feat(actions): add deployment environments for scoped secrets and variables - #38149
Open
alexosumi wants to merge 38 commits into
Open
feat(actions): add deployment environments for scoped secrets and variables#38149alexosumi wants to merge 38 commits into
alexosumi wants to merge 38 commits into
Conversation
GiteaBot
added
the
lgtm/need 2
alexosumi
force-pushed
the
feat/actions-environments
branch
from
June 17, 2026 16:41
b985d41 to
94c5b3a
Compare
alexosumi
changed the title
github-actions
Bot
added
the
type/feature
alexosumi
force-pushed
the
feat/actions-environments
branch
3 times, most recently
from
June 17, 2026 17:36
f10c32e to
3b7ee2d
Compare
Author
|
main branch is protected, maybe better open PR to branch 1.26? |
Contributor
|
no, opening to main branch is correct. |
Author
|
ok, I also opened a pull request in the runner repository so that the runner can use the environment. https://gitea.com/gitea/runner/pulls/1037 |
bircni
requested changes
Jun 17, 2026
GiteaBot
added
lgtm/blocked
alexosumi
force-pushed
the
feat/actions-environments
branch
from
June 18, 2026 01:49
3b7ee2d to
48e07bb
Compare
Implements deployment environments similar to GitHub Actions, resolves go-gitea#32090. Environments allow scoping secrets and variables to a named deployment target (e.g. production, staging) with optional branch protection rules. - New DB tables: action_environment, action_environment_secret, action_environment_variable (migrations v340, v341 in v1_27) - ActionRunJob.environment_name populated from workflow YAML environment: key - Secret/variable resolution overlays env-scoped values over repo/org scope - GenerateGiteaContext exposes github.environment to runner steps - REST API: CRUD under /repos/{owner}/{repo}/environments - Web UI: Environments nested inside Actions settings dropdown - Generated swagger spec Closes go-gitea#32090.
alexosumi
force-pushed
the
feat/actions-environments
branch
from
June 18, 2026 14:25
c750a28 to
9318ed2
Compare
Member
|
please dont force push so it is easier to review :-) |
bircni
requested changes
Jun 18, 2026
bircni
marked this pull request as draft
June 18, 2026 16:52
Add ActionEnvironmentVariable, ActionEnvironmentSecret and ActionEnvironment to deleteBeans so they are removed when the repository is deleted. Addresses review feedback from bircni.
- MatchesBranch now also handles refs/tags/ prefix so tag-triggered deployments respect the branch/tag protection rule - Clean up environment tables (ActionEnvironment, ActionEnvironmentSecret, ActionEnvironmentVariable) on repository deletion via deleteBeans - Minor API and struct adjustments from review
alexosumi
marked this pull request as ready for review
June 18, 2026 19:38
lunny
reviewed
Jun 19, 2026
lunny
reviewed
Jun 19, 2026
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
GiteaBot
added
lgtm/need 1
bircni
self-requested a review
August 15, 2026 16:31
GiteaBot
added
lgtm/need 2
Member
|
3.6k lines diff seems too big. I would assume this can be cut in half, if not more. |
Member
I dont think so... |
Member
|
@silverwind The secret/variable CRUD reuses the existing repo/org/user-scoped services rather than reimplementing them, so there wasn't much duplicated logic left to trim — I did collapse a repeated environment-lookup block in the API handlers into one helper, but that's cosmetic, not a size reduction. Given that, I don't think this shrinks further without cutting scope, and I'd rather keep it as one PR. |
Member
|
Will clean this up |
A job declaring `environment:` could still run as though it declared none, with the repository's credentials and no branch policy. The name was dropped for the first combination of a deferred matrix, an expression resolving to nothing produced an environment literally named "null", and a name Gitea cannot create was only logged. Resolve the environment once when the task is picked and deny the job when it cannot be reached, creating it on first reference so a runner arriving before the run finished planning does not fail it instead. Share the fork-trust predicate, so pull_request_target, which does receive the repository's secrets, is gated like a push rather than exempted. Closes go-gitea#32090 Assisted-by: Claude Code:claude-opus-5
silverwind
changed the title
Member
|
Done, 7 bugs fixed. And you're right, this branch is already as slim as it can get. |
xorm's plain Sync drops every index it does not find in the struct it is given, and a migration adding a single column declares none. Adding environment_name therefore left action_run_job without any of its indices on every upgrading instance, with nothing to restore them. The secret and action_variable column adds survive only because RecreateTable rebuilds those two a step later, so they are switched over as well. Assisted-by: Claude Code:claude-opus-5
Member
|
xorm footgun avoided in 88058a4 and AGENTS.md extended for it. |
silverwind
approved these changes
Aug 18, 2026
GiteaBot
added
lgtm/need 1
…y settings The danger zone was built from flex-list classes rather than the ones the repository danger zone uses, so it rendered without its red border and with the button stacked under the text, and its body showed the confirm prompt instead of a description. The list gains a delete button beside the edit one, and shows the creation date next to the branch policy rather than opposite it, so the row reads as one line of metadata. Assisted-by: Claude Code:claude-opus-5
Member
|
Also tweaked UI and added screenshots. |
Member
|
I wanna wait for @Zettat123 |
Member
|
I don't think they'll have anything to complain, Claude worked over an hour on it with a lot of context 😆. |
…ents # Conflicts: # modelmigration/migrations.go # modelmigration/v28/v349.go # modelmigration/v28/v349_test.go
bircni
added
the
release/highlight
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds deployment environments to Actions.
Secrets and variables are repo- or org-scoped today, so a production deploy token is
readable by any workflow on any branch. An environment is a named scope holding its own
secrets and variables, optionally restricted to matching branches and tags.
A job declaring
environment: productionreceives those values layered over the repo andorg ones. A job that cannot reach the environment it names fails, rather than quietly
deploying with the repository's credentials and no branch policy. An environment named by a
workflow is created on first reference, as on GitHub, except for fork pull requests, whose
workflow comes from the fork.
Managed under Settings → Actions → Environments, and through
/repos/{owner}/{repo}/environments.Fixes: #32090