no need to "clean up test fixture"

fix
Merge remote-tracking branch 'origin/main' into various-sec-fixes
2026-08-29 00:59:39 +09:00 · 2026-06-16 08:51:21 +08:00 · 2026-06-16 08:48:53 +08:00 · 2026-06-15 22:12:27 +02:00 · 2026-06-15 22:11:23 +02:00 · 2026-06-15 22:08:10 +02:00
777 changed files with 8808 additions and 22333 deletions
@@ -13,7 +13,7 @@ runs:
  using: composite
  steps:
    - uses: ./.github/actions/free-disk-space
-    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: go.mod
        check-latest: true
@@ -9,7 +9,7 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
    - if: ${{ inputs.cache == 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
@@ -29,7 +29,7 @@ jobs:
  gobuild:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: TAGS="bindata" make backend
@@ -59,7 +59,7 @@ jobs:
        include:
          - { tags: "bindata", target: "lint-backend" }
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
        with:
          lint-cache: "true"
@@ -12,8 +12,8 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
@@ -20,8 +20,8 @@ jobs:
    if: github.repository == 'go-gitea/gitea' # prevent running on forks
    timeout-minutes: 30
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: renovatebot/github-action@8217b3fc286df088d7c27f3255fe8414463bc0fd # v46.1.15
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
@@ -12,8 +12,8 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: crowdin/github-action@8868a33591d21088edfc398968173a3b98d51706 # v2.16.2
        with:
          upload_sources: true
          upload_translations: false
@@ -49,7 +49,7 @@ jobs:
      e2e: ${{ steps.changes.outputs.e2e }}
      shell: ${{ steps.changes.outputs.shell }}
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
        id: changes
        with:
@@ -19,7 +19,7 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
-      - uses: go-gitea/giteabot@912675d47455ac93be82d8bda4667a02b20a6fe4 # v1.0.4
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
        with:
          github_token: ${{ secrets.GITEABOT_TOKEN }}
          gitea_fork: giteabot/gitea
@@ -1,16 +1,9 @@
 name: giteabot

 on:
-  # When main advances, rerun merge queue maintenance so the oldest
-  # reviewed/wait-merge PR can be updated against the new base promptly.
-  push:
-    branches:
-      - main
  # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
  # forks, which the bot needs to write labels, statuses and comments. Safe here
  # because the job only runs a pinned action and never checks out PR HEAD.
-  # These PR lifecycle events drive label maintenance, queue maintenance, and
-  # explicit bot actions triggered by relevant label changes.
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    types:
      - opened
@@ -20,19 +13,13 @@ on:
      - closed
      - review_requested
      - review_request_removed
-  # Review events keep review-derived state such as lgtm labels and status checks
-  # in sync after approvals, edits, or dismissals.
  pull_request_review:
    types:
      - submitted
      - edited
      - dismissed
-  # Periodic maintenance is still useful as a backstop for queue cleanup and
-  # other housekeeping, even though main pushes now trigger it promptly.
  schedule:
    - cron: "15 3 * * *"
-  # Allow maintainers to rerun selected checks manually when debugging bot
-  # behavior without waiting for another repository event.
  workflow_dispatch:
    inputs:
      checks:
@@ -58,7 +45,7 @@ jobs:
    steps:
