run: make lint-actions
@@ -7,131 +7,104 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml

-  test-pgsql-shard-1:
-    if: needs.files-changed.outputs.backend == 'true'
+  test-pgsql:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    timeout-minutes: 50
    services:
      pgsql:
-        image: postgres:14
+        image: postgres:15
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
        ports:
          - "5432:5432"
      ldap:
-        image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
+        image: gitea/test-openldap:latest
        ports:
          - "389:389"
          - "636:636"
      minio:
        # as github actions doesn't support "entrypoint", we need to use a non-official image
        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2025.7.23
+        image: bitnami/minio:2021.3.17
        env:
-          MINIO_ROOT_USER: 123456
-          MINIO_ROOT_PASSWORD: 12345678
+          MINIO_ACCESS_KEY: 123456
+          MINIO_SECRET_KEY: 12345678
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-      - uses: ./.github/actions/pgsql-shard
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
        with:
-          shard: 1
-          total-shards: 2
-          run-migration: "true"
-
-  test-pgsql-shard-2:
-    if: needs.files-changed.outputs.backend == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 50
-    services:
-      pgsql:
-        image: postgres:14
+          go-version: ">=1.20.0"
+      - name: Add hosts to /etc/hosts
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
+      - run: make deps-backend
+      - run: make backend
        env:
-          POSTGRES_DB: test
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - "5432:5432"
-      ldap:
-        image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
-        ports:
-          - "389:389"
-          - "636:636"
-      minio:
-        # as github actions doesn't support "entrypoint", we need to use a non-official image
-        # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2025.7.23
+          TAGS: bindata
+      - run: make test-pgsql-migration test-pgsql
+        timeout-minutes: 50
        env:
-          MINIO_ROOT_USER: 123456
-          MINIO_ROOT_PASSWORD: 12345678
-        ports:
-          - "9000:9000"
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-      - uses: ./.github/actions/pgsql-shard
-        with:
-          shard: 2
-          total-shards: 2
+          TAGS: bindata gogit
+          RACE_ENABLED: true
+          TEST_TAGS: gogit
+          TEST_LDAP: 1
+          USE_REPO_TEST_DIR: 1

  test-sqlite:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20.0"
      - run: make deps-backend
      - run: make backend
        env:
-          TAGS: bindata gogit
-          GOEXPERIMENT:
-      - run: GITEA_TEST_DATABASE=sqlite make test-migration
-        env:
-          TAGS: bindata gogit
-      - name: run tests
-        run: GITEA_TEST_DATABASE=sqlite make test-integration
+          TAGS: bindata gogit sqlite sqlite_unlock_notify
+      - run: make test-sqlite-migration test-sqlite
        timeout-minutes: 50
        env:
-          # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
-          GOTEST_FLAGS: -timeout=40m
-          TAGS: bindata gogit
-          GOEXPERIMENT:
+          TAGS: bindata gogit sqlite sqlite_unlock_notify
+          RACE_ENABLED: true
+          TEST_TAGS: gogit sqlite sqlite_unlock_notify
+          USE_REPO_TEST_DIR: 1

  test-unit:
-    if: needs.files-changed.outputs.backend == 'true'
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    services:
+      mysql:
+        image: mysql:5.7
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: yes
+          MYSQL_DATABASE: test
+        ports:
+          - "3306:3306"
      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
+        image: elasticsearch:7.5.0
        env:
          discovery.type: single-node
-          xpack.security.enabled: false
-          xpack.ml.enabled: false
-          ingest.geoip.downloader.enabled: false
-          ES_JAVA_OPTS: "-Xms1g -Xmx1g"
        ports:
          - "9200:9200"
-      meilisearch:
-        image: getmeili/meilisearch:v1
-        env:
-          MEILI_ENV: development # disable auth
+      smtpimap:
+        image: tabascoterrier/docker-imap-devel:latest
        ports:
-          - "7700:7700"
+          - "25:25"
+          - "143:143"
+          - "587:587"
+          - "993:993"
      redis:
-        image: redis:latest@sha256:e74c9b933d78e2829583d88f92793f4524752a15ac59c8baff2dd5ed000b7432
+        image: redis
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -140,118 +113,135 @@ jobs:
        ports:
          - 6379:6379
      minio:
-        image: bitnamilegacy/minio:2025.7.23
+        image: bitnami/minio:2021.3.17
        env:
-          MINIO_ROOT_USER: 123456
-          MINIO_ROOT_PASSWORD: 12345678
+          MINIO_ACCESS_KEY: 123456
+          MINIO_SECRET_KEY: 12345678
        ports:
          - "9000:9000"
-      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
-        ports:
-          - 10000:10000
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
-      - run: make deps-backend
-      - run: make generate-go
-        env:
-          TAGS: bindata
-      - name: unit-tests
-        run: make test-backend
-        env:
-          GOTEST_FLAGS: -race -timeout=20m
-          TAGS: bindata
-          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
-      - name: unit-tests-gogit
-        run: make test-backend
-        env:
-          GOTEST_FLAGS: -race -timeout=20m
-          TAGS: bindata gogit
-          GOEXPERIMENT:
-          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
-          GITEA_TEST_CI_SKIP_EXTERNAL: true
-      - run: make test-check
-
-  test-mysql:
-    if: needs.files-changed.outputs.backend == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    services:
-      mysql:
-        # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnamilegacy/mysql:8.4
-        env:
-          ALLOW_EMPTY_PASSWORD: true
-          MYSQL_DATABASE: testgitea
-        ports:
-          - "3306:3306"
-        options: >-
-          --mount type=tmpfs,destination=/bitnami/mysql/data
-      elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
-        env:
-          discovery.type: single-node
-          xpack.security.enabled: false
-          xpack.ml.enabled: false
-          ingest.geoip.downloader.enabled: false
-          ES_JAVA_OPTS: "-Xms1g -Xmx1g"
-        ports:
-          - "9200:9200"
-      smtpimap:
-        image: tabascoterrier/docker-imap-devel:latest@sha256:3fb7cf50b47693e7b80f6f74abea2def4d7386016931d61359864de8a0aba551
-        ports:
-          - "25:25"
-          - "143:143"
-          - "587:587"
-          - "993:993"
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20.0"
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
      - run: make deps-backend
      - run: make backend
        env:
          TAGS: bindata
-      - run: GITEA_TEST_DATABASE=mysql make test-migration
-      - name: run tests
-        run: GITEA_TEST_DATABASE=mysql make test-integration
+      - name: unit-tests
+        run: make unit-test-coverage test-check
        env:
          TAGS: bindata
+          RACE_ENABLED: true
+          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
+      - name: unit-tests-gogit
+        run: make unit-test-coverage test-check
+        env:
+          TAGS: bindata gogit
+          RACE_ENABLED: true
+          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
+
+  test-mysql5:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:5.7
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: yes
+          MYSQL_DATABASE: test
+        ports:
+          - "3306:3306"
+      elasticsearch:
+        image: elasticsearch:7.5.0
+        env:
+          discovery.type: single-node
+        ports:
+          - "9200:9200"
+      smtpimap:
+        image: tabascoterrier/docker-imap-devel:latest
+        ports:
+          - "25:25"
+          - "143:143"
+          - "587:587"
+          - "993:993"
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20.0"
+      - name: Add hosts to /etc/hosts
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
+      - run: make deps-backend
+      - run: make backend
+        env:
+          TAGS: bindata
+      - name: run tests
+        run: make test-mysql-migration integration-test-coverage
+        env:
+          TAGS: bindata
+          RACE_ENABLED: true
+          USE_REPO_TEST_DIR: 1
          TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"

+  test-mysql8:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    services:
+      mysql8:
+        image: mysql:8
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: yes
+          MYSQL_DATABASE: testgitea
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20.0"
+      - name: Add hosts to /etc/hosts
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql8" | sudo tee -a /etc/hosts'
+      - run: make deps-backend
+      - run: make backend
+        env:
+          TAGS: bindata
+      - run: make test-mysql8-migration test-mysql8
+        timeout-minutes: 50
+        env:
+          TAGS: bindata
+          USE_REPO_TEST_DIR: 1
+
  test-mssql:
-    if: needs.files-changed.outputs.backend == 'true'
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    services:
      mssql:
-        image: mcr.microsoft.com/mssql/server:2019-latest
+        image: mcr.microsoft.com/mssql/server:latest
        env:
          ACCEPT_EULA: Y
          MSSQL_PID: Standard
          SA_PASSWORD: MwantsaSecurePassword1
        ports:
          - "1433:1433"
-      devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
-        ports:
-          - 10000:10000
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20.0"
      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
+        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql" | sudo tee -a /etc/hosts'
      - run: make deps-backend
      - run: make backend
        env:
          TAGS: bindata
-      - run: GITEA_TEST_DATABASE=mssql make test-migration
-      - name: run tests
-        run: GITEA_TEST_DATABASE=mssql make test-integration
+      - run: make test-mssql-migration test-mssql
        timeout-minutes: 50
        env:
          TAGS: bindata
+          USE_REPO_TEST_DIR: 1
@@ -7,41 +7,17 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml

-  # QEMU-based build is slow (40-50 minutes), so run arm64 and riscv64 when dockerfile changes.
-  # Run amd64 when any docker-related files change, which is fast (4 minutes).
-  container-amd64:
-    if: needs.files-changed.outputs.docker == 'true'
-    needs: [files-changed]
+  docker-dryrun:
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/docker-dryrun
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/build-push-action@v4
        with:
-          platform: linux/amd64
-
-  container-arm64:
-    if: needs.files-changed.outputs.dockerfile == 'true'
-    needs: [files-changed]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/docker-dryrun
-        with:
-          platform: linux/arm64
-
-  container-riscv64:
-    if: needs.files-changed.outputs.dockerfile == 'true'
-    needs: [files-changed]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/docker-dryrun
-        with:
-          platform: linux/riscv64
+          push: false
+          tags: gitea/gitea:linux-amd64
@@ -7,31 +7,26 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

-permissions:
-  contents: read
-
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml

  test-e2e:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.e2e == 'true'
+    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: ./.github/actions/go-setup
-      - uses: ./.github/actions/node-setup
-      - run: make deps-frontend
-      - run: make frontend
-      - run: make deps-backend
-      - run: make backend
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ">=1.20"
+          check-latest: true
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - run: make deps-frontend frontend deps-backend
+      - run: npx playwright install --with-deps
+      - run: make test-e2e-sqlite
+        timeout-minutes: 40
        env:
-          TAGS: bindata
-      - run: make playwright
-      - run: make test-e2e
-        timeout-minutes: 10
-        env:
-          TAGS: bindata
-          FORCE_COLOR: 1
-          GITEA_TEST_E2E_DEBUG: 1
+          USE_REPO_TEST_DIR: 1
@@ -1,47 +0,0 @@
-name: labeler
-
-on:
-  # pull_request_target is required to label PRs from forks; jobs only use pinned
-  # actions or base-branch checkout, never PR-head code.
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
-    types: [opened, synchronize, reopened, edited, ready_for_review]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  labeler:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
-        with:
-          sync-labels: true
-
-  pr-title:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
-      - run: node ./tools/ci-tools.ts lint-pr-title
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-      - run: node ./tools/ci-tools.ts set-pr-labels
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          GITHUB_TOKEN: ${{ github.token }}
@@ -1,41 +0,0 @@
-name: release-nightly-snapcraft
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build-and-publish:
-    runs-on: ubuntu-latest
-
-    env:
-      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
-
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-
-      - name: Install snapcraft
-        run: sudo snap install snapcraft --classic
-
-      - name: Remote build
-        run: |
-          snapcraft remote-build \
-            --launchpad-accept-public-upload \
-            --build-for=amd64,arm64,armhf
-
-      - name: List built snaps
-        run: find . -maxdepth 1 -type f -name '*.snap' -print
-
-      - name: Upload and release snapcraft nightly build
-        run: |
-          set -euo pipefail
-
-          for snap in ./*.snap; do
-            echo "Uploading $snap to edge"
-            snapcraft upload --release="latest/edge" "$snap"
-          done
@@ -1,145 +1,92 @@
-name: release-nightly
+name: release-nightly-assets

 on:
  push:
-    branches: [main, release/v*]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+    branches: [ main, release/v* ]

 jobs:
  nightly-binary:
-    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
+    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@v4
        with:
-          go-version-file: go.mod
+          go-version: ">=1.20"
          check-latest: true
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@v3
        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+          node-version: 20
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
        env:
-          TAGS: bindata
+          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        uses: crazy-max/ghaction-import-gpg@v5
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
      - name: sign binaries
-        env:
-          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
+            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
          done
      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
-        env:
-          REF: ${{ github.ref }}
        run: |
-          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
-          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
-        with:
-          aws-region: ${{ secrets.AWS_REGION }}
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: upload binaries to s3
+        uses: jakejarvis/s3-sync-action@master
        env:
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-
-  nightly-container:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      contents: read
-      packages: write # to publish to ghcr.io
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: ${{ secrets.AWS_REGION }}
+          SOURCE_DIR: dist/release
+          DEST_DIR: gitea/${{ steps.clean_name.outputs.branch }}
+  nightly-docker:
+    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@v3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
      - name: Get cleaned branch name
        id: clean_name
-        env:
-          REF: ${{ github.ref }}
        run: |
-          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          # if main then say nightly otherwise cleanup name
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "branch=nightly" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          tags: |
-            type=raw,value=${{ steps.clean_name.outputs.branch }}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            suffix=-rootless
-          tags: |
-            type=raw,value=${{ steps.clean_name.outputs.branch }}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - name: build rootful docker image
+        uses: docker/build-push-action@v4
        with:
          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
+          platforms: linux/amd64,linux/arm64
          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
-          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
+          tags: gitea/gitea:${{ steps.clean_name.outputs.branch }}
      - name: build rootless docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@v4
        with:
          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
+          platforms: linux/amd64,linux/arm64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
-          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless,mode=max
+          tags: gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
@@ -1,150 +0,0 @@
-name: release-tag-rc
-
-on:
-  push:
-    tags:
-      - "v1*-rc*"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  binary:
-    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - run: make deps-frontend deps-backend
-      # xgo build
-      - run: make release
-        env:
-          TAGS: bindata
-      - name: import gpg key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
-        with:
-          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
-          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
-      - name: sign binaries
-        env:
-          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
-        run: |
-          for f in dist/release/*; do
-            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
-          done
-      # clean branch name to get the folder name in S3
-      - name: Get cleaned branch name
-        id: clean_name
-        env:
-          REF: ${{ github.ref }}
-        run: |
-          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
-          echo "Cleaned name is ${REF_NAME}"
-          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
-        with:
-          aws-region: ${{ secrets.AWS_REGION }}
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      - name: upload binaries to s3
-        env:
-          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
-        with:
-          gh-cli-version: 2.39.1
-      - name: create github release
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          gh release create "$TAG" --title "$TAG" --draft --notes-from-tag dist/release/*
-
-  container:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      contents: read
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          flavor: |
-            latest=false
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            latest=false
-            suffix=-rootless
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
@@ -1,162 +0,0 @@
-name: release-tag-version
-
-on:
-  push:
-    tags:
-      - "v1.*"
-      - "!v1*-rc*"
-      - "!v1*-dev"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  binary:
-    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - run: make deps-frontend deps-backend
-      # xgo build
-      - run: make release
-        env:
-          TAGS: bindata
-      - name: import gpg key
-        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
-        with:
-          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
-          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
-      - name: sign binaries
-        env:
-          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
-        run: |
-          for f in dist/release/*; do
-            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
-          done
-      # clean branch name to get the folder name in S3
-      - name: Get cleaned branch name
-        id: clean_name
-        env:
-          REF: ${{ github.ref }}
-        run: |
-          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
-          echo "Cleaned name is ${REF_NAME}"
-          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
-        with:
-          aws-region: ${{ secrets.AWS_REGION }}
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      - name: upload binaries to s3
-        env:
-          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
-        with:
-          gh-cli-version: 2.39.1
-      - name: create github release
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*
-
-  container:
-    runs-on: namespace-profile-gitea-release-docker
-    permissions:
-      contents: read
-      packages: write # to publish to ghcr.io
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
-      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
-      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # this will generate tags in the following format:
-          # latest
-          # 1
-          # 1.2
-          # 1.2.3
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}
-            type=semver,pattern={{major}}.{{minor}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            suffix=-rootless,onlatest=true
-          # this will generate tags in the following format (with -rootless suffix added):
-          # latest
-          # 1
-          # 1.2
-          # 1.2.3
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}
-            type=semver,pattern={{major}}.{{minor}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
@@ -9,24 +9,12 @@ _test

 # IntelliJ
 .idea
-.run
-
-# IntelliJ Gateway
-.uuid
-
 # Goland's output filename can not be set manually
 /go_build_*
-/gitea_*

 # MS VSCode
 .vscode
-__debug_bin*
-
-# Visual Studio
-/.vs/
-
-# mise version managment tool
-mise.toml
+__debug_bin

 *.cgo1.go
 *.cgo2.c
@@ -39,23 +27,28 @@ _testmain.go
 *.exe
 *.test
 *.prof
-*.tsbuildinfo

 *coverage.out
 coverage.all
 cpu.out

-/modules/migration/bindata.*
-/modules/options/bindata.*
-/modules/public/bindata.*
-/modules/templates/bindata.*
+/modules/migration/bindata.go
+/modules/migration/bindata.go.hash
+/modules/options/bindata.go
+/modules/options/bindata.go.hash
+/modules/public/bindata.go
+/modules/public/bindata.go.hash
+/modules/templates/bindata.go
+/modules/templates/bindata.go.hash

 *.db
 *.log
 *.log.*.gz

 /gitea
+/gitea-vet
 /debug
+/integrations.test

 /bin
 /dist
@@ -64,30 +57,42 @@ cpu.out
 /data
 /indexers
 /log
-/public/assets/img/avatar
-/tests/e2e-output
+/public/img/avatar
 /tests/integration/gitea-integration-*
 /tests/integration/indexers-*
+/tests/e2e/gitea-e2e-*
+/tests/e2e/indexers-*
+/tests/e2e/reports
+/tests/e2e/test-artifacts
+/tests/e2e/test-snapshots
 /tests/*.ini
 /tests/**/*.git/**/*.sample
 /node_modules
-/.venv
 /yarn.lock
 /yarn-error.log
 /npm-debug.log*
-/.pnpm-store
-/public/assets/.vite
-/public/assets/js
-/public/assets/css
-/public/assets/fonts
-/public/assets/licenses.txt
+/public/js
+/public/css
+/public/fonts
+/public/img/webpack
 /vendor
+/web_src/fomantic/node_modules
+/web_src/fomantic/build/*
+!/web_src/fomantic/build/semantic.js
+!/web_src/fomantic/build/semantic.css
+!/web_src/fomantic/build/themes
+/web_src/fomantic/build/themes/*
+!/web_src/fomantic/build/themes/default
+/web_src/fomantic/build/themes/default/assets/*
+!/web_src/fomantic/build/themes/default/assets/fonts
+/web_src/fomantic/build/themes/default/assets/fonts/*
+!/web_src/fomantic/build/themes/default/assets/fonts/icons.woff2
+!/web_src/fomantic/build/themes/default/assets/fonts/outline-icons.woff2
 /VERSION
 /.air
-
+/.go-licenses

 # Snapcraft
-/gitea_a*.txt
 snap/.snapcraft/
 parts/
 stage/
@@ -97,26 +102,8 @@ prime/
 *_source.tar.bz2
 .DS_Store

-# nix-direnv generated files
-.direnv/
-
 # Make evidence files
 /.make_evidence

 # Manpage
 /man
-
-# Ignore AI/LLM instruction files
-/.claude/
-/.cursorrules
-/.cursor/
-/.goosehints
-/.windsurfrules
-/.github/copilot-instructions.md
-/llms.txt
-
-# Ignore worktrees when working on multiple branches
-.worktrees/
-
-# A Makefile for custom make targets
-Makefile.local
@@ -0,0 +1,41 @@
+tasks:
+  - name: Setup
+    init: |
+      cp -r contrib/ide/vscode .vscode
+      make deps
+      make build
+    command: |
+      gp sync-done setup
+      exit 0
+  - name: Run backend
+    command: |
+      gp sync-await setup
+      if [ ! -f custom/conf/app.ini ]
+      then
+        mkdir -p custom/conf/
+        echo -e "[server]\nROOT_URL=$(gp url 3000)/" > custom/conf/app.ini
+        echo -e "\n[database]\nDB_TYPE = sqlite3\nPATH = $GITPOD_REPO_ROOT/data/gitea.db" >> custom/conf/app.ini
+      fi
+      export TAGS="sqlite sqlite_unlock_notify"
+      make watch-backend
+  - name: Run frontend
+    command: |
+      gp sync-await setup
+      make watch-frontend
+    openMode: split-right
+
+vscode:
+  extensions:
+    - editorconfig.editorconfig
+    - dbaeumer.vscode-eslint
+    - golang.go
+    - stylelint.vscode-stylelint
+    - DavidAnson.vscode-markdownlint
+    - Vue.volar
+    - ms-azuretools.vscode-docker
+    - zixuanchen.vitest-explorer
+    - alexcvzz.vscode-sqlite
+
+ports:
+  - name: Gitea
+    port: 3000
@@ -1,190 +1,131 @@
-version: "2"
-output:
-  sort-order:
-    - file
 linters:
-  default: none
  enable:
    - bidichk
-    - bodyclose
+    # - deadcode # deprecated - https://github.com/golangci/golangci-lint/issues/1841
    - depguard
    - dupl
    - errcheck
    - forbidigo
-    - gocheckcompilerdirectives
    - gocritic
+    # - gocyclo # The cyclomatic complexety of a lot of functions is too high, we should refactor those another time.
+    - gofmt
+    - gofumpt
+    - gosimple
    - govet
    - ineffassign
-    - mirror
-    - modernize
    - nakedret
-    - nilnil
    - nolintlint
-    - perfsprint
    - revive
    - staticcheck
-    - testifylint
+    # - structcheck # deprecated - https://github.com/golangci/golangci-lint/issues/1841
+    - stylecheck
+    - typecheck
    - unconvert
-    - unparam
    - unused
-    - usestdlibvars
-    - usetesting
+    # - varcheck # deprecated - https://github.com/golangci/golangci-lint/issues/1841
    - wastedassign
-  settings:
-    depguard:
-      rules:
-        main:
-          deny:
-            - pkg: encoding/json
-              desc: use gitea's modules/json instead of encoding/json
-            - pkg: github.com/unknwon/com
-              desc: use gitea's util and replacements
-            - pkg: io/ioutil
-              desc: use os or io instead
-            - pkg: golang.org/x/exp
-              desc: it's experimental and unreliable
-            - pkg: gitea.dev/modules/git/internal
-              desc: do not use the internal package, use AddXxx function instead
-            - pkg: gopkg.in/ini.v1
-              desc: do not use the ini package, use gitea's config system instead
-            - pkg: gitea.com/go-chi/cache
-              desc: do not use the go-chi cache package, use gitea's cache system
-            - pkg: github.com/pkg/errors
-              desc: use builtin errors package instead
-        migrations:
-          files:
-            - '**/models/migrations/**/*.go'
-          deny:
-            - pkg: gitea.dev/models$
-              desc: migrations must not depend on the models package
-            - pkg: gitea.dev/modules/structs
-              desc: migrations must not depend on modules/structs (API structures change over time)
-    nolintlint:
-      allow-unused: false
-      require-explanation: true
-      require-specific: true
-    gocritic:
-      enabled-checks:
-        - equalFold
-      disabled-checks:
-        - ifElseChain
-        - singleCaseSwitch # Every time this occurred in the code, there was no other way.
-        - deprecatedComment # conflicts with go-swagger comments
-    revive:
-      severity: error
-      rules:
-        - name: blank-imports
-        - name: constant-logical-expr
-        - name: context-as-argument
-        - name: context-keys-type
-        - name: dot-imports
-        - name: empty-lines
-        - name: error-return
-        - name: error-strings
-        - name: exported
-        - name: identical-branches
-        - name: if-return
-        - name: increment-decrement
-        - name: modifies-value-receiver
-        - name: package-comments
-        - name: redefines-builtin-id
-        - name: superfluous-else
-        - name: time-naming
-        - name: unexported-return
-        - name: var-declaration
-        - name: var-naming
-          arguments:
-            - [] # AllowList - do not remove as args for the rule are positional and won't work without lists first
-            - [] # DenyList
-            - - skip-package-name-checks: true # supress errors from underscore in migration packages
-    staticcheck:
-      checks:
-        - all
-        - -ST1003
-        - -ST1005
-        - -QF1001
-        - -QF1006
-        - -QF1008
-    testifylint:
-      disable:
-        - go-require
-        - require-error
-    usetesting:
-      os-temp-dir: true
-    perfsprint:
-      concat-loop: false
-    govet:
-      enable:
-        - nilness
-        - unusedwrite
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
+  enable-all: false
+  disable-all: true
+  fast: false
+
+run:
+  go: "1.20"
+  timeout: 10m
+  skip-dirs:
+    - node_modules
+    - public
+    - web_src
+
+linters-settings:
+  stylecheck:
+    checks: ["all", "-ST1005", "-ST1003"]
+  nakedret:
+    max-func-lines: 0
+  gocritic:
+    disabled-checks:
+      - ifElseChain
+      - singleCaseSwitch # Every time this occurred in the code, there  was no other way.
+  revive:
+    ignore-generated-header: false
+    severity: warning
+    confidence: 0.8
+    errorCode: 1
+    warningCode: 1
    rules:
-      - linters:
-          - dupl
-          - errcheck
-          - staticcheck
-          - unparam
-        path: _test\.go
-      - linters:
-          - dupl
-          - errcheck
-        path: models/migrations/v
-      - linters:
-          - forbidigo
-        path: cmd
-      - linters:
-          - dupl
-        text: (?i)webhook
-      - linters:
-          - gocritic
-        text: (?i)`ID' should not be capitalized
-      - linters:
-          - unused
-        text: (?i)swagger
-      - linters:
-          - gocritic
-        text: '(?i)commentFormatting: put a space between `//` and comment text'
-      - linters:
-          - gocritic
-        text: '(?i)exitAfterDefer:'
-    paths:
-      - node_modules
-      - .venv
-      - public
-      - web_src
-      - third_party$
-      - builtin$
-      - examples$
+      - name: blank-imports
+      - name: context-as-argument
+      - name: context-keys-type
+      - name: dot-imports
+      - name: error-return
+      - name: error-strings
+      - name: error-naming
+      - name: exported
+      - name: if-return
+      - name: increment-decrement
+      - name: var-naming
+      - name: var-declaration
+      - name: package-comments
+      - name: range
+      - name: receiver-naming
+      - name: time-naming
+      - name: unexported-return
+      - name: indent-error-flow
+      - name: errorf
+      - name: duplicated-imports
+      - name: modifies-value-receiver
+  gofumpt:
+    extra-rules: true
+    lang-version: "1.20"
+  depguard:
+    list-type: denylist
+    # Check the list against standard lib.
+    include-go-root: true
+    packages-with-error-message:
+      - encoding/json: "use gitea's modules/json instead of encoding/json"
+      - github.com/unknwon/com: "use gitea's util and replacements"
+      - io/ioutil: "use os or io instead"
+      - golang.org/x/exp: "it's experimental and unreliable."
+      - code.gitea.io/gitea/modules/git/internal: "do not use the internal package, use AddXxx function instead"
+      - gopkg.in/ini.v1: "do not use the ini package, use gitea's config system instead"
+
 issues:
  max-issues-per-linter: 0
  max-same-issues: 0
-formatters:
-  enable:
-    - gci
-    - gofumpt
-  settings:
-    gci:
-      custom-order: true
-      sections:
-        - standard
-        - prefix(gitea.dev)
-        - blank
-        - default
-    gofumpt:
-      extra-rules: true
-  exclusions:
-    generated: lax
-    paths:
-      - node_modules
-      - .venv
-      - public
-      - web_src
-
-run:
-  timeout: 10m
+  exclude-rules:
+    # Exclude some linters from running on tests files.
+    - path: _test\.go
+      linters:
+        - gocyclo
+        - errcheck
+        - dupl
+        - gosec
+        - unparam
+        - staticcheck
+    - path: models/migrations/v
+      linters:
+        - gocyclo
+        - errcheck
+        - dupl
+        - gosec
+    - path: cmd
+      linters:
+        - forbidigo
+    - linters:
+        - dupl
+      text: "webhook"
+    - linters:
+        - gocritic
+      text: "`ID' should not be capitalized"
+    - linters:
+        - unused
+        - deadcode
+      text: "swagger"
+    - linters:
+        - staticcheck
+      text: "argument x is overwritten before first use"
+    - text: "commentFormatting: put a space between `//` and comment text"
+      linters:
+        - gocritic
+    - text: "exitAfterDefer:"
+      linters:
+        - gocritic
@@ -1,8 +1,8 @@
 *.min.css
 *.min.js
 /assets/*.json
-/options/gitignore
-/options/license
-/public/assets
+/modules/options/bindata.go
+/modules/public/bindata.go
+/modules/templates/bindata.go
 /vendor
 node_modules
@@ -1,2 +0,0 @@
-Unknwon <u@gogs.io> <joe2010xtmf@163.com>
-Unknwon <u@gogs.io> 无闻 <u@gogs.io>
@@ -1,15 +1,18 @@
 commands-show-output: false
 fenced-code-language: false
 first-line-h1: false
-heading-increment: false
+header-increment: false
 line-length: {code_blocks: false, tables: false, stern: true, line_length: -1}
 no-alt-text: false
 no-bare-urls: false
-no-emphasis-as-heading: false
+no-blanks-blockquote: false
+no-duplicate-header: {allow_different_nesting: true}
+no-emphasis-as-header: false
 no-empty-links: false
 no-hard-tabs: {code_blocks: false}
 no-inline-html: false
 no-space-in-code: false
 no-space-in-emphasis: false
+no-trailing-punctuation: false
 no-trailing-spaces: {br_spaces: 0}
 single-h1: false
@@ -0,0 +1,6 @@
+audit=false
+fund=false
+update-notifier=false
+package-lock=true
+save-exact=true
+lockfile-version=3
@@ -1 +0,0 @@
-disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2154,SC2155,SC2164,SC2181,SC2207
@@ -0,0 +1,141 @@
+plugins:
+  - stylelint-declaration-strict-value
+
+ignoreFiles:
+  - "**/*.go"
+
+overrides:
+  - files: ["**/chroma/*", "**/codemirror/*", "**/standalone/*", "**/console.css", "font_i18n.css"]
+    rules:
+      scale-unlimited/declaration-strict-value: null
+  - files: ["**/chroma/*", "**/codemirror/*"]
+    rules:
+      block-no-empty: null
+  - files: ["**/*.vue"]
+    customSyntax: postcss-html
+
+rules:
+  alpha-value-notation: null
+  annotation-no-unknown: true
+  at-rule-allowed-list: null
+  at-rule-disallowed-list: null
+  at-rule-empty-line-before: null
+  at-rule-no-unknown: true
+  at-rule-no-vendor-prefix: true
+  at-rule-property-required-list: null
+  block-no-empty: true
+  color-function-notation: null
+  color-hex-alpha: null
+  color-hex-length: null
+  color-named: null
+  color-no-hex: null
+  color-no-invalid-hex: true
+  comment-empty-line-before: null
+  comment-no-empty: true
+  comment-pattern: null
+  comment-whitespace-inside: null
+  comment-word-disallowed-list: null
+  custom-media-pattern: null
+  custom-property-empty-line-before: null
+  custom-property-no-missing-var-function: true
+  custom-property-pattern: null
+  declaration-block-no-duplicate-custom-properties: true
+  declaration-block-no-duplicate-properties: [true, {ignore: [consecutive-duplicates-with-different-values]}]
+  declaration-block-no-redundant-longhand-properties: null
+  declaration-block-no-shorthand-property-overrides: null
+  declaration-block-single-line-max-declarations: null
+  declaration-empty-line-before: null
+  declaration-no-important: null
+  declaration-property-max-values: null
+  declaration-property-unit-allowed-list: null
+  declaration-property-unit-disallowed-list: null
+  declaration-property-value-allowed-list: null
+  declaration-property-value-disallowed-list: null
+  declaration-property-value-no-unknown: true
+  font-family-name-quotes: always-where-recommended
+  font-family-no-duplicate-names: true
+  font-family-no-missing-generic-family-keyword: true
+  font-weight-notation: null
+  function-allowed-list: null
+  function-calc-no-unspaced-operator: true
+  function-disallowed-list: null
+  function-linear-gradient-no-nonstandard-direction: true
+  function-name-case: lower
+  function-no-unknown: null
+  function-url-no-scheme-relative: null
+  function-url-quotes: always
+  function-url-scheme-allowed-list: null
+  function-url-scheme-disallowed-list: null
+  hue-degree-notation: null
+  import-notation: string
+  keyframe-block-no-duplicate-selectors: true
+  keyframe-declaration-no-important: true
+  keyframe-selector-notation: null
+  keyframes-name-pattern: null
+  length-zero-no-unit: true
+  max-nesting-depth: null
+  media-feature-name-allowed-list: null
+  media-feature-name-disallowed-list: null
+  media-feature-name-no-unknown: true
+  media-feature-name-no-vendor-prefix: true
+  media-feature-name-unit-allowed-list: null
+  media-feature-name-value-allowed-list: null
+  media-feature-name-value-no-unknown: true
+  media-feature-range-notation: null
+  named-grid-areas-no-invalid: true
+  no-descending-specificity: null
+  no-duplicate-at-import-rules: true
+  no-duplicate-selectors: true
+  no-empty-source: true
+  no-invalid-double-slash-comments: true
+  no-invalid-position-at-import-rule: null
+  no-irregular-whitespace: true
+  no-unknown-animations: null
+  no-unknown-custom-properties: null
+  number-max-precision: null
+  property-allowed-list: null
+  property-disallowed-list: null
+  property-no-unknown: true
+  property-no-vendor-prefix: null
+  rule-empty-line-before: null
+  rule-selector-property-disallowed-list: null
+  scale-unlimited/declaration-strict-value: [[color, background-color, border-color, font-weight], {ignoreValues: /^(inherit|transparent|unset|initial|currentcolor|none)$/, ignoreFunctions: false, disableFix: true}]
+  selector-attribute-name-disallowed-list: null
+  selector-attribute-operator-allowed-list: null
+  selector-attribute-operator-disallowed-list: null
+  selector-attribute-quotes: always
+  selector-class-pattern: null
+  selector-combinator-allowed-list: null
+  selector-combinator-disallowed-list: null
+  selector-disallowed-list: null
+  selector-id-pattern: null
+  selector-max-attribute: null
+  selector-max-class: null
+  selector-max-combinators: null
+  selector-max-compound-selectors: null
+  selector-max-id: null
+  selector-max-pseudo-class: null
+  selector-max-specificity: null
+  selector-max-type: null
+  selector-max-universal: null
+  selector-nested-pattern: null
+  selector-no-qualifying-type: null
+  selector-no-vendor-prefix: true
+  selector-not-notation: null
+  selector-pseudo-class-allowed-list: null
+  selector-pseudo-class-disallowed-list: null
+  selector-pseudo-class-no-unknown: true
+  selector-pseudo-element-allowed-list: null
+  selector-pseudo-element-colon-notation: double
+  selector-pseudo-element-disallowed-list: null
+  selector-pseudo-element-no-unknown: true
+  selector-type-case: lower
+  selector-type-no-unknown: [true, {ignore: [custom-elements]}]
+  shorthand-property-no-redundant-values: true
+  string-no-newline: true
+  time-min-milliseconds: null
+  unit-allowed-list: null
+  unit-disallowed-list: null
+  unit-no-unknown: true
+  value-keyword-case: null
+  value-no-vendor-prefix: [true, {ignoreValues: [box, inline-box]}]
@@ -1,42 +0,0 @@
-extends: default
-
-rules:
-  braces:
-    min-spaces-inside: 0
-    max-spaces-inside: 1
-    min-spaces-inside-empty: 0
-    max-spaces-inside-empty: 0
-
-  brackets:
-    min-spaces-inside: 0
-    max-spaces-inside: 1
-    min-spaces-inside-empty: 0
-    max-spaces-inside-empty: 0
-
-  comments:
-    require-starting-space: true
-    ignore-shebangs: true
-    min-spaces-from-content: 1
-
-  comments-indentation:
-    level: error
-
-  document-start: disable
-
-  document-end:
-    present: false
-
-  empty-lines:
-    max: 1
-
-  indentation:
-    spaces: 2
-
-  line-length: disable
-
-  truthy:
-    allowed-values: ["true", "false", "on", "off"]
-
-ignore: |
-  .venv
-  node_modules
@@ -1,20 +0,0 @@
- Use `make help` to find available development targets
- Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
- Run `make lint-js` to lint `.ts` files
- Run `make tidy` after any `go.mod` changes
- Run single go tests with `go test -run '^TestName$' ./modulepath/`
- Run single js test files with `pnpm exec vitest <path-filter>`
- Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
- Add the current year into the copyright header of new `.go` files
- Ensure no trailing whitespace in edited files
- Use Conventional Commits for commit messages and PR titles, e.g. `type(scope): subject`; `!` before the colon if breaking. Use `test` type for test-only changes.
- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
- Preserve existing code comments, do not remove or rewrite comments that are still relevant
- Keep comments short, prefer same-line, explain why, never narrate code
- Prefer unit tests over integration tests when logic is testable in isolation
- Aim for sub-2s local runtime for integration and e2e tests
- In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
- For CSS layout, prefer `flex-*` helpers over per-child `tw-ml-*` / `tw-mr-*` margins; fall back to `tw-*` utilities when specificity requires `!important`
- Include authorship attribution in issue and pull request comments
- Always add `Assisted-By` trailers to commit messages in format `Assisted-by: AGENT_NAME:MODEL_VERSION`
- Never add `Co-Authored-By` `Signed-off-by` trailer to commit messages. Sign off must be done by a human.
@@ -42,13 +42,13 @@ GARGS = "--no-print-directory"

