docs: Clean up build section in CHANGELOG.md (#38671)

added the changelog for 1.27.1

---------

Signed-off-by: bircni <bircni@icloud.com>

.github/workflows/release-nightly.yml

@@ -72,6 +72,18 @@ jobs:
           BRANCH: ${{ steps.clean_name.outputs.branch }}
         run: |
           aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
+      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
+      - name: upload binaries to cloudflare r2
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          AWS_REGION: auto
+          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
+          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
+        run: |
+          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
 
   nightly-container:
     runs-on: namespace-profile-gitea-release-docker

.github/workflows/release-tag-rc.yml

@@ -73,6 +73,18 @@ jobs:
           BRANCH: ${{ steps.clean_name.outputs.branch }}
         run: |
           aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
+      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
+      - name: upload binaries to cloudflare r2
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          AWS_REGION: auto
+          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
+          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
+        run: |
+          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
       - name: Install GH CLI
         uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
         with:

.github/workflows/release-tag-version.yml

@@ -76,6 +76,18 @@ jobs:
           BRANCH: ${{ steps.clean_name.outputs.branch }}
         run: |
           aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
+      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
+      - name: upload binaries to cloudflare r2
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          AWS_REGION: auto
+          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
+          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
+        run: |
+          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
       - name: Install GH CLI
         uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
         with:

CHANGELOG.md

@@ -4,6 +4,64 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).
 
+## [1.27.1](https://github.com/go-gitea/gitea/releases/tag/v1.27.1) - 2026-07-27
+
+* SECURITY
+  * fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
+
+* API
+  * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
+
+* ENHANCEMENTS
+  * enhance: improve diff contrast in light and dark themes (#37477) (#38574)
+
+* BUGFIXES
+  * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
+  * fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
+  * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
+  * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654)
+  * fix: orgmode render include path (#38642) (#38645)
+  * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
+  * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
+  * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
+  * fix(actions): correctness and hardening fixes (#38518) (#38631)
+  * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
+  * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
+  * fix(webhook): remove slack channel name check (#38608) (#38612)
+  * fix: download dropdown menu clipped on the branches page (#38604) (#38609)
+  * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
+  * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
+  * fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
+  * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
+  * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
+  * fix: branch protection user list (#38570) (#38584)
+  * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
+  * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
+  * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557)
+  * fix(actions): align status icon span for Safari rendering (#38558) (#38562)
+  * fix: revert git clone http redirection forbidden (#38530) (#38545)
+  * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
+  * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
+  * fix: make the merge box button red if some checks fail (#38508) (#38516)
+  * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
+  * fix: make commit message merge correctly (#38490) (#38502)
+  * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
+  * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497)
+  * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
+  * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
+  * fix: full file highlighting for git diff with CR char (#38484) (#38491)
+  * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
+  * fix: 500 error when updating user visibility (#38480) (#38483)
+  * fix(actions): make job list item fully clickable (#38462) (#38471)
+  * fix: mail template for push event (#38467) (#38468)
+  * fix: make "test push webhook" always work (#38425) (#38455)
+  * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
+  * fix(org): align follow button and wrap description (#38448) (#38454)
+  * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452)
+
+* MISC
+  * refactor: git patch apply (#38637) (#38638)
+
 ## [1.27.0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0) - 2026-07-13
 
 * BREAKING

modules/session/key.go

@@ -8,4 +8,10 @@ const (
 	KeyUname = "uname"
 
 	KeyUserHasTwoFactorAuth = "userHasTwoFactorAuth"
+
+	// KeySignInMethod records how the current session was authenticated so logout
+	// can decide whether RP-initiated OIDC logout is appropriate.
+	KeySignInMethod = "signInMethod"
+
+	SignInMethodOAuth2 = "oauth2"
 )

routers/web/auth/auth.go

@@ -484,20 +484,26 @@ func SignOut(ctx *context.Context) {
 }
 
 func buildSignOutRedirectURL(ctx *context.Context) string {
-	if ctx.Doer != nil && ctx.Doer.LoginType == auth.OAuth2 {
+	if ctx.Doer != nil && shouldRedirectToOIDCEndSession(ctx) {
 		if s := buildOIDCEndSessionURL(ctx, ctx.Doer); s != "" {
 			return s
 		}
 	}
 