      # pull_request_review runs without repository secrets on fork PRs, so fall
      # back to the workflow token for the non-backport checks handled here.
-      - uses: go-gitea/giteabot@912675d47455ac93be82d8bda4667a02b20a6fe4 # v1.0.4
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
        with:
          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
@@ -19,7 +19,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
        with:
          lint-cache: "true"
@@ -31,7 +31,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
        with:
          cache: "false"
@@ -62,7 +62,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: make --always-make checks-backend # ensure the "go-licenses" make target runs
@@ -72,7 +72,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
      - run: make lint-frontend
@@ -85,7 +85,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend generate-go
      # no frontend build here as backend should be able to build, even without any frontend files
@@ -42,7 +42,7 @@ jobs:
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/pgsql-shard
        with:
@@ -78,7 +78,7 @@ jobs:
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/pgsql-shard
        with:
@@ -90,7 +90,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - run: make deps-backend
      - run: make backend
@@ -131,7 +131,7 @@ jobs:
        ports:
          - "7700:7700"
      redis:
-        image: redis:latest@sha256:c904002d182255b6db3cbe3a1e8ce6c187d15390c39500b59fc07181aabff7bf
+        image: redis:latest@sha256:a505f8b9d8ac3ff7b0848055b4abf1901d6d77606774aa1e38bd37f1197ed2b5
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -151,7 +151,7 @@ jobs:
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
@@ -208,7 +208,7 @@ jobs:
          - "587:587"
          - "993:993"
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
@@ -241,7 +241,7 @@ jobs:
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - name: Add hosts to /etc/hosts
        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
@@ -21,7 +21,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/amd64
@@ -31,7 +31,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/arm64
@@ -41,7 +41,7 @@ jobs:
    needs: [files-changed]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/docker-dryrun
        with:
          platform: linux/riscv64
@@ -19,7 +19,7 @@ jobs:
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./.github/actions/go-setup
      - uses: ./.github/actions/node-setup
      - run: make deps-frontend
@@ -30,7 +30,7 @@ jobs:
      pull-requests: write
    steps:
      # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.event.pull_request.base.sha }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -17,15 +17,11 @@ jobs:
      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}

    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install snapcraft
        run: sudo snap install snapcraft --classic

-      - name: Authenticate snapcraft
-        shell: bash
-        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
-
      - name: Remote build
        run: |
          snapcraft remote-build \
@@ -13,17 +13,16 @@ jobs:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
      contents: read
-      id-token: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -34,8 +33,6 @@ jobs:
      - run: make release
        env:
          TAGS: bindata
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: import gpg key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -48,10 +45,9 @@ jobs:
          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
-      # clean branch name to get the folder name in the object storage
+      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -60,16 +56,18 @@ jobs:
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
+      - name: configure aws
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      - name: upload binaries to s3
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress

  nightly-container:
    runs-on: namespace-profile-gitea-release-docker
@@ -77,7 +75,7 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -14,17 +14,16 @@ jobs:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
      contents: read
-      id-token: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -35,8 +34,6 @@ jobs:
      - run: make release
        env:
          TAGS: bindata
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: import gpg key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -49,10 +46,9 @@ jobs:
          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
-      # clean branch name to get the folder name in the object storage
+      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -61,16 +57,18 @@ jobs:
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
+      - name: configure aws
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      - name: upload binaries to s3
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
      - name: Install GH CLI
        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
@@ -88,7 +86,7 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -17,17 +17,16 @@ jobs:
    permissions:
      contents: read
      packages: write # to publish to ghcr.io
-      id-token: write
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -38,8 +37,6 @@ jobs:
      - run: make release
        env:
          TAGS: bindata
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: import gpg key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -52,10 +49,9 @@ jobs:
          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
        run: |
          for f in dist/release/*; do
-            cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
          done
-      # clean branch name to get the folder name in the object storage
+      # clean branch name to get the folder name in S3
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -64,16 +60,18 @@ jobs:
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
-      - name: upload binaries to cloudflare r2
+      - name: configure aws
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        with:
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      - name: upload binaries to s3
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
      - name: Install GH CLI
        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
@@ -91,7 +89,7 @@ jobs:
