feat: add deploy tokens (#37306)

Deploy keys only work over SSH. A deploy token is their counterpart for HTTPS: a repository scoped credential, used as the password of a Git request, with read or read and write access. It covers Git operations and LFS, and can be regenerated in place.

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Mythos <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
ToastyTheBot
2026-08-26 19:32:44 +00:00
committed by GitHub
co-authored by Claude Mythos silverwind bircni wxiaoguang
parent 3c4d5a6a5c
commit 646ea0f253
76 changed files with 1592 additions and 829 deletions
+10 -1
View File
@@ -23,8 +23,17 @@ func HookProcReceive(ctx *gitea_context.PrivateContext) {
ctx.Status(http.StatusNotFound)
return
}
if !loadContextDoerPermission(ctx, opts.UserID, opts.UserExtDoerData) {
return
}
results, err := agit.ProcReceive(ctx, ctx.Repo.Repository, ctx.Repo.GitRepo, opts)
results, err := agit.ProcReceive(ctx, ctx.Repo.Repository, ctx.Repo.GitRepo, &agit.ProcReceiveOptions{
OldCommitIDs: opts.OldCommitIDs,
NewCommitIDs: opts.NewCommitIDs,
RefFullNames: opts.RefFullNames,
GitPushOptions: opts.GitPushOptions,
Doer: ctx.Doer,
})
if err != nil {
if errors.Is(err, issues_model.ErrMustCollaborator) {
ctx.PrivateUserErrorf(http.StatusUnauthorized, "You must be a collaborator to create pull request.")