feat(actions): Add artifact preview in Actions run view by bircni · Pull Request #36754 · go-gitea/gitea

bircni · 2026-02-25T19:22:14Z

Adds browser preview support for Actions artifacts in the run view, so files can be viewed without downloading the ZIP. Clicking an artifact name now opens a lightweight file browser at /preview; clicking a file opens its rendered or raw content in a new tab.

Previews are read-only and sandboxed: HTML is rendered with a strict CSP (sandbox, no allow-same-origin, connect-src 'none'), only text/* and application/pdf are previewable, and a configurable [actions] ARTIFACT_PREVIEW_MAX_SIZE bounds how large an artifact can be before preview is disabled. The existing ZIP download action is unchanged.

docs PR: https://gitea.com/gitea/docs/pulls/533

bircni · 2026-02-25T19:22:52Z

you can test with http://localhost:3000/devtest/repo-action-view

silverwind · 2026-02-25T23:50:39Z

What's up with the font in second screenshot? Is that just the devtest mockup? We should not render serif fonts.

silverwind · 2026-02-26T00:03:35Z

How do we secure this iframe from exploiting the parent page? Common practices include:

<iframe
  sandbox="allow-scripts"
  referrerpolicy="no-referrer"
  csp="default-src 'self' 'unsafe-inline'"
></iframe>

And these HTTP headers on the parent page:

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

wxiaoguang · 2026-02-26T04:54:54Z

AI seldom designs correct tests or mocks.

You can't make the the template be a mock.

bircni · 2026-02-26T18:00:09Z

I suggest the following:

Improve iframe hardening:
- switch iframe to referrerpolicy="no-referrer",
- keep strict CSP sandbox on HTML raw preview responses,
- keep PDF behavior compatible with browser rendering (no sandboxing that breaks PDF viewers).
Fix relative links in previewed HTML by supporting path-based raw routes (.../preview/raw/*) and using path-based iframe src instead of only ?path=....
Address v4 storage read amplification by removing full-object copy for ZIP parsing and using seek/read-at based ZIP access over artifact storage.
Add an option to enable or disable the feature from app.ini?

silverwind · 2026-02-26T18:37:36Z

sandbox would be a hard requirement for me to secure the iframe. allow-scripts is fine to allow the content to run scripts. If more permissions are needed, add more of these allow-* attributes.

Add an option to enable or disable the feature from app.ini?

I don't fully understand the use case of this yet, but I guess it wouldn't hurt being able to disable it.

wxiaoguang · 2026-02-27T03:13:28Z

Address v4 storage read amplification by removing full-object copy for ZIP parsing and using seek/read-at based ZIP access over artifact storage.

~~I don't think it works for ObjectStorage.~~

~~Maybe you need to store the file list to somewhere else, don't depend on the big zip file.~~

Update: #36754 (comment)

Add an option to enable or disable the feature from app.ini?

As long as the design is good enough, no need to use an option to toggle the future.

ChristopherHX · 2026-02-27T17:04:48Z

I want to rework artifacts to support other file types, previewing a zip is not something I think is good.

My Reasoning https://github.blog/changelog/2026-02-26-github-actions-now-supports-uploading-and-downloading-non-zipped-artifacts/, so the backend can get some love.

bircni · 2026-02-27T17:45:27Z

I want to rework artifacts to support other file types, previewing a zip is not something I think is good.

My Reasoning https://github.blog/changelog/2026-02-26-github-actions-now-supports-uploading-and-downloading-non-zipped-artifacts/, so the backend can get some love.

Oh yes please!!
I need this

ChristopherHX · 2026-02-28T22:31:15Z

Created a draft of artifacts v4 with custom mime types #36786, maybe I should remove the unsecure inline content-disposition l had experimentally enabled there.

This is GitHub.com https://github.com/actions/toolkit/actions/runs/22458120907

As I expected they use the blob storage url that has a domain sensitive sandbox for inline content disposition.

silverwind · 2026-03-01T12:26:44Z

Either iframe with sandbox attribute or HTML with Content-Security-Policy: sandbox should be equivalently safe. content-disposition has no real security implications that I know of, it just controls whether content is displayed or downloaded.