 	// The assumption is: if reverse proxy auth is enabled, then the users should only sign-in via reverse proxy auth.
-	// TODO: in the future, if we need to distinguish different sign-in methods, we need to save the sign-in method in session and check here
 	if setting.Service.EnableReverseProxyAuth && setting.ReverseProxyLogoutRedirect != "" {
 		return setting.ReverseProxyLogoutRedirect
 	}
 	return setting.AppSubURL + "/"
 }
 
+// shouldRedirectToOIDCEndSession reports whether this session should end at the
+// OIDC provider. Prefer the session sign-in method so an OAuth2-linked account
+// that signed in with a password does not hit end_session_endpoint.
+func shouldRedirectToOIDCEndSession(ctx *context.Context) bool {
+	return ctx.Session.Get(session.KeySignInMethod) == session.SignInMethodOAuth2
+}
+
 func prepareSignUpPageData(ctx *context.Context) bool {
 	ctx.Data["Title"] = ctx.Tr("sign_up")
 	ctx.Data["SignUpLink"] = setting.AppSubURL + "/user/sign_up"

routers/web/auth/auth_test.go

@@ -154,16 +154,31 @@ func TestWebAuthOAuth2(t *testing.T) {
 		authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), "oidc-auth-source")
 		require.NoError(t, err)
 
-		mockOpt := contexttest.MockContextOption{SessionStore: session.NewMockMemStore("dummy-sid")}
-		ctx, resp := contexttest.MockContext(t, "/user/logout", mockOpt)
-		ctx.Doer = &user_model.User{ID: 1, LoginType: auth_model.OAuth2, LoginSource: authSource.ID}
-		SignOut(ctx)
-		assert.Equal(t, http.StatusSeeOther, resp.Code)
-		u, err := url.Parse(test.RedirectURL(resp))
-		require.NoError(t, err)
-		expectedValues := url.Values{"oidc-key": []string{"oidc-val"}, "post_logout_redirect_uri": []string{setting.AppURL}, "client_id": []string{"mock-client-id"}}
-		assert.Equal(t, expectedValues, u.Query())
-		u.RawQuery = ""
-		assert.Equal(t, "https://example.com/oidc-logout", u.String())
+		oauthUser := &user_model.User{ID: 1, LoginType: auth_model.OAuth2, LoginSource: authSource.ID}
+
+		t.Run("OAuth2SignInRedirectsToOIDC", func(t *testing.T) {
+			mockOpt := contexttest.MockContextOption{SessionStore: session.NewMockMemStore("dummy-sid-oauth")}
+			ctx, resp := contexttest.MockContext(t, "/user/logout", mockOpt)
+			ctx.Doer = oauthUser
+			require.NoError(t, ctx.Session.Set(session.KeySignInMethod, session.SignInMethodOAuth2))
+			SignOut(ctx)
+			assert.Equal(t, http.StatusSeeOther, resp.Code)
+			u, err := url.Parse(test.RedirectURL(resp))
+			require.NoError(t, err)
+			expectedValues := url.Values{"oidc-key": []string{"oidc-val"}, "post_logout_redirect_uri": []string{setting.AppURL}, "client_id": []string{"mock-client-id"}}
+			assert.Equal(t, expectedValues, u.Query())
+			u.RawQuery = ""
+			assert.Equal(t, "https://example.com/oidc-logout", u.String())
+		})
+
+		t.Run("PasswordSignInSkipsOIDC", func(t *testing.T) {
+			// OAuth2-linked account signed in via password form must not hit end_session_endpoint.
+			mockOpt := contexttest.MockContextOption{SessionStore: session.NewMockMemStore("dummy-sid-password")}
+			ctx, resp := contexttest.MockContext(t, "/user/logout", mockOpt)
+			ctx.Doer = oauthUser
+			SignOut(ctx)
+			assert.Equal(t, http.StatusSeeOther, resp.Code)
+			assert.Equal(t, "/", test.RedirectURL(resp))
+		})
 	})
 }