 # The GNU convention is to use the lowercased `prefix` variable/macro to
 # specify the installation directory. Humor them.
-GPREFIX =
+GPREFIX = ""
 .if defined(PREFIX) && ! defined(prefix)
    GPREFIX = 'prefix = "$(PREFIX)"'
 .endif

 .BEGIN: .SILENT
-	which $(GMAKE) || (printf "Error: GNU Make is required!\n\n" 1>&2 && false)
+	which $(GMAKE) || printf "Error: GNU Make is required!\n\n" 1>&2 && false

 .PHONY: FRC
 $(.TARGETS): FRC
@@ -1 +0,0 @@
-@AGENTS.md
@@ -30,7 +30,7 @@ These are the values to which people in the Gitea community should aspire.
 - **Be constructive.**
  - Avoid derailing: stay on topic; if you want to talk about something else, start a new conversation.
  - Avoid unconstructive criticism: don't merely decry the current state of affairs; offer—or at least solicit—suggestions as to how things may be improved.
-  - Avoid snarking (pithy, unproductive, sniping comments).
+  - Avoid snarking (pithy, unproductive, sniping comments)
  - Avoid discussing potentially offensive or sensitive issues; this all too often leads to unnecessary conflict.
  - Avoid microaggressions (brief and commonplace verbal, behavioral and environmental indignities that communicate hostile, derogatory or negative slights and insults to a person or group).
 - **Be responsible.**
@@ -42,7 +42,7 @@ People are complicated. You should expect to be misunderstood and to misundersta

 ### Our Pledge

-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.

 ### Our Standards

@@ -1,25 +1,18 @@
 # Contribution Guidelines

-This document explains how to contribute changes to the Gitea project. Topic-specific guides live in separate files so the essentials are easier to find.
-
-| Topic | Document |
-| :---- | :------- |
-| Backend (Go modules, API v1) | [docs/guideline-backend.md](docs/guideline-backend.md) |
-| Frontend (npm, UI guidelines) | [docs/guideline-frontend.md](docs/guideline-frontend.md) |
-| Maintainers, TOC, labels, merge queue, commit format for mergers | [docs/community-governance.md](docs/community-governance.md) |
-| Release cycle, backports, tagging releases | [docs/release-management.md](docs/release-management.md) |
-
 <details><summary>Table of Contents</summary>

 - [Contribution Guidelines](#contribution-guidelines)
  - [Introduction](#introduction)
-  - [AI Contribution Policy](#ai-contribution-policy)
  - [Issues](#issues)
    - [How to report issues](#how-to-report-issues)
    - [Types of issues](#types-of-issues)
    - [Discuss your design before the implementation](#discuss-your-design-before-the-implementation)
-    - [Issue locking](#issue-locking)
  - [Building Gitea](#building-gitea)
+  - [Dependencies](#dependencies)
+    - [Backend](#backend)
+    - [Frontend](#frontend)
+  - [Design guideline](#design-guideline)
  - [Styleguide](#styleguide)
  - [Copyright](#copyright)
  - [Testing](#testing)
@@ -27,39 +20,51 @@ This document explains how to contribute changes to the Gitea project. Topic-spe
  - [Code review](#code-review)
    - [Pull request format](#pull-request-format)
    - [PR title and summary](#pr-title-and-summary)
+    - [Milestone](#milestone)
+    - [Labels](#labels)
    - [Breaking PRs](#breaking-prs)
      - [What is a breaking PR?](#what-is-a-breaking-pr)
      - [How to handle breaking PRs?](#how-to-handle-breaking-prs)
    - [Maintaining open PRs](#maintaining-open-prs)
-    - [Reviewing PRs](#reviewing-prs)
-      - [For PR authors](#for-pr-authors)
+    - [Getting PRs merged](#getting-prs-merged)
+    - [Final call](#final-call)
+    - [Commit messages](#commit-messages)
+      - [PR Co-authors](#pr-co-authors)
+      - [PRs targeting `main`](#prs-targeting-main)
+      - [Backport PRs](#backport-prs)
  - [Documentation](#documentation)
+  - [API v1](#api-v1)
+    - [GitHub API compatibility](#github-api-compatibility)
+    - [Adding/Maintaining API routes](#addingmaintaining-api-routes)
+    - [When to use what HTTP method](#when-to-use-what-http-method)
+    - [Requirements for API routes](#requirements-for-api-routes)
+  - [Backports and Frontports](#backports-and-frontports)
+    - [What is backported?](#what-is-backported)
+    - [How to backport?](#how-to-backport)
+    - [Format of backport PRs](#format-of-backport-prs)
+    - [Frontports](#frontports)
  - [Developer Certificate of Origin (DCO)](#developer-certificate-of-origin-dco)
+  - [Release Cycle](#release-cycle)
+  - [Maintainers](#maintainers)
+  - [Technical Oversight Committee (TOC)](#technical-oversight-committee-toc)
+    - [Current TOC members](#current-toc-members)
+    - [Previous TOC/owners members](#previous-tocowners-members)
+  - [Governance Compensation](#governance-compensation)
+  - [TOC \& Working groups](#toc--working-groups)
+  - [Roadmap](#roadmap)
+  - [Versions](#versions)
+  - [Releasing Gitea](#releasing-gitea)

 </details>

 ## Introduction

+This document explains how to contribute changes to the Gitea project. \
 It assumes you have followed the [installation instructions](https://docs.gitea.com/category/installation). \
 Sensitive security-related issues should be reported to [security@gitea.io](mailto:security@gitea.io).

 For configuring IDEs for Gitea development, see the [contributed IDE configurations](contrib/ide/).

-## AI Contribution Policy
-
-Contributions made with the assistance of AI tools are welcome, but contributors must use them responsibly and disclose that use clearly.
-
-1. Review AI-generated code closely before marking a pull request ready for review.
-2. Manually test the changes and add appropriate automated tests where feasible.
-3. Only use AI to assist in contributions that you understand well enough to explain, defend, and revise yourself during review.
-4. Disclose AI-assisted content clearly.
-5. Do not use AI to reply to questions about your issue or pull request. The questions are for you, not an AI model.
-6. AI may be used to help draft issues and pull requests, but contributors remain responsible for the accuracy, completeness, and intent of what they submit.
-
-Maintainers reserve the right to close pull requests and issues that do not disclose AI assistance, that appear to be low-quality AI-generated content, or where the contributor cannot explain or defend the proposed changes themselves.
-
-We welcome new contributors, but cannot sustain the effort of supporting contributors who primarily defer to AI rather than engaging substantively with the review process.
-
 ## Issues

 ### How to report issues
@@ -70,10 +75,10 @@ If your issue has not been reported yet, [open an issue](https://github.com/go-g
 and answer the questions so we can understand and reproduce the problematic behavior. \
 Please write clear and concise instructions so that we can reproduce the behavior — even if it seems obvious. \
 The more detailed and specific you are, the faster we can fix the issue. \
-It is really helpful if you can reproduce your problem on a site running on the latest commits, i.e. <https://demo.gitea.com>, as perhaps your problem has already been fixed on a current version. \
+It is really helpful if you can reproduce your problem on a site running on the latest commits, i.e. <https://try.gitea.io>, as perhaps your problem has already been fixed on a current version. \
 Please follow the guidelines described in [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html) for your report.

-Please be kind—remember that Gitea comes at no cost to you, and you're getting free help.
+Please be kind, remember that Gitea comes at no cost to you, and you're getting free help.

 ### Types of issues

@@ -97,17 +102,38 @@ the goals for the project and tools.

 Pull requests should not be the place for architecture discussions.

-### Issue locking
-
-Commenting on closed or merged issues/PRs is strongly discouraged.
-Such comments will likely be overlooked as some maintainers may not view notifications on closed issues, thinking that the item is resolved.
-As such, commenting on closed/merged issues/PRs may be disabled prior to the scheduled auto-locking if a discussion starts or if unrelated comments are posted.
-If further discussion is needed, we encourage you to open a new issue instead and we recommend linking to the issue/PR in question for context.
-
 ## Building Gitea

 See the [development setup instructions](https://docs.gitea.com/development/hacking-on-gitea).

+## Dependencies
+
+### Backend
+
+Go dependencies are managed using [Go Modules](https://golang.org/cmd/go/#hdr-Module_maintenance). \
+You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).
+
+Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
+Apart from that, these files should only be modified by Pull Requests whose only purpose is to update dependencies.
+
+The `go.mod`, `go.sum` update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
+
+### Frontend
+
+For the frontend, we use [npm](https://www.npmjs.com/).
+
+The same restrictions apply for frontend dependencies as for backend dependencies, with the exceptions that the files for it are `package.json` and `package-lock.json`, and that new versions must always reference an existing version.
+
+## Design guideline
+
+Depending on your change, please read the
+
+- [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend)
+- [frontend development guideline](https://docs.gitea.com/contributing/guidelines-frontend)
+- [refactoring guideline](https://docs.gitea.com/contributing/guidelines-refactoring)
+
 ## Styleguide

 You should always run `make fmt` before committing to conform to Gitea's styleguide.
@@ -131,32 +157,24 @@ Here's how to run the test suite:

 - code lint

-|                       |                                                                              |
-| :-------------------- | :--------------------------------------------------------------------------- |
+|                       |                                                                   |
+| :-------------------- | :---------------------------------------------------------------- |
 |``make lint``          | lint everything (not needed if you only change the front- **or** backend)    |
-|``make lint-frontend`` | lint frontend files                                                          |
-|``make lint-backend``  | lint backend files                                                           |
+|``make lint-frontend`` | lint frontend files  |
+|``make lint-backend``  | lint backend files   |

 - run tests (we suggest running them on Linux)

-| Command                                       | Action                                               |                                             |
-|:----------------------------------------------|:-----------------------------------------------------| ------------------------------------------- |
-| ``make test-backend[\#SpecificTestName]``     | run unit test(s)                                     |                                             |
-| ``make test-integration[\#SpecificTestName]`` | run [integration](tests/integration) test(s)         | [More details](tests/integration/README.md) |
-| ``make test-e2e``                             | run [end-to-end](tests/e2e) test(s) using Playwright |                                             |
-
- E2E test environment variables
-
-| Variable                          | Description                                                 |
-| :-------------------------------- | :---------------------------------------------------------- |
-| ``GITEA_TEST_E2E_DEBUG``          | When set, show Gitea server output                          |
-| ``GITEA_TEST_E2E_FLAGS``          | Additional flags passed to Playwright, for example ``--ui`` |
-| ``GITEA_TEST_E2E_TIMEOUT_FACTOR`` | Timeout multiplier (default: 4 on CI, 1 locally)            |
+|  Command                               | Action                                           |              |
+| :------------------------------------- | :----------------------------------------------- | ------------ |
+|``make test[\#SpecificTestName]``       |  run unit test(s)  |
+|``make test-sqlite[\#SpecificTestName]``|  run [integration](tests/integration) test(s) for SQLite |[More details](tests/integration/README.md)  |
+|``make test-e2e-sqlite[\#SpecificTestName]``|  run [end-to-end](tests/e2e) test(s) for SQLite |[More details](tests/e2e/README.md)  |

 ## Translation

-All translation work happens on [Crowdin](https://translate.gitea.com).
-The only translation that is maintained in this repository is [the English translation](https://github.com/go-gitea/gitea/blob/main/options/locale/locale_en-US.json).
+All translation work happens on [Crowdin](https://crowdin.com/project/gitea).
+The only translation that is maintained in this repository is [the English translation](https://github.com/go-gitea/gitea/blob/main/options/locale/locale_en-US.ini).
 It is synced regularly with Crowdin. \
 Other locales on main branch **should not** be updated manually as they will be overwritten with each sync. \
 Once a language has reached a **satisfactory percentage** of translated keys (~25%), it will be synced back into this repo and included in the next released version.
@@ -165,8 +183,6 @@ The tool `go run build/backport-locale.go` can be used to backport locales from

 ## Code review

-How labels, milestones, and the merge queue work is documented in [docs/community-governance.md](docs/community-governance.md).
-
 ### Pull request format

 Please try to make your pull request easy to review for us. \
@@ -187,56 +203,10 @@ Some of the key points:

 In the PR title, describe the problem you are fixing, not how you are fixing it. \
 Use the first comment as a summary of your PR. \
-In the PR summary, you can describe exactly how you are fixing this problem.
-
-PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message:
-
-```text
-type(scope)!: subject
-```
-
-The scope in parentheses is optional. A `!` immediately before the colon marks a [breaking change](https://www.conventionalcommits.org/en/v1.0.0/#summary): either `type!:` or `type(scope)!:` (not `type!(scope):`).
-
-Use one of these types:
-
- `build`: Changes affecting the build system, packaging, or external dependencies
- `ci`: Changes to CI/CD configuration files and scripts
- `chore`: Maintenance changes that do not affect production code or should not appear in the changelog
- `docs`: Documentation-only changes
- `feat`: A larger user-facing feature, improvement, or new functionality
- `enhance`: Small or trivial user-facing improvements or UX polish (for example wording changes, color adjustments, spacing or padding tweaks, placeholders, small UI behavior improvements)
- `fix`: A bug fix, UX correction, or security-related dependency update
- `perf`: Performance improvements (speed, memory, scalability)
- `refactor`: A code change that neither fixes a bug nor adds a feature
- `revert`: Reverts a previous change
- `style`: Formatting or style-only changes that do not affect code behavior (for example lint-driven edits)
- `test`: Adding or correcting tests
-
-Examples:
-
-```text
-fix(web): prevent avatar upload crash on empty file
-feat(api): add pagination to repo hooks list
-enhance(repo): improve diff toolbar spacing
-ci(workflows): lint PR titles in CI
-```
-
+In the PR summary, you can describe exactly how you are fixing this problem. \
 Keep this summary up-to-date as the PR evolves. \
 If your PR changes the UI, you must add **after** screenshots in the PR summary. \
-If you are not implementing a new feature, you should also post **before** screenshots for comparison.
-
-If you are implementing a new feature, your PR will only be merged if your screenshots are up to date.\
-Furthermore, feature PRs will only be merged if their summary contains a clear usage description (understandable for users) and testing description (understandable for reviewers).
-You should strive to combine both into a single description.
-
-Another requirement for merging PRs is that the PR is labeled correctly.\
-However, this is not your job as a contributor, but the job of the person merging your PR.\
-If you think that your PR was labeled incorrectly, or notice that it was merged without labels, please let us know.
-
-For pull requests that use a valid Conventional Commits title, CI automatically applies a matching `type/…` label when the title prefix is `feat`, `enhance`, `fix`, `docs`, or `test` (for example `enhance(web): …` receives `type/enhancement`).\
-That label is kept in sync with the PR title when the title is edited.\
-Other title prefixes do not get an automatic `type/…` label; the merger still assigns the correct labels (including `type/…` when needed) for changelog and backport decisions.
-
+If you are not implementing a new feature, you should also post **before** screenshots for comparison. \
 If your PR closes some issues, you must note that in a way that both GitHub and Gitea understand, i.e. by appending a paragraph like

 ```text
@@ -247,6 +217,26 @@ Fixes/Closes/Resolves #<ISSUE_NR_Y>.
 to your summary. \
 Each issue that will be closed must stand on a separate line.

+### Milestone
+
+A PR should only be assigned to a milestone if it will likely be merged into the given version. \
+As a rule of thumb, assume that a PR will stay open for an additional month for every 100 added lines. \
+PRs without a milestone may not be merged.
+
+### Labels
+
+Every PR should be labeled correctly with every label that applies. \
+This includes especially the distinction between `bug` (fixing existing functionality), `feature` (new functionality), `enhancement` (upgrades for existing functionality), and `refactoring` (improving the internal code structure without changing the output (much)). \
+Furthermore,
+
+- the amount of pending required approvals
+- whether this PR is `blocked`, a `backport` or `breaking`
+- if it targets the `ui` or `api`
+- if it increases the application `speed`
+- reduces `memory usage`
+
+are oftentimes notable labels.
+
 ### Breaking PRs

 #### What is a breaking PR?
@@ -262,41 +252,173 @@ Changing the default value of a setting or replacing the setting with another on

 #### How to handle breaking PRs?

-If your PR has a breaking change, you must add two things to the summary of your PR:
+If your PR has a breaking change, you must add a `BREAKING` section to your PR summary, e.g.

-1. A reasoning why this breaking change is necessary
-2. A `BREAKING` section explaining in simple terms (understandable for a typical user) how this PR affects users and how to mitigate these changes. This section can look for example like
-
-```md
+```
 ## :warning: BREAKING :warning:
 ```

-Breaking PRs will not be merged as long as not both of these requirements are met.
+To explain how this will affect users and how to mitigate these changes.

 ### Maintaining open PRs

-Code review starts when you open a non-draft PR or move a draft out of draft state. After that, do not rebase or squash your branch; it makes new changes harder to review.
+The moment you create a non-draft PR or the moment you convert a draft PR to a non-draft PR is the moment code review starts for it. \
+Once that happens, do not rebase or squash your branch anymore as it makes it difficult to review the new changes. \
+Merge the base branch into your branch only when you really need to, i.e. because of conflicting changes in the mean time. \
+This reduces unnecessary CI runs. \
+Don't worry about merge commits messing up your commit history as every PR will be squash merged. \
+This means that all changes are joined into a single new commit whose message is as described below.

-Merge the base branch into yours only when you need to, for example because of conflicting changes elsewhere. That limits unnecessary CI runs.
+### Getting PRs merged

-Every PR is squash-merged, so merge commits on your branch do not matter for final history. The squash produces a single commit; mergers follow the [commit message format](docs/community-governance.md#commit-messages) in the governance guide.
+Changes to Gitea must be reviewed before they are accepted — no matter who
+makes the change, even if they are an owner or a maintainer. \
+The only exception are critical bugs that prevent Gitea from being compiled or started. \
+Specifically, we require two approvals from maintainers for every PR. \
+Once this criteria has been met, your PR receives the `lgtm/done` label. \
+From this point on, your only responsibility is to fix merge conflicts or respond to/implement requests by maintainers. \
+It is the responsibility of the maintainers from this point to get your PR merged.