ChristopherHX · 2026-03-01T12:54:36Z

With iframe this is looks to be ok.

As long nobody can navigate you to the direct url to exploit your browser sandbox (bypassing iframe via special crafted link)

~~I read today that (citation needed, source is not 100% trustworthy)~~

~~> Content-Security-Policy: sandbox~~

~~Might be bypassed if the link is opened outside an iframe.~~

content-disposition has no real security implications that I know of

The type attachment prevents previewing the html + js in context of our gitea instance by forcing the browser to always download the file.

Effectively makes the html not part of the gitea website.

(only client side security)

EDIT msedge and firefox appl the sandbox rule without iframe from http headers

wxiaoguang · 2026-03-01T12:56:46Z

I think you can refer to our external render: Make external iframe render work #35730

If it is right, you can use the same approach. If you find security problems, let's fix 😄

ChristopherHX · 2026-03-01T15:01:17Z

Ok I know it better now, you are right CSP header works fine served stand alone (tested manually in firefox and msedge)

Not sure if we should really allow file previews within zipped artifacts via backend unpacking, since this makes serve direct impossible.

bircni · 2026-03-13T20:41:30Z

@ChristopherHX is this still needed or already covered by another PR from you?
If so I would close this PR

ChristopherHX · 2026-03-13T21:41:31Z

@ChristopherHX is this still needed or already covered by another PR from you?

Not covered by me (basically everything you did here)

preview of v1-v3 artifacts
preview of v4+ zipped artifacts
Only the following is covered my me (new type of artifact upload with mime type)
Open Single File Artifacts as preview in next tab
- (v7 upload with archive: false during upload)
- html, pdf, pictures etc. Browser decides to download

bircni · 2026-03-13T21:53:31Z

  Only the following is covered my me (new type of artifact upload with mime type)

* Open Single File Artifacts as preview in next tab
  
  * (v7 upload with archive: false during upload)
  * html, pdf, pictures etc. Browser decides to download

I think its enough to only support the newr ones - what do you think?

silverwind · 2026-08-21T13:04:36Z

+	req := NewRequestf(t, "GET", "/%s/actions/runs/791/artifacts/artifact-download", repo.FullName())
+	resp := session.MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Header().Get("Content-Disposition"), "attachment; filename=artifact-download.zip")
+}


Make these are fast and consolidated, I assume they are rather slow currently with all the serial sequencing.

silverwind · 2026-08-21T13:07:13Z

Also I recommend a security review pass on this. HTML rendering business is always security-critical.

bircni · 2026-08-21T20:49:23Z

PR description needs to be rewritten as per latest AGENTS.md. And I recommend doing a AI cleanup pass to ensure everything conforms and is clean and minimal.

@silverwind fixed and fixed your reviews - will do a security review now

bircni · 2026-08-21T21:06:43Z

Also I recommend a security review pass on this. HTML rendering business is always security-critical.

Security Review: `feature/artifact-viewer`

No findings met the reporting threshold (confidence ≥ 8).

One candidate was identified and filtered out:

Arbitrary user-controlled HTML/JS rendered as a top-level document on the instance origin (routers/web/repo/actions/view_artifact.go:258-264, :403-414) — filtered at confidence 3/10. The mechanism is real, but the asserted XSS impact is neutralized: the CSP sandbox allow-scripts (without allow-same-origin) is applied on every path that can emit text/html, giving the document an opaque origin with no access to cookies, localStorage, or the CSRF token, and connect-src 'none' blocks fetch/XHR. Absent allow-forms/allow-popups/allow-top-navigation/allow-downloads tokens block form submission, popups, self-navigation, and downloads. What remains is a hardening/content-policy concern (deviation from the "do not render user HTML as a page" rule in modules/httplib/serve.go, and missing frame-ancestors 'none'/base-uri 'none'), which falls under the hardening exclusion.