routers/web/auth/linkaccount.go

@@ -11,6 +11,7 @@ import (
 	"gitea.dev/models/auth"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/log"
+	"gitea.dev/modules/session"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/templates"
 	"gitea.dev/modules/util"
@@ -171,9 +172,10 @@ func oauth2LinkAccount(ctx *context.Context, u *user_model.User, linkAccountData
 
 	if err := regenerateSession(ctx, nil, map[string]any{
 		// User needs to use 2FA, save data and redirect to 2FA page.
-		"twofaUid":      u.ID,
-		"twofaRemember": remember,
-		"linkAccount":   true,
+		"twofaUid":              u.ID,
+		"twofaRemember":         remember,
+		"linkAccount":           true,
+		session.KeySignInMethod: session.SignInMethodOAuth2,
 	}); err != nil {
 		ctx.ServerError("RegenerateSession", err)
 		return

routers/web/auth/oauth.go

@@ -432,6 +432,7 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
 			session.KeyUID:                  u.ID,
 			session.KeyUname:                u.Name,
 			session.KeyUserHasTwoFactorAuth: userHasTwoFactorAuth,
+			session.KeySignInMethod:         session.SignInMethodOAuth2,
 		}); err != nil {
 			ctx.ServerError("updateSession", err)
 			return
@@ -455,8 +456,9 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m
 
 	if err := regenerateSession(ctx, nil, map[string]any{
 		// User needs to use 2FA, save data and redirect to 2FA page.
-		"twofaUid":      u.ID,
-		"twofaRemember": false,
+		"twofaUid":              u.ID,
+		"twofaRemember":         false,
+		session.KeySignInMethod: session.SignInMethodOAuth2,
 	}); err != nil {
 		ctx.ServerError("updateSession", err)
 		return

services/actions/approve.go

@@ -28,6 +28,9 @@ func ApproveRuns(ctx context.Context, repo *repo_model.Repository, doer *user_mo
 			if err != nil {
 				return err
 			}
+			if !run.NeedApproval {
+				continue
+			}
 			run.NeedApproval = false
 			run.ApprovedBy = doer.ID
 			if err := actions_model.UpdateRun(ctx, run, "need_approval", "approved_by"); err != nil {

services/actions/approve_test.go

@@ -0,0 +1,67 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestApproveRuns(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+
+	insertRun := func(index int64, status actions_model.Status, needApproval bool, approvedBy int64) *actions_model.ActionRun {
+		run := &actions_model.ActionRun{
+			Title: "approve-run", RepoID: repo.ID, OwnerID: repo.OwnerID, WorkflowID: "test.yaml", Index: index,
+			TriggerUserID: doer.ID, Ref: "refs/heads/main",
+			CommitSHA: "c2d72f548424103f01ee1dc02889c1e2bff816b0", Event: "push", TriggerEvent: "push",
+			Status: status, NeedApproval: needApproval, ApprovedBy: approvedBy,
+		}
+		require.NoError(t, db.Insert(t.Context(), run))
+		return run
+	}
+	insertJob := func(run *actions_model.ActionRun, status actions_model.Status) *actions_model.ActionRunJob {
+		job := &actions_model.ActionRunJob{
+			RunID: run.ID, RepoID: run.RepoID, OwnerID: run.OwnerID, CommitSHA: run.CommitSHA,
+			Name: "job1", Attempt: 1, JobID: "job1", Status: status,
+			RunsOn: []string{"ubuntu-latest"},
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+		return job
+	}
+
+	t.Run("approve blocked run", func(t *testing.T) {
+		run := insertRun(1001, actions_model.StatusBlocked, true, 0)
+		job := insertJob(run, actions_model.StatusBlocked)
+
+		require.NoError(t, ApproveRuns(t.Context(), repo, doer, []int64{run.ID}))
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+		assert.False(t, run.NeedApproval)
+		assert.Equal(t, doer.ID, run.ApprovedBy)
+		assert.Equal(t, actions_model.StatusWaiting, unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: job.ID}).Status)
+	})
+
+	t.Run("re-approving an approved run is a no-op", func(t *testing.T) {
+		run := insertRun(1002, actions_model.StatusRunning, false, 4)
+		job := insertJob(run, actions_model.StatusRunning)
+
+		require.NoError(t, ApproveRuns(t.Context(), repo, doer, []int64{run.ID}))
+
+		run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+		assert.EqualValues(t, 4, run.ApprovedBy, "approver must not be overwritten")
+		assert.Equal(t, actions_model.StatusRunning, unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: job.ID}).Status, "started job must not be reset to waiting")
+	})
+}