-### Reviewing PRs
+If a PR has the `lgtm/done` label and there are no open discussions or merge conflicts anymore, any maintainer can add the `reviewed/wait-merge` label. \
+This label means that the PR is part of the merge queue and will be merged as soon as possible. \
+The merge queue will be cleared in the order of the list below:

-Maintainers are encouraged to review pull requests in areas where they have expertise or particular interest.
+<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>

-#### For PR authors
+Gitea uses it's own tool, the <https://github.com/GiteaBot/gitea-backporter> to automate parts of the review process. \
+This tool does the things listed below automatically:

- **Response**: When answering reviewer questions, use real-world cases or examples and avoid speculation.
- **Discussion**: A discussion is always welcome and should be used to clarify the changes and the intent of the PR.
- **Help**: If you need help with the PR or comments are unclear, ask for clarification.
+- create a backport PR if needed once the initial PR was merged
+- remove the PR from the merge queue after the PR merged
+- keep the oldest branch in the merge queue up to date with merges

-Guidance for reviewers, the merge queue, and the squash commit message format is in [docs/community-governance.md](docs/community-governance.md).
+### Final call
+
+If a PR has been ignored for more than 7 days with no comments or reviews, and the author or any maintainer believes it will not survive a long wait (such as a refactoring PR), they can send "final call" to the TOC by mentioning them in a comment.
+
+After another 7 days, if there is still zero approval, this is considered a polite refusal, and the PR will be closed to avoid wasting further time. Therefore, the "final call" has a cost, and should be used cautiously.
+
+However, if there are no objections from maintainers, the PR can be merged with only one approval from the TOC (not the author).
+
+### Commit messages
+
+Mergers are able and required to rewrite the PR title and summary (the first comment of a PR) so that it can produce an easily understandable commit message if necessary. \
+The final commit message should no longer contain any uncertainty such as `hopefully, <x> won't happen anymore`. Replace uncertainty with certainty.
+
+#### PR Co-authors
+
+A person counts as a PR co-author the moment they (co-)authored a commit that is not simply a `Merge base branch into branch` commit. \
+Mergers are required to remove such "false-positive" co-authors when writing the commit message. \
+The true co-authors must remain in the commit message.
+
+#### PRs targeting `main`
+
+The commit message of PRs targeting `main` is always
+
+```bash
+$PR_TITLE ($PR_INDEX)
+
+$REWRITTEN_PR_SUMMARY
+```
+
+#### Backport PRs
+
+The commit message of backport PRs is always
+
+```bash
+$PR_TITLE ($INITIAL_PR_INDEX) ($BACKPORT_PR_INDEX)
+
+$REWRITTEN_PR_SUMMARY
+```

 ## Documentation

-If you add a new feature or change an existing aspect of Gitea, the documentation for that feature must be created or updated in another PR at [https://gitea.com/gitea/docs](https://gitea.com/gitea/docs).
-**The docs directory on main repository will be removed at some time. We will have a yaml file to store configuration file's meta data. After that completed, configuration documentation should be in the main repository.**
+If you add a new feature or change an existing aspect of Gitea, the documentation for that feature must be created or updated in the same PR.
+
+## API v1
+
+The API is documented by [swagger](http://try.gitea.io/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
+
+### GitHub API compatibility
+
+Gitea's API should use the same endpoints and fields as the GitHub API as far as possible, unless there are good reasons to deviate. \
+If Gitea provides functionality that GitHub does not, a new endpoint can be created. \
+If information is provided by Gitea that is not provided by the GitHub API, a new field can be used that doesn't collide with any GitHub fields. \
+Updating an existing API should not remove existing fields unless there is a really good reason to do so. \
+The same applies to status responses. If you notice a problem, feel free to leave a comment in the code for future refactoring to API v2 (which is currently not planned).
+
+### Adding/Maintaining API routes
+
+All expected results (errors, success, fail messages) must be documented ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L319-L327)). \
+All JSON input types must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L76-L91)) \
+and referenced in [routers/api/v1/swagger/options.go](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/options.go). \
+They can then be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L318). \
+All JSON responses must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L36-L68)) \
+and referenced in its category in [routers/api/v1/swagger/](routers/api/v1/swagger/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/issue.go#L11-L16)) \
+They can be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L277-L279).
+
+### When to use what HTTP method
+
+In general, HTTP methods are chosen as follows:
+
+- **GET** endpoints return the requested object(s) and status **OK (200)**
+- **DELETE** endpoints return the status **No Content (204)** and no content either
+- **POST** endpoints are used to **create** new objects (e.g. a User) and return the status **Created (201)** and the created object
+- **PUT** endpoints are used to **add/assign** existing Objects (e.g. a user to a team) and return the status **No Content (204)** and no content either
+- **PATCH** endpoints are used to **edit/change** an existing object and return the changed object and the status **OK (200)**
+
+### Requirements for API routes
+
+All parameters of endpoints changing/editing an object must be optional (except the ones to identify the object, which are required).
+
+Endpoints returning lists must
+
+- support pagination (`page` & `limit` options in query)
+- set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
+
+## Backports and Frontports
+
+### What is backported?
+
+We backport PRs given the following circumstances:
+
+1. Feature freeze is active, but `<version>-rc0` has not been released yet. Here, we backport as much as possible. <!-- TODO: Is that our definition with the new backport bot? -->
+2. `rc0` has been released. Here, we only backport bug- and security-fixes, and small enhancements. Large PRs such as refactors are not backported anymore. <!-- TODO: Is that our definition with the new backport bot? -->
+3. We never backport new features.
+4. We never backport breaking changes except when
+    1. The breaking change has no effect on the vast majority of users
+    2. The component triggering the breaking change is marked as experimental
+
+### How to backport?
+
+In the past, it was necessary to manually backport your PRs. \
+Now, that's not a requirement anymore as our [backport bot](https://github.com/GiteaBot) tries to create backports automatically once the PR is merged when the PR
+
+- does not have the label `backport/manual`
+- has the label `backport/<version>`
+
+The `backport/manual` label signifies either that you want to backport the change yourself, or that there were conflicts when backporting, thus you **must** do it yourself.
+
+### Format of backport PRs
+
+The title of backport PRs should be
+
+```
+<original PR title> (#<original pr number>)
+```
+
+The first two lines of the summary of the backporting PR should be
+
+```
+Backport #<original pr number>
+
+```
+
+with the rest of the summary and labels matching the original PR.
+
+### Frontports
+
+Frontports behave exactly as described above for backports.

 ## Developer Certificate of Origin (DCO)

@@ -311,3 +433,131 @@ Signed-off-by: Joe Smith <joe.smith@email.com>
 If you set the `user.name` and `user.email` Git config options, you can add the line to the end of your commits automatically with `git commit -s`.

 We assume in good faith that the information you provide is legally binding.
+
+## Release Cycle
+
+We adopted a release schedule to streamline the process of working on, finishing, and issuing releases. \
+The overall goal is to make a major release every three or four months, which breaks down into two or three months of general development followed by one month of testing and polishing known as the release freeze. \
+All the feature pull requests should be
+merged before feature freeze. And, during the frozen period, a corresponding
+release branch is open for fixes backported from main branch. Release candidates
+are made during this period for user testing to
+obtain a final version that is maintained in this branch.
+
+During a development cycle, we may also publish any necessary minor releases
+for the previous version. For example, if the latest, published release is
+v1.2, then minor changes for the previous release—e.g., v1.1.0 -> v1.1.1—are
+still possible.
+
+## Maintainers
+
+To make sure every PR is checked, we have [maintainers](MAINTAINERS). \
+Every PR **must** be reviewed by at least two maintainers (or owners) before it can get merged. \
+For refactoring PRs after a week and documentation only PRs, the approval of only one maintainer is enough. \
+A maintainer should be a contributor of Gitea and contributed at least
+4 accepted PRs. A contributor should apply as a maintainer in the
+[Discord](https://discord.gg/Gitea) `#develop` channel. The team maintainers may invite the contributor. A maintainer
+should spend some time on code reviews. If a maintainer has no
+time to do that, they should apply to leave the maintainers team
+and we will give them the honor of being a member of the [advisors
+team](https://github.com/orgs/go-gitea/teams/advisors). Of course, if
+an advisor has time to code review, we will gladly welcome them back
+to the maintainers team. If a maintainer is inactive for more than 3
+months and forgets to leave the maintainers team, the owners may move
+him or her from the maintainers team to the advisors team.
+For security reasons, Maintainers should use 2FA for their accounts and
+if possible provide GPG signed commits.
+https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
+https://help.github.com/articles/signing-commits-with-gpg/
+
+## Technical Oversight Committee (TOC)
+
+At the start of 2023, the `Owners` team was dissolved. Instead, the governance charter proposed a technical oversight committee (TOC) which expands the ownership team of the Gitea project from three elected positions to six positions. Three positions would be elected as it has been over the past years, and the other three would consist of appointed members from the Gitea company.
+https://blog.gitea.io/2023/02/gitea-quarterly-report-23q1/
+
+When the new community members have been elected, the old members will give up ownership to the newly elected members. For security reasons, TOC members or any account with write access (like a bot) must use 2FA.
+https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
+
+### Current TOC members
+
+- 2023-01-01 ~ 2023-12-31 - https://blog.gitea.io/2023/02/gitea-quarterly-report-23q1/
+  - Company
+    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
+    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
+    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.io>
+  - Community
+    - [6543](https://gitea.com/6543) <6543@obermui.de>
+    - [Andrew Thornton](https://gitea.com/zeripath) <art27@cantab.net>
+    - [John Olheiser](https://gitea.com/jolheiser) <john.olheiser@gmail.com>
+
+### Previous TOC/owners members
+
+Here's the history of the owners and the time they served:
+
+- [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872)
+- [Kim Carlbäcker](https://github.com/bkcsoft) - 2016, 2017
+- [Thomas Boerger](https://gitea.com/tboerger) - 2016, 2017
+- [Lauris Bukšis-Haberkorns](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801)
+- [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872)
+- [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872)
+
+## Governance Compensation
+
+Each member of the community elected TOC will be granted $500 each month as compensation for their work.
+
+Furthermore, any community release manager for a specific release or LTS will be compensated $500 for the delivery of said release.
+
+These funds will come from community sources like the OpenCollective rather than directly from the company.
+Only non-company members are eligible for this compensation, and if a member of the community TOC takes the responsibility of release manager, they would only be compensated for their TOC duties.
+Gitea Ltd employees are not eligible to receive any funds from the OpenCollective unless it is reimbursement for a purchase made for the Gitea project itself.
+
+## TOC & Working groups
+
+With Gitea covering many projects outside of the main repository, several groups will be created to help focus on specific areas instead of requiring maintainers to be a jack-of-all-trades. Maintainers are of course more than welcome to be part of multiple groups should they wish to contribute in multiple places.
+
+The currently proposed groups are:
+
+- **Core Group**: maintain the primary Gitea repository
+- **Integration Group**: maintain the Gitea ecosystem's related tools, including go-sdk/tea/changelog/bots etc.
+- **Documentation Group**: maintain related documents and repositories
+- **Translation Group**: coordinate with translators and maintain translations
+- **Security Group**: managed by TOC directly, members are decided by TOC, maintains security patches/responsible for security items
+
+## Roadmap
+
+Each year a roadmap will be discussed with the entire Gitea maintainers team, and feedback will be solicited from various stakeholders.
+TOC members need to review the roadmap every year and work together on the direction of the project.
+
+When a vote is required for a proposal or other change, the vote of community elected TOC members count slightly more than the vote of company elected TOC members. With this approach, we both avoid ties and ensure that changes align with the mission statement and community opinion.
+
+You can visit our roadmap on the wiki.
+
+## Versions
+
+Gitea has the `main` branch as a tip branch and has version branches
+such as `release/v1.19`. `release/v1.19` is a release branch and we will
+tag `v1.19.0` for binary download. If `v1.19.0` has bugs, we will accept
+pull requests on the `release/v1.19` branch and publish a `v1.19.1` tag,
+after bringing the bug fix also to the main branch.
+
+Since the `main` branch is a tip version, if you wish to use Gitea
+in production, please download the latest release tag version. All the
+branches will be protected via GitHub, all the PRs to every branch must
+be reviewed by two maintainers and must pass the automatic tests.
+
+## Releasing Gitea
+
+- Let $vmaj, $vmin and $vpat be Major, Minor and Patch version numbers, $vpat should be rc1, rc2, 0, 1, ...... $vmaj.$vmin will be kept the same as milestones on github or gitea in future.
+- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody against in about serval hours.
+- If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
+  - Create `-dev` tag as `git tag -s -F release.notes v$vmaj.$vmin.0-dev` and push the tag as `git push origin v$vmaj.$vmin.0-dev`.
+  - When CI has finished building tag then you have to create a new branch named `release/v$vmaj.$vmin`
+- If it is bugfix version create PR for changelog on branch `release/v$vmaj.$vmin` and wait till it is reviewed and merged.
+- Add a tag as `git tag -s -F release.notes v$vmaj.$vmin.$`, release.notes file could be a temporary file to only include the changelog this version which you added to `CHANGELOG.md`.
+- And then push the tag as `git push origin v$vmaj.$vmin.$`. Drone CI will automatically create a release and upload all the compiled binary. (But currently it doesn't add the release notes automatically. Maybe we should fix that.)
+- If needed send a frontport PR for the changelog to branch `main` and update the version in `docs/config.yaml` to refer to the new version.
+- Send PR to [blog repository](https://gitea.com/gitea/blog) announcing the release.
+- Verify all release assets were correctly published through CI on dl.gitea.com and GitHub releases. Once ACKed:
+  - bump the version of https://dl.gitea.com/gitea/version.json
+  - merge the blog post PR
+  - announce the release in discord `#announcements`
@@ -1,50 +1,30 @@
-# syntax=docker/dockerfile:1
-# Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
-RUN apk --no-cache add build-base git nodejs pnpm
-WORKDIR /src
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
-COPY --exclude=.git/ . .
-RUN make frontend
+#Build stage
+FROM docker.io/library/golang:1.20-alpine3.18 AS build-env

-# Build backend for each target platform
-FROM docker.io/library/golang:1.26-alpine3.23 AS build-env
+ARG GOPROXY
+ENV GOPROXY ${GOPROXY:-direct}

 ARG GITEA_VERSION
-ARG TAGS=""
-ENV TAGS="bindata timetzdata $TAGS"
+ARG TAGS="sqlite sqlite_unlock_notify"
+ENV TAGS "bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

-# Build deps
-RUN apk --no-cache add \
-    build-base \
-    git
+#Build deps
+RUN apk --no-cache add build-base git nodejs npm

-WORKDIR ${GOPATH}/src/gitea.dev
-COPY go.mod go.sum ./
-RUN go mod download
-# Use COPY instead of bind mount as read-only one breaks makefile state tracking and read-write one needs binary to be moved as it's discarded.
-# ".git" directory is mounted separately later only for version data extraction.
-COPY --exclude=.git/ . .
-COPY --from=frontend-build /src/public/assets public/assets
+#Setup repo
+COPY . ${GOPATH}/src/code.gitea.io/gitea
+WORKDIR ${GOPATH}/src/code.gitea.io/gitea

-# Build gitea, .git mount is required for version data
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=bind,source=".git/",target=".git/" \
-    make backend
+#Checkout version if set
+RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+ && make clean-all build

-COPY docker/root /tmp/local
+# Begin env-to-ini build
+RUN go build contrib/environment-to-ini/environment-to-ini.go

-# Set permissions for builds that made under windows which strips the executable bit from file
-RUN chmod 755 /tmp/local/usr/bin/entrypoint \
-              /tmp/local/usr/local/bin/* \
-              /tmp/local/etc/s6/gitea/* \
-              /tmp/local/etc/s6/openssh/* \
-              /tmp/local/etc/s6/.s6-svscan/* \
-              /go/src/gitea.dev/gitea
-
-FROM docker.io/library/alpine:3.23 AS gitea
+FROM docker.io/library/alpine:3.18
+LABEL maintainer="maintainers@gitea.io"

 EXPOSE 22 3000

@@ -73,14 +53,18 @@ RUN addgroup \
    git && \
  echo "git:*" | chpasswd -e

-COPY --from=build-env /tmp/local /
-COPY --from=build-env /go/src/gitea.dev/gitea /app/gitea/gitea
-
-ENV USER=git
-ENV GITEA_CUSTOM=/data/gitea
+ENV USER git
+ENV GITEA_CUSTOM /data/gitea

 VOLUME ["/data"]

-# HINT: HEALTH-CHECK-ENDPOINT: don't use HEALTHCHECK, search this hint keyword for more information
 ENTRYPOINT ["/usr/bin/entrypoint"]
-CMD ["/usr/bin/s6-svscan", "/etc/s6"]
+CMD ["/bin/s6-svscan", "/etc/s6"]
+
+COPY docker/root /
+COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
+COPY --from=build-env /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete /etc/profile.d/gitea_bash_autocomplete.sh
+RUN chmod 755 /usr/bin/entrypoint /app/gitea/gitea /usr/local/bin/gitea /usr/local/bin/environment-to-ini
+RUN chmod 755 /etc/s6/gitea/* /etc/s6/openssh/* /etc/s6/.s6-svscan/*
+RUN chmod 644 /etc/profile.d/gitea_bash_autocomplete.sh
@@ -1,45 +1,30 @@
-# syntax=docker/dockerfile:1
-# Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
-RUN apk --no-cache add build-base git nodejs pnpm
-WORKDIR /src
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
-COPY --exclude=.git/ . .
-RUN make frontend
+#Build stage
+FROM docker.io/library/golang:1.20-alpine3.18 AS build-env

-# Build backend for each target platform
-FROM docker.io/library/golang:1.26-alpine3.23 AS build-env
+ARG GOPROXY
+ENV GOPROXY ${GOPROXY:-direct}

 ARG GITEA_VERSION
-ARG TAGS=""
-ENV TAGS="bindata timetzdata $TAGS"
+ARG TAGS="sqlite sqlite_unlock_notify"
+ENV TAGS "bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

-# Build deps
-RUN apk --no-cache add \
-    build-base \
-    git
+#Build deps
+RUN apk --no-cache add build-base git nodejs npm

-WORKDIR ${GOPATH}/src/gitea.dev
-COPY go.mod go.sum ./
-RUN go mod download
-# See the comments in Dockerfile
-COPY --exclude=.git/ . .
-COPY --from=frontend-build /src/public/assets public/assets
+#Setup repo
+COPY . ${GOPATH}/src/code.gitea.io/gitea
+WORKDIR ${GOPATH}/src/code.gitea.io/gitea

-# Build gitea, .git mount is required for version data
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=bind,source=".git/",target=".git/" \
-    make backend
+#Checkout version if set
+RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+ && make clean-all build

-COPY docker/rootless /tmp/local
+# Begin env-to-ini build
+RUN go build contrib/environment-to-ini/environment-to-ini.go

-# Set permissions for builds that made under windows which strips the executable bit from file
-RUN chmod 755 /tmp/local/usr/local/bin/* \
-              /go/src/gitea.dev/gitea
-
-FROM docker.io/library/alpine:3.23 AS gitea-rootless
+FROM docker.io/library/alpine:3.18
+LABEL maintainer="maintainers@gitea.io"

 EXPOSE 2222 3000

@@ -50,8 +35,7 @@ RUN apk --no-cache add \
    gettext \
    git \
    curl \
-    gnupg \
-    openssh-keygen
+    gnupg

 RUN addgroup \
    -S -g 1000 \
@@ -67,22 +51,26 @@ RUN addgroup \
 RUN mkdir -p /var/lib/gitea /etc/gitea
 RUN chown git:git /var/lib/gitea /etc/gitea

-COPY --from=build-env /tmp/local /
-COPY --from=build-env --chown=root:root /go/src/gitea.dev/gitea /app/gitea/gitea
+COPY docker/rootless /
+COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
+COPY --from=build-env /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete /etc/profile.d/gitea_bash_autocomplete.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh /usr/local/bin/docker-setup.sh /app/gitea/gitea /usr/local/bin/gitea /usr/local/bin/environment-to-ini
+RUN chmod 644 /etc/profile.d/gitea_bash_autocomplete.sh

-# git:git
+#git:git
 USER 1000:1000
-ENV GITEA_WORK_DIR=/var/lib/gitea
-ENV GITEA_CUSTOM=/var/lib/gitea/custom
-ENV GITEA_TEMP=/tmp/gitea
-ENV TMPDIR=/tmp/gitea
+ENV GITEA_WORK_DIR /var/lib/gitea
+ENV GITEA_CUSTOM /var/lib/gitea/custom
+ENV GITEA_TEMP /tmp/gitea
+ENV TMPDIR /tmp/gitea

-# TODO add to docs the ability to define the ini to load (useful to test and revert a config)
-ENV GITEA_APP_INI=/etc/gitea/app.ini
-ENV HOME="/var/lib/gitea/git"
+#TODO add to docs the ability to define the ini to load (useful to test and revert a config)
+ENV GITEA_APP_INI /etc/gitea/app.ini
+ENV HOME "/var/lib/gitea/git"
 VOLUME ["/var/lib/gitea", "/etc/gitea"]
 WORKDIR /var/lib/gitea

-# HINT: HEALTH-CHECK-ENDPOINT: don't use HEALTHCHECK, search this hint keyword for more information
 ENTRYPOINT ["/usr/bin/dumb-init", "--", "/usr/local/bin/docker-entrypoint.sh"]
 CMD []
+
@@ -1,232 +1,20 @@
-GNU GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
-
-Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
-
-Preamble
-
-The GNU General Public License is a free, copyleft license for software and other kinds of works.
-
-The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
-
-When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
-
-To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
-
-For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
-
-Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
-
-For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
-
-Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
-
-Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
-
-The precise terms and conditions for copying, distribution and modification follow.
-
-TERMS AND CONDITIONS
-
-0. Definitions.
-
-“This License” refers to version 3 of the GNU General Public License.
-
-“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
-
-“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
-
-To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
-
-A “covered work” means either the unmodified Program or a work based on the Program.
-
-To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
-
-To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
-
-An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
-
-1. Source Code.
-The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
-
-A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
-
-The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
-
-The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
-
-The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
-
-The Corresponding Source for a work in source code form is that same work.
-
-2. Basic Permissions.
-All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
-
-You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
-
-Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
-
-3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
-
-When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
-
-4. Conveying Verbatim Copies.
-You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
-
-You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
-
-5. Conveying Modified Source Versions.
-You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
-
-     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
-
-     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
-
-     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
-
-     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
-
-A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
-
-6. Conveying Non-Source Forms.
-You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
-
-     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
-
-     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
-
-     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
-
-     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
-
-     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
-
-A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
-
-A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
-
-“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
-
-If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
-
-The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
-
-Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
-
-7. Additional Terms.
-“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
-
-When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
-
-Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
-
-     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
-
-     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
-
-     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
-
-     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
-
-     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
-
-     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
-
-All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
-
-If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
-
-Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
-
-8. Termination.
-You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
-
-However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
-
-Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
-
-Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
-
-9. Acceptance Not Required for Having Copies.
-You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
-
-10. Automatic Licensing of Downstream Recipients.
-Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
-
-An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
-
-You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
-
-11. Patents.
-A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
-
-A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
-
-Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
-
-In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
-
-If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
-
-If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
-
-A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
-
-Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
-
-12. No Surrender of Others' Freedom.
-If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
-
-13. Use with the GNU Affero General Public License.
-Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
-
-14. Revised Versions of this License.
-The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
-
-If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
-
-Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
-
-15. Disclaimer of Warranty.
-THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-16. Limitation of Liability.
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-17. Interpretation of Sections 15 and 16.
-If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
-
-END OF TERMS AND CONDITIONS
-
-How to Apply These Terms to Your New Programs
-
-If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
-
-To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
-
-     vphash
-     Copyright (C) 2026  d
-
-     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
-
-     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
-
-     vphash  Copyright (C) 2026  d
-     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
-
-You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
-
-The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.
+Copyright (c) 2016 The Gitea Authors
+Copyright (c) 2015 The Gogs Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
@@ -31,37 +31,24 @@ Gary Kim <gary@garykim.dev> (@gary-kim)
 Guillermo Prandi <gitea.maint@mailfilter.com.ar> (@guillep2k)
 Mura Li <typeless@ctli.io> (@typeless)
 6543 <6543@obermui.de> (@6543)
+jaqra <jaqra@hotmail.com> (@jaqra)
 David Svantesson <davidsvantesson@gmail.com> (@davidsvantesson)
 a1012112796 <1012112796@qq.com> (@a1012112796)
 Karl Heinz Marbaise <kama@soebes.de> (@khmarbaise)
 Norwin Roosen <git@nroo.de> (@noerw)
 Kyle Dumont <kdumontnu@gmail.com> (@kdumontnu)
+Patrick Schratz <patrick.schratz@gmail.com> (@pat-s)
 Janis Estelmann <admin@oldschoolhack.me> (@KN4CK3R)
+Steven Kriegler <sk.bunsenbrenner@gmail.com> (@justusbunsi)
 Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
 Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
+Eddie Yang <576951401@qq.com> (@yp05327)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
 wxiaoguang <wxiaoguang@gmail.com> (@wxiaoguang)
 Gary Moon <gary@garymoon.net> (@garymoon)
 Philip Peterson <philip.c.peterson@gmail.com> (@philip-peterson)
-Denys Konovalov <kontakt@denyskon.de> (@denyskon)
-Punit Inani <punitinani1@gmail.com> (@puni9869)
-CaiCandong  <1290147055@qq.com> (@caicandong)
-Rui Chen  <rui@chenrui.dev> (@chenrui333)
-Nanguan Lin <nanguanlin6@gmail.com> (@lng2020)
-kerwin612 <kerwin612@qq.com> (@kerwin612)
-Gary Wang <git@blumia.net> (@BLumia)
-Tim-Niclas Oelschläger <zokki.softwareschmiede@gmail.com> (@zokkis)
-Yu Liu <1240335630@qq.com> (@HEREYUA)
-Kemal Zebari <kemalzebra@gmail.com> (@kemzeb)
-Rowan Bohde <rowan.bohde@gmail.com> (@bohde)
-hiifong <i@hiif.ong> (@hiifong)
-metiftikci <metiftikci@hotmail.com> (@metiftikci)
-Christopher Homberger <christopher.homberger@web.de> (@ChristopherHX)
-Tobias Balle-Petersen <tobiasbp@gmail.com> (@tobiasbp)
-TheFox <thefox0x7@gmail.com> (@TheFox0x7)
-Nicolas <bircni@icloud.com> (@bircni)
@@ -1,23 +1,180 @@
-# M8SH - decentralized swiss knife
+<p align="center">
+  <a href="https://gitea.io/">
+    <img alt="Gitea" src="https://raw.githubusercontent.com/go-gitea/gitea/main/public/img/gitea.svg" width="220"/>
+  </a>
+</p>
+<h1 align="center">Gitea - Git with a cup of tea</h1>

-Project is under development.
+<p align="center">
+  <a href="https://drone.gitea.io/go-gitea/gitea" title="Build Status">
+    <img src="https://drone.gitea.io/api/badges/go-gitea/gitea/status.svg?ref=refs/heads/main">
+  </a>
+  <a href="https://discord.gg/Gitea" title="Join the Discord chat at https://discord.gg/Gitea">
+    <img src="https://img.shields.io/discord/322538954119184384.svg">
+  </a>
+  <a href="https://app.codecov.io/gh/go-gitea/gitea" title="Codecov">
+    <img src="https://codecov.io/gh/go-gitea/gitea/branch/main/graph/badge.svg">
+  </a>
+  <a href="https://goreportcard.com/report/code.gitea.io/gitea" title="Go Report Card">
+    <img src="https://goreportcard.com/badge/code.gitea.io/gitea">
+  </a>
+  <a href="https://pkg.go.dev/code.gitea.io/gitea" title="GoDoc">
+    <img src="https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg">
+  </a>
+  <a href="https://github.com/go-gitea/gitea/releases/latest" title="GitHub release">
+    <img src="https://img.shields.io/github/release/go-gitea/gitea.svg">
+  </a>
+  <a href="https://www.codetriage.com/go-gitea/gitea" title="Help Contribute to Open Source">
+    <img src="https://www.codetriage.com/go-gitea/gitea/badges/users.svg">
+  </a>
+  <a href="https://opencollective.com/gitea" title="Become a backer/sponsor of gitea">
+    <img src="https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen">
+  </a>
+  <a href="https://opensource.org/licenses/MIT" title="License: MIT">
+    <img src="https://img.shields.io/badge/License-MIT-blue.svg">
+  </a>
+  <a href="https://gitpod.io/#https://github.com/go-gitea/gitea">
+  <img
+    src="https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod"
+    alt="Contribute with Gitpod"
+  />
+  </a>
+  <a href="https://crowdin.com/project/gitea" title="Crowdin">
+    <img src="https://badges.crowdin.net/gitea/localized.svg">
+  </a>
+  <a href="https://www.tickgit.com/browse?repo=github.com/go-gitea/gitea&branch=main" title="TODOs">
+    <img src="https://badgen.net/https/api.tickgit.com/badgen/github.com/go-gitea/gitea/main">
+  </a>
+  <a href="https://app.bountysource.com/teams/gitea" title="Bountysource">
+    <img src="https://img.shields.io/bountysource/team/gitea/activity">
+  </a>
+</p>

-Roadmap:
+<p align="center">
+  <a href="README_ZH.md">View this document in Chinese</a>
+</p>

- decentralized GPG-based registration, authorization and authentication (further when clients are developed - GPG would be integrated into client and invoked via secure bridge for fully password-less and input-less flow, preseving security level of GPG) (usage of external email domain assumes it's an external user and decetralized features will be disabled)
- integrated email server (ui, rest)
- integrated messenger (ui, rest)
- integrated search engine (seach over external gitea instances repositories, specific tags for repos to be indexed, view external things from home instance)
- integrated posts, articles
- integrated videos, reels
- integrated music player
- integrated VPN (amnesia)
+## Purpose

+The goal of this project is to make the easiest, fastest, and most
+painless way of setting up a self-hosted Git service.