Areas verified as sound, for the record:

Path traversal — normalizeArtifactPreviewPath applies util.PathJoinRelX identically on both the listing and the lookup side; v4 paths are matched against zip central-directory entries only, and legacy paths resolve to artifact.StoragePath from the DB. No filesystem path is derived from request input.
Authorization — the three new routes sit in the existing /{username}/{reponame}/actions group behind optSignIn, RepoAssignment, MustBeNotEmpty, reqRepoActionsReader, MustEnableActions, identical to the pre-existing download route; artifact lookup is scoped by run ID plus resolved attempt ID and re-checks ArtifactStatusUploadConfirmed.
Content-type sniffing — gated on the sniffed type (IsText() || IsPDF()), so SVG is rejected; the extension override only narrows to text/css/text/javascript/text/html, and text/html is exactly the case carrying the explicit CSP. X-Content-Type-Options: nosniff is always set.
Template injection / XSS in the preview page — no Safe/Str2html/template.HTML in the new templates; hrefs are built via url.PathEscape and PathEscapeSegments.
Error pages — WritePreviewRawError emits only constants through html.EscapeString under a stricter no-scripts sandbox CSP.
Listing cache — keyed on globally unique artifactID:UpdatedUnix, stores only path strings; no cross-repo disclosure.

# Conflicts: # custom/conf/app.example.ini # modules/setting/actions.go

lunny · 2026-08-29T20:11:08Z

 ;; Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
 ;ARTIFACT_RETENTION_DAYS = 90
+;; Max artifact size in bytes that can be browsed or previewed in the web UI. Set to 0 to disable artifact previews, or -1 for no limit.
+;ARTIFACT_PREVIEW_MAX_SIZE = 104857600


104MB? It might too big?

Reduced the default to 10 MiB. Administrators can increase it or set -1 for no limit

bircni · 2026-08-30T09:24:54Z

--> Conclusion
No qualifying high- or medium-severity vulnerabilities found. The new code is notably defensive in the two places that matter most.

Reviewed by CodeT with Socrates, Stoic and the Security Gang Teams

cc @lunny

wxiaoguang · 2026-08-30T10:12:22Z

I think it means that on a public instance, any user can run a full static site under the instance's domain to let other visitors to view it?

Although its origin is sandboxed, but I think we were preventing from such case because it allows attackers to publish malicious phishing content under the instance's domain?

bircni · 2026-08-30T10:18:04Z

I think it means that on a public instance, any user can run a full static site under the instance's domain to let other visitors to view it?

Although its origin is sandboxed, but I think we were preventing from such case because it allows attackers to publish malicious phishing content under the instance's domain?

Should we just disable it per default?
I think that would be good

wxiaoguang · 2026-08-30T10:30:38Z

Or only serve it to signed-in users? Then crawlers won't read the phishing content.

If a user already has an account, maybe it's fine to assume that they should know what the site is for?

And I don't see why an anonymous user should preview the artifact output.

Also add a banner to prompt saying that "the content is automatically generated by XXX", then it won't mislead users to view it as a standalone static site.

bircni · 2026-08-30T10:50:01Z

@wxiaoguang added the following

Require sign-in for artifact previews
generated-content warning banner
Display content in a sandboxed iframe
Simplify CSP to sandbox allow-scripts
Keep preview navigation in the same tab

wxiaoguang · 2026-08-30T11:21:33Z

Is it intentionally that the layout is top-bottom?

If I remember correctly, all "file explorers / viewers" use left-right layout?

Details

bircni · 2026-08-30T12:18:57Z

@wxiaoguang

moved it to a left bar - thanks for saying!
improved the ui
Showing the coverage fixture in standalone devtest now too