services/actions/context.go

@@ -49,7 +49,7 @@ func GenerateGiteaContext(ctx context.Context, run *actions_model.ActionRun, att
 		// In GitHub's documentation, ref should be the branch or tag that triggered workflow. But when the TriggerEvent is pull_request_target,
 		// the ref will be the base branch.
 		if run.TriggerEvent == actions_module.GithubEventPullRequestTarget {
-			ref = git.BranchPrefix + pullPayload.PullRequest.Base.Name
+			ref = git.BranchPrefix + pullPayload.PullRequest.Base.Ref
 			sha = pullPayload.PullRequest.Base.Sha
 		}
 	}

services/actions/context_test.go

@@ -12,8 +12,10 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
+	actions_module "gitea.dev/modules/actions"
 	"gitea.dev/modules/json"
 	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	act_model "gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
@@ -321,6 +323,38 @@ func TestFindTaskNeeds(t *testing.T) {
 	assert.Equal(t, "bbb", ret["job1"].Outputs["output_b"])
 }
 
+func TestGenerateGiteaContextPullRequestTarget(t *testing.T) {
+	payload := api.PullRequestPayload{
+		PullRequest: &api.PullRequest{
+			Base: &api.PRBranchInfo{
+				Name: "owner:main",
+				Ref:  "main",
+				Sha:  "1234567890abcdef",
+			},
+			Head: &api.PRBranchInfo{
+				Name: "fork:feature",
+				Ref:  "feature",
+				Sha:  "fedcba0987654321",
+			},
+		},
+	}
+	payloadBytes, err := json.Marshal(payload)
+	assert.NoError(t, err)
+
+	run := &actions_model.ActionRun{
+		Event:        webhook_module.HookEventPullRequest,
+		TriggerEvent: string(actions_module.GithubEventPullRequestTarget),
+		EventPayload: string(payloadBytes),
+		TriggerUser:  &user_model.User{Name: "test-user"},
+		Repo:         &repo_model.Repository{Name: "test-repo", OwnerName: "test-owner"},
+	}
+
+	giteaCtx := GenerateGiteaContext(t.Context(), run, nil, nil)
+
+	assert.Equal(t, "refs/heads/main", giteaCtx["ref"])
+	assert.Equal(t, "main", giteaCtx["ref_name"])
+}
+
 // TestGenerateGiteaContext_NilAttempt verifies that, with no explicit attempt,
 // use GetLatestAttempt to load the latest attempt and resolve attempt-related context variables.
 func TestGenerateGiteaContext_NilAttempt(t *testing.T) {

web_src/js/components/ActionRunJobView.vue

@@ -723,7 +723,7 @@ async function hashChangeListener() {
 
 .job-step-logs .job-log-line .log-msg {
   flex: 1;
-  white-space: break-spaces;
+  white-space: break-spaces; /* decoded commands like "::error::foo%0Abar" contain "\n" */
   margin-left: 12px;
   overflow-wrap: anywhere;
 }

