Fryuni/forgejo
Watch
1
0
Fork
You've already forked forgejo
 0
forked from mirror/forgejo
Code Pull requests Activity Actions

chore: merge upstream Forgejo changes (2026-09) #3

Merged
Fryuni merged 23 commits from t3code/merge-upstream-forgejo into forgejo 2026-09-15 00:15:16 +00:00
Conversation 0 Commits 23 Files changed 116 +2947 -365
Fryuni commented 2026-09-14 23:02:44 +00:00
Owner

Summary

  • Merges upstream forgejo into t3code/merge-upstream-forgejo
  • feat: webhooks for workflow jobs (blocked/cancelled/failure/running/skipped/success/waiting events, payload types, UI settings, locale strings)
  • feat: allow pushing to AGit refs (receive.procReceiveRefs for refs/pull/, unhide refs/pull/)
  • fix(api): PATCH /orgs/{org} now keeps public visibility and makes EditOrgOption fields optional
  • fix: prevent rollback of git commits during push mirror operations
  • fix: adjust Arch Linux package name/version validation to match specs
  • fix: compile zoekt indexer on openbsd via build tags
  • fix: don't auto-focus "Repository name" field in repo settings
  • fix: initMarkupContent in RepoActionView when new summaries arrive; expose job html_url in API
  • fix: prevent template expansion interfering with git repo initialization; authorization reducer access for editable PR APIs
  • chore: remove OpenID options from initial setup page, improve LFS log messages
  • chore: optimize PNGs losslessly, update css-loader/katex/mermaid/sharp (sharp is a security update)
  • chore: re-pin forgejo/upload-artifact with documented requirements; release notes for v15.0.8 and v16.0.4

Testing

  • Not run: full make test-sqlite integration suite
  • Upstream changes land with their own unit/integration tests (webhook payload tests, Arch metadata tests, git_push_test.go, pull_update_test.go, repo_generate_test.go)
  • Recommended checks before merge:
    • make lint-backend and make lint-frontend
    • make 'test-sqlite#TestWebhook' style focused runs for webhook event changes
    • Verify AGit push to refs/pull/* works on a dev instance
    • Verify PATCH /orgs/{org} with omitted visibility keeps existing visibility
## Summary - Merges upstream `forgejo` into `t3code/merge-upstream-forgejo` - feat: webhooks for workflow jobs (blocked/cancelled/failure/running/skipped/success/waiting events, payload types, UI settings, locale strings) - feat: allow pushing to AGit refs (`receive.procReceiveRefs` for `refs/pull/`, unhide `refs/pull/`) - fix(api): `PATCH /orgs/{org}` now keeps `public` visibility and makes `EditOrgOption` fields optional - fix: prevent rollback of git commits during push mirror operations - fix: adjust Arch Linux package name/version validation to match specs - fix: compile zoekt indexer on openbsd via build tags - fix: don't auto-focus "Repository name" field in repo settings - fix: initMarkupContent in RepoActionView when new summaries arrive; expose job `html_url` in API - fix: prevent template expansion interfering with git repo initialization; authorization reducer access for editable PR APIs - chore: remove OpenID options from initial setup page, improve LFS log messages - chore: optimize PNGs losslessly, update css-loader/katex/mermaid/sharp (sharp is a security update) - chore: re-pin forgejo/upload-artifact with documented requirements; release notes for v15.0.8 and v16.0.4 ## Testing - Not run: full `make test-sqlite` integration suite - Upstream changes land with their own unit/integration tests (webhook payload tests, Arch metadata tests, `git_push_test.go`, `pull_update_test.go`, `repo_generate_test.go`) - Recommended checks before merge: - `make lint-backend` and `make lint-frontend` - `make 'test-sqlite#TestWebhook'` style focused runs for webhook event changes - Verify AGit push to `refs/pull/*` works on a dev instance - Verify `PATCH /orgs/{org}` with omitted `visibility` keeps existing visibility
Initializes the client-side renderers which are required to for example render mermaid graphs.  Followup of #14076.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14280
Reviewed-by: Mathieu Fenniak <[email protected]>
Fixes forgejo/forgejo#13493 (discussed in forgejo/discussions#131)

This allows pull requests created via AGit to be pushed directly (to the `refs/pull/.../head` reference):
- users with "write code" permissions can push to any PR
- contributors can only push to their own PRs
- `git push --force` is supported

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13661
Reviewed-by: Mathieu Fenniak <[email protected]>
Per the discussion at #8706, this PR removes `autofocus` from the repository settings page.

Fixes #14234

## Testing this change

1. Launch the dev server using `make test-e2e-debugserver`
2. Log in to any user, e.g. `user2`/`password`
3. Open any repo settings, e.g. `/user2/commits_search_test/settings`
4. Notice no autofocus behavior.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14308
Reviewed-by: 0ko <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14300
Reviewed-by: 0ko <[email protected]>
https://codeberg.org/forgejo/forgejo/milestone/139652

Co-authored-by: 0ko <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14309
Reviewed-by: 0ko <[email protected]>
https://codeberg.org/forgejo/forgejo/milestone/139655

Co-authored-by: 0ko <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14310
Reviewed-by: 0ko <[email protected]>
Co-authored-by: Mathieu Fenniak <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14279
Reviewed-by: Mathieu Fenniak <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14316
Reviewed-by: Mathieu Fenniak <[email protected]>
From source https://man.archlinux.org/man/PKGBUILD.5:
- pkgname: Valid characters for members of this array are alphanumerics, and any of the following characters: “@ . _ + -”. Additionally, names are not allowed to start with hyphens or dots.
- pkgver: The variable is not allowed to contain colons, forward slashes, hyphens or whitespace.
- pkgrel: The variable is a positive integer, with an optional subrelease level specified by adding another positive integer separated by a period.

Closes #14259

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14304
Reviewed-by: Mathieu Fenniak <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14289
Reviewed-by: Gusted <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14288
Reviewed-by: Gusted <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14180
Reviewed-by: Gusted <[email protected]>
Fixes #14273.

Extracted as a chunk of @eleboucher's PR #13892.  All credit to @eleboucher for the fix; all I've done is extracted it from an existing PR and added a comment explaining the behaviour.

Co-authored-by: Erwan Leboucher <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14324
Reviewed-by: Andreas Ahlenstorf <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14276
Reviewed-by: Gusted <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13856
Reviewed-by: Gusted <[email protected]>
A `PATCH /orgs/{org}` API call with `{"visibility":"public"}` succeeds while silently discarding the visibility.
This is because of a logic error that ignores "public" because it is the zero value of the VisibleType struct.

Resolves #13956

Co-authored-by: Julien Dessaux <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14287
Reviewed-by: Mathieu Fenniak <[email protected]>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14270
Reviewed-by: Mathieu Fenniak <[email protected]>
Add webhook notifications for status changes of workflow jobs. Users can select which job statuses (waiting, running, success, ...) they want to receive a notification for. Notifications are either delivered using one of the many chat integrations (Discord, Microsoft Teams, ...) or using HTTP POST requests.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14334
Reviewed-by: Mathieu Fenniak <[email protected]>
[OpenID](https://en.wikipedia.org/wiki/OpenID) is a rarely used authentication technology in 2026.  Its implementation in Forgejo is covered by no automated tests, and there are a small number of confidential security issues with the implementation.  The lack of automated tests and the perceived lack of widespread contemporary usage has left some of the security issues unresolved for an extended period of time.  While some of those issues will be unavoidable to fix, I think it's time to deprecate OpenID support, plan for its removal, and manage the related security issues within that context.

(Note: this is distinct from OAuth, and OpenID Connect; all these technologies share concepts and confusing naming)

This PR removes the "Enable OpenID sign-in" and "Enable OpenID self-registration" option from Forgejo's initial server configuration screen on new installations.  Instead, these options are configured to `false` for new installations.  They can still be enabled in the config file if an administrator chooses to do so.

Future PRs will:
- Change the configuration options' default value to disabled.
- Warn server administrators in the `/admin` page if the settings are in-use, with notice of their removal timeline.
- Remove the capability.
- Remove the related user data.

Manually tested by configuring a server from the new setup installation screen, and validating the output settings.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/14340
Reviewed-by: Gusted <[email protected]>
Reviewed-by: Andreas Ahlenstorf <[email protected]>
Fryuni merged commit 481e5cf5e8 into forgejo 2026-09-15 00:15:16 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Fryuni/forgejo!3
No description provided.