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Feb 25, 2026

github-actions Bot added modifies/go labels Feb 25, 2026

silverwind reviewed Feb 25, 2026

View reviewed changes

Comment thread web_src/js/components/RepoActionView.vue Outdated

wxiaoguang marked this pull request as draft February 26, 2026 04:52

wxiaoguang reviewed Feb 26, 2026

View reviewed changes

Comment thread templates/repo/actions/artifact_preview.tmpl Outdated

wxiaoguang reviewed Feb 26, 2026

View reviewed changes

Comment thread routers/web/repo/actions/view.go Outdated

bircni closed this Mar 16, 2026

bircni added 2 commits March 31, 2026 20:10

Add Actions artifact preview with devtest coverage

a5de784

actions: harden artifact preview and rebase onto main

979572f

bircni reopened this Mar 31, 2026

bircni force-pushed the feature/artifact-viewer branch from 4a73b1a to 979572f Compare March 31, 2026 18:42

silverwind reviewed Aug 21, 2026

View reviewed changes

Comment thread web_src/css/index.css Outdated

silverwind reviewed Aug 21, 2026

View reviewed changes

Comment thread web_src/css/features/actions-artifact-preview.css Outdated

silverwind reviewed Aug 21, 2026

View reviewed changes

bircni added 2 commits August 21, 2026 22:37

Merge branch 'main' into feature/artifact-viewer

dcd8dbe

cleanup

2b9fea0

bircni requested a review from silverwind August 22, 2026 21:21

Merge branch 'main' into feature/artifact-viewer

d9493d7

bircni requested a review from a team August 29, 2026 07:23

Merge remote-tracking branch 'origin/main' into feature/artifact-viewer

7e4a47e

# Conflicts: # custom/conf/app.example.ini # modules/setting/actions.go

lunny reviewed Aug 29, 2026

View reviewed changes

bircni added 2 commits August 30, 2026 10:55

lower limit

f4175c0

Merge remote-tracking branch 'origin/main' into feature/artifact-viewer

0219cb7

.

d42f7cd

wxiaoguang reviewed Aug 30, 2026

View reviewed changes

Comment thread routers/web/repo/actions/view_artifact.go Outdated

adjustments

424256f

bircni requested a review from wxiaoguang August 30, 2026 10:50

This comment was marked as resolved.

Sign in to view

adjustments v2

a599b37

bircni added the release/highlight Marks a PR as a highlight-worthy change for the release notes. label Aug 30, 2026

Uh oh!

Uh oh!

Conversation

bircni commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bircni commented Feb 25, 2026

Uh oh!

silverwind commented Feb 25, 2026

Uh oh!

Uh oh!

silverwind commented Feb 26, 2026

Uh oh!

wxiaoguang commented Feb 26, 2026

Uh oh!

Uh oh!

Uh oh!

bircni commented Feb 26, 2026

Uh oh!

silverwind commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wxiaoguang commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristopherHX commented Feb 27, 2026

Uh oh!

bircni commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristopherHX commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silverwind commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristopherHX commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wxiaoguang commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ChristopherHX commented Mar 1, 2026

Uh oh!

bircni commented Mar 13, 2026

Uh oh!

ChristopherHX commented Mar 13, 2026

Uh oh!

bircni commented Mar 13, 2026

Uh oh!

Uh oh!

Uh oh!

silverwind Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

silverwind commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bircni commented Aug 21, 2026

Uh oh!

bircni commented Aug 21, 2026

Security Review: feature/artifact-viewer

Uh oh!

lunny Aug 29, 2026

Choose a reason for hiding this comment

Uh oh!

bircni Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

bircni commented Aug 30, 2026

Uh oh!

wxiaoguang commented Aug 30, 2026

Uh oh!

bircni commented Aug 30, 2026

Uh oh!

wxiaoguang commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

bircni commented Feb 25, 2026 •

edited

Loading

silverwind commented Feb 26, 2026 •

edited

Loading

wxiaoguang commented Feb 27, 2026 •

edited

Loading

bircni commented Feb 27, 2026 •

edited

Loading

ChristopherHX commented Feb 28, 2026 •

edited

Loading

silverwind commented Mar 1, 2026 •

edited

Loading

ChristopherHX commented Mar 1, 2026 •

edited

Loading

wxiaoguang commented Mar 1, 2026 •

edited

Loading

silverwind Aug 21, 2026 •

edited

Loading

silverwind commented Aug 21, 2026 •

edited

Loading

Security Review: `feature/artifact-viewer`

wxiaoguang commented Aug 30, 2026 •

edited

Loading

wxiaoguang commented Aug 30, 2026 •

edited

Loading