-<!-- 
- integrated cloud storage
- integrated calls
- integrated video-conferences
- integrated stickers
- integrated NFT assets, crypto-wallets
-->
+As Gitea is written in Go, it works across **all** the platforms and
+architectures that are supported by Go, including Linux, macOS, and
+Windows on x86, amd64, ARM and PowerPC architectures.
+You can try it out using [the online demo](https://try.gitea.io/).
+This project has been
+[forked](https://blog.gitea.io/2016/12/welcome-to-gitea/) from
+[Gogs](https://gogs.io) since November of 2016, but a lot has changed.
+
+## Building
+
+From the root of the source tree, run:
+
+    TAGS="bindata" make build
+
+or if SQLite support is required:
+
+    TAGS="bindata sqlite sqlite_unlock_notify" make build
+
+The `build` target is split into two sub-targets:
+
+- `make backend` which requires [Go Stable](https://go.dev/dl/), required version is defined in [go.mod](/go.mod).
+- `make frontend` which requires [Node.js LTS](https://nodejs.org/en/download/) or greater and Internet connectivity to download npm dependencies.
+
+When building from the official source tarballs which include pre-built frontend files, the `frontend` target will not be triggered, making it possible to build without Node.js and Internet connectivity.
+
+Parallelism (`make -j <num>`) is not supported.
+
+More info: https://docs.gitea.com/installation/install-from-source
+
+## Using
+
+    ./gitea web
+
+NOTE: If you're interested in using our APIs, we have experimental
+support with [documentation](https://try.gitea.io/api/swagger).
+
+## Contributing
+
+Expected workflow is: Fork -> Patch -> Push -> Pull Request
+
+NOTES:
+
+1. **YOU MUST READ THE [CONTRIBUTORS GUIDE](CONTRIBUTING.md) BEFORE STARTING TO WORK ON A PULL REQUEST.**
+2. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!
+
+## Translating
+
+Translations are done through Crowdin. If you want to translate to a new language ask one of the managers in the Crowdin project to add a new language there.
+
+You can also just create an issue for adding a language or ask on discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty but we hope to fill it as questions pop up.
+
+https://docs.gitea.com/contributing/localization
+
+[![Crowdin](https://badges.crowdin.net/gitea/localized.svg)](https://crowdin.com/project/gitea)
+
+## Further information
+
+For more information and instructions about how to install Gitea, please look at our [documentation](https://docs.gitea.com).
+If you have questions that are not covered by the documentation, you can get in contact with us on our [Discord server](https://discord.gg/Gitea) or create  a post in the [discourse forum](https://discourse.gitea.io/).
+
+We maintain a list of Gitea-related projects at [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea).
+
+The Hugo-based documentation theme is hosted at [gitea/theme](https://gitea.com/gitea/theme).
+
+The official Gitea CLI is developed at [gitea/tea](https://gitea.com/gitea/tea).
+
+## Authors
+
+- [Maintainers](https://github.com/orgs/go-gitea/people)
+- [Contributors](https://github.com/go-gitea/gitea/graphs/contributors)
+- [Translators](options/locale/TRANSLATORS)
+
+## Backers
+
+Thank you to all our backers! 🙏 [[Become a backer](https://opencollective.com/gitea#backer)]
+
+<a href="https://opencollective.com/gitea#backers" target="_blank"><img src="https://opencollective.com/gitea/backers.svg?width=890"></a>
+
+## Sponsors
+
+Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/gitea#sponsor)]
+
+<a href="https://opencollective.com/gitea/sponsor/0/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/0/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/1/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/1/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/2/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/2/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/3/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/3/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/4/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/4/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/5/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/5/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/6/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/6/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/7/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/7/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/8/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/8/avatar.svg"></a>
+<a href="https://opencollective.com/gitea/sponsor/9/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/9/avatar.svg"></a>
+<a href="https://cynkra.com/" target="_blank"><img src="https://images.opencollective.com/cynkra/logo/square/64/192.png"></a>
+
+## FAQ
+
+**How do you pronounce Gitea?**
+
+Gitea is pronounced [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY) as in "gi-tea" with a hard g.
+
+**Why is this not hosted on a Gitea instance?**
+
+We're [working on it](https://github.com/go-gitea/gitea/issues/1029).
+
+## License
+
+This project is licensed under the MIT License.
+See the [LICENSE](https://github.com/go-gitea/gitea/blob/main/LICENSE) file
+for the full license text.
+
+## Screenshots
+
+Looking for an overview of the interface? Check it out!
+
+|![Dashboard](https://dl.gitea.com/screenshots/home_timeline.png)|![User Profile](https://dl.gitea.com/screenshots/user_profile.png)|![Global Issues](https://dl.gitea.com/screenshots/global_issues.png)|
+|:---:|:---:|:---:|
+|![Branches](https://dl.gitea.com/screenshots/branches.png)|![Web Editor](https://dl.gitea.com/screenshots/web_editor.png)|![Activity](https://dl.gitea.com/screenshots/activity.png)|
+|![New Migration](https://dl.gitea.com/screenshots/migration.png)|![Migrating](https://dl.gitea.com/screenshots/migration.gif)|![Pull Request View](https://image.ibb.co/e02dSb/6.png)
+![Pull Request Dark](https://dl.gitea.com/screenshots/pull_requests_dark.png)|![Diff Review Dark](https://dl.gitea.com/screenshots/review_dark.png)|![Diff Dark](https://dl.gitea.com/screenshots/diff_dark.png)|
@@ -1,201 +0,0 @@
-# Gitea
-
-[![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
-[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
-[![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
-[![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
-[![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
-[![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
-[![](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com "Crowdin")
-
-[English](./README.md) | [繁體中文](./README.zh-tw.md)
-
-## 目的
-
-这个项目的目标是提供最简单、最快速、最无痛的方式来设置自托管的 Git 服务。
-
-由于 Gitea 是用 Go 语言编写的，它可以在 Go 支持的所有平台和架构上运行，包括 Linux、macOS 和 Windows 的 x86、amd64、ARM 和 PowerPC 架构。这个项目自 2016 年 11 月从 [Gogs](https://gogs.io) [分叉](https://blog.gitea.com/welcome-to-gitea/) 而来，但已经有了很多变化。
-
-在线演示可以访问 [demo.gitea.com](https://demo.gitea.com)。
-
-要访问免费的 Gitea 服务（有一定数量的仓库限制），可以访问 [gitea.com](https://gitea.com/user/login)。
-
-要快速部署您自己的专用 Gitea 实例，可以在 [cloud.gitea.com](https://cloud.gitea.com) 开始免费试用。
-
-## 文件
-
-您可以在我们的官方 [文件网站](https://docs.gitea.com/) 上找到全面的文件。
-
-它包括安装、管理、使用、开发、贡献指南等，帮助您快速入门并有效地探索所有功能。
-
-如果您有任何建议或想要贡献，可以访问 [文件仓库](https://gitea.com/gitea/docs)
-
-## 构建
-
-从源代码树的根目录运行：
-
-    TAGS="bindata" make build
-
-`build` 目标分为两个子目标：
-
- `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定义。
- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本以及 [pnpm](https://pnpm.io/installation)。
-
-需要互联网连接来下载 go 和 npm 模块。从包含预构建前端文件的官方源代码压缩包构建时，不会触发 `frontend` 目标，因此可以在没有 Node.js 的情况下构建。
-
-更多信息：https://docs.gitea.com/installation/install-from-source
-
-## 使用
-
-构建后，默认情况下会在源代码树的根目录生成一个名为 `gitea` 的二进制文件。要运行它，请使用：
-
-    ./gitea web
-
-> [!注意]
-> 如果您对使用我们的 API 感兴趣，我们提供了实验性支持，并附有 [文件](https://docs.gitea.com/api)。
-
-## 贡献
-
-预期的工作流程是：Fork -> Patch -> Push -> Pull Request
-
-> [!注意]
->
-> 1. **在开始进行 Pull Request 之前，您必须阅读 [贡献者指南](CONTRIBUTING.md)。**
-> 2. 如果您在项目中发现了漏洞，请私下写信给 **security@gitea.io**。谢谢！
-
-## 翻译
-
-[![Crowdin](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com)
-
-翻译通过 [Crowdin](https://translate.gitea.com) 进行。如果您想翻译成新的语言，请在 Crowdin 项目中请求管理员添加新语言。
-
-您也可以创建一个 issue 来添加语言，或者在 discord 的 #translation 频道上询问。如果您需要上下文或发现一些翻译问题，可以在字符串上留言或在 Discord 上询问。对于一般的翻译问题，文档中有一个部分。目前有点空，但我们希望随着问题的出现而填充它。
-
-更多信息请参阅 [文件](https://docs.gitea.com/contributing/localization)。
-
-## 官方和第三方项目
-
-我们提供了一个官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一个名为 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一个 Gitea Action 的 [action runner](https://gitea.com/gitea/act_runner)。
-
-我们在 [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea) 维护了一个 Gitea 相关项目的列表，您可以在那里发现更多的第三方项目，包括 SDK、插件、主题等。
-
-## 通讯
-
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-
-如果您有任何文件未涵盖的问题，可以在我们的 [Discord 服务器](https://discord.gg/Gitea) 上与我们联系，或者在 [discourse 论坛](https://forum.gitea.com/) 上创建帖子。
-
-## 作者
-
- [维护者](https://github.com/orgs/go-gitea/people)
- [贡献者](https://github.com/go-gitea/gitea/graphs/contributors)
- [翻译者](options/locale/TRANSLATORS)
-
-## 支持者
-
-感谢所有支持者！ 🙏 [[成为支持者](https://opencollective.com/gitea#backer)]
-
-<a href="https://opencollective.com/gitea#backers" target="_blank"><img src="https://opencollective.com/gitea/backers.svg?width=890"></a>
-
-## 赞助商
-
-通过成为赞助商来支持这个项目。您的标志将显示在这里，并带有链接到您的网站。 [[成为赞助商](https://opencollective.com/gitea#sponsor)]
-
-<a href="https://opencollective.com/gitea/sponsor/0/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/0/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/1/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/1/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/2/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/2/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/3/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/3/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/4/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/4/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/5/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/5/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/6/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/6/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/7/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/7/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/8/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/8/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/9/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/9/avatar.svg"></a>
-
-## 常见问题
-
-**Gitea 怎么发音？**
-
-Gitea 的发音是 [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY)，就像 "gi-tea" 一样，g 是硬音。
-
-**为什么这个项目没有托管在 Gitea 实例上？**
-
-我们正在 [努力](https://github.com/go-gitea/gitea/issues/1029)。
-
-**在哪里可以找到安全补丁？**
-
-在 [发布日志](https://github.com/go-gitea/gitea/releases) 或 [变更日志](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md) 中，搜索关键词 `SECURITY` 以找到安全补丁。
-
-## 许可证
-
-这个项目是根据 MIT 许可证授权的。
-请参阅 [LICENSE](https://github.com/go-gitea/gitea/blob/main/LICENSE) 文件以获取完整的许可证文本。
-
-## 进一步信息
-
-<details>
-<summary>寻找界面概述？查看这里！</summary>
-
-### 登录/注册页面
-
-![Login](https://dl.gitea.com/screenshots/login.png)
-![Register](https://dl.gitea.com/screenshots/register.png)
-
-### 用户仪表板
-
-![Home](https://dl.gitea.com/screenshots/home.png)
-![Issues](https://dl.gitea.com/screenshots/issues.png)
-![Pull Requests](https://dl.gitea.com/screenshots/pull_requests.png)
-![Milestones](https://dl.gitea.com/screenshots/milestones.png)
-
-### 用户资料
-
-![Profile](https://dl.gitea.com/screenshots/user_profile.png)
-
-### 探索
-
-![Repos](https://dl.gitea.com/screenshots/explore_repos.png)
-![Users](https://dl.gitea.com/screenshots/explore_users.png)
-![Orgs](https://dl.gitea.com/screenshots/explore_orgs.png)
-
-### 仓库
-
-![Home](https://dl.gitea.com/screenshots/repo_home.png)
-![Commits](https://dl.gitea.com/screenshots/repo_commits.png)
-![Branches](https://dl.gitea.com/screenshots/repo_branches.png)
-![Labels](https://dl.gitea.com/screenshots/repo_labels.png)
-![Milestones](https://dl.gitea.com/screenshots/repo_milestones.png)
-![Releases](https://dl.gitea.com/screenshots/repo_releases.png)
-![Tags](https://dl.gitea.com/screenshots/repo_tags.png)
-
-#### 仓库问题
-
-![List](https://dl.gitea.com/screenshots/repo_issues.png)
-![Issue](https://dl.gitea.com/screenshots/repo_issue.png)
-
-#### 仓库拉取请求
-
-![List](https://dl.gitea.com/screenshots/repo_pull_requests.png)
-![Pull Request](https://dl.gitea.com/screenshots/repo_pull_request.png)
-![File](https://dl.gitea.com/screenshots/repo_pull_request_file.png)
-![Commits](https://dl.gitea.com/screenshots/repo_pull_request_commits.png)
-
-#### 仓库操作
-
-![List](https://dl.gitea.com/screenshots/repo_actions.png)
-![Details](https://dl.gitea.com/screenshots/repo_actions_run.png)
-
-#### 仓库活动
-
-![Activity](https://dl.gitea.com/screenshots/repo_activity.png)
-![Contributors](https://dl.gitea.com/screenshots/repo_contributors.png)
-![Code Frequency](https://dl.gitea.com/screenshots/repo_code_frequency.png)
-![Recent Commits](https://dl.gitea.com/screenshots/repo_recent_commits.png)
-
-### 组织
-
-![Home](https://dl.gitea.com/screenshots/org_home.png)
-
-</details>
@@ -1,201 +0,0 @@
-# Gitea
-
-[![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
-[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
-[![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
-[![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
-[![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
-[![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
-[![](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com "Crowdin")
-
-[English](./README.md) | [简体中文](./README.zh-cn.md)
-
-## 目的
-
-這個項目的目標是提供最簡單、最快速、最無痛的方式來設置自託管的 Git 服務。
-
-由於 Gitea 是用 Go 語言編寫的，它可以在 Go 支援的所有平台和架構上運行，包括 Linux、macOS 和 Windows 的 x86、amd64、ARM 和 PowerPC 架構。這個項目自 2016 年 11 月從 [Gogs](https://gogs.io) [分叉](https://blog.gitea.com/welcome-to-gitea/) 而來，但已經有了很多變化。
-
-在線演示可以訪問 [demo.gitea.com](https://demo.gitea.com)。
-
-要訪問免費的 Gitea 服務（有一定數量的倉庫限制），可以訪問 [gitea.com](https://gitea.com/user/login)。
-
-要快速部署您自己的專用 Gitea 實例，可以在 [cloud.gitea.com](https://cloud.gitea.com) 開始免費試用。
-
-## 文件
-
-您可以在我們的官方 [文件網站](https://docs.gitea.com/) 上找到全面的文件。
-
-它包括安裝、管理、使用、開發、貢獻指南等，幫助您快速入門並有效地探索所有功能。
-
-如果您有任何建議或想要貢獻，可以訪問 [文件倉庫](https://gitea.com/gitea/docs)
-
-## 構建
-
-從源代碼樹的根目錄運行：
-
-    TAGS="bindata" make build
-
-`build` 目標分為兩個子目標：
-
- `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定義。
- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本以及 [pnpm](https://pnpm.io/installation)。
-
-需要互聯網連接來下載 go 和 npm 模塊。從包含預構建前端文件的官方源代碼壓縮包構建時，不會觸發 `frontend` 目標，因此可以在沒有 Node.js 的情況下構建。
-
-更多信息：https://docs.gitea.com/installation/install-from-source
-
-## 使用
-
-構建後，默認情況下會在源代碼樹的根目錄生成一個名為 `gitea` 的二進制文件。要運行它，請使用：
-
-    ./gitea web
-
-> [!注意]
-> 如果您對使用我們的 API 感興趣，我們提供了實驗性支援，並附有 [文件](https://docs.gitea.com/api)。
-
-## 貢獻
-
-預期的工作流程是：Fork -> Patch -> Push -> Pull Request
-
-> [!注意]
->
-> 1. **在開始進行 Pull Request 之前，您必須閱讀 [貢獻者指南](CONTRIBUTING.md)。**
-> 2. 如果您在項目中發現了漏洞，請私下寫信給 **security@gitea.io**。謝謝！
-
-## 翻譯
-
-[![Crowdin](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com)
-
-翻譯通過 [Crowdin](https://translate.gitea.com) 進行。如果您想翻譯成新的語言，請在 Crowdin 項目中請求管理員添加新語言。
-
-您也可以創建一個 issue 來添加語言，或者在 discord 的 #translation 頻道上詢問。如果您需要上下文或發現一些翻譯問題，可以在字符串上留言或在 Discord 上詢問。對於一般的翻譯問題，文檔中有一個部分。目前有點空，但我們希望隨著問題的出現而填充它。
-
-更多信息請參閱 [文件](https://docs.gitea.com/contributing/localization)。
-
-## 官方和第三方項目
-
-我們提供了一個官方的 [go-sdk](https://gitea.com/gitea/go-sdk)，一個名為 [tea](https://gitea.com/gitea/tea) 的 CLI 工具和一個 Gitea Action 的 [action runner](https://gitea.com/gitea/act_runner)。
-
-我們在 [gitea/awesome-gitea](https://gitea.com/gitea/awesome-gitea) 維護了一個 Gitea 相關項目的列表，您可以在那裡發現更多的第三方項目，包括 SDK、插件、主題等。
-
-## 通訊
-
-[![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-
-如果您有任何文件未涵蓋的問題，可以在我們的 [Discord 服務器](https://discord.gg/Gitea) 上與我們聯繫，或者在 [discourse 論壇](https://forum.gitea.com/) 上創建帖子。
-
-## 作者
-
- [維護者](https://github.com/orgs/go-gitea/people)
- [貢獻者](https://github.com/go-gitea/gitea/graphs/contributors)
- [翻譯者](options/locale/TRANSLATORS)
-
-## 支持者
-
-感謝所有支持者！ 🙏 [[成為支持者](https://opencollective.com/gitea#backer)]
-
-<a href="https://opencollective.com/gitea#backers" target="_blank"><img src="https://opencollective.com/gitea/backers.svg?width=890"></a>
-
-## 贊助商
-
-通過成為贊助商來支持這個項目。您的標誌將顯示在這裡，並帶有鏈接到您的網站。 [[成為贊助商](https://opencollective.com/gitea#sponsor)]
-
-<a href="https://opencollective.com/gitea/sponsor/0/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/0/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/1/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/1/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/2/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/2/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/3/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/3/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/4/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/4/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/5/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/5/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/6/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/6/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/7/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/7/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/8/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/8/avatar.svg"></a>
-<a href="https://opencollective.com/gitea/sponsor/9/website" target="_blank"><img src="https://opencollective.com/gitea/sponsor/9/avatar.svg"></a>
-
-## 常見問題
-
-**Gitea 怎麼發音？**
-
-Gitea 的發音是 [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY)，就像 "gi-tea" 一樣，g 是硬音。
-
-**為什麼這個項目沒有託管在 Gitea 實例上？**
-
-我們正在 [努力](https://github.com/go-gitea/gitea/issues/1029)。
-
-**在哪裡可以找到安全補丁？**
-
-在 [發佈日誌](https://github.com/go-gitea/gitea/releases) 或 [變更日誌](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md) 中，搜索關鍵詞 `SECURITY` 以找到安全補丁。
-
-## 許可證
-
-這個項目是根據 MIT 許可證授權的。
-請參閱 [LICENSE](https://github.com/go-gitea/gitea/blob/main/LICENSE) 文件以獲取完整的許可證文本。
-
-## 進一步信息
-
-<details>
-<summary>尋找界面概述？查看這裡！</summary>
-
-### 登錄/註冊頁面
-
-![Login](https://dl.gitea.com/screenshots/login.png)
-![Register](https://dl.gitea.com/screenshots/register.png)
-
-### 用戶儀表板
-
-![Home](https://dl.gitea.com/screenshots/home.png)
-![Issues](https://dl.gitea.com/screenshots/issues.png)
-![Pull Requests](https://dl.gitea.com/screenshots/pull_requests.png)
-![Milestones](https://dl.gitea.com/screenshots/milestones.png)
-
-### 用戶資料
-
-![Profile](https://dl.gitea.com/screenshots/user_profile.png)
-
-### 探索
-
-![Repos](https://dl.gitea.com/screenshots/explore_repos.png)
-![Users](https://dl.gitea.com/screenshots/explore_users.png)
-![Orgs](https://dl.gitea.com/screenshots/explore_orgs.png)
-
-### 倉庫
-
-![Home](https://dl.gitea.com/screenshots/repo_home.png)
-![Commits](https://dl.gitea.com/screenshots/repo_commits.png)
-![Branches](https://dl.gitea.com/screenshots/repo_branches.png)
-![Labels](https://dl.gitea.com/screenshots/repo_labels.png)
-![Milestones](https://dl.gitea.com/screenshots/repo_milestones.png)
-![Releases](https://dl.gitea.com/screenshots/repo_releases.png)
-![Tags](https://dl.gitea.com/screenshots/repo_tags.png)
-
-#### 倉庫問題
-
-![List](https://dl.gitea.com/screenshots/repo_issues.png)
-![Issue](https://dl.gitea.com/screenshots/repo_issue.png)
-
-#### 倉庫拉取請求
-
-![List](https://dl.gitea.com/screenshots/repo_pull_requests.png)
-![Pull Request](https://dl.gitea.com/screenshots/repo_pull_request.png)
-![File](https://dl.gitea.com/screenshots/repo_pull_request_file.png)
-![Commits](https://dl.gitea.com/screenshots/repo_pull_request_commits.png)
-
-#### 倉庫操作
-
-![List](https://dl.gitea.com/screenshots/repo_actions.png)
-![Details](https://dl.gitea.com/screenshots/repo_actions_run.png)
-
-#### 倉庫活動
-
-![Activity](https://dl.gitea.com/screenshots/repo_activity.png)
-![Contributors](https://dl.gitea.com/screenshots/repo_contributors.png)
-![Code Frequency](https://dl.gitea.com/screenshots/repo_code_frequency.png)
-![Recent Commits](https://dl.gitea.com/screenshots/repo_recent_commits.png)
-
-### 組織
-
-![Home](https://dl.gitea.com/screenshots/org_home.png)
-
-</details>
@@ -0,0 +1,98 @@
+<p align="center">
+  <a href="https://gitea.io/">
+    <img alt="Gitea" src="https://raw.githubusercontent.com/go-gitea/gitea/main/public/img/gitea.svg" width="220"/>
+  </a>
+</p>
+<h1 align="center">Gitea - Git with a cup of tea</h1>
+
+<p align="center">
+  <a href="https://drone.gitea.io/go-gitea/gitea" title="Build Status">
+    <img src="https://drone.gitea.io/api/badges/go-gitea/gitea/status.svg?ref=refs/heads/main">
+  </a>
+  <a href="https://discord.gg/Gitea" title="Join the Discord chat at https://discord.gg/Gitea">
+    <img src="https://img.shields.io/discord/322538954119184384.svg">
+  </a>
+  <a href="https://app.codecov.io/gh/go-gitea/gitea" title="Codecov">
+    <img src="https://codecov.io/gh/go-gitea/gitea/branch/main/graph/badge.svg">
+  </a>
+  <a href="https://goreportcard.com/report/code.gitea.io/gitea" title="Go Report Card">
+    <img src="https://goreportcard.com/badge/code.gitea.io/gitea">
+  </a>
+  <a href="https://pkg.go.dev/code.gitea.io/gitea" title="GoDoc">
+    <img src="https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg">
+  </a>
+  <a href="https://github.com/go-gitea/gitea/releases/latest" title="GitHub release">
+    <img src="https://img.shields.io/github/release/go-gitea/gitea.svg">
+  </a>
+  <a href="https://www.codetriage.com/go-gitea/gitea" title="Help Contribute to Open Source">
+    <img src="https://www.codetriage.com/go-gitea/gitea/badges/users.svg">
+  </a>
+  <a href="https://opencollective.com/gitea" title="Become a backer/sponsor of gitea">
+    <img src="https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen">
+  </a>
+  <a href="https://opensource.org/licenses/MIT" title="License: MIT">
+    <img src="https://img.shields.io/badge/License-MIT-blue.svg">
+  </a>
+  <a href="https://gitpod.io/#https://github.com/go-gitea/gitea">
+  <img
+    src="https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod"
+    alt="Contribute with Gitpod"
+  />
+  </a>
+  <a href="https://crowdin.com/project/gitea" title="Crowdin">
+    <img src="https://badges.crowdin.net/gitea/localized.svg">
+  </a>
+  <a href="https://www.tickgit.com/browse?repo=github.com/go-gitea/gitea&branch=main" title="TODOs">
+    <img src="https://badgen.net/https/api.tickgit.com/badgen/github.com/go-gitea/gitea/main">
+  </a>
+  <a href="https://app.bountysource.com/teams/gitea" title="Bountysource">
+    <img src="https://img.shields.io/bountysource/team/gitea/activity">
+  </a>
+</p>
+
+<p align="center">
+  <a href="README.md">View this document in English</a>
+</p>
+
+## 目标
+
+Gitea 的首要目标是创建一个极易安装，运行非常快速，安装和使用体验良好的自建 Git 服务。我们采用 Go 作为后端语言，这使我们只要生成一个可执行程序即可。并且他还支持跨平台，支持 Linux, macOS 和 Windows 以及各种架构，除了 x86，amd64，还包括 ARM 和 PowerPC。
+
+如果您想试用一下，请访问 [在线Demo](https://try.gitea.io/)！
+
+## 提示
+
+1. **开始贡献代码之前请确保你已经看过了 [贡献者向导（英文）](CONTRIBUTING.md)**.
+2. 所有的安全问题，请私下发送邮件给 **security@gitea.io**。谢谢！
+3. 如果你要使用API，请参见 [API 文档](https://godoc.org/code.gitea.io/sdk/gitea).
+
+## 文档
+
+关于如何安装请访问我们的 [文档站](https://docs.gitea.com/zh-cn/category/installation)，如果没有找到对应的文档，你也可以通过 [Discord - 英文](https://discord.gg/gitea) 和 QQ群 328432459 来和我们交流。
+
+## 贡献流程
+
+Fork -> Patch -> Push -> Pull Request
+
+## 翻译
+
+多语言翻译是基于Crowdin进行的.
+[![Crowdin](https://badges.crowdin.net/gitea/localized.svg)](https://crowdin.com/project/gitea)
+
+## 作者
+
+* [Maintainers](https://github.com/orgs/go-gitea/people)
+* [Contributors](https://github.com/go-gitea/gitea/graphs/contributors)
+* [Translators](options/locale/TRANSLATORS)
+
+## 授权许可
+
+本项目采用 MIT 开源授权许可证，完整的授权说明已放置在 [LICENSE](https://github.com/go-gitea/gitea/blob/main/LICENSE) 文件中。
+
+## 截图
+
+|![Dashboard](https://dl.gitea.com/screenshots/home_timeline.png)|![User Profile](https://dl.gitea.com/screenshots/user_profile.png)|![Global Issues](https://dl.gitea.com/screenshots/global_issues.png)|
+|:---:|:---:|:---:|
+|![Branches](https://dl.gitea.com/screenshots/branches.png)|![Web Editor](https://dl.gitea.com/screenshots/web_editor.png)|![Activity](https://dl.gitea.com/screenshots/activity.png)|
+|![New Migration](https://dl.gitea.com/screenshots/migration.png)|![Migrating](https://dl.gitea.com/screenshots/migration.gif)|![Pull Request View](https://image.ibb.co/e02dSb/6.png)
+![Pull Request Dark](https://dl.gitea.com/screenshots/pull_requests_dark.png)|![Diff Review Dark](https://dl.gitea.com/screenshots/review_dark.png)|![Diff Dark](https://dl.gitea.com/screenshots/diff_dark.png)|
@@ -4,22 +4,20 @@ The Gitea maintainers take security seriously.

 If you discover a security issue, please bring it to their attention right away!

-Previous vulnerabilities are listed at https://about.gitea.com/security.
-
 ## Reporting a Vulnerability

 Please **DO NOT** file a public issue, instead send your report privately to `security@gitea.io`.

 ## Protecting Security Information

-Due to the sensitive nature of security information, you can use the below GPG public key to encrypt your mail body.
+Due to the sensitive nature of security information, you can use below GPG public key encrypt your mail body.