      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -107,7 +107,6 @@ linters:
        - -QF1008
    testifylint:
      disable:
-        - empty
        - go-require
        - require-error
    usetesting:
@@ -4,455 +4,6 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.27.2](https://github.com/go-gitea/gitea/releases/tag/v1.27.2) - 2026-08-14
-
-* SECURITY
-  * Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
-  * Refactor: external render (#38885) (#38898)
-  * Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
-  * Refactor: markup render (#38864) (#38869)
-  * Fix(deps): update dependency mermaid to v11.16.1 (#38816)
-  * Fix(auth): set WebAuthn user verification per request (#38805) (#38810)
-  * Fix: render highlight language (#38793) (#38795)
-
-* ENHANCEMENTS
-  * enhance: add missing npm package metadata properties (#38826) (#38831)
-
-* BUGFIXES
-  * fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
-  * fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
-  * fix(lfs): accept successful transfer responses (#38866) (#38875)
-  * fix(packages): ignore nested Package.swift (#38788) (#38836)
-  * fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
-  * fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
-  * fix(migration): migration deletion returned json redirection (#38796) (#38825)
-  * fix(ui): change underlines to default browser style (#38819) (#38823)
-  * fix(actions): allow cancelling runs without running jobs (#35842) (#38812)
-  * fix(actions): evaluate each `${{ }}` part on its own (#38754) (#38797)
-  * fix(actions): write an action task report in one transaction (#38792) (#38794)
-  * fix: markup link (#38764) (#38765)
-  * fix: set a minio part size when the content size is unknown (#38753) (#38755)
-  * fix: bad path escape in subpath archive download (#38749) (#38750)
-  * fix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
-  * fix(markdown): fix double strikethough on code (#38707) (#38729)
-  * fix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
-  * fix: correct full url when using sub-path (#38712) (#38716)
-  * fix: avoid markup render panic (#38698) (#38703)
-  * fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
-  * fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
-  * fix(migrations): use all configured GitHub tokens (#38841) (#38846)
-
-## [1.27.1](https://github.com/go-gitea/gitea/releases/tag/v1.27.1) - 2026-07-27
-
-* SECURITY
-  * fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
-
-* API
-  * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
-
-* ENHANCEMENTS
-  * enhance: improve diff contrast in light and dark themes (#37477) (#38574)
-
-* BUGFIXES
-  * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
-  * fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
-  * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
-  * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654)
-  * fix: orgmode render include path (#38642) (#38645)
-  * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
-  * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
-  * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
-  * fix(actions): correctness and hardening fixes (#38518) (#38631)
-  * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
-  * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
-  * fix(webhook): remove slack channel name check (#38608) (#38612)
-  * fix: download dropdown menu clipped on the branches page (#38604) (#38609)
-  * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
-  * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
-  * fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
-  * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
-  * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
-  * fix: branch protection user list (#38570) (#38584)
-  * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
-  * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
-  * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557)
-  * fix(actions): align status icon span for Safari rendering (#38558) (#38562)
-  * fix: revert git clone http redirection forbidden (#38530) (#38545)
-  * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
-  * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
-  * fix: make the merge box button red if some checks fail (#38508) (#38516)
-  * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
-  * fix: make commit message merge correctly (#38490) (#38502)
-  * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
-  * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497)
-  * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
-  * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
-  * fix: full file highlighting for git diff with CR char (#38484) (#38491)
-  * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
-  * fix: 500 error when updating user visibility (#38480) (#38483)
-  * fix(actions): make job list item fully clickable (#38462) (#38471)
-  * fix: mail template for push event (#38467) (#38468)
-  * fix: make "test push webhook" always work (#38425) (#38455)
-  * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
-  * fix(org): align follow button and wrap description (#38448) (#38454)
-  * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452)
-
-* MISC
-  * refactor: git patch apply (#38637) (#38638)
-
-## [1.27.0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0) - 2026-07-13
-
-* BREAKING
-  * Feat(actions)!: improve support for reusable workflows (#37478)
-  * Use Content-Security-Policy: script nonce (#37232)
-
-* SECURITY
-  * Fix: various security fixes (#38406) (#38426)
-  * Fix(security): harden access checks and migration validation (#38324) (#38400)
-  * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
-  * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
-  * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
-  * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
-  * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
-  * Fix: golang html template url escaping (#38363) (#38369)
-  * Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
-  * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
-  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
-  * Fix(oauth): restrict introspection to the token's client (#38042)
-  * Fix(api): don't expose private org membership via public_members (#38145)
-  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