web_src/js/components/ActionRunView.test.ts

@@ -14,6 +14,13 @@ test('LogLineMessage', () => {
     '##[debug] foo': '<span class="log-msg log-cmd-debug"><span class="log-msg-label">Debug:</span><span> foo</span></span>',
     '::error::foo': '<span class="log-msg log-cmd-error"><span class="log-msg-label">Error:</span><span> foo</span></span>',
     '::warning file=test.js,line=1::foo': '<span class="log-msg log-cmd-warning"><span class="log-msg-label">Warning:</span><span> foo</span></span>',
+    '::error::foo%0Abar': '<span class="log-msg log-cmd-error"><span class="log-msg-label">Error:</span><span> foo\nbar</span></span>',
+    '::error::foo%0D%0Abar': '<span class="log-msg log-cmd-error"><span class="log-msg-label">Error:</span><span> foo\nbar</span></span>',
+    '::error::100%25 done%250A': '<span class="log-msg log-cmd-error"><span class="log-msg-label">Error:</span><span> 100% done%0A</span></span>',
+    '::error::keep%5Dsemi%3B': '<span class="log-msg log-cmd-error"><span class="log-msg-label">Error:</span><span> keep%5Dsemi%3B</span></span>',
+    '::group::foo%0Abar': '<span class="log-msg log-cmd-group">foo\nbar</span>',
+    '##[error]foo%0Abar%3B%5D': '<span class="log-msg log-cmd-error"><span class="log-msg-label">Error:</span><span> foo\nbar;]</span></span>',
+    '##[command]foo%0Abar': '<span class="log-msg log-cmd-command">foo%0Abar</span>',
     '::notice::foo': '<span class="log-msg log-cmd-notice"><span class="log-msg-label">Notice:</span><span> foo</span></span>',
     '::debug::foo': '<span class="log-msg log-cmd-debug"><span class="log-msg-label">Debug:</span><span> foo</span></span>',
     '##[command] foo': '<span class="log-msg log-cmd-command"> foo</span>',

web_src/js/components/ActionRunView.ts

@@ -9,7 +9,8 @@ import {POST} from '../modules/fetch.ts';
 // * Workflow command outputs log commands like "::group::the-title", "::add-matcher::...."
 // * Workflow runner parses and processes the commands to "##[group]", apply "matchers", hide secrets, etc.
 // * The reported logs are the processed logs.
-// HOWEVER: Gitea runner does not completely process those commands. Many works are done by the frontend at the moment.
+// HOWEVER: Gitea cannot, a decoded message may contain newlines and FormatLog drops them,
+// so the commands arrive here still escaped and the frontend decodes them.
 const LogLinePrefixCommandMap: Record<string, LogLineCommandName> = {
   '::group::': 'group',
   '##[group]': 'group',
@@ -67,14 +68,23 @@ const LogLineLabelMap: Partial<Record<LogLineCommandName, string>> = {
   'debug': 'Debug',
 };
 
+function decodeLineMessage(line: LogLine, cmd: LogLineCommand | null): string {
+  // TODO: for some commands (::group::), the "prefix removal" works well, for some commands with "arguments" (::remove-matcher ...::),
+  // it needs to do further processing in the future (fortunately, at the moment we don't need to handle these commands)
+  if (!cmd) return line.message;
+  let msg = line.message.substring(cmd.prefix.length);
+  if (cmd.name === 'command') return msg; // "command" is only an output tag, do not parse or escape it
+  // "##[cmd]" also escapes ";" and "]" which delimit its header, "::cmd::" does not
+  if (!cmd.prefix.startsWith('::')) msg = msg.replace(/%3B/g, ';').replace(/%5D/g, ']');
+  // renderAnsiInto breaks a line per "\r", so "%0D%0A" is one break. "%25" last keeps "%250A" literal
+  return msg.replace(/(?:%0D)?%0A/g, '\n').replace(/%0D/g, '\r').replace(/%25/g, '%');
+}
+
 export function createLogLineMessage(line: LogLine, cmd: LogLineCommand | null) {
   const logMsgAttrs = {class: 'log-msg'};
   if (cmd?.name) logMsgAttrs.class += ` log-cmd-${cmd.name}`; // make it easier to add styles to some commands like "error"
 
-  // TODO: for some commands (::group::), the "prefix removal" works well, for some commands with "arguments" (::remove-matcher ...::),
-  // it needs to do further processing in the future (fortunately, at the moment we don't need to handle these commands)
-  const msgContent = cmd ? line.message.substring(cmd.prefix.length) : line.message;
-
+  const msgContent = decodeLineMessage(line, cmd);
   const logMsg = createElementFromAttrs('span', logMsgAttrs);
   const label = cmd ? LogLineLabelMap[cmd.name] : null;
   if (label) {