-The PGP key is valid until July 4, 2026.
+The PGP key is valid until June 24, 2024.

 ```
 Key ID: 6FCD2D5B
 Key Type: RSA
-Expires: 7/4/2026
+Expires: 6/24/2024
 Key Size: 4096/4096
 Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
 ```
@@ -40,20 +38,20 @@ q+pHZl24JYR0Kf3T/ZiOC0cGd2QJqpJtg5J6S/OqfX9NH6MsCczO8pUC1N/aHH2X
 CTme2nF56izORqDWKoiICteL3GpYsCV9nyCidcCmoQsS+DKvE86YhIhVIVWGRY2F
 lzpAjnN9/KLtQroutrm+Ft0mdjDiJUeFVl1cOHDhoyfCsQh62HumoyZoZvqzQd6e
 AbN11nq6aViMe2Q3je1AbiBnRnQSHxt1Tc8X4IshO3MQK1Sk7oPI6LA5oQARAQAB
-tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBAhsD
-BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAFiEEPeA9HhRKfwaTWZncqv0jgW/N
-LVsFAmhoHmkFCQeT6esACgkQqv0jgW/NLVuFLRAAmjBQSKRAgs2bFIEj7HLAbDp4
-f+XkdH+GsT3jRPOZ9QZgmtM+TfoE4yNgIVfOl+s4RdjM/W4QzqZuPQ55hbEHd056
-cJmm7B+6GsHFcdrPmh65sOCEIyh4+t45dUfeWpFsDPqm9j1UHXAJQIpB8vDEVAPH
-t+3wLCk8GMPJs1o5tIyMmaO23ngvkwn8eG7KgY+rp2PzObrb5g7ppci0ILzILkrp
-HVjZsEfUWRgSVF7LuU5ppqDKrlcqwUpQq6n3kGMZcLrCp6ACKP04TBmTfUxNwdL7
-I0N7apI2Pbct9T1Gv/lYAUFWyU2c3gh/EBLbO6BukaLOFRQHrtNfdJV/YnMPlcXr
-LUJjK9K4eAH9DsrZqrisz/LthsC2BaNIN3KRMTk5YTYgmIh8GXzSgihORmtDFELC
-RroID3pTuS0zjXh+wpY9GuPTh7UW23p42Daxca4fAT4k5EclvDRUrL21xMopPMiL
-HuNdELz4FVchRTy05PjzKVyjVInDNojE2KUxnjxZDzYJ6aT/g+coD5yfntYm8BEj
-+ZzL0ndZES54hzKLpv7zwBQwFzam68clZYmDPILOPTflQDfpGEWmJK4undFU5obz
-ZsQRz0R3ulspChATbZxO0d5LX2obLpKO9X3b5VoO1KF+R8Vjw1Y0KxrNZ6rIcfqH
-Z50QVQKSe9dm08K0ON+5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
+tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBFiEE
+PeA9HhRKfwaTWZncqv0jgW/NLVsFAmK1Z/4CGwMFCQPCZwAFCwkIBwICIgIGFQoJ
+CAsCBBYCAwECHgcCF4AACgkQqv0jgW/NLVvnyxAAhxyNnWzw/rQO2qhzqicmZM94
+njSbOg+U2qMBvCdaqCQQeC+uaMmMzkDPanUUmLcyCkWqfCjPNjeSXAkE9npepVJI
+4HtmgxZQ94OU/h3CLbft+9GVRzUkVI29TSYGdvNtV2/BkNGoFFnKWQr119um0o6A
+bgha2Uy5uY8o3ZIoiKkiHRaEoWIjjeBxJxYAojsZY4YElUmsQ3ik2joG6rhFesTa
+ofVt/bL8G2xzpOG26WGIxBbqf2qjV6OtZ0hu/vtTPHeIWMLq0Mz0V3PEDQWfkGPE
+i2RYxxYDs2xzJhSQWqTNVLSq0m5xTJnbHhQPfdCX4C2jvFKgLdfmytQq49S7jiJb
+Z03HVOZ/PsyBlQfH9xJi06R5yQCMEA8h8Z5r3/NXW09kQ6OFRe6xshoTcxZGRPTo
+srhwr3uPbmCRh+YEl7qBLU6+BC5k8IRTZXqhrj/aPJu3MxgbgwV8u3vLoFSXM2lb
+a61FgeCQ0O7lkgVswwF0RppCaH9Ul3ZDapet/vCRg4NVwm9zOI/8q/Vj0FKA1GDR
+JhRu8+Ce8zlFL65D34t+PprAzSeTlbv9um3x/ZIjCco7EEKSBylt+AZj/VyA6+e5
+kjOQwRRc6dFJWBcorsSI2dG+H+QMF7ZabzmeCcz1v9HjLOPzYHoZAHhCmSppWTvX
+AJy6+lhfW2OUTqQeYSi5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
 T+p07yCSSoSlmnJHCQmwh4vfg1blyz0zZ4vkIhtpHsEgc+ZAG+WQXSsJ2iRz+eSN
 GwoOQl4XC3n+QWkc1ws+btr48+6UqXIQU+F8TPQyx/PIgi2nZXJB7f5+mjCqsk46
 XvH4nTr4kJjuqMSR/++wvre2qNQRa/q/dTsK0OaN/mJsdX6Oi+aGNaQJUhIG7F+E
@@ -64,20 +62,20 @@ qoExANj5lUTZPe8M50lI182FrcjAN7dClO3QI6pg7wy0erMxfFly3j8UQ91ysS9T
 s+GsP9I3cmWWQcKYxWHtE8xTXnNCVPFZQj2nwhJzae8ypfOtulBRA3dUKWGKuDH/
 axFENhUsT397aOU3qkP/od4a64JyNIEo4CTTSPVeWd7njsGqli2U3A4xL2CcyYvt
 D/MWcMBGEoLSNTswwKdom4FaJpn5KThnK/T0bQcmJblJhoCtppXisbexZnCpuS0x
-Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYCGwwWIQQ94D0eFEp/BpNZmdyq/SOBb80t
-WwUCaGgeJAUJB5PppgAKCRCq/SOBb80tW/NWEACB6Jrf0gWlk7e+hNCdnbM0ZVWU
-f2sHNFfXxxsdhpcDgKbNHtkZb8nZgv8AX+5fTtUwMVa3vKcdw30xFiIM5N7cCIPV
-vg/5z5BtfEaitnabEUG2iiVDIy8IHXIcK10rX+7BosA3QDl2PsiBHwyi5G13lRk8
-zGTSNDuOalug33h5/lr2dPigamkq74Aoy29q8Rjad6GfWHipL2bFimgtY+Zdi0BH
-NLk4EJXxj1SgVx5dtkQzWJReBA5M+FQ4QYQZBO+f4TDoOLmjui152uhkoLBQbGAa
-WWJFTVxm0bG5MXloEL3gA8DfU7XDwuW/sHJC5pBko8RpQViooOhckMepZV3Y83DK
-bwLYa3JmPgj2rEv4993dvrJbQhpGd082HOxOsllCs8pgNq1SnXpWYfcGTgGKC3ts
-U8YZUUJUQ7mi2L8Tv3ix20c9EiGmA30JAmA8eZTC3cWup91ZkkVBFRml2czTXajd
-RWZ6GbHV5503ueDQcB8yBVgF3CSixs67+dGSbD3p86OqGrjAcJzM5TFbNKcnGLdE
-kGbZpNwAISy750lXzXKmyrh5RTCeTOQerbwCMBvHZO+HAevA/LXDTw2OAiSIQlP5
-sYA4sFYLQ30OAkgJcmdp/pSgVj/erNtSN07ClrOpDb/uFpQymO6K2h0Pst3feNVK
-9M2VbqL9C51z/wyHLg==
-=SfZA
+Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYWIQQ94D0eFEp/BpNZmdyq/SOBb80tWwUC
+YrVn/gIbDAUJA8JnAAAKCRCq/SOBb80tWyTBD/9AGpW6QoDF7zYjHAozH9S5RGCA
+Y7E82dG/0xmFUwPprAG0BKmmgU6TiipyVGmKIXGYYYU92pMnbvXkYQMoa+WJNncN
+D3fY52UeXeffTf4cFpStlzi9xgYtOLhFamzYu/4xhkjOX+xhOSXscCiFRyT8cF3B
+O6c5BHU+Zj0/rGPgOyPUbx7l7B9MubB/41nNX35k08e+8T3wtWDb4XF+15HnRfva
+6fblO8wgU25Orv2Rm1jnKGa9DxJ8nE40IMrqDapENtDuL+zKJsvR0+ptWvEyL56U
+GtJJG5un6mXiLKuRQT0DEv4MdZRHDgDstDnqcbEiazVEbUuvhZZob6lRY2A19m1+
+7zfnDxkhqCA1RCnv4fdvcPdCMMFHwLpdhjgW0aI/uwgwrvsEz5+JRlnLvdQHlPAg
+q7l2fGcBSpz9U0ayyfRPjPntsNCtZl1UDxGLeciPkZhyG84zEWQbk/j52ZpRN+Ik
+ALpRLa8RBFmFSmXDUmwQrmm1EmARyQXwweKU31hf8ZGbCp2lPuRYm1LuGiirXSVP
+GysjRAJgW+VRpBKOzFQoUAUbReVWSaCwT8s17THzf71DdDb6CTj31jMLLYWwBpA/
+i73DgobDZMIGEZZC1EKqza8eh11xfyHFzGec03tbh+lIen+5IiRtWiEWkDS9ll0G
+zgS/ZdziCvdAutqnGA==
+=gZWO
 -----END PGP PUBLIC KEY BLOCK-----

 ```
@@ -1,21 +0,0 @@
-acounts,accounts
-canidate,candidate
-comfirm,confirm
-converage,coverage
-currrently,currently
-delimeter,delimiter
-differrent,different
-exclusing,excluding
-finshed,finished
-formated,formatted
-inderect,indirect
-insuficient,insufficient
-likly,likely
-mergable,mergeable
-overrided,overridden
-priortized,prioritized
-registeration,registration
-reuqest,request
-reviwer,reviewer
-superceded,superseded
-underlaying,underlying
@@ -0,0 +1,23 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build vendor
+
+package main
+
+// Libraries that are included to vendor utilities used during build.
+// These libraries will not be included in a normal compilation.
+
+import (
+	// for embed
+	_ "github.com/shurcooL/vfsgen"
+
+	// for cover merge
+	_ "golang.org/x/tools/cover"
+
+	// for vet
+	_ "code.gitea.io/gitea-vet"
+
+	// for swagger
+	_ "github.com/go-swagger/go-swagger/cmd/swagger"
+)
@@ -0,0 +1,114 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build ignore
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"code.gitea.io/gitea/modules/setting"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		println("usage: backport-locales <to-ref>")
+		println("eg: backport-locales release/v1.19")
+		os.Exit(1)
+	}
+
+	mustNoErr := func(err error) {
+		if err != nil {
+			panic(err)
+		}
+	}
+	collectInis := func(ref string) map[string]setting.ConfigProvider {
+		inis := map[string]setting.ConfigProvider{}
+		err := filepath.WalkDir("options/locale", func(path string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() || !strings.HasSuffix(d.Name(), ".ini") {
+				return nil
+			}
+			cfg, err := setting.NewConfigProviderForLocale(path)
+			mustNoErr(err)
+			inis[path] = cfg
+			fmt.Printf("collecting: %s @ %s\n", path, ref)
+			return nil
+		})
+		mustNoErr(err)
+		return inis
+	}
+
+	// collect new locales from current working directory
+	inisNew := collectInis("HEAD")
+
+	// switch to the target ref, and collect the old locales
+	cmd := exec.Command("git", "checkout", os.Args[1])
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	mustNoErr(cmd.Run())
+	inisOld := collectInis(os.Args[1])
+
+	// use old en-US as the base, and copy the new translations to the old locales
+	enUsOld := inisOld["options/locale/locale_en-US.ini"]
+	brokenWarned := map[string]bool{}
+	for path, iniOld := range inisOld {
+		if iniOld == enUsOld {
+			continue
+		}
+		iniNew := inisNew[path]
+		if iniNew == nil {
+			continue
+		}
+		for _, secEnUS := range enUsOld.Sections() {
+			secOld := iniOld.Section(secEnUS.Name())
+			secNew := iniNew.Section(secEnUS.Name())
+			for _, keyEnUs := range secEnUS.Keys() {
+				if secNew.HasKey(keyEnUs.Name()) {
+					oldStr := secOld.Key(keyEnUs.Name()).String()
+					newStr := secNew.Key(keyEnUs.Name()).String()
+					broken := oldStr != "" && strings.Count(oldStr, "%") != strings.Count(newStr, "%")
+					broken = broken || strings.Contains(oldStr, "\n") || strings.Contains(oldStr, "\n")
+					if broken {
+						brokenWarned[secOld.Name()+"."+keyEnUs.Name()] = true
+						fmt.Println("----")
+						fmt.Printf("WARNING: skip broken locale: %s , [%s] %s\n", path, secEnUS.Name(), keyEnUs.Name())
+						fmt.Printf("\told: %s\n", strings.ReplaceAll(oldStr, "\n", "\\n"))
+						fmt.Printf("\tnew: %s\n", strings.ReplaceAll(newStr, "\n", "\\n"))
+						continue
+					}
+					secOld.Key(keyEnUs.Name()).SetValue(newStr)
+				}
+			}
+		}
+		mustNoErr(iniOld.SaveTo(path))
+	}
+
+	fmt.Println("========")
+
+	for path, iniNew := range inisNew {
+		for _, sec := range iniNew.Sections() {
+			for _, key := range sec.Keys() {
+				str := sec.Key(key.Name()).String()
+				broken := strings.Contains(str, "\n")
+				broken = broken || strings.HasPrefix(str, "`") != strings.HasSuffix(str, "`")
+				broken = broken || strings.HasPrefix(str, "\"`")
+				broken = broken || strings.HasPrefix(str, "`\"")
+				broken = broken || strings.Count(str, `"`)%2 == 1
+				broken = broken || strings.Count(str, "`")%2 == 1
+				if broken && !brokenWarned[sec.Name()+"."+key.Name()] {
+					fmt.Printf("WARNING: found broken locale: %s , [%s] %s\n", path, sec.Name(), key.Name())
+					fmt.Printf("\tstr: %s\n", strings.ReplaceAll(str, "\n", "\\n"))
+					fmt.Println("----")
+				}
+			}
+		}
+	}
+}
@@ -0,0 +1,290 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build ignore
+
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"code.gitea.io/gitea/build/codeformat"
+)
+
+// Windows has a limitation for command line arguments, the size can not exceed 32KB.
+// So we have to feed the files to some tools (like gofmt) batch by batch
+
+// We also introduce a `gitea-fmt` command, it does better import formatting than gofmt/goimports. `gitea-fmt` calls `gofmt` internally.
+
+var optionLogVerbose bool
+
+func logVerbose(msg string, args ...any) {
+	if optionLogVerbose {
+		log.Printf(msg, args...)
+	}
+}
+
+func passThroughCmd(cmd string, args []string) error {
+	foundCmd, err := exec.LookPath(cmd)
+	if err != nil {
+		log.Fatalf("can not find cmd: %s", cmd)
+	}
+	c := exec.Cmd{
+		Path:   foundCmd,
+		Args:   append([]string{cmd}, args...),
+		Stdin:  os.Stdin,
+		Stdout: os.Stdout,
+		Stderr: os.Stderr,
+	}
+	return c.Run()
+}
+
+type fileCollector struct {
+	dirs            []string
+	includePatterns []*regexp.Regexp
+	excludePatterns []*regexp.Regexp
+	batchSize       int
+}
+
+func newFileCollector(fileFilter string, batchSize int) (*fileCollector, error) {
+	co := &fileCollector{batchSize: batchSize}
+	if fileFilter == "go-own" {
+		co.dirs = []string{
+			"build",
+			"cmd",
+			"contrib",
+			"tests",
+			"models",
+			"modules",
+			"routers",
+			"services",
+		}
+		co.includePatterns = append(co.includePatterns, regexp.MustCompile(`.*\.go$`))
+
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`.*\bbindata\.go$`))
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`tests/gitea-repositories-meta`))
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`tests/integration/migration-test`))
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`modules/git/tests`))
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`models/fixtures`))
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`models/migrations/fixtures`))
+		co.excludePatterns = append(co.excludePatterns, regexp.MustCompile(`services/gitdiff/testdata`))
+	}
+
+	if co.dirs == nil {
+		return nil, fmt.Errorf("unknown file-filter: %s", fileFilter)
+	}
+	return co, nil
+}
+
+func (fc *fileCollector) matchPatterns(path string, regexps []*regexp.Regexp) bool {
+	path = strings.ReplaceAll(path, "\\", "/")
+	for _, re := range regexps {
+		if re.MatchString(path) {
+			return true
+		}
+	}
+	return false
+}
+
+func (fc *fileCollector) collectFiles() (res [][]string, err error) {
+	var batch []string
+	for _, dir := range fc.dirs {
+		err = filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
+			include := len(fc.includePatterns) == 0 || fc.matchPatterns(path, fc.includePatterns)
+			exclude := fc.matchPatterns(path, fc.excludePatterns)
+			process := include && !exclude
+			if !process {
+				if d.IsDir() {
+					if exclude {
+						logVerbose("exclude dir %s", path)
+						return filepath.SkipDir
+					}
+					// for a directory, if it is not excluded explicitly, we should walk into
+					return nil
+				}
+				// for a file, we skip it if it shouldn't be processed
+				logVerbose("skip process %s", path)
+				return nil
+			}
+			if d.IsDir() {
+				// skip dir, we don't add dirs to the file list now
+				return nil
+			}
+			if len(batch) >= fc.batchSize {
+				res = append(res, batch)
+				batch = nil
+			}
+			batch = append(batch, path)
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+	}
+	res = append(res, batch)
+	return res, nil
+}
+
+// substArgFiles expands the {file-list} to a real file list for commands
+func substArgFiles(args, files []string) []string {
+	for i, s := range args {
+		if s == "{file-list}" {
+			newArgs := append(args[:i], files...)
+			newArgs = append(newArgs, args[i+1:]...)
+			return newArgs
+		}
+	}
+	return args
+}
+
+func exitWithCmdErrors(subCmd string, subArgs []string, cmdErrors []error) {
+	for _, err := range cmdErrors {
+		if err != nil {
+			if exitError, ok := err.(*exec.ExitError); ok {
+				exitCode := exitError.ExitCode()
+				log.Printf("run command failed (code=%d): %s %v", exitCode, subCmd, subArgs)
+				os.Exit(exitCode)
+			} else {
+				log.Fatalf("run command failed (err=%s) %s %v", err, subCmd, subArgs)
+			}
+		}
+	}
+}
+
+func parseArgs() (mainOptions map[string]string, subCmd string, subArgs []string) {
+	mainOptions = map[string]string{}
+	for i := 1; i < len(os.Args); i++ {
+		arg := os.Args[i]
+		if arg == "" {
+			break
+		}
+		if arg[0] == '-' {
+			arg = strings.TrimPrefix(arg, "-")
+			arg = strings.TrimPrefix(arg, "-")
+			fields := strings.SplitN(arg, "=", 2)
+			if len(fields) == 1 {
+				mainOptions[fields[0]] = "1"
+			} else {
+				mainOptions[fields[0]] = fields[1]
+			}
+		} else {
+			subCmd = arg
+			subArgs = os.Args[i+1:]
+			break
+		}
+	}
+	return
+}
+
+func showUsage() {
+	fmt.Printf(`Usage: %[1]s [options] {command} [arguments]
+
+Options:
+  --verbose
+  --file-filter=go-own
+  --batch-size=100
+
+Commands:
+  %[1]s gofmt ...
+
+Arguments:
+  {file-list}     the file list
+
+Example:
+  %[1]s gofmt -s -d {file-list}
+
+`, "file-batch-exec")
+}
+
+func getGoVersion() string {
+	goModFile, err := os.ReadFile("go.mod")
+	if err != nil {
+		log.Fatalf(`Faild to read "go.mod": %v`, err)
+		os.Exit(1)
+	}
+	goModVersionRegex := regexp.MustCompile(`go \d+\.\d+`)
+	goModVersionLine := goModVersionRegex.Find(goModFile)
+	return string(goModVersionLine[3:])
+}
+
+func newFileCollectorFromMainOptions(mainOptions map[string]string) (fc *fileCollector, err error) {
+	fileFilter := mainOptions["file-filter"]
+	if fileFilter == "" {
+		fileFilter = "go-own"
+	}
+	batchSize, _ := strconv.Atoi(mainOptions["batch-size"])
+	if batchSize == 0 {
+		batchSize = 100
+	}
+
+	return newFileCollector(fileFilter, batchSize)
+}
+
+func containsString(a []string, s string) bool {
+	for _, v := range a {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}
+
+func giteaFormatGoImports(files []string, doWriteFile bool) error {
+	for _, file := range files {
+		if err := codeformat.FormatGoImports(file, doWriteFile); err != nil {
+			log.Printf("failed to format go imports: %s, err=%v", file, err)
+			return err
+		}
+	}
+	return nil
+}
+
+func main() {
+	mainOptions, subCmd, subArgs := parseArgs()
+	if subCmd == "" {
+		showUsage()
+		os.Exit(1)
+	}
+	optionLogVerbose = mainOptions["verbose"] != ""
+
+	fc, err := newFileCollectorFromMainOptions(mainOptions)
+	if err != nil {
+		log.Fatalf("can not create file collector: %s", err.Error())
+	}
+
+	fileBatches, err := fc.collectFiles()
+	if err != nil {
+		log.Fatalf("can not collect files: %s", err.Error())
+	}
+
+	processed := 0
+	var cmdErrors []error
+	for _, files := range fileBatches {
+		if len(files) == 0 {
+			break
+		}
+		substArgs := substArgFiles(subArgs, files)
+		logVerbose("batch cmd: %s %v", subCmd, substArgs)
+		switch subCmd {
+		case "gitea-fmt":
+			if containsString(subArgs, "-d") {
+				log.Print("the -d option is not supported by gitea-fmt")
+			}
+			cmdErrors = append(cmdErrors, giteaFormatGoImports(files, containsString(subArgs, "-w")))
+			cmdErrors = append(cmdErrors, passThroughCmd("go", append([]string{"run", os.Getenv("GOFUMPT_PACKAGE"), "-extra", "-lang", getGoVersion()}, substArgs...)))
+		default:
+			log.Fatalf("unknown cmd: %s %v", subCmd, subArgs)
+		}
+		processed += len(files)
+	}
+
+	logVerbose("processed %d files", processed)
+	exitWithCmdErrors(subCmd, subArgs, cmdErrors)
+}
@@ -0,0 +1,195 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package codeformat
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"sort"
+	"strings"
+)
+
+var importPackageGroupOrders = map[string]int{
+	"":                     1, // internal
+	"code.gitea.io/gitea/": 2,
+}
+
+var errInvalidCommentBetweenImports = errors.New("comments between imported packages are invalid, please move comments to the end of the package line")
+
+var (
+	importBlockBegin = []byte("\nimport (\n")
+	importBlockEnd   = []byte("\n)")
+)
+
+type importLineParsed struct {
+	group   string
+	pkg     string
+	content string
+}
+
+func parseImportLine(line string) (*importLineParsed, error) {
+	il := &importLineParsed{content: line}
+	p1 := strings.IndexRune(line, '"')
+	if p1 == -1 {
+		return nil, errors.New("invalid import line: " + line)
+	}
+	p1++
+	p := strings.IndexRune(line[p1:], '"')
+	if p == -1 {
+		return nil, errors.New("invalid import line: " + line)
+	}
+	p2 := p1 + p
+	il.pkg = line[p1:p2]
+
+	pDot := strings.IndexRune(il.pkg, '.')
+	pSlash := strings.IndexRune(il.pkg, '/')
+	if pDot != -1 && pDot < pSlash {
+		il.group = "domain-package"
+	}
+	for groupName := range importPackageGroupOrders {
+		if groupName == "" {
+			continue // skip internal
+		}
+		if strings.HasPrefix(il.pkg, groupName) {
+			il.group = groupName
+		}
+	}
+	return il, nil
+}
+
+type (
+	importLineGroup    []*importLineParsed
+	importLineGroupMap map[string]importLineGroup
+)
+
+func formatGoImports(contentBytes []byte) ([]byte, error) {
+	p1 := bytes.Index(contentBytes, importBlockBegin)
+	if p1 == -1 {
+		return nil, nil
+	}
+	p1 += len(importBlockBegin)
+	p := bytes.Index(contentBytes[p1:], importBlockEnd)
+	if p == -1 {
+		return nil, nil
+	}
+	p2 := p1 + p
+
+	importGroups := importLineGroupMap{}
+	r := bytes.NewBuffer(contentBytes[p1:p2])
+	eof := false
+	for !eof {
+		line, err := r.ReadString('\n')
+		eof = err == io.EOF
+		if err != nil && !eof {
+			return nil, err
+		}
+		line = strings.TrimSpace(line)
+		if line != "" {
+			if strings.HasPrefix(line, "//") || strings.HasPrefix(line, "/*") {
+				return nil, errInvalidCommentBetweenImports
+			}
+			importLine, err := parseImportLine(line)
+			if err != nil {
+				return nil, err
+			}
+			importGroups[importLine.group] = append(importGroups[importLine.group], importLine)
+		}
+	}
+
+	var groupNames []string
+	for groupName, importLines := range importGroups {
+		groupNames = append(groupNames, groupName)
+		sort.Slice(importLines, func(i, j int) bool {
+			return strings.Compare(importLines[i].pkg, importLines[j].pkg) < 0
+		})
+	}
+
+	sort.Slice(groupNames, func(i, j int) bool {
+		n1 := groupNames[i]
+		n2 := groupNames[j]
+		o1 := importPackageGroupOrders[n1]
+		o2 := importPackageGroupOrders[n2]
+		if o1 != 0 && o2 != 0 {
+			return o1 < o2
+		}
+		if o1 == 0 && o2 == 0 {
+			return strings.Compare(n1, n2) < 0
+		}
+		return o1 != 0
+	})
+
+	formattedBlock := bytes.Buffer{}
+	for _, groupName := range groupNames {
+		hasNormalImports := false
+		hasDummyImports := false
+		// non-dummy import comes first
+		for _, importLine := range importGroups[groupName] {
+			if strings.HasPrefix(importLine.content, "_") {
+				hasDummyImports = true
+			} else {
+				formattedBlock.WriteString("\t" + importLine.content + "\n")
+				hasNormalImports = true
+			}
+		}
+		// dummy (_ "pkg") comes later
+		if hasDummyImports {
+			if hasNormalImports {
+				formattedBlock.WriteString("\n")
+			}
+			for _, importLine := range importGroups[groupName] {
+				if strings.HasPrefix(importLine.content, "_") {
+					formattedBlock.WriteString("\t" + importLine.content + "\n")
+				}
+			}
+		}
+		formattedBlock.WriteString("\n")
+	}
+	formattedBlockBytes := bytes.TrimRight(formattedBlock.Bytes(), "\n")
+
+	var formattedBytes []byte
+	formattedBytes = append(formattedBytes, contentBytes[:p1]...)
+	formattedBytes = append(formattedBytes, formattedBlockBytes...)
+	formattedBytes = append(formattedBytes, contentBytes[p2:]...)
+	return formattedBytes, nil
+}
+
+// FormatGoImports format the imports by our rules (see unit tests)
+func FormatGoImports(file string, doWriteFile bool) error {
+	f, err := os.Open(file)
+	if err != nil {
+		return err
+	}
+	var contentBytes []byte
+	{
+		defer f.Close()
+		contentBytes, err = io.ReadAll(f)
+		if err != nil {
+			return err
+		}
+	}
+	formattedBytes, err := formatGoImports(contentBytes)
+	if err != nil {
+		return err
+	}
+	if formattedBytes == nil {
+		return nil
+	}
+	if bytes.Equal(contentBytes, formattedBytes) {
+		return nil
+	}
+
+	if doWriteFile {
+		f, err = os.OpenFile(file, os.O_TRUNC|os.O_WRONLY, 0o644)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		_, err = f.Write(formattedBytes)
+		return err
+	}
+
+	return err
+}
@@ -0,0 +1,124 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package codeformat
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFormatImportsSimple(t *testing.T) {
+	formatted, err := formatGoImports([]byte(`
+package codeformat
+
+import (
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+`))
+
+	expected := `
+package codeformat
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+`
+
+	assert.NoError(t, err)
+	assert.Equal(t, expected, string(formatted))
+}
+
+func TestFormatImportsGroup(t *testing.T) {
+	// gofmt/goimports won't group the packages, for example, they produce such code:
+	//     "bytes"
+	//     "image"
+	//        (a blank line)
+	//     "fmt"
+	//     "image/color/palette"
+	// our formatter does better, and these packages are grouped into one.
+
+	formatted, err := formatGoImports([]byte(`
+package test
+
+import (
+	"bytes"
+	"fmt"
+	"image"
+	"image/color"
+
+	_ "image/gif"  // for processing gif images
+	_ "image/jpeg" // for processing jpeg images
+	_ "image/png"  // for processing png images
+
+	"code.gitea.io/other/package"
+
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+
+  "xorm.io/the/package"
+
+	"github.com/issue9/identicon"
+	"github.com/nfnt/resize"
+	"github.com/oliamb/cutter"
+)
+`))
+
+	expected := `
+package test
+
+import (
+	"bytes"
+	"fmt"
+	"image"
+	"image/color"
+
+	_ "image/gif"  // for processing gif images
+	_ "image/jpeg" // for processing jpeg images
+	_ "image/png"  // for processing png images
+
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+
+	"code.gitea.io/other/package"
+	"github.com/issue9/identicon"
+	"github.com/nfnt/resize"
+	"github.com/oliamb/cutter"
+	"xorm.io/the/package"
+)
+`
+
+	assert.NoError(t, err)
+	assert.Equal(t, expected, string(formatted))
+}
+
+func TestFormatImportsInvalidComment(t *testing.T) {
+	// why we shouldn't write comments between imports: it breaks the grouping of imports
+	// for example:
+	//    "pkg1"
+	//    "pkg2"
+	//    // a comment
+	//    "pkgA"
+	//    "pkgB"
+	// the comment splits the packages into two groups, pkg1/2 are sorted separately, pkgA/B are sorted separately
+	// we don't want such code, so the code should be:
+	//    "pkg1"
+	//    "pkg2"
+	//    "pkgA" // a comment
+	//    "pkgB"
+
+	_, err := formatGoImports([]byte(`
+package test
+
+import (
+  "image/jpeg"
+	// for processing gif images
+	"image/gif"
+)
+`))
+	assert.ErrorIs(t, err, errInvalidCommentBetweenImports)
+}
@@ -6,22 +6,87 @@
 package main

 import (
+	"bytes"
+	"crypto/sha1"
 	"fmt"
+	"log"
+	"net/http"
 	"os"
+	"path/filepath"
+	"strconv"

-	"gitea.dev/modules/assetfs"
+	"github.com/shurcooL/vfsgen"
 )

-func main() {
-	if len(os.Args) != 3 {
-		fmt.Println("usage: ./generate-bindata {local-directory} {bindata-filename}")
-		os.Exit(1)
+func needsUpdate(dir, filename string) (bool, []byte) {
+	needRegen := false
+	_, err := os.Stat(filename)
+	if err != nil {
+		needRegen = true
 	}

-	dir, filename := os.Args[1], os.Args[2]
-	fmt.Printf("generating bindata for %s to %s\n", dir, filename)
-	if err := assetfs.GenerateEmbedBindata(dir, filename); err != nil {
-		fmt.Printf("failed: %s\n", err.Error())
-		os.Exit(1)
+	oldHash, err := os.ReadFile(filename + ".hash")
+	if err != nil {
+		oldHash = []byte{}
 	}
+
+	hasher := sha1.New()
+
+	err = filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		info, err := d.Info()
+		if err != nil {
+			return err
+		}
+		_, _ = hasher.Write([]byte(d.Name()))
+		_, _ = hasher.Write([]byte(info.ModTime().String()))
+		_, _ = hasher.Write([]byte(strconv.FormatInt(info.Size(), 16)))
+		return nil
+	})
+	if err != nil {
+		return true, oldHash
+	}
+
+	newHash := hasher.Sum([]byte{})
+
+	if bytes.Compare(oldHash, newHash) != 0 {
+		return true, newHash
+	}
+