-  * Fix(migrations): prevent path traversal in repository restore (#38215)
-
-* FEATURES
-  * Feat(actions): add workflow status badge modal (#38196)
-  * Feat(actions): support owner-level and global scoped workflows (#38154)
-  * Feat(api): support ref suffixes in compare (#38148)
-  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
-  * Feat(actions): show run status on browser tab favicon (#38071)
-  * Feat(api): add token introspection and self-deletion endpoint (#37995)
-  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
-  * Feat(repo): split repository creation limit into user and org scopes (#37872)
-  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
-  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
-  * Feat(org): add team visibility so org members can discover teams (#37680)
-  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
-  * Feat: Add avatar stacks (#37594)
-  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
-  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
-  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
-  * Feat(orgs): Add search bar for organization members tab page (#37347)
-  * Feat(api): Add assignees APIs (#37330)
-  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
-  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
-  * Add project column picker to issue and pull request sidebar (#37037)
-  * Allow multiple projects per issue and pull requests (#36784)
-  * Feat(ui): add "follow rename" to file commit history list (#34994)
-  * Feat(ssh): auto generate additional ssh keys (#33974)
-
-* ENHANCEMENTS
-  * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
-  * Enhance: allow builtin default git config options to be overridden (#38172)
-  * Enhance: allow MathML core elements (#38034)
-  * Enhance(markup): improve issue title rendering (#37908)
-  * Enhance(actions): set descriptive browser tab title on run view (#37870)
-  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
-  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
-  * Feat(actions): add before/after to PR synchronize event payload (#37827)
-  * Enhance(actions): add branch filters to run list (#37826)
-  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
-  * Feat: add copy button to action step header, improve other copy buttons (#37744)
-  * Fix(icon): use repo-forked icon to display forks count (#37731)
-  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
-  * Feat(api): add last_sync to repository API (#37566)
-  * Enhance: Adjust Workflow Graph styling (#37497)
-  * Improve code editor text selection and clean up lint enablement (#37474)
-  * Add mirror auth updates to repo edit API and settings (#37468)
-  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
-  * Feat: Add default PR branch update style setting (#37410)
-  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
-  * Allow fast-forward-only merge when signed commits are required (#37335)
-  * Enhance styling in actions page (#37323)
-  * Fix: improve actions status icons and texts (#37206)
-  * Make Markdown fenced code block work with more syntaxes (#37154)
-  * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
-  * Add API endpoint to reply to pull request review comments (#36683)
-
-* PERFORMANCE
-  * Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
-  * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
-  * Perf: Various performance regression fixes (#38078)
-  * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076)
-  * Batch-load related data in actions run, job, and task API endpoints (#37032)
-
-* BUGFIXES
-  * Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
-  * Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
-  * Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
-  * Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
-  * Fix: actions task state concurrent update (#38405) (#38409)
-  * Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
-  * Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
-  * Fix: co-author detection (#38392) (#38397)
-  * Fix: incorrect co-author detection on commit page (#38386) (#38387)
-  * Fix(ui): restore commits table column widths (#38379) (#38383)
-  * Fix: minio init check (#38355) (#38361)
-  * Fix: org project view assignee list (#38357) (#38360)
-  * Fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347)
-  * Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
-  * Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
-  * Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
-  * Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
-  * Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
-  * Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
-  * Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
-  * Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
-  * Fix: update npm dependencies, fix misc issues (#38257)
-  * Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
-  * Fix: codemirror regressions (#38248)
-  * Fix(api): support HEAD requests on all API GET endpoints (#38245)
-  * Fix(actions): Cleanup workflow status badge code (#38241)
-  * Fix(web): Correctly align the "disabled" label on larger workflow names (#38240)
-  * Fix(actions): don't swallow HTML entities into linkified URLs (#38239)
-  * Fix(packages): accept npm "repository" and "bin" in string form (#38236)
-  * Fix(actions): fix 500 error when canceling a canceling task (#38223)
-  * Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
-  * Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
-  * Fix(api): deny private org member enumeration via /members (#38213)
-  * Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
-  * Fix(deps): update go dependencies (#38194)
-  * Fix(deps): update npm dependencies (#38193)
-  * Fix(cli): default must-change-password to false for bot users (#38175)
-  * Fix(actions): show run index in run view and fix summary graph height (#38165)
-  * Fix: csp (#38162)
-  * Fix(deps): update npm dependencies (#38123)
-  * Fix(mssql): expand legacy issue and comment long-text columns (#38120)
-  * Fix(packages): validate debian distribution and component names (#38116)
-  * Fix(packages): validate module version in goproxy ParsePackage (#38104)
-  * Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
-  * Fix: git push hook post receive (#38089)
-  * Fix(ui): prevent commit status popup overflowing its row (#38081)
