feat: manage bot accounts from the admin UI, API and CLI (#38966)

Adds first-class bot accounts (`UserTypeBot`): local, password-less
users for automation that authenticate only with access tokens.

1. Admin UI: create bots, filter users by type, manage a bot's access
tokens, convert between user and bot
2. API: `POST /admin/users/{username}/convert-type`, and user objects
gain a GitHub-compatible `type` (`User`, `Organization`, `Bot`)
3. CLI: `gitea admin user change-type`, `--user-type` accepts `User` or
`Bot` case-insensitively
4. Converting keeps the password, 2FA, OAuth2 grants and access tokens,
and since sign-in rejects bots, converting back restores the account.
Only local, non-admin accounts can be converted, and conversions are
audited
5. Session, reverse proxy, SSPI, external source and password reset
sign-in reject non-individual users, so a bot never gets an interactive
session
6. Bots receive no notifications or emails

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: joestump <joe@joestump.net>
Co-authored-by: Joe Stump <joe@stu.mp>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

modules/structs/admin_user.go

@@ -77,3 +77,12 @@ type EditUserOption struct {
 	// User visibility level: public, limited, or private
 	Visibility VisibilityString `json:"visibility" binding:"In(,public,limited,private)"`
 }
+
+// ConvertUserTypeOption options when converting a user between individual and bot
+type ConvertUserTypeOption struct {
+	// The target user type
+	//
+	// required: true
+	// enum: ["User","Bot"]
+	UserType UserTypeString `json:"user_type" binding:"Required;In(User,Bot)"`
+}

modules/structs/user.go

@@ -17,6 +17,8 @@ type User struct {
 	ID int64 `json:"id"`
 	// login of the user, same as `username`
 	UserName string `json:"login"`
+	// the account type
+	Type UserTypeString `json:"type"`
 	// identifier of the user, provided by the external authenticator (if configured)
 	LoginName string `json:"login_name"`
 	// The ID of the user's Authentication Source

modules/structs/user_type.go

@@ -0,0 +1,17 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+// UserTypeString defines the account type as rendered in API responses, webhook payloads and
+// the resulting GitHub Actions event context, where workflows read it as `github.event.sender.type`.
+// The values are capitalized to stay compatible with GitHub, unlike VisibilityString and the other
+// lowercase API enums. The DB representation is user.UserType (int).
+// swagger:enum UserTypeString
+type UserTypeString string
+
+const (
+	UserTypeStringUser         UserTypeString = "User"
+	UserTypeStringOrganization UserTypeString = "Organization"
+	UserTypeStringBot          UserTypeString = "Bot"
+)

modules/templates/util_misc.go

@@ -16,6 +16,7 @@ import (
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/git"
+	"gitea.dev/modules/htmlutil"
 	"gitea.dev/modules/json"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/repository"
@@ -168,6 +169,14 @@ func mirrorRemoteAddress(ctx context.Context, m *repo_model.Repository, remoteNa
 	return ret
 }
 
+// UserTypeLabel marks a bot account next to a name built in Go, the template equivalent is shared/user/user_type_label
+func (ut *RenderUtils) UserTypeLabel(u *user_model.User) template.HTML {
+	if u == nil || !u.IsTypeBot() {
+		return ""
+	}
+	return htmlutil.HTMLFormat(` <span class="ui basic label tw-py-0 tw-align-baseline">%s</span>`, ut.locale().TrString("concept_user_bot"))
+}
+
 func filenameIsImage(filename string) bool {
 	mimeType := mime.TypeByExtension(filepath.Ext(filename))
 	return strings.HasPrefix(mimeType, "image/")

modules/templates/util_render.go

@@ -411,10 +411,10 @@ func (ut *RenderUtils) AvatarStackWithNames(data *user_model.AvatarStackData) te
 // participantNameLink prefers (in order): commits-by-author search, `GetShortDisplayNameLinkHTML` (keeps alt-name tooltip), `mailto:`, bare name.
 func (ut *RenderUtils) participantNameLink(data *user_model.AvatarStackData, participant *user_model.CommitParticipant) template.HTML {
 	if href := renderAvatarStackViewEmailLink(data, participant.GitIdentity.Email); href != "" {
-		return htmlutil.HTMLFormat(`<a class="muted" href="%s">%s</a>`, href, participantName(participant))
+		return htmlutil.HTMLFormat(`<a class="muted" href="%s">%s</a>%s`, href, participantName(participant), ut.UserTypeLabel(participant.GiteaUser))
 	}
 	if participant.GiteaUser != nil {
-		return participant.GiteaUser.GetShortDisplayNameLinkHTML()
+		return participant.GiteaUser.GetShortDisplayNameLinkHTML() + ut.UserTypeLabel(participant.GiteaUser)
 	}
 	if participant.GitIdentity.Email != "" {
 		return htmlutil.HTMLFormat(`<a class="muted" href="mailto:%s">%s</a>`, participant.GitIdentity.Email, participant.GitIdentity.Name)
@@ -423,10 +423,9 @@ func (ut *RenderUtils) participantNameLink(data *user_model.AvatarStackData, par
 }
 
 func (ut *RenderUtils) participantPopupRow(data *user_model.AvatarStackData, participant *user_model.CommitParticipant) template.HTML {
-	avatar := ut.participantAvatar(participant)
-	name := participantName(participant)
+	avatar, name, label := ut.participantAvatar(participant), participantName(participant), ut.UserTypeLabel(participant.GiteaUser)
 	if href := ut.participantHref(data, participant); href != "" {
-		return htmlutil.HTMLFormat(`<a class="silenced flex-text-block" href="%s">%s<span>%s</span></a>`, href, avatar, name)
+		return htmlutil.HTMLFormat(`<a class="silenced flex-text-block" href="%s">%s<span>%s</span></a>%s`, href, avatar, name, label)
 	}
-	return htmlutil.HTMLFormat(`<span class="flex-text-block">%s<span>%s</span></span>`, avatar, name)
+	return htmlutil.HTMLFormat(`<span class="flex-text-block">%s<span>%s</span></span>%s`, avatar, name, label)
 }