+	return needRegen, newHash
+}
+
+func main() {
+	if len(os.Args) < 4 {
+		log.Fatal("Insufficient number of arguments. Need: directory packageName filename")
+	}
+
+	dir, packageName, filename := os.Args[1], os.Args[2], os.Args[3]
+	var useGlobalModTime bool
+	if len(os.Args) == 5 {
+		useGlobalModTime, _ = strconv.ParseBool(os.Args[4])
+	}
+
+	update, newHash := needsUpdate(dir, filename)
+
+	if !update {
+		fmt.Printf("bindata for %s already up-to-date\n", packageName)
+		return
+	}
+
+	fmt.Printf("generating bindata for %s\n", packageName)
+	var fsTemplates http.FileSystem = http.Dir(dir)
+	err := vfsgen.Generate(fsTemplates, vfsgen.Options{
+		PackageName:      packageName,
+		BuildTags:        "bindata",
+		VariableName:     "Assets",
+		Filename:         filename,
+		UseGlobalModTime: useGlobalModTime,
+	})
+	if err != nil {
+		log.Fatalf("%v\n", err)
+	}
+	_ = os.WriteFile(filename+".hash", newHash, 0o666)
 }
@@ -20,12 +20,12 @@ import (
 	"strings"
 	"unicode/utf8"

-	"gitea.dev/modules/json"
+	"code.gitea.io/gitea/modules/json"
 )

 const (
-	gemojiURL         = "https://raw.githubusercontent.com/rhysd/gemoji/537ff2d7e0496e9964824f7f73ec7ece88c9765a/db/emoji.json"
-	maxUnicodeVersion = 16
+	gemojiURL         = "https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json"
+	maxUnicodeVersion = 14
 )

 var flagOut = flag.String("o", "modules/emoji/emoji_data.go", "out")
@@ -53,6 +53,8 @@ func (e Emoji) MarshalJSON() ([]byte, error) {
 }

 func main() {
+	var err error
+
 	flag.Parse()

 	// generate data
@@ -81,6 +83,8 @@ var replacer = strings.NewReplacer(
 var emojiRE = regexp.MustCompile(`\{Emoji:"([^"]*)"`)

 func generate() ([]byte, error) {
+	var err error
+
 	// load gemoji data
 	res, err := http.Get(gemojiURL)
 	if err != nil {
@@ -149,8 +153,8 @@ func generate() ([]byte, error) {
 	}

 	// write a JSON file to use with tribute (write before adding skin tones since we can't support them there yet)
-	file, _ := json.MarshalIndent(data, "", "  ")
-	_ = os.WriteFile("assets/emoji.json", append(file, '\n'), 0o644)
+	file, _ := json.Marshal(data)
+	_ = os.WriteFile("assets/emoji.json", file, 0o644)

 	// Add skin tones to emoji that support it
 	var (
@@ -1,6 +1,3 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
 //go:build ignore

 package main
@@ -18,7 +15,7 @@ import (
 	"path/filepath"
 	"strings"

-	"gitea.dev/modules/util"
+	"code.gitea.io/gitea/modules/util"
 )

 func main() {
@@ -8,220 +8,103 @@ package main
 import (
 	"encoding/json"
 	"fmt"
+	"io/fs"
 	"os"
-	"os/exec"
+	"path"
 	"path/filepath"
 	"regexp"
-	"slices"
 	"sort"
 	"strings"
 )

 // regexp is based on go-license, excluding README and NOTICE
 // https://github.com/google/go-licenses/blob/master/licenses/find.go
-// also defined in vite.config.ts
 var licenseRe = regexp.MustCompile(`^(?i)((UN)?LICEN(S|C)E|COPYING).*$`)

-// primaryLicenseRe matches exact primary license filenames without suffixes.
-// When a directory has both primary and variant files (e.g. LICENSE and
-// LICENSE.docs), only the primary files are kept.
-var primaryLicenseRe = regexp.MustCompile(`^(?i)(LICEN[SC]E|COPYING)$`)
-
-// ignoredNames are LicenseEntry.Name values to exclude from the output.
-var ignoredNames = map[string]bool{
-	"gitea.dev":                 true,
-	"gitea.dev/options/license": true,
-}
-
-var excludedExt = map[string]bool{
-	".gitignore": true,
-	".go":        true,
-	".mod":       true,
-	".sum":       true,
-	".toml":      true,
-	".yaml":      true,
-	".yml":       true,
-}
-
-type ModuleInfo struct {
-	Path    string
-	Dir     string
-	PkgDirs []string // directories of packages imported from this module
-}
-
 type LicenseEntry struct {
 	Name        string `json:"name"`
 	Path        string `json:"path"`
 	LicenseText string `json:"licenseText"`
 }

-// getModules returns all dependency modules with their local directory paths
-// and the package directories used from each module.
-func getModules(goCmd string) []ModuleInfo {
-	cmd := exec.Command(goCmd, "list", "-deps", "-f",
-		"{{if .Module}}{{.Module.Path}}\t{{.Module.Dir}}\t{{.Dir}}{{end}}", "./...")
-	cmd.Stderr = os.Stderr
-	// Use GOOS=linux with CGO to ensure we capture all platform-specific
-	// dependencies, matching the CI environment.
-	cmd.Env = append(os.Environ(), "GOOS=linux", "GOARCH=amd64", "CGO_ENABLED=1")
-	output, err := cmd.Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "failed to run 'go list -deps': %v\n", err)
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Println("usage: go run generate-go-licenses.go <base-dir> <out-json-file>")
 		os.Exit(1)
 	}

-	var modules []ModuleInfo
-	seen := make(map[string]int) // module path -> index in modules
-	for _, line := range strings.Split(string(output), "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" {
-			continue
-		}
-		parts := strings.Split(line, "\t")
-		if len(parts) != 3 {
-			continue
-		}
-		modPath, modDir, pkgDir := parts[0], parts[1], parts[2]
-		if idx, ok := seen[modPath]; ok {
-			modules[idx].PkgDirs = append(modules[idx].PkgDirs, pkgDir)
-		} else {
-			seen[modPath] = len(modules)
-			modules = append(modules, ModuleInfo{
-				Path:    modPath,
-				Dir:     modDir,
-				PkgDirs: []string{pkgDir},
-			})
-		}
+	base, out := os.Args[1], os.Args[2]
+
+	// Add ext for excluded files because license_test.go will be included for some reason.
+	// And there are more files that should be excluded, check with:
+	//
+	// go run github.com/google/go-licenses@v1.6.0 save . --force --save_path=.go-licenses 2>/dev/null
+	// find .go-licenses -type f | while read FILE; do echo "${$(basename $FILE)##*.}"; done | sort -u
+	//    AUTHORS
+	//    COPYING
+	//    LICENSE
+	//    Makefile
+	//    NOTICE
+	//    gitignore
+	//    go
+	//    md
+	//    mod
+	//    sum
+	//    toml
+	//    txt
+	//    yml
+	//
+	// It could be removed once we have a better regex.
+	excludedExt := map[string]bool{
+		".gitignore": true,
+		".go":        true,
+		".mod":       true,
+		".sum":       true,
+		".toml":      true,
+		".yml":       true,
 	}
-	return modules
-}
-
-// findLicenseFiles scans a module's root directory and its used package
-// directories for license files. It also walks up from each package directory
-// to the module root, scanning intermediate directories. Subdirectory licenses
-// are only included if their text differs from the root license(s).
-func findLicenseFiles(mod ModuleInfo) []LicenseEntry {
-	var entries []LicenseEntry
-	seenTexts := make(map[string]bool)
-
-	// First, collect root-level license files.
-	entries = append(entries, scanDirForLicenses(mod.Dir, mod.Path, "")...)
-	for _, e := range entries {
-		seenTexts[e.LicenseText] = true
-	}
-
-	// Then check each package directory and all intermediate parent directories
-	// up to the module root for license files with unique text.
-	seenDirs := map[string]bool{mod.Dir: true}
-	for _, pkgDir := range mod.PkgDirs {
-		for dir := pkgDir; dir != mod.Dir && strings.HasPrefix(dir, mod.Dir); dir = filepath.Dir(dir) {
-			if seenDirs[dir] {
-				continue
-			}
-			seenDirs[dir] = true
-			for _, e := range scanDirForLicenses(dir, mod.Path, mod.Dir) {
-				if !seenTexts[e.LicenseText] {
-					seenTexts[e.LicenseText] = true
-					entries = append(entries, e)
-				}
-			}
-		}
-	}
-	return entries
-}
-
-// scanDirForLicenses reads a single directory for license files and returns entries.
-// If moduleRoot is non-empty, paths are made relative to it.
-func scanDirForLicenses(dir, modulePath, moduleRoot string) []LicenseEntry {
-	dirEntries, err := os.ReadDir(dir)
-	if err != nil {
-		return nil
-	}
-
-	var entries []LicenseEntry
-	for _, entry := range dirEntries {
-		if entry.IsDir() {
-			continue
-		}
-		name := entry.Name()
-		if !licenseRe.MatchString(name) {
-			continue
-		}
-		if excludedExt[strings.ToLower(filepath.Ext(name))] {
-			continue
-		}
-
-		content, err := os.ReadFile(filepath.Join(dir, name))
+	var paths []string
+	err := filepath.WalkDir(base, func(path string, entry fs.DirEntry, err error) error {
 		if err != nil {
-			continue
+			return err
+		}
+		if entry.IsDir() || !licenseRe.MatchString(entry.Name()) || excludedExt[filepath.Ext(entry.Name())] {
+			return nil
+		}
+		paths = append(paths, path)
+		return nil
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	sort.Strings(paths)
+
+	var entries []LicenseEntry
+	for _, filePath := range paths {
+		licenseText, err := os.ReadFile(filePath)
+		if err != nil {
+			panic(err)
 		}

-		entryName := modulePath
-		entryPath := modulePath + "/" + name
-		if moduleRoot != "" {
-			rel, _ := filepath.Rel(moduleRoot, dir)
-			if rel != "." {
-				relSlash := filepath.ToSlash(rel)
-				entryName = modulePath + "/" + relSlash
-				entryPath = modulePath + "/" + relSlash + "/" + name
-			}
+		pkgPath := filepath.ToSlash(filePath)
+		pkgPath = strings.TrimPrefix(pkgPath, base+"/")
+		pkgName := path.Dir(pkgPath)
+
+		// There might be a bug somewhere in go-licenses that sometimes interprets the
+		// root package as "." and sometimes as "code.gitea.io/gitea". Workaround by
+		// removing both of them for the sake of stable output.
+		if pkgName == "." || pkgName == "code.gitea.io/gitea" {
+			continue
 		}

 		entries = append(entries, LicenseEntry{
-			Name:        entryName,
-			Path:        entryPath,
-			LicenseText: string(content),
+			Name:        pkgName,
+			Path:        pkgPath,
+			LicenseText: string(licenseText),
 		})
 	}

-	// When multiple license files exist, prefer primary files (e.g. LICENSE)
-	// over variants with suffixes (e.g. LICENSE.docs, LICENSE-2.0.txt).
-	// If no primary file exists, keep only the first variant.
-	if len(entries) > 1 {
-		var primary []LicenseEntry
-		for _, e := range entries {
-			fileName := e.Path[strings.LastIndex(e.Path, "/")+1:]
-			if primaryLicenseRe.MatchString(fileName) {
-				primary = append(primary, e)
-			}
-		}
-		if len(primary) > 0 {
-			return primary
-		}
-		return entries[:1]
-	}
-
-	return entries
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		fmt.Println("usage: go run generate-go-licenses.go <out-json-file>")
-		os.Exit(1)
-	}
-
-	out := os.Args[1]
-
-	goCmd := "go"
-	if env := os.Getenv("GO"); env != "" {
-		goCmd = env
-	}
-
-	modules := getModules(goCmd)
-
-	var entries []LicenseEntry
-	for _, mod := range modules {
-		entries = append(entries, findLicenseFiles(mod)...)
-	}
-
-	entries = slices.DeleteFunc(entries, func(e LicenseEntry) bool {
-		return ignoredNames[e.Name]
-	})
-
-	sort.Slice(entries, func(i, j int) bool {
-		return entries[i].Path < entries[j].Path
-	})
-
 	jsonBytes, err := json.MarshalIndent(entries, "", "  ")
 	if err != nil {
 		panic(err)
@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+import imageminZopfli from 'imagemin-zopfli';
+import {optimize} from 'svgo';
+import {fabric} from 'fabric';
+import {readFile, writeFile} from 'node:fs/promises';
+
+function exit(err) {
+  if (err) console.error(err);
+  process.exit(err ? 1 : 0);
+}
+
+function loadSvg(svg) {
+  return new Promise((resolve) => {
+    fabric.loadSVGFromString(svg, (objects, options) => {
+      resolve({objects, options});
+    });
+  });
+}
+
+async function generate(svg, path, {size, bg}) {
+  const outputFile = new URL(path, import.meta.url);
+
+  if (String(outputFile).endsWith('.svg')) {
+    const {data} = optimize(svg, {
+      plugins: [
+        'preset-default',
+        'removeDimensions',
+        {
+          name: 'addAttributesToSVGElement',
+          params: {attributes: [{width: size}, {height: size}]}
+        },
+      ],
+    });
+    await writeFile(outputFile, data);
+    return;
+  }
+
+  const {objects, options} = await loadSvg(svg);
+  const canvas = new fabric.Canvas();
+  canvas.setDimensions({width: size, height: size});
+  const ctx = canvas.getContext('2d');
+  ctx.scale(options.width ? (size / options.width) : 1, options.height ? (size / options.height) : 1);
+
+  if (bg) {
+    canvas.add(new fabric.Rect({
+      left: 0,
+      top: 0,
+      height: size * (1 / (size / options.height)),
+      width: size * (1 / (size / options.width)),
+      fill: 'white',
+    }));
+  }
+
+  canvas.add(fabric.util.groupSVGElements(objects, options));
+  canvas.renderAll();
+
+  let png = Buffer.from([]);
+  for await (const chunk of canvas.createPNGStream()) {
+    png = Buffer.concat([png, chunk]);
+  }
+
+  png = await imageminZopfli({more: true})(png);
+  await writeFile(outputFile, png);
+}
+
+async function main() {
+  const gitea = process.argv.slice(2).includes('gitea');
+  const logoSvg = await readFile(new URL('../assets/logo.svg', import.meta.url), 'utf8');
+  const faviconSvg = await readFile(new URL('../assets/favicon.svg', import.meta.url), 'utf8');
+
+  await Promise.all([
+    generate(logoSvg, '../public/img/logo.svg', {size: 32}),
+    generate(logoSvg, '../public/img/logo.png', {size: 512}),
+    generate(faviconSvg, '../public/img/favicon.svg', {size: 32}),
+    generate(faviconSvg, '../public/img/favicon.png', {size: 180}),
+    generate(logoSvg, '../public/img/avatar_default.png', {size: 200}),
+    generate(logoSvg, '../public/img/apple-touch-icon.png', {size: 180, bg: true}),
+    gitea && generate(logoSvg, '../public/img/gitea.svg', {size: 32}),
+  ]);
+}
+
+main().then(exit).catch(exit);
@@ -0,0 +1,122 @@
+//go:build ignore
+
+package main
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"code.gitea.io/gitea/modules/util"
+)
+
+func main() {
+	var (
+		prefix         = "gitea-licenses"
+		url            = "https://api.github.com/repos/spdx/license-list-data/tarball"
+		githubApiToken = ""
+		githubUsername = ""
+		destination    = ""
+	)
+
+	flag.StringVar(&destination, "dest", "options/license/", "destination for the licenses")
+	flag.StringVar(&githubUsername, "username", "", "github username")
+	flag.StringVar(&githubApiToken, "token", "", "github api token")
+	flag.Parse()
+
+	file, err := os.CreateTemp(os.TempDir(), prefix)
+	if err != nil {
+		log.Fatalf("Failed to create temp file. %s", err)
+	}
+
+	defer util.Remove(file.Name())
+
+	if err := os.RemoveAll(destination); err != nil {
+		log.Fatalf("Cannot clean destination folder: %v", err)
+	}
+
+	if err := os.MkdirAll(destination, 0o755); err != nil {
+		log.Fatalf("Cannot create destination: %v", err)
+	}
+
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		log.Fatalf("Failed to download archive. %s", err)
+	}
+
+	if len(githubApiToken) > 0 && len(githubUsername) > 0 {
+		req.SetBasicAuth(githubUsername, githubApiToken)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		log.Fatalf("Failed to download archive. %s", err)
+	}
+
+	defer resp.Body.Close()
+
+	if _, err := io.Copy(file, resp.Body); err != nil {
+		log.Fatalf("Failed to copy archive to file. %s", err)
+	}
+
+	if _, err := file.Seek(0, 0); err != nil {
+		log.Fatalf("Failed to reset seek on archive. %s", err)
+	}
+
+	gz, err := gzip.NewReader(file)
+	if err != nil {
+		log.Fatalf("Failed to gunzip the archive. %s", err)
+	}
+
+	tr := tar.NewReader(gz)
+
+	for {
+		hdr, err := tr.Next()
+
+		if err == io.EOF {
+			break
+		}
+
+		if err != nil {
+			log.Fatalf("Failed to iterate archive. %s", err)
+		}
+
+		if !strings.Contains(hdr.Name, "/text/") {
+			continue
+		}
+
+		if filepath.Ext(hdr.Name) != ".txt" {
+			continue
+		}
+
+		if strings.HasPrefix(filepath.Base(hdr.Name), "README") {
+			continue
+		}
+
+		if strings.HasPrefix(filepath.Base(hdr.Name), "deprecated_") {
+			continue
+		}
+		out, err := os.Create(path.Join(destination, strings.TrimSuffix(filepath.Base(hdr.Name), ".txt")))
+		if err != nil {
+			log.Fatalf("Failed to create new file. %s", err)
+		}
+
+		defer out.Close()
+
+		if _, err := io.Copy(out, tr); err != nil {
+			log.Fatalf("Failed to write new file. %s", err)
+		} else {
+			fmt.Printf("Written %s\n", out.Name())
+		}
+	}
+
+	fmt.Println("Done")
+}
@@ -1,97 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-// generate-openapi converts Gitea's Swagger 2.0 spec into an OpenAPI 3.0 spec.
-//
-// Gitea generates a Swagger 2.0 spec from code annotations (make generate-swagger).
-// This tool converts it to OAS3 so that SDK generators and tools that require
-// OAS3 (e.g. progenitor for Rust) can consume it directly. The conversion also
-// deduplicates inline enum definitions into named schema components, producing
-// cleaner SDK output with proper enum types instead of anonymous strings.
-//
-// Run: go run build/generate-openapi.go
-// Output: templates/swagger/v1_openapi3_json.tmpl
-
-//go:build ignore
-
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"os"
-	"regexp"
-	"sort"
-	"strings"
-
-	"gitea.dev/build/openapi3gen"
-
-	"github.com/getkin/kin-openapi/openapi3"
-)
-
-const (
-	swaggerSpecPath = "templates/swagger/v1_json.tmpl"
-	openapi3OutPath = "templates/swagger/v1_openapi3_json.tmpl"
-
-	appSubUrlVar = "{{.SwaggerAppSubUrl}}"
-	appVerVar    = "{{.SwaggerAppVer}}"
-
-	appSubUrlPlaceholder = "GITEA_APP_SUB_URL_PLACEHOLDER"
-	appVerPlaceholder    = "0.0.0-gitea-placeholder"
-)
-
-var (
-	appSubUrlRe = regexp.MustCompile(regexp.QuoteMeta(appSubUrlVar))
-	appVerRe    = regexp.MustCompile(regexp.QuoteMeta(appVerVar))
-
-	enumScanDirs = []string{
-		"modules/structs",
-		"modules/commitstatus",
-	}
-)
-
-func main() {
-	astEnumMap, err := openapi3gen.ScanSwaggerEnumTypes(enumScanDirs)
-	if err != nil {
-		log.Fatalf("scanning swagger:enum annotations: %v", err)
-	}
-	names := make([]string, 0, len(astEnumMap))
-	for _, n := range astEnumMap {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	fmt.Fprintf(os.Stderr, "discovered %d swagger:enum types: %s\n", len(names), strings.Join(names, ", "))
-
-	data, err := os.ReadFile(swaggerSpecPath)
-	if err != nil {
-		log.Fatalf("reading swagger spec: %v", err)
-	}
-
-	cleaned := appSubUrlRe.ReplaceAll(data, []byte(appSubUrlPlaceholder))
-	cleaned = appVerRe.ReplaceAll(cleaned, []byte(appVerPlaceholder))
-
-	oas3, err := openapi3gen.Convert(cleaned, astEnumMap)
-	if err != nil {
-		log.Fatalf("converting to openapi 3.0: %v", err)
-	}
-
-	oas3.Servers = openapi3.Servers{
-		{URL: appSubUrlPlaceholder + "/api/v1"},
-	}
-
-	out, err := json.MarshalIndent(oas3, "", "  ")
-	if err != nil {
-		log.Fatalf("marshaling openapi 3.0: %v", err)
-	}
-
-	result := strings.ReplaceAll(string(out), appSubUrlPlaceholder, appSubUrlVar)
-	result = strings.ReplaceAll(result, appVerPlaceholder, appVerVar)
-	result = strings.TrimSpace(result)
-
-	if err := os.WriteFile(openapi3OutPath, []byte(result), 0o644); err != nil {
-		log.Fatalf("writing openapi 3.0 spec: %v", err)
-	}
-
-	fmt.Printf("Generated %s\n", openapi3OutPath)
-}
@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import fastGlob from 'fast-glob';
+import {optimize} from 'svgo';
+import {parse} from 'node:path';
+import {readFile, writeFile, mkdir} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+
+const glob = (pattern) => fastGlob.sync(pattern, {
+  cwd: fileURLToPath(new URL('..', import.meta.url)),
+  absolute: true,
+});
+
+function exit(err) {
+  if (err) console.error(err);
+  process.exit(err ? 1 : 0);
+}
+
+async function processFile(file, {prefix, fullName} = {}) {
+  let name;
+  if (fullName) {
+    name = fullName;
+  } else {
+    name = parse(file).name;
+    if (prefix) name = `${prefix}-${name}`;
+    if (prefix === 'octicon') name = name.replace(/-[0-9]+$/, ''); // chop of '-16' on octicons
+  }
+
+  // Set the `xmlns` attribute so that the files are displayable in standalone documents
+  // The svg backend module will strip the attribute during startup for inline display
+  const {data} = optimize(await readFile(file, 'utf8'), {
+    plugins: [
+      {name: 'preset-default'},
+      {name: 'removeDimensions'},
+      {name: 'prefixIds', params: {prefix: () => name}},
+      {name: 'addClassesToSVGElement', params: {classNames: ['svg', name]}},
+      {
+        name: 'addAttributesToSVGElement', params: {
+          attributes: [
+            {'xmlns': 'http://www.w3.org/2000/svg'},
+            {'width': '16'}, {'height': '16'}, {'aria-hidden': 'true'},
+          ]
+        }
+      },
+    ],
+  });
+
+  await writeFile(fileURLToPath(new URL(`../public/img/svg/${name}.svg`, import.meta.url)), data);
+}
+
+function processFiles(pattern, opts) {
+  return glob(pattern).map((file) => processFile(file, opts));
+}
+
+async function main() {
+  try {
+    await mkdir(fileURLToPath(new URL('../public/img/svg', import.meta.url)), {recursive: true});
+  } catch {}
+
+  await Promise.all([
+    ...processFiles('node_modules/@primer/octicons/build/svg/*-16.svg', {prefix: 'octicon'}),
+    ...processFiles('web_src/svg/*.svg'),
+    ...processFiles('public/img/gitea.svg', {fullName: 'gitea-gitea'}),
+  ]);
+}
+
+main().then(exit).catch(exit);
@@ -1,281 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package openapi3gen
-
-import (
-	"fmt"
-	"regexp"
-	"strings"
-
-	"gitea.dev/modules/json"
-
-	"github.com/getkin/kin-openapi/openapi2"
-	"github.com/getkin/kin-openapi/openapi2conv"
-	"github.com/getkin/kin-openapi/openapi3"
-)
-
-// rxDeprecated matches "deprecated" as a word at the start of a description
-// or preceded by whitespace/punctuation that indicates a leading marker (e.g.
-// "Deprecated: true", "deprecated (use X instead)"). Rejects negated phrases
-// like "not deprecated" or "previously deprecated, now supported".
-var rxDeprecated = regexp.MustCompile(`(?i)(?:^|[\n.;])\s*deprecated\b`)
-
-// Convert parses a Swagger 2.0 spec and returns an OAS3 spec, applying
-// Gitea-specific post-processing: file-schema fixups, URI formats,
-// deprecated flags, and shared-enum extraction.
-//
-// astEnumMap is a value-set-key → Go-type-name map (built by
-// ScanSwaggerEnumTypes). If a shared enum in the spec has no entry in the
-// map, Convert returns an error — no fallback naming.
-func Convert(swaggerJSON []byte, astEnumMap map[string]string) (*openapi3.T, error) {
-	var swagger2 openapi2.T
-	if err := json.Unmarshal(swaggerJSON, &swagger2); err != nil {
-		return nil, fmt.Errorf("parsing swagger 2.0: %w", err)
-	}
-
-	oas3, err := openapi2conv.ToV3(&swagger2)
-	if err != nil {
-		return nil, fmt.Errorf("converting to openapi 3.0: %w", err)
-	}
-
-	fixFileSchemas(oas3)
-	addURIFormats(oas3)
-	addDeprecatedFlags(oas3)
-	if err := extractSharedEnums(oas3, astEnumMap); err != nil {
-		return nil, err
-	}
-	return oas3, nil
-}
-
-func fixFileSchemas(doc *openapi3.T) {
-	for _, pathItem := range doc.Paths.Map() {
-		for _, op := range []*openapi3.Operation{
-			pathItem.Get, pathItem.Post, pathItem.Put, pathItem.Patch,
-			pathItem.Delete, pathItem.Head, pathItem.Options, pathItem.Trace,
-		} {
-			if op == nil {
-				continue
-			}
-			for _, resp := range op.Responses.Map() {
-				if resp.Value == nil {
-					continue
-				}
-				for _, mediaType := range resp.Value.Content {
-					fixSchema(mediaType.Schema)
-				}
-			}
-			if op.RequestBody != nil && op.RequestBody.Value != nil {
-				for _, mediaType := range op.RequestBody.Value.Content {
-					fixSchema(mediaType.Schema)
-				}
-			}
-		}
-	}
-}
-
-// fixSchema rewrites any "type: file" schemas to the OAS3 equivalent
-// (type: string, format: binary), recursing into Properties, Items, and
-// AllOf/OneOf/AnyOf/Not branches. $ref nodes are skipped so shared schemas
-// are rewritten exactly once when visited through their declaration.
-func fixSchema(ref *openapi3.SchemaRef) {
-	if ref == nil || ref.Value == nil || ref.Ref != "" {
-		return
-	}
-	s := ref.Value
-	if s.Type.Is("file") {
-		s.Type = &openapi3.Types{"string"}
-		s.Format = "binary"
-	}
-	for _, p := range s.Properties {
-		fixSchema(p)
-	}
-	fixSchema(s.Items)
-	for _, sub := range s.AllOf {
-		fixSchema(sub)
-	}
-	for _, sub := range s.OneOf {
-		fixSchema(sub)
-	}
-	for _, sub := range s.AnyOf {
-		fixSchema(sub)
-	}
-	fixSchema(s.Not)
-}
-
-// addURIFormats sets format: uri on string properties whose names indicate
-// they hold URLs. This information is lost in Swagger 2.0 but is valuable
-// for code generators.
-func addURIFormats(doc *openapi3.T) {
-	if doc.Components == nil {
-		return
-	}
-	for _, schemaRef := range doc.Components.Schemas {
-		if schemaRef.Value == nil {
-			continue
-		}
-		for propName, propRef := range schemaRef.Value.Properties {
-			if propRef == nil || propRef.Value == nil || propRef.Ref != "" {
-				continue
-			}
-			prop := propRef.Value
-			if !prop.Type.Is("string") || prop.Format != "" {
-				continue
-			}
-			if isURLProperty(propName) {
-				prop.Format = "uri"
-			}
-		}
-	}
-}
-
-func isURLProperty(name string) bool {
-	if strings.HasSuffix(name, "_url") {
-		return true
-	}
-	switch name {
-	case "url", "html_url", "clone_url":
-		return true
-	}
-	return false
-}
-
-// addDeprecatedFlags sets deprecated: true on schema properties whose
-// description starts with a "deprecated" marker (e.g. "Deprecated: true"
-// or "deprecated (use X instead)"). Does not match negated phrases.
-func addDeprecatedFlags(doc *openapi3.T) {
-	if doc.Components == nil {
-		return
-	}
-	for _, schemaRef := range doc.Components.Schemas {
-		if schemaRef.Value == nil {
-			continue
-		}
-		for _, propRef := range schemaRef.Value.Properties {
-			if propRef == nil || propRef.Value == nil || propRef.Ref != "" {
-				continue
-			}
-			if rxDeprecated.MatchString(propRef.Value.Description) {
-				propRef.Value.Deprecated = true
-			}
-		}
-	}
-}
-
-type enumUsage struct {
-	schemaName string
-	propName   string
-	propRef    *openapi3.SchemaRef
-	inItems    bool
-}
-
-// extractSharedEnums finds identical enum arrays used by multiple schema
-// properties, creates a standalone named schema for each, and replaces
-// the inline enums with $ref pointers.
-//
-// If the derived enum name collides with an existing component schema, or
-// no // swagger:enum annotation matches the value set, generation aborts
-// with an actionable error — there are no silent fallbacks.
-func extractSharedEnums(doc *openapi3.T, astEnumMap map[string]string) error {
-	if doc.Components == nil {
-		return nil
-	}
-
-	enumGroups := map[string][]enumUsage{}
-
-	for schemaName, schemaRef := range doc.Components.Schemas {
-		if schemaRef.Value == nil {
-			continue
-		}
-		for propName, propRef := range schemaRef.Value.Properties {
-			if propRef == nil || propRef.Value == nil || propRef.Ref != "" {
-				continue
-			}
-			if len(propRef.Value.Enum) > 1 && propRef.Value.Type.Is("string") {
-				key := EnumKey(propRef.Value.Enum)
-				enumGroups[key] = append(enumGroups[key], enumUsage{schemaName, propName, propRef, false})
-			}
-			if propRef.Value.Type.Is("array") && propRef.Value.Items != nil &&
-				propRef.Value.Items.Value != nil && propRef.Value.Items.Ref == "" &&
-				len(propRef.Value.Items.Value.Enum) > 1 && propRef.Value.Items.Value.Type.Is("string") {
-				key := EnumKey(propRef.Value.Items.Value.Enum)
-				enumGroups[key] = append(enumGroups[key], enumUsage{schemaName, propName, propRef, true})
-			}
-		}
-	}
-
-	for key, usages := range enumGroups {
-		if len(usages) < 2 {
-			continue
-		}
-
-		enumName, err := deriveEnumName(key, usages, astEnumMap)
-		if err != nil {
-			return err
-		}
-		if _, exists := doc.Components.Schemas[enumName]; exists {
-			return fmt.Errorf("enum name collision: %s already exists as a component schema", enumName)
-		}
-
-		var enumValues []any
-		if usages[0].inItems {
-			enumValues = usages[0].propRef.Value.Items.Value.Enum
-		} else {
-			enumValues = usages[0].propRef.Value.Enum
-		}
-
-		doc.Components.Schemas[enumName] = &openapi3.SchemaRef{
-			Value: &openapi3.Schema{
-				Type: &openapi3.Types{"string"},
-				Enum: enumValues,
-			},
-		}
-
-		ref := "#/components/schemas/" + enumName
-
-		for _, usage := range usages {
-			if usage.inItems {
-				usage.propRef.Value.Items = &openapi3.SchemaRef{Ref: ref}
-			} else {
-				old := usage.propRef.Value
-				if old.Description == "" && !old.Deprecated && old.Format == "" {
-					usage.propRef.Ref = ref
-					usage.propRef.Value = nil
-				} else {
-					usage.propRef.Value = &openapi3.Schema{
-						AllOf: openapi3.SchemaRefs{
-							{Ref: ref},
-						},
-						Description: old.Description,
-						Deprecated:  old.Deprecated,
-						Format:      old.Format,
-					}
-				}
-			}
-		}
-	}
-	return nil
-}
-
-// deriveEnumName looks up a shared enum's Go type name from astEnumMap by
-// value-set key. If no annotation matches, returns an error identifying the
-// offending properties and the fix.
-func deriveEnumName(key string, usages []enumUsage, astEnumMap map[string]string) (string, error) {
-	if name, ok := astEnumMap[key]; ok {
-		return name, nil
-	}
-
-	props := map[string]bool{}
-	for _, u := range usages {
-		props[fmt.Sprintf("%s.%s", u.schemaName, u.propName)] = true
-	}
-	propList := make([]string, 0, len(props))
-	for p := range props {
-		propList = append(propList, p)
-	}
-	return "", fmt.Errorf(
-		"no swagger:enum annotation matches value-set %q used by %d properties: %v; "+
-			"fix by adding a named string type with // swagger:enum to modules/structs or modules/commitstatus",
-		key, len(usages), propList,
-	)
-}
@@ -1,170 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package openapi3gen
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/getkin/kin-openapi/openapi3"
-)
-
-func TestDeriveEnumName_hit(t *testing.T) {
-	key := EnumKey([]any{"red", "green", "blue"})
-	astMap := map[string]string{key: "Color"}
-	usages := []enumUsage{{schemaName: "Paint", propName: "color"}}
-	got, err := deriveEnumName(key, usages, astMap)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if got != "Color" {
-		t.Fatalf("got %q, want %q", got, "Color")
-	}
-}
-
-func TestDeriveEnumName_miss(t *testing.T) {
-	key := EnumKey([]any{"x", "y"})
-	usages := []enumUsage{{schemaName: "Thing", propName: "kind"}}
-	_, err := deriveEnumName(key, usages, map[string]string{})
-	if err == nil {
-		t.Fatal("expected miss error, got nil")
-	}
-	msg := err.Error()
-	if !strings.Contains(msg, "Thing.kind") {
-		t.Fatalf("error %q should list the missing usage", msg)
-	}
-	if !strings.Contains(msg, "swagger:enum") {
-		t.Fatalf("error %q should hint at the fix", msg)
-	}
-}
-
-func TestExtractSharedEnums_usesASTMap(t *testing.T) {
-	doc := &openapi3.T{
-		Components: &openapi3.Components{
-			Schemas: openapi3.Schemas{
-				"A": {Value: &openapi3.Schema{
-					Type: &openapi3.Types{"object"},
-					Properties: openapi3.Schemas{
-						"color": {Value: &openapi3.Schema{
-							Type: &openapi3.Types{"string"},
-							Enum: []any{"red", "green", "blue"},
-						}},
-					},
-				}},
-				"B": {Value: &openapi3.Schema{
-					Type: &openapi3.Types{"object"},
-					Properties: openapi3.Schemas{
-						"color": {Value: &openapi3.Schema{
-							Type: &openapi3.Types{"string"},
-							Enum: []any{"red", "green", "blue"},
-						}},
-					},
-				}},
-			},
-		},
-	}
-	astMap := map[string]string{EnumKey([]any{"red", "green", "blue"}): "Color"}
-	if err := extractSharedEnums(doc, astMap); err != nil {
-		t.Fatalf("extractSharedEnums: %v", err)
-	}
-	if _, ok := doc.Components.Schemas["Color"]; !ok {
-		t.Fatalf("expected Color schema to be extracted")
-	}
-}
-
-func TestFixFileSchemas_recursesIntoNested(t *testing.T) {
-	fileType := func() *openapi3.SchemaRef {
-		return &openapi3.SchemaRef{Value: &openapi3.Schema{Type: &openapi3.Types{"file"}}}
-	}
-	doc := &openapi3.T{
-		Paths: openapi3.NewPaths(),
-	}
-	doc.Paths.Set("/upload", &openapi3.PathItem{
-		Post: &openapi3.Operation{
-			RequestBody: &openapi3.RequestBodyRef{
-				Value: &openapi3.RequestBody{
-					Content: openapi3.Content{
-						"multipart/form-data": {
-							Schema: &openapi3.SchemaRef{Value: &openapi3.Schema{
-								Type: &openapi3.Types{"object"},
-								Properties: openapi3.Schemas{
-									"attachment": fileType(),
-									"items": {Value: &openapi3.Schema{
-										Type:  &openapi3.Types{"array"},
-										Items: fileType(),
-									}},
-									"alt": {Value: &openapi3.Schema{
-										AllOf: openapi3.SchemaRefs{fileType()},
-									}},
-									"one": {Value: &openapi3.Schema{
-										OneOf: openapi3.SchemaRefs{fileType()},
-									}},
-									"any": {Value: &openapi3.Schema{
-										AnyOf: openapi3.SchemaRefs{fileType()},
-									}},
-									"not": {Value: &openapi3.Schema{
-										Not: fileType(),
-									}},
-								},
-							}},
-						},
-					},
-				},
-			},
-			Responses: openapi3.NewResponses(),
-		},
-	})
-
-	fixFileSchemas(doc)
-
-	props := doc.Paths.Value("/upload").Post.RequestBody.Value.Content["multipart/form-data"].Schema.Value.Properties
-	if !props["attachment"].Value.Type.Is("string") || props["attachment"].Value.Format != "binary" {
-		t.Errorf("nested property not fixed: %+v", props["attachment"].Value)
-	}
-	if !props["items"].Value.Items.Value.Type.Is("string") || props["items"].Value.Items.Value.Format != "binary" {
-		t.Errorf("array items not fixed: %+v", props["items"].Value.Items.Value)
-	}
-	if !props["alt"].Value.AllOf[0].Value.Type.Is("string") || props["alt"].Value.AllOf[0].Value.Format != "binary" {
-		t.Errorf("allOf branch not fixed: %+v", props["alt"].Value.AllOf[0].Value)
-	}
-	if !props["one"].Value.OneOf[0].Value.Type.Is("string") || props["one"].Value.OneOf[0].Value.Format != "binary" {
-		t.Errorf("oneOf branch not fixed: %+v", props["one"].Value.OneOf[0].Value)
-	}
-	if !props["any"].Value.AnyOf[0].Value.Type.Is("string") || props["any"].Value.AnyOf[0].Value.Format != "binary" {
-		t.Errorf("anyOf branch not fixed: %+v", props["any"].Value.AnyOf[0].Value)
-	}
-	if !props["not"].Value.Not.Value.Type.Is("string") || props["not"].Value.Not.Value.Format != "binary" {
-		t.Errorf("not branch not fixed: %+v", props["not"].Value.Not.Value)
-	}
-}
-
-func TestExtractSharedEnums_missReturnsError(t *testing.T) {
-	doc := &openapi3.T{
-		Components: &openapi3.Components{
-			Schemas: openapi3.Schemas{
-				"A": {Value: &openapi3.Schema{
-					Type: &openapi3.Types{"object"},
-					Properties: openapi3.Schemas{
-						"color": {Value: &openapi3.Schema{
-							Type: &openapi3.Types{"string"},
-							Enum: []any{"red", "green"},
-						}},
-					},
-				}},
-				"B": {Value: &openapi3.Schema{
-					Type: &openapi3.Types{"object"},
-					Properties: openapi3.Schemas{
-						"color": {Value: &openapi3.Schema{
-							Type: &openapi3.Types{"string"},
-							Enum: []any{"red", "green"},
-						}},
-					},
-				}},
-			},
-		},
-	}
-	if err := extractSharedEnums(doc, map[string]string{}); err == nil {
-		t.Fatal("expected miss error")
-	}
-}
@@ -1,188 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-// Package openapi3gen converts Gitea's Swagger 2.0 spec to an OpenAPI 3.0
-// spec. It discovers Go enum type names by scanning swagger:enum annotations
-// in the source tree, then names extracted shared-enum schemas accordingly.
-package openapi3gen
-
-import (
-	"fmt"
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-)
-
-// EnumKey returns a canonical key for a set of enum values: values are
-// stringified, sorted, and joined with "|". Used to match enum value sets
-// across spec properties and scanned Go type declarations.
-func EnumKey(values []any) string {
-	strs := make([]string, len(values))
-	for i, v := range values {
-		strs[i] = fmt.Sprintf("%v", v)
-	}
-	sort.Strings(strs)
-	return strings.Join(strs, "|")
-}
-
-var rxSwaggerEnum = regexp.MustCompile(`swagger:enum\s+(\w+)`)
-
-// ScanSwaggerEnumTypes walks .go files under each dir and returns a map from
-// a canonical value-set key (see EnumKey) to the Go type name declared with
-// // swagger:enum TypeName.
-//
-// Returns an error on parse failure, on an annotation for a type whose
-// constants can't be extracted, or on value-set collisions between two
-// different enum types.
-func ScanSwaggerEnumTypes(dirs []string) (map[string]string, error) {
-	fset := token.NewFileSet()
-	parsed := []*ast.File{}
-
-	for _, dir := range dirs {
-		entries, err := os.ReadDir(dir)
-		if err != nil {
-			return nil, fmt.Errorf("reading %s: %w", dir, err)
-		}
-		for _, entry := range entries {
-			if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".go") {
-				continue
-			}
-			if strings.HasSuffix(entry.Name(), "_test.go") {
-				continue
-			}
-			path := filepath.Join(dir, entry.Name())
-			file, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
-			if err != nil {
-				return nil, fmt.Errorf("%s: %w", path, err)
-			}
-			parsed = append(parsed, file)
-		}
-	}
-
-	enumTypes := map[string]string{} // typeName → "" (presence marker)
-	enumValues := map[string][]any{} // typeName → values
-
-	// Pass 1: collect every // swagger:enum TypeName declaration.
-	for _, file := range parsed {
-		for _, decl := range file.Decls {
-			gd, ok := decl.(*ast.GenDecl)
-			if !ok || gd.Tok != token.TYPE {
-				continue
-			}
-			if err := collectEnumType(gd, enumTypes); err != nil {
-				return nil, fmt.Errorf("%s: %w", fset.Position(gd.Pos()).Filename, err)
-			}
-		}
-	}
-
-	// Pass 2: collect const values; now every annotated type is visible.
-	for _, file := range parsed {
-		for _, decl := range file.Decls {
-			gd, ok := decl.(*ast.GenDecl)
-			if !ok || gd.Tok != token.CONST {
-				continue
-			}
-			collectEnumValues(gd, enumTypes, enumValues)
-		}
-	}
-
-	result := map[string]string{}
-	for typeName := range enumTypes {
-		values, ok := enumValues[typeName]
-		if !ok || len(values) == 0 {
-			return nil, fmt.Errorf("swagger:enum %s has no const block with typed string values", typeName)
-		}
-		key := EnumKey(values)
-		if existing, ok := result[key]; ok && existing != typeName {
-			return nil, fmt.Errorf("swagger:enum value-set collision: %s and %s both use %q", existing, typeName, key)
-		}
-		result[key] = typeName
-	}
-	return result, nil
-}
-
-// collectEnumType scans a `type` GenDecl for // swagger:enum annotations,
-// handling both the lone form (`// swagger:enum Foo\n type Foo string`)
-// where the comment group is attached to the GenDecl, and the grouped form:
-//
-//	type (
-//	    // swagger:enum Foo
-//	    Foo string
-//	)
-//
-// where the comment group is attached to each TypeSpec. Caveat: Go's parser
-// only attaches a CommentGroup when it is immediately adjacent to the decl.
-// A blank line (not a `//` continuation line) between the comment and the
-// declaration drops the Doc, so annotations MUST sit directly above their
-// type. All current annotated files obey this — the rule is noted here so
-// a future edit that inserts a blank line fails fast rather than silently.
-func collectEnumType(gd *ast.GenDecl, enumTypes map[string]string) error {
-	if err := registerEnumAnnotation(gd.Doc, gd.Specs, enumTypes); err != nil {
-		return err
-	}
-	for _, spec := range gd.Specs {
-		ts, ok := spec.(*ast.TypeSpec)
-		if !ok || ts.Doc == nil {
-			continue
-		}
-		if err := registerEnumAnnotation(ts.Doc, []ast.Spec{ts}, enumTypes); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func registerEnumAnnotation(doc *ast.CommentGroup, specs []ast.Spec, enumTypes map[string]string) error {
-	if doc == nil {
-		return nil
-	}
-	matches := rxSwaggerEnum.FindStringSubmatch(doc.Text())
-	if len(matches) < 2 {
-		return nil
-	}
-	annotated := matches[1]
-	for _, spec := range specs {
-		ts, ok := spec.(*ast.TypeSpec)
-		if !ok {
-			continue
-		}
-		if ts.Name.Name == annotated {
-			enumTypes[annotated] = ""
-			return nil
-		}
-	}
-	return fmt.Errorf("swagger:enum %s: no type declaration with that name in the same decl group; check for a typo", annotated)
-}
-
-func collectEnumValues(gd *ast.GenDecl, enumTypes map[string]string, enumValues map[string][]any) {
-	for _, spec := range gd.Specs {
-		vs, ok := spec.(*ast.ValueSpec)
-		if !ok || vs.Type == nil {
-			continue
-		}
-		ident, ok := vs.Type.(*ast.Ident)
-		if !ok {
-			continue
-		}
-		if _, isEnum := enumTypes[ident.Name]; !isEnum {
-			continue
-		}
-		for _, val := range vs.Values {
-			lit, ok := val.(*ast.BasicLit)
-			if !ok || lit.Kind != token.STRING {
-				continue
-			}
-			unquoted, err := strconv.Unquote(lit.Value)
-			if err != nil {
-				continue
-			}
-			enumValues[ident.Name] = append(enumValues[ident.Name], unquoted)
-		}
-	}
-}
@@ -1,239 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package openapi3gen
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestEnumKey_sortsAndJoins(t *testing.T) {
-	key := EnumKey([]any{"b", "a", "c"})
-	if key != "a|b|c" {
-		t.Fatalf("EnumKey = %q, want %q", key, "a|b|c")
-	}
-}
-
-func TestEnumKey_handlesNonStringValues(t *testing.T) {
-	key := EnumKey([]any{2, 1, 3})
-	if key != "1|2|3" {
-		t.Fatalf("EnumKey = %q, want %q", key, "1|2|3")
-	}
-}
-
-func TestScanSwaggerEnumTypes_basic(t *testing.T) {
-	dir := t.TempDir()
-	src := `package fixture
-
-// Color is a primary color.
-// swagger:enum Color
-type Color string
-
-const (
-	ColorRed   Color = "red"
-	ColorGreen Color = "green"
-	ColorBlue  Color = "blue"
-)
-`
-	if err := os.WriteFile(filepath.Join(dir, "color.go"), []byte(src), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := ScanSwaggerEnumTypes([]string{dir})
-	if err != nil {
-		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
-	}
-	wantKey := EnumKey([]any{"red", "green", "blue"})
-	if got[wantKey] != "Color" {
-		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Color")
-	}
-}
-
-func TestScanSwaggerEnumTypes_orphanAnnotation(t *testing.T) {
-	dir := t.TempDir()
-	src := `package fixture
-
-// swagger:enum Sttype
-type StateType string
-
-const (
-	StateOpen StateType = "open"
-)
-`
-	if err := os.WriteFile(filepath.Join(dir, "typo.go"), []byte(src), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := ScanSwaggerEnumTypes([]string{dir})
-	if err == nil {
-		t.Fatal("expected error for annotation referencing a non-matching type name")
-	}
-	if !strings.Contains(err.Error(), "Sttype") {
-		t.Fatalf("error %q should mention the typo'd name Sttype", err.Error())
-	}
-}
-
-func TestScanSwaggerEnumTypes_collision(t *testing.T) {
-	dir := t.TempDir()
-	src := `package fixture
-
-// swagger:enum Alpha
-type Alpha string
-const (
-	AlphaX Alpha = "x"
-	AlphaY Alpha = "y"
-)
-
-// swagger:enum Beta
-type Beta string
-const (
-	BetaX Beta = "x"
-	BetaY Beta = "y"
-)
-`
-	if err := os.WriteFile(filepath.Join(dir, "dup.go"), []byte(src), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := ScanSwaggerEnumTypes([]string{dir})
-	if err == nil {
-		t.Fatal("expected collision error, got nil")
-	}
-	msg := err.Error()
-	if !strings.Contains(msg, "Alpha") || !strings.Contains(msg, "Beta") {
-		t.Fatalf("error %q should mention both Alpha and Beta", msg)
-	}
-}
-
-func TestScanSwaggerEnumTypes_parseFailure(t *testing.T) {
-	dir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(dir, "bad.go"), []byte("package fixture\nfunc Foo() {"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := ScanSwaggerEnumTypes([]string{dir})
-	if err == nil {
-		t.Fatal("expected parse error, got nil")
-	}
-}
-
-func TestScanSwaggerEnumTypes_annotationWithoutConsts(t *testing.T) {
-	dir := t.TempDir()
-	src := `package fixture
-
-// swagger:enum Lonely
-type Lonely string
-`
-	if err := os.WriteFile(filepath.Join(dir, "lonely.go"), []byte(src), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	_, err := ScanSwaggerEnumTypes([]string{dir})
-	if err == nil {
-		t.Fatal("expected error for annotation without consts")
-	}
-	if !strings.Contains(err.Error(), "Lonely") {
-		t.Fatalf("error %q should mention Lonely", err.Error())
-	}
-}
-
-func TestScanSwaggerEnumTypes_constsAndTypeInDifferentFiles(t *testing.T) {
-	dir := t.TempDir()
-	// Name ordering: `a_consts.go` < `b_type.go`, so readdir returns consts first.
-	// Old single-pass scanner would miss the values; two-pass must not.
-	constsSrc := `package fixture
-
-const (
-	HueA Hue = "a"
-	HueB Hue = "b"
-)
-`
-	typeSrc := `package fixture
-
-// swagger:enum Hue
-type Hue string
-`
-	if err := os.WriteFile(filepath.Join(dir, "a_consts.go"), []byte(constsSrc), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "b_type.go"), []byte(typeSrc), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := ScanSwaggerEnumTypes([]string{dir})
-	if err != nil {
-		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
-	}
-	wantKey := EnumKey([]any{"a", "b"})
-	if got[wantKey] != "Hue" {
-		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Hue")
-	}
-}
-
-func TestScanSwaggerEnumTypes_constsBeforeType(t *testing.T) {
-	dir := t.TempDir()
-	src := `package fixture
-
-const (
-	ShadeDark  Shade = "dark"
-	ShadeLight Shade = "light"
-)
-
-// swagger:enum Shade
-type Shade string
-`
-	if err := os.WriteFile(filepath.Join(dir, "shade.go"), []byte(src), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := ScanSwaggerEnumTypes([]string{dir})
-	if err != nil {
-		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
-	}
-	wantKey := EnumKey([]any{"dark", "light"})
-	if got[wantKey] != "Shade" {
-		t.Fatalf("map[%q] = %q, want %q", wantKey, got[wantKey], "Shade")
-	}
-}
-
-func TestScanSwaggerEnumTypes_groupedTypeDecl(t *testing.T) {
-	dir := t.TempDir()
-	src := `package fixture
-
-type (
-	// swagger:enum Color
-	Color string
-	// swagger:enum Shade
-	Shade string
-)
-
-const (
-	ColorRed  Color = "red"
-	ColorBlue Color = "blue"
-)
-
-const (
-	ShadeDark  Shade = "dark"
-	ShadeLight Shade = "light"
-)
-`
-	if err := os.WriteFile(filepath.Join(dir, "grouped.go"), []byte(src), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := ScanSwaggerEnumTypes([]string{dir})
-	if err != nil {
-		t.Fatalf("ScanSwaggerEnumTypes: %v", err)
-	}
-	colorKey := EnumKey([]any{"red", "blue"})
-	shadeKey := EnumKey([]any{"dark", "light"})
-	if got[colorKey] != "Color" {
-		t.Fatalf("Color: map[%q] = %q, want %q", colorKey, got[colorKey], "Color")
-	}
-	if got[shadeKey] != "Shade" {
-		t.Fatalf("Shade: map[%q] = %q, want %q", shadeKey, got[shadeKey], "Shade")
-	}
-}
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+set -e
+
+if [ ! -f ./build/test-env-check.sh ]; then
+  echo "${0} can only be executed in gitea source root directory"
+  exit 1
+fi
+
+
+echo "check uid ..."
+
+# the uid of gitea defined in "https://gitea.com/gitea/test-env" is 1000
+gitea_uid=$(id -u gitea)
+if [ "$gitea_uid" != "1000" ]; then
+  echo "The uid of linux user 'gitea' is expected to be 1000, but it is $gitea_uid"
+  exit 1
+fi
+
+cur_uid=$(id -u)
+if [ "$cur_uid" != "0" -a "$cur_uid" != "$gitea_uid" ]; then
+  echo "The uid of current linux user is expected to be 0 or $gitea_uid, but it is $cur_uid"
+  exit 1
+fi
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+if [ ! -f ./build/test-env-prepare.sh ]; then
+  echo "${0} can only be executed in gitea source root directory"
+  exit 1
+fi
+
+echo "change the owner of files to gitea ..."
+chown -R gitea:gitea .
@@ -1,22 +1,52 @@
 #!/bin/sh

 # this script runs in alpine image which only has `sh` shell
-if [ ! -f ./options/locale/locale_en-US.json ]; then
+
+set +e
+if sed --version 2>/dev/null | grep -q GNU; then
+  SED_INPLACE="sed -i"
+else
+  SED_INPLACE="sed -i ''"
+fi
+set -e
+
+if [ ! -f ./options/locale/locale_en-US.ini ]; then
  echo "please run this script in the root directory of the project"
  exit 1
 fi

-mv ./options/locale/locale_en-US.json ./options/
+mv ./options/locale/locale_en-US.ini ./options/
+
+# the "ini" library for locale has many quirks, its behavior is different from Crowdin.
+# see i18n_test.go for more details
+
+# this script helps to unquote the Crowdin outputs for the quirky ini library
+# * find all `key="...\"..."` lines
+# * remove the leading quote
+# * remove the trailing quote
+# * unescape the quotes
+# * eg: key="...\"..." => key=..."...
+$SED_INPLACE -r -e '/^[-.A-Za-z0-9_]+[ ]*=[ ]*".*"$/ {
+	s/^([-.A-Za-z0-9_]+)[ ]*=[ ]*"/\1=/
+	s/"$//
+	s/\\"/"/g
+	}' ./options/locale/*.ini
+
+# * if the escaped line is incomplete like `key="...` or `key=..."`, quote it with backticks
+# * eg: key="... => key=`"...`
+# * eg: key=..." => key=`..."`
+$SED_INPLACE -r -e 's/^([-.A-Za-z0-9_]+)[ ]*=[ ]*(".*[^"])$/\1=`\2`/' ./options/locale/*.ini
+$SED_INPLACE -r -e 's/^([-.A-Za-z0-9_]+)[ ]*=[ ]*([^"].*")$/\1=`\2`/' ./options/locale/*.ini

 # Remove translation under 25% of en_us
-baselines=$(cat "./options/locale_en-US.json" | wc -l)
+baselines=$(wc -l "./options/locale_en-US.ini" | cut -d" " -f1)
 baselines=$((baselines / 4))
-for filename in ./options/locale/*.json; do
-  lines=$(cat "$filename" | wc -l)
-  if [ "$lines" -lt "$baselines" ]; then
+for filename in ./options/locale/*.ini; do
+  lines=$(wc -l "$filename" | cut -d" " -f1)
+  if [ $lines -lt $baselines ]; then
    echo "Removing $filename: $lines/$baselines"
    rm "$filename"
  fi
 done

-mv ./options/locale_en-US.json ./options/locale/
+mv ./options/locale_en-US.ini ./options/locale/
@@ -4,43 +4,44 @@
 package cmd

 import (
-	"context"
 	"fmt"

-	"gitea.dev/modules/private"
-	"gitea.dev/modules/setting"
+	"code.gitea.io/gitea/modules/private"
+	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli"
 )

-func newActionsCommand() *cli.Command {
-	return &cli.Command{
-		Name:  "actions",
-		Usage: "Manage Gitea Actions",
-		Commands: []*cli.Command{
-			newActionsGenerateRunnerTokenCommand(),
+var (
+	// CmdActions represents the available actions sub-commands.
+	CmdActions = cli.Command{
+		Name:        "actions",
+		Usage:       "",
+		Description: "Commands for managing Gitea Actions",
+		Subcommands: []cli.Command{
+			subcmdActionsGenRunnerToken,
 		},
 	}
-}

-func newActionsGenerateRunnerTokenCommand() *cli.Command {
-	return &cli.Command{
+	subcmdActionsGenRunnerToken = cli.Command{
 		Name:    "generate-runner-token",
 		Usage:   "Generate a new token for a runner to use to register with the server",