-  * Fix: validate gem name in rubygems parseMetadataFile (#38061)
-  * Fix: commit display name (#38057)
-  * Fix: csp regressions (#38047)
-  * Fix: api error message (#38031)
-  * Fix(deps): update npm dependencies (#38029)
-  * Fix: pgsql lint (#38022)
-  * Fix(indexer): fix assignee filters in issue search (#38021)
-  * Fix: various dropdown problems (#38020)
-  * Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
-  * Fix: raise git required version to 2.13 (#37996)
-  * Fix: remove "no-transfrom" from the cache-control header (#37985)
-  * Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
-  * Fix: use committer time where ever possible as default (#37969)
-  * Fix(deps): update npm dependencies, remove nolyfill (#37968)
-  * Fix(deps): update go dependencies (#37967)
-  * Fix(pull): preserve squash message trailers and additional commit messages (#37954)
-  * Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
-  * Fix: support ##[command] log prefix in action run UI (#37882)
-  * Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
-  * Fix(deps): update npm dependencies (#37844)
-  * Fix(deps): update go dependencies (#37841)
-  * Fix(frontend): resolve Vite assets by manifest source path (#37836)
-  * Fix(locales): Replace hardcoded strings (#37788)
-  * Fix(packages): render markdown links relative to linked repo (#37676)
-  * Fix: persist mirror repository metadata (#37519)
-  * Fix cmd tests by mocking builtin paths (#37369)
-  * Add `form-fetch-action` to some forms, fix "fetch action" resp bug (#37305)
-  * Feat: execute post run cleanup when workflow is cancelled (#37275)
-  * Fix `relative-time` error and improve global error handler (#37241)
-  * Refactor flash message and remove SanitizeHTML template func (#37179)
-
-* TESTING
-  * Test(e2e): fix race in pdf file render test (#38380) (#38381)
-  * Test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331)
-  * Test: speed up two tests (#37905)
-  * Test: Fix random failure test (#37887)
-  * Test: fix flaky `issue-comment` close test (#37880)
-  * Test: enable WAL for sqlite integration tests (#37861)
-  * Test: fix flaky `TestResourceIndex` and reduce its runtime (#37847)
-  * Test: run `TestAPIRepoMigrate` offline via a local clone source (#37817)
-  * Ci: shard tests and reduce redundant work (#37618)
-  * Test(e2e): run playwright via container (#37300)
-  * Remove external service dependencies in migration tests (#36866)
-
-* BUILD
-  * Fix(actions): authenticate snapcraft before nightly remote build (#38252)
-  * Ci: cap Elasticsearch heap in db-tests (#37816)
-  * Build(snap): publish nightly version to snapcraft via actions (#37814)
-  * Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
-  * Ci: narrow files-changed frontend filter (#37749)
-  * Ci: add `zizmor` to `lint-actions` (#37720)
-  * Chore: clean up "contrib" dir (#37690)
-  * Fix: snap build (main branch) (#37685)
-  * Ci: Also lint json5 files (#37659)
-  * Feat(editor): broaden language detection in web code editor (#37619)
-  * Build: update pnpm to v11 (#37591)
-  * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557)
-  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
-  * Update go js py dependencies (#37525)
-  * Ci: lint PR titles with commitlint (#37498)
-  * Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
-  * Update GitHub Actions to latest major versions (#37313)
-  * Update go js dependencies (#37312)
-  * Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
-  * Remove htmx (#37224)
-  * Replace custom Go formatter with `golangci-lint fmt` (#37194)
-  * Refactor htmx and fetch-action related code (#37186)
-  * Integrate renovate bot for all dependency updates (#37050)
-  * Build(sign): move to sigstore (#38250)
-
-* DOCS
-  * Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
-  * Docs: fix duplicated word in foreachref doc comment (#38161)
-  * Docs: Clarify criteria for becoming a merger (#38113)
-  * Docs: Publish TOC Election Result 2026 (#38111)
-  * Docs: mark openapi3 as autogenerated in attributes (#37963)
-  * Docs: add development setup guide (#37960)
-
-* MISC
-  * Revert(sign): restore gpg (#38251)
-  * Refactor: replace legacy `delete-button` with `link-action` (#38143)
-  * Refactor(actions): read runner capabilities from proto field (#38068)
-  * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
-  * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
-  * Fix(deps): update go dependencies (#37851)
-  * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
-  * Ci: tweak `files-changed`, add `free-disk-space` (#37819)
-  * Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
-  * Test(e2e): add comment, release, star, PR and fork tests (#37800)
-  * Chore: simplify issue and pull request templates (#37799)
-  * Chore: Update giteabot to fix failure when backport (#37789)
-  * Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
-  * Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
-  * Ci: split giteabot workflow (#37770)
-  * Fix(deps): update npm dependencies (#37768)
-  * Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
-  * Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
-  * Ci: fix cache-related issues (#37761)
-  * Chore: fix tests (#37760)
-  * Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
-  * Fix(deps): update npm dependencies (#37753)
-  * Fix(deps): update go dependencies (#37752)
-  * Chore(deps): update action dependencies (#37751)
-  * Fix(markup): wrap indented code blocks for the code-copy button (#37748)
-  * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
-  * Feat(web): also display PR counts in repo list (#37739)
-  * Refactor(glob): use strings.Builder for regexp compilation (#37730)
-  * Chore(doctor): remove four obsolete doctor check implementations (#37728)
-  * Refactor(org): simplify owner-team org repo creation logic (#37727)
-  * Refactor: move `workflowpattern` into `modules/actions` (#37717)
-  * Chore: clean up tests (#37715)
-  * Style: misc UI fixes (#37691)
-  * Ci: add shellcheck linter (#37682)
-  * Fix: catch and fix more lint problems (#37674)
-  * Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
-  * Fix(deps): update npm dependencies (#37647)
-  * Ci(renovate): update Go import paths on major bumps (#37641)
-  * Fix(deps): update go dependencies (major) (#37639)
-  * Chore(deps): update action dependencies (major) (#37638)
-  * Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
-  * