Merge remote-tracking branch 'origin/main' into feat/audit-logging

Renumbered the audit event migration to 353 to avoid colliding with the new
deploy_key token migration (352), moved CLI/AuthenticationSource system user
IDs to -4/-5 (deploy-key now owns -3), adapted DeleteDeployKey, the
post-receive visibility audit, and audit pagination/test helpers to the
refactored APIs on main.

Author: bircni

.github/actions/docker-dryrun/action.yml

@@ -12,7 +12,7 @@ runs:
     - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       with:
         cache-image: false
-    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
     - name: Build regular image
       uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:

.github/actions/python-setup/action.yml

@@ -4,7 +4,7 @@ description: Set up uv and python and restore the uv cache
 runs:
   using: composite
   steps:
-    - uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+    - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       with:
         python-version: 3.14
         save-cache: ${{ github.workflow == 'cache-seeder' }}

.github/workflows/cache-seeder.yml

@@ -37,7 +37,7 @@ jobs:
       - uses: ./.github/actions/go-setup
       - run: make deps-backend deps-tools
       - run: TAGS="bindata" make backend
-      - run: TAGS="bindata gogit" GOEXPERIMENT="" make backend
+      - run: TAGS="bindata gogit" make backend
       - name: warm test compile cache (bindata)
         env:
           TAGS: bindata
@@ -46,13 +46,12 @@ jobs:
       - name: warm test compile cache (bindata gogit)
         env:
           TAGS: bindata gogit
-          GOEXPERIMENT:
           GOTEST_FLAGS: -race -list=^$$ -count=1
         run: make test-backend
       - name: warm integration compile cache
         run: |
           TAGS="bindata" make test-integration-compile
-          TAGS="bindata gogit" GOEXPERIMENT="" make test-integration-compile
+          TAGS="bindata gogit" make test-integration-compile
           TAGS="bindata gogit" GOTEST_FLAGS="-race" make test-integration-compile
 
   lint:

.github/workflows/pull-db-tests.yml

@@ -96,7 +96,6 @@ jobs:
       - run: make backend
         env:
           TAGS: bindata gogit
-          GOEXPERIMENT:
       - run: GITEA_TEST_DATABASE=sqlite make test-migration
         env:
           TAGS: bindata gogit
@@ -107,7 +106,6 @@ jobs:
           # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
           GOTEST_FLAGS: -timeout=40m
           TAGS: bindata gogit
-          GOEXPERIMENT:
 
   test-unit:
     if: needs.files-changed.outputs.backend == 'true'
@@ -131,7 +129,7 @@ jobs:
         ports:
           - "7700:7700"
       redis:
-        image: redis:latest@sha256:52334768d4a6594d8969f51a1a6fee3ffa7545f6359a4877229cdc754d2def82
+        image: redis:latest@sha256:1c4405ec7fb6ed58b6b83d26c7e3fc80625d2aca6cfa517ae03b6e963510f7ca
         options: >- # wait until redis has started
           --health-cmd "redis-cli ping"
           --health-interval 5s
@@ -170,7 +168,6 @@ jobs:
         env:
           GOTEST_FLAGS: -race -timeout=20m
           TAGS: bindata gogit
-          GOEXPERIMENT:
           GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
           GITEA_TEST_CI_SKIP_EXTERNAL: true
       - run: make test-check

.github/workflows/release-nightly-snapcraft.yml

@@ -25,8 +25,15 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
+      - name: Build snap
         id: build
+        env:
+          SNAPCRAFT_IMAGE_INFO: '{"build_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"}'
+        run: |
+          # snapcraft installs build-snaps and apt packages system-wide, which needs root
+          sudo snap install --classic snapcraft
+          sudo SNAPCRAFT_BUILD_INFO=1 SNAPCRAFT_IMAGE_INFO="$SNAPCRAFT_IMAGE_INFO" snapcraft pack --destructive-mode
+          echo "snap=$(ls ./*.snap)" >> "$GITHUB_OUTPUT"
       # retry snapcraft uploads which can be flaky
       - name: Publish snap
         run: |

.github/workflows/release-nightly.yml

@@ -79,7 +79,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           cache-image: false
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - name: Get cleaned branch name
         id: clean_name
         env:

.github/workflows/release-tag-rc.yml

@@ -67,7 +67,7 @@ jobs:
         run: |
           aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
       - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
         with:
           gh-cli-version: 2.39.1
       - name: create github release
@@ -90,7 +90,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           cache-image: false
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:

.github/workflows/release-tag-version.yml

@@ -70,7 +70,7 @@ jobs:
         run: |
           aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
       - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@6089bdde54118ad7ca3d22053eb2d69387fd2779 # v0.3.0
         with:
           gh-cli-version: 2.39.1
       - name: create github release
@@ -93,7 +93,7 @@ jobs:
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           cache-image: false
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         id: meta
         with:

.golangci.yml

@@ -62,6 +62,9 @@ linters:
               desc: "migrations must not depend on the models package. HINT: MIGRATION-STRUCT-FROZEN"
             - pkg: gitea.dev/modules/structs
               desc: "migrations must not depend on modules/structs. HINT: MIGRATION-STRUCT-FROZEN"
+    modernize:
+      disable:
+        - embedlit
     nolintlint:
       allow-unused: false
       require-explanation: true
@@ -143,9 +146,6 @@ linters:
       - linters:
           - dupl
         path: modelmigration/v
-      - linters:
-          - forbidigo
-        path: cmd
       - linters:
           - dupl
         text: (?i)webhook
@@ -162,10 +162,10 @@ linters:
           - gocritic
         text: '(?i)exitAfterDefer:'
     paths:
-      - node_modules
-      - .venv
-      - public
-      - web_src
+      - ^node_modules/
+      - ^\.venv/
+      - ^public/
+      - ^web_src/
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
@@ -182,14 +182,15 @@ formatters:
         - blank
         - default
     gofumpt:
-      extra-rules: true
+      extra:
+        group-params: true
   exclusions:
     generated: lax
     paths:
-      - node_modules
-      - .venv
-      - public
-      - web_src
+      - ^node_modules/
+      - ^\.venv/
+      - ^public/
+      - ^web_src/
 
 run:
   timeout: 10m

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.24 AS frontend-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.27-alpine3.24 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
@@ -9,7 +9,7 @@ COPY --exclude=.git/ . .
 RUN make frontend
 
 # Build backend for each target platform
-FROM docker.io/library/golang:1.26-alpine3.24 AS build-env
+FROM docker.io/library/golang:1.27-alpine3.24 AS build-env
 
 ARG GITEA_VERSION
 ARG TAGS=""