 		Action:  runGenerateActionsRunnerToken,
 		Aliases: []string{"grt"},
 		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "scope",
-				Aliases: []string{"s"},
-				Value:   "",
-				Usage:   "{owner}[/{repo}] - leave empty for a global runner",
+			cli.StringFlag{
+				Name:  "scope, s",
+				Value: "",
+				Usage: "{owner}[/{repo}] - leave empty for a global runner",
 			},
 		},
 	}
-}
+)
+
+func runGenerateActionsRunnerToken(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()

-func runGenerateActionsRunnerToken(ctx context.Context, c *cli.Command) error {
 	setting.MustInstalled()

 	scope := c.String("scope")
@@ -49,6 +50,6 @@ func runGenerateActionsRunnerToken(ctx context.Context, c *cli.Command) error {
 	if extra.HasError() {
 		return handleCliResponseExtra(extra)
 	}
-	_, _ = fmt.Printf("%s\n", respText.Text)
+	_, _ = fmt.Printf("%s\n", respText)
 	return nil
 }
@@ -5,115 +5,356 @@
 package cmd

 import (
-	"context"
+	"errors"
 	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"text/tabwriter"

-	"gitea.dev/models/db"
-	repo_model "gitea.dev/models/repo"
-	"gitea.dev/modules/git"
-	"gitea.dev/modules/gitrepo"
-	"gitea.dev/modules/log"
-	repo_module "gitea.dev/modules/repository"
+	asymkey_model "code.gitea.io/gitea/models/asymkey"
+	auth_model "code.gitea.io/gitea/models/auth"
+	"code.gitea.io/gitea/models/db"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/graceful"
+	"code.gitea.io/gitea/modules/log"
+	repo_module "code.gitea.io/gitea/modules/repository"
+	"code.gitea.io/gitea/modules/util"
+	auth_service "code.gitea.io/gitea/services/auth"
+	"code.gitea.io/gitea/services/auth/source/oauth2"
+	"code.gitea.io/gitea/services/auth/source/smtp"
+	repo_service "code.gitea.io/gitea/services/repository"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli"
 )

-func newAdminCommand() *cli.Command {
-	return &cli.Command{
+var (
+	// CmdAdmin represents the available admin sub-command.
+	CmdAdmin = cli.Command{
 		Name:  "admin",
-		Usage: "Perform common administrative operations",
-		Commands: []*cli.Command{
-			newUserCommand(),
-			newRepoSyncReleasesCommand(),
-			newRegenerateCommand(),
-			newAuthCommand(),
-			newSendMailCommand(),
+		Usage: "Command line interface to perform common administrative operations",
+		Subcommands: []cli.Command{
+			subcmdUser,
+			subcmdRepoSyncReleases,
+			subcmdRegenerate,
+			subcmdAuth,
+			subcmdSendMail,
 		},
 	}
-}

-func newRepoSyncReleasesCommand() *cli.Command {
-	return &cli.Command{
+	subcmdRepoSyncReleases = cli.Command{
 		Name:   "repo-sync-releases",
 		Usage:  "Synchronize repository releases with tags",
 		Action: runRepoSyncReleases,
 	}
-}

-func newRegenerateCommand() *cli.Command {
-	return &cli.Command{
+	subcmdRegenerate = cli.Command{
 		Name:  "regenerate",
 		Usage: "Regenerate specific files",
-		Commands: []*cli.Command{
-			newRegenerateHooksCommand(),
-			newRegenerateKeysCommand(),
+		Subcommands: []cli.Command{
+			microcmdRegenHooks,
+			microcmdRegenKeys,
 		},
 	}
-}

-func newAuthCommand() *cli.Command {
-	return &cli.Command{
+	microcmdRegenHooks = cli.Command{
+		Name:   "hooks",
+		Usage:  "Regenerate git-hooks",
+		Action: runRegenerateHooks,
+	}
+
+	microcmdRegenKeys = cli.Command{
+		Name:   "keys",
+		Usage:  "Regenerate authorized_keys file",
+		Action: runRegenerateKeys,
+	}
+
+	subcmdAuth = cli.Command{
 		Name:  "auth",
 		Usage: "Modify external auth providers",
-		Commands: []*cli.Command{
-			microcmdAuthAddOauth(),
-			microcmdAuthUpdateOauth(),
-			microcmdAuthAddLdapBindDn(),
-			microcmdAuthUpdateLdapBindDn(),
-			microcmdAuthAddLdapSimpleAuth(),
-			microcmdAuthUpdateLdapSimpleAuth(),
-			microcmdAuthAddSMTP(),
-			microcmdAuthUpdateSMTP(),
-			newAuthListCommand(),
-			newAuthDeleteCommand(),
+		Subcommands: []cli.Command{
+			microcmdAuthAddOauth,
+			microcmdAuthUpdateOauth,
+			cmdAuthAddLdapBindDn,
+			cmdAuthUpdateLdapBindDn,
+			cmdAuthAddLdapSimpleAuth,
+			cmdAuthUpdateLdapSimpleAuth,
+			microcmdAuthAddSMTP,
+			microcmdAuthUpdateSMTP,
+			microcmdAuthList,
+			microcmdAuthDelete,
 		},
 	}
-}

-func newSendMailCommand() *cli.Command {
-	return &cli.Command{
+	microcmdAuthList = cli.Command{
+		Name:   "list",
+		Usage:  "List auth sources",
+		Action: runListAuth,
+		Flags: []cli.Flag{
+			cli.IntFlag{
+				Name:  "min-width",
+				Usage: "Minimal cell width including any padding for the formatted table",
+				Value: 0,
+			},
+			cli.IntFlag{
+				Name:  "tab-width",
+				Usage: "width of tab characters in formatted table (equivalent number of spaces)",
+				Value: 8,
+			},
+			cli.IntFlag{
+				Name:  "padding",
+				Usage: "padding added to a cell before computing its width",
+				Value: 1,
+			},
+			cli.StringFlag{
+				Name:  "pad-char",
+				Usage: `ASCII char used for padding if padchar == '\\t', the Writer will assume that the width of a '\\t' in the formatted output is tabwidth, and cells are left-aligned independent of align_left (for correct-looking results, tabwidth must correspond to the tab width in the viewer displaying the result)`,
+				Value: "\t",
+			},
+			cli.BoolFlag{
+				Name:  "vertical-bars",
+				Usage: "Set to true to print vertical bars between columns",
+			},
+		},
+	}
+
+	idFlag = cli.Int64Flag{
+		Name:  "id",
+		Usage: "ID of authentication source",
+	}
+
+	microcmdAuthDelete = cli.Command{
+		Name:   "delete",
+		Usage:  "Delete specific auth source",
+		Flags:  []cli.Flag{idFlag},
+		Action: runDeleteAuth,
+	}
+
+	oauthCLIFlags = []cli.Flag{
+		cli.StringFlag{
+			Name:  "name",
+			Value: "",
+			Usage: "Application Name",
+		},
+		cli.StringFlag{
+			Name:  "provider",
+			Value: "",
+			Usage: "OAuth2 Provider",
+		},
+		cli.StringFlag{
+			Name:  "key",
+			Value: "",
+			Usage: "Client ID (Key)",
+		},
+		cli.StringFlag{
+			Name:  "secret",
+			Value: "",
+			Usage: "Client Secret",
+		},
+		cli.StringFlag{
+			Name:  "auto-discover-url",
+			Value: "",
+			Usage: "OpenID Connect Auto Discovery URL (only required when using OpenID Connect as provider)",
+		},
+		cli.StringFlag{
+			Name:  "use-custom-urls",
+			Value: "false",
+			Usage: "Use custom URLs for GitLab/GitHub OAuth endpoints",
+		},
+		cli.StringFlag{
+			Name:  "custom-tenant-id",
+			Value: "",
+			Usage: "Use custom Tenant ID for OAuth endpoints",
+		},
+		cli.StringFlag{
+			Name:  "custom-auth-url",
+			Value: "",
+			Usage: "Use a custom Authorization URL (option for GitLab/GitHub)",
+		},
+		cli.StringFlag{
+			Name:  "custom-token-url",
+			Value: "",
+			Usage: "Use a custom Token URL (option for GitLab/GitHub)",
+		},
+		cli.StringFlag{
+			Name:  "custom-profile-url",
+			Value: "",
+			Usage: "Use a custom Profile URL (option for GitLab/GitHub)",
+		},
+		cli.StringFlag{
+			Name:  "custom-email-url",
+			Value: "",
+			Usage: "Use a custom Email URL (option for GitHub)",
+		},
+		cli.StringFlag{
+			Name:  "icon-url",
+			Value: "",
+			Usage: "Custom icon URL for OAuth2 login source",
+		},
+		cli.BoolFlag{
+			Name:  "skip-local-2fa",
+			Usage: "Set to true to skip local 2fa for users authenticated by this source",
+		},
+		cli.StringSliceFlag{
+			Name:  "scopes",
+			Value: nil,
+			Usage: "Scopes to request when to authenticate against this OAuth2 source",
+		},
+		cli.StringFlag{
+			Name:  "required-claim-name",
+			Value: "",
+			Usage: "Claim name that has to be set to allow users to login with this source",
+		},
+		cli.StringFlag{
+			Name:  "required-claim-value",
+			Value: "",
+			Usage: "Claim value that has to be set to allow users to login with this source",
+		},
+		cli.StringFlag{
+			Name:  "group-claim-name",
+			Value: "",
+			Usage: "Claim name providing group names for this source",
+		},
+		cli.StringFlag{
+			Name:  "admin-group",
+			Value: "",
+			Usage: "Group Claim value for administrator users",
+		},
+		cli.StringFlag{
+			Name:  "restricted-group",
+			Value: "",
+			Usage: "Group Claim value for restricted users",
+		},
+		cli.StringFlag{
+			Name:  "group-team-map",
+			Value: "",
+			Usage: "JSON mapping between groups and org teams",
+		},
+		cli.BoolFlag{
+			Name:  "group-team-map-removal",
+			Usage: "Activate automatic team membership removal depending on groups",
+		},
+	}
+
+	microcmdAuthUpdateOauth = cli.Command{
+		Name:   "update-oauth",
+		Usage:  "Update existing Oauth authentication source",
+		Action: runUpdateOauth,
+		Flags:  append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
+	}
+
+	microcmdAuthAddOauth = cli.Command{
+		Name:   "add-oauth",
+		Usage:  "Add new Oauth authentication source",
+		Action: runAddOauth,
+		Flags:  oauthCLIFlags,
+	}
+
+	subcmdSendMail = cli.Command{
 		Name:   "sendmail",
 		Usage:  "Send a message to all users",
 		Action: runSendMail,
 		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:     "title",
-				Usage:    "a title of a message",
-				Required: true,
+			cli.StringFlag{
+				Name:  "title",
+				Usage: `a title of a message`,
+				Value: "",
 			},
-			&cli.StringFlag{
+			cli.StringFlag{
 				Name:  "content",
 				Usage: "a content of a message",
 				Value: "",
 			},
-			&cli.BoolFlag{
-				Name:    "force",
-				Aliases: []string{"f"},
-				Usage:   "A flag to bypass a confirmation step",
+			cli.BoolFlag{
+				Name:  "force,f",
+				Usage: "A flag to bypass a confirmation step",
 			},
 		},
 	}
-}

-func idFlag() *cli.Int64Flag {
-	return &cli.Int64Flag{
-		Name:  "id",
-		Usage: "ID of authentication source",
+	smtpCLIFlags = []cli.Flag{
+		cli.StringFlag{
+			Name:  "name",
+			Value: "",
+			Usage: "Application Name",
+		},
+		cli.StringFlag{
+			Name:  "auth-type",
+			Value: "PLAIN",
+			Usage: "SMTP Authentication Type (PLAIN/LOGIN/CRAM-MD5) default PLAIN",
+		},
+		cli.StringFlag{
+			Name:  "host",
+			Value: "",
+			Usage: "SMTP Host",
+		},
+		cli.IntFlag{
+			Name:  "port",
+			Usage: "SMTP Port",
+		},
+		cli.BoolTFlag{
+			Name:  "force-smtps",
+			Usage: "SMTPS is always used on port 465. Set this to force SMTPS on other ports.",
+		},
+		cli.BoolTFlag{
+			Name:  "skip-verify",
+			Usage: "Skip TLS verify.",
+		},
+		cli.StringFlag{
+			Name:  "helo-hostname",
+			Value: "",
+			Usage: "Hostname sent with HELO. Leave blank to send current hostname",
+		},
+		cli.BoolTFlag{
+			Name:  "disable-helo",
+			Usage: "Disable SMTP helo.",
+		},
+		cli.StringFlag{
+			Name:  "allowed-domains",
+			Value: "",
+			Usage: "Leave empty to allow all domains. Separate multiple domains with a comma (',')",
+		},
+		cli.BoolTFlag{
+			Name:  "skip-local-2fa",
+			Usage: "Skip 2FA to log on.",
+		},
+		cli.BoolTFlag{
+			Name:  "active",
+			Usage: "This Authentication Source is Activated.",
+		},
 	}
-}

-func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
+	microcmdAuthAddSMTP = cli.Command{
+		Name:   "add-smtp",
+		Usage:  "Add new SMTP authentication source",
+		Action: runAddSMTP,
+		Flags:  smtpCLIFlags,
+	}
+
+	microcmdAuthUpdateSMTP = cli.Command{
+		Name:   "update-smtp",
+		Usage:  "Update existing SMTP authentication source",
+		Action: runUpdateSMTP,
+		Flags:  append(smtpCLIFlags[:1], append([]cli.Flag{idFlag}, smtpCLIFlags[1:]...)...),
+	}
+)
+
+func runRepoSyncReleases(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}

-	if err := git.InitSimple(); err != nil {
+	if err := git.InitSimple(ctx); err != nil {
 		return err
 	}

 	log.Trace("Synchronizing repository releases (this may take a while)")
 	for page := 1; ; page++ {
-		repos, count, err := repo_model.SearchRepositoryByName(ctx, repo_model.SearchRepoOptions{
+		repos, count, err := repo_model.SearchRepositoryByName(ctx, &repo_model.SearchRepoOptions{
 			ListOptions: db.ListOptions{
 				PageSize: repo_model.RepositoryListDefaultPageSize,
 				Page:     page,
@@ -128,33 +369,33 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 		}
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
-			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RelativePath())
-			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
+			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RepoPath())
+			gitRepo, err := git.OpenRepository(ctx, repo.RepoPath())
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
 				continue
 			}

-			oldnum, err := getReleaseCount(ctx, repo.ID)
+			oldnum, err := getReleaseCount(repo.ID)
 			if err != nil {
 				log.Warn(" GetReleaseCountByRepoID: %v", err)
 			}
 			log.Trace(" currentNumReleases is %d, running SyncReleasesWithTags", oldnum)

-			if _, err = repo_module.SyncReleasesWithTags(ctx, repo, gitRepo); err != nil {
+			if err = repo_module.SyncReleasesWithTags(repo, gitRepo); err != nil {
 				log.Warn(" SyncReleasesWithTags: %v", err)
 				gitRepo.Close()
 				continue
 			}

-			count, err = getReleaseCount(ctx, repo.ID)
+			count, err = getReleaseCount(repo.ID)
 			if err != nil {
 				log.Warn(" GetReleaseCountByRepoID: %v", err)
 				gitRepo.Close()
 				continue
 			}

-			log.Trace("repo %s releases synchronized to tags: from %d to %d",
+			log.Trace(" repo %s releases synchronized to tags: from %d to %d",
 				repo.FullName(), oldnum, count)
 			gitRepo.Close()
 		}
@@ -163,12 +404,360 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 	return nil
 }

-func getReleaseCount(ctx context.Context, id int64) (int64, error) {
-	return db.Count[repo_model.Release](
-		ctx,
+func getReleaseCount(id int64) (int64, error) {
+	return repo_model.GetReleaseCountByRepoID(
+		db.DefaultContext,
+		id,
 		repo_model.FindReleasesOptions{
-			RepoID:      id,
 			IncludeTags: true,
 		},
 	)
 }
+
+func runRegenerateHooks(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+	return repo_service.SyncRepositoryHooks(graceful.GetManager().ShutdownContext())
+}
+
+func runRegenerateKeys(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+	return asymkey_model.RewriteAllPublicKeys()
+}
+
+func parseOAuth2Config(c *cli.Context) *oauth2.Source {
+	var customURLMapping *oauth2.CustomURLMapping
+	if c.IsSet("use-custom-urls") {
+		customURLMapping = &oauth2.CustomURLMapping{
+			TokenURL:   c.String("custom-token-url"),
+			AuthURL:    c.String("custom-auth-url"),
+			ProfileURL: c.String("custom-profile-url"),
+			EmailURL:   c.String("custom-email-url"),
+			Tenant:     c.String("custom-tenant-id"),
+		}
+	} else {
+		customURLMapping = nil
+	}
+	return &oauth2.Source{
+		Provider:                      c.String("provider"),
+		ClientID:                      c.String("key"),
+		ClientSecret:                  c.String("secret"),
+		OpenIDConnectAutoDiscoveryURL: c.String("auto-discover-url"),
+		CustomURLMapping:              customURLMapping,
+		IconURL:                       c.String("icon-url"),
+		SkipLocalTwoFA:                c.Bool("skip-local-2fa"),
+		Scopes:                        c.StringSlice("scopes"),
+		RequiredClaimName:             c.String("required-claim-name"),
+		RequiredClaimValue:            c.String("required-claim-value"),
+		GroupClaimName:                c.String("group-claim-name"),
+		AdminGroup:                    c.String("admin-group"),
+		RestrictedGroup:               c.String("restricted-group"),
+		GroupTeamMap:                  c.String("group-team-map"),
+		GroupTeamMapRemoval:           c.Bool("group-team-map-removal"),
+	}
+}
+
+func runAddOauth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	config := parseOAuth2Config(c)
+	if config.Provider == "openidConnect" {
+		discoveryURL, err := url.Parse(config.OpenIDConnectAutoDiscoveryURL)
+		if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+			return fmt.Errorf("invalid Auto Discovery URL: %s (this must be a valid URL starting with http:// or https://)", config.OpenIDConnectAutoDiscoveryURL)
+		}
+	}
+
+	return auth_model.CreateSource(&auth_model.Source{
+		Type:     auth_model.OAuth2,
+		Name:     c.String("name"),
+		IsActive: true,
+		Cfg:      config,
+	})
+}
+
+func runUpdateOauth(c *cli.Context) error {
+	if !c.IsSet("id") {
+		return fmt.Errorf("--id flag is missing")
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	source, err := auth_model.GetSourceByID(c.Int64("id"))
+	if err != nil {
+		return err
+	}
+
+	oAuth2Config := source.Cfg.(*oauth2.Source)
+
+	if c.IsSet("name") {
+		source.Name = c.String("name")
+	}
+
+	if c.IsSet("provider") {
+		oAuth2Config.Provider = c.String("provider")
+	}
+
+	if c.IsSet("key") {
+		oAuth2Config.ClientID = c.String("key")
+	}
+
+	if c.IsSet("secret") {
+		oAuth2Config.ClientSecret = c.String("secret")
+	}
+
+	if c.IsSet("auto-discover-url") {
+		oAuth2Config.OpenIDConnectAutoDiscoveryURL = c.String("auto-discover-url")
+	}
+
+	if c.IsSet("icon-url") {
+		oAuth2Config.IconURL = c.String("icon-url")
+	}
+
+	if c.IsSet("scopes") {
+		oAuth2Config.Scopes = c.StringSlice("scopes")
+	}
+
+	if c.IsSet("required-claim-name") {
+		oAuth2Config.RequiredClaimName = c.String("required-claim-name")
+	}
+	if c.IsSet("required-claim-value") {
+		oAuth2Config.RequiredClaimValue = c.String("required-claim-value")
+	}
+
+	if c.IsSet("group-claim-name") {
+		oAuth2Config.GroupClaimName = c.String("group-claim-name")
+	}
+	if c.IsSet("admin-group") {
+		oAuth2Config.AdminGroup = c.String("admin-group")
+	}
+	if c.IsSet("restricted-group") {
+		oAuth2Config.RestrictedGroup = c.String("restricted-group")
+	}
+	if c.IsSet("group-team-map") {
+		oAuth2Config.GroupTeamMap = c.String("group-team-map")
+	}
+	if c.IsSet("group-team-map-removal") {
+		oAuth2Config.GroupTeamMapRemoval = c.Bool("group-team-map-removal")
+	}
+
+	// update custom URL mapping
+	customURLMapping := &oauth2.CustomURLMapping{}
+
+	if oAuth2Config.CustomURLMapping != nil {
+		customURLMapping.TokenURL = oAuth2Config.CustomURLMapping.TokenURL
+		customURLMapping.AuthURL = oAuth2Config.CustomURLMapping.AuthURL
+		customURLMapping.ProfileURL = oAuth2Config.CustomURLMapping.ProfileURL
+		customURLMapping.EmailURL = oAuth2Config.CustomURLMapping.EmailURL
+		customURLMapping.Tenant = oAuth2Config.CustomURLMapping.Tenant
+	}
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-token-url") {
+		customURLMapping.TokenURL = c.String("custom-token-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-auth-url") {
+		customURLMapping.AuthURL = c.String("custom-auth-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-profile-url") {
+		customURLMapping.ProfileURL = c.String("custom-profile-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-email-url") {
+		customURLMapping.EmailURL = c.String("custom-email-url")
+	}
+
+	if c.IsSet("use-custom-urls") && c.IsSet("custom-tenant-id") {
+		customURLMapping.Tenant = c.String("custom-tenant-id")
+	}
+
+	oAuth2Config.CustomURLMapping = customURLMapping
+	source.Cfg = oAuth2Config
+
+	return auth_model.UpdateSource(source)
+}
+
+func parseSMTPConfig(c *cli.Context, conf *smtp.Source) error {
+	if c.IsSet("auth-type") {
+		conf.Auth = c.String("auth-type")
+		validAuthTypes := []string{"PLAIN", "LOGIN", "CRAM-MD5"}
+		if !util.SliceContainsString(validAuthTypes, strings.ToUpper(c.String("auth-type"))) {
+			return errors.New("Auth must be one of PLAIN/LOGIN/CRAM-MD5")
+		}
+		conf.Auth = c.String("auth-type")
+	}
+	if c.IsSet("host") {
+		conf.Host = c.String("host")
+	}
+	if c.IsSet("port") {
+		conf.Port = c.Int("port")
+	}
+	if c.IsSet("allowed-domains") {
+		conf.AllowedDomains = c.String("allowed-domains")
+	}
+	if c.IsSet("force-smtps") {
+		conf.ForceSMTPS = c.BoolT("force-smtps")
+	}
+	if c.IsSet("skip-verify") {
+		conf.SkipVerify = c.BoolT("skip-verify")
+	}
+	if c.IsSet("helo-hostname") {
+		conf.HeloHostname = c.String("helo-hostname")
+	}
+	if c.IsSet("disable-helo") {
+		conf.DisableHelo = c.BoolT("disable-helo")
+	}
+	if c.IsSet("skip-local-2fa") {
+		conf.SkipLocalTwoFA = c.BoolT("skip-local-2fa")
+	}
+	return nil
+}
+
+func runAddSMTP(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	if !c.IsSet("name") || len(c.String("name")) == 0 {
+		return errors.New("name must be set")
+	}
+	if !c.IsSet("host") || len(c.String("host")) == 0 {
+		return errors.New("host must be set")
+	}
+	if !c.IsSet("port") {
+		return errors.New("port must be set")
+	}
+	active := true
+	if c.IsSet("active") {
+		active = c.BoolT("active")
+	}
+
+	var smtpConfig smtp.Source
+	if err := parseSMTPConfig(c, &smtpConfig); err != nil {
+		return err
+	}
+
+	// If not set default to PLAIN
+	if len(smtpConfig.Auth) == 0 {
+		smtpConfig.Auth = "PLAIN"
+	}
+
+	return auth_model.CreateSource(&auth_model.Source{
+		Type:     auth_model.SMTP,
+		Name:     c.String("name"),
+		IsActive: active,
+		Cfg:      &smtpConfig,
+	})
+}
+
+func runUpdateSMTP(c *cli.Context) error {
+	if !c.IsSet("id") {
+		return fmt.Errorf("--id flag is missing")
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	source, err := auth_model.GetSourceByID(c.Int64("id"))
+	if err != nil {
+		return err
+	}
+
+	smtpConfig := source.Cfg.(*smtp.Source)
+
+	if err := parseSMTPConfig(c, smtpConfig); err != nil {
+		return err
+	}
+
+	if c.IsSet("name") {
+		source.Name = c.String("name")
+	}
+
+	if c.IsSet("active") {
+		source.IsActive = c.BoolT("active")
+	}
+
+	source.Cfg = smtpConfig
+
+	return auth_model.UpdateSource(source)
+}
+
+func runListAuth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	authSources, err := auth_model.Sources()
+	if err != nil {
+		return err
+	}
+
+	flags := tabwriter.AlignRight
+	if c.Bool("vertical-bars") {
+		flags |= tabwriter.Debug
+	}
+
+	padChar := byte('\t')
+	if len(c.String("pad-char")) > 0 {
+		padChar = c.String("pad-char")[0]
+	}
+
+	// loop through each source and print
+	w := tabwriter.NewWriter(os.Stdout, c.Int("min-width"), c.Int("tab-width"), c.Int("padding"), padChar, flags)
+	fmt.Fprintf(w, "ID\tName\tType\tEnabled\n")
+	for _, source := range authSources {
+		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, source.Type.String(), source.IsActive)
+	}
+	w.Flush()
+
+	return nil
+}
+
+func runDeleteAuth(c *cli.Context) error {
+	if !c.IsSet("id") {
+		return fmt.Errorf("--id flag is missing")
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
+	}
+
+	source, err := auth_model.GetSourceByID(c.Int64("id"))
+	if err != nil {
+		return err
+	}
+
+	return auth_service.DeleteSource(source)
+}
@@ -1,109 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"text/tabwriter"
-
-	auth_model "gitea.dev/models/auth"
-	"gitea.dev/models/db"
-	auth_service "gitea.dev/services/auth"
-
-	"github.com/urfave/cli/v3"
-)
-
-func newAuthDeleteCommand() *cli.Command {
-	return &cli.Command{
-		Name:   "delete",
-		Usage:  "Delete specific auth source",
-		Flags:  []cli.Flag{idFlag()},
-		Action: runDeleteAuth,
-	}
-}
-
-func newAuthListCommand() *cli.Command {
-	return &cli.Command{
-		Name:   "list",
-		Usage:  "List auth sources",
-		Action: runListAuth,
-		Flags: []cli.Flag{
-			&cli.IntFlag{
-				Name:  "min-width",
-				Usage: "Minimal cell width including any padding for the formatted table",
-				Value: 0,
-			},
-			&cli.IntFlag{
-				Name:  "tab-width",
-				Usage: "width of tab characters in formatted table (equivalent number of spaces)",
-				Value: 8,
-			},
-			&cli.IntFlag{
-				Name:  "padding",
-				Usage: "padding added to a cell before computing its width",
-				Value: 1,
-			},
-			&cli.StringFlag{
-				Name:  "pad-char",
-				Usage: `ASCII char used for padding if padchar == '\\t', the Writer will assume that the width of a '\\t' in the formatted output is tabwidth, and cells are left-aligned independent of align_left (for correct-looking results, tabwidth must correspond to the tab width in the viewer displaying the result)`,
-				Value: "\t",
-			},
-			&cli.BoolFlag{
-				Name:  "vertical-bars",
-				Usage: "Set to true to print vertical bars between columns",
-			},
-		},
-	}
-}
-
-func runListAuth(ctx context.Context, c *cli.Command) error {
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	authSources, err := db.Find[auth_model.Source](ctx, auth_model.FindSourcesOptions{})
-	if err != nil {
-		return err
-	}
-
-	flags := tabwriter.AlignRight
-	if c.Bool("vertical-bars") {
-		flags |= tabwriter.Debug
-	}
-
-	padChar := byte('\t')
-	if len(c.String("pad-char")) > 0 {
-		padChar = c.String("pad-char")[0]
-	}
-
-	// loop through each source and print
-	w := tabwriter.NewWriter(os.Stdout, c.Int("min-width"), c.Int("tab-width"), c.Int("padding"), padChar, flags)
-	fmt.Fprintf(w, "ID\tName\tType\tEnabled\n")
-	for _, source := range authSources {
-		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, source.Type.String(), source.IsActive)
-	}
-	w.Flush()
-
-	return nil
-}
-
-func runDeleteAuth(ctx context.Context, c *cli.Command) error {
-	if !c.IsSet("id") {
-		return errors.New("--id flag is missing")
-	}
-
-	if err := initDB(ctx); err != nil {
-		return err
-	}
-
-	source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
-	if err != nil {
-		return err
-	}
-
-	return auth_service.DeleteSource(ctx, source)
-}
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2154,SC2155,SC2164,SC2181,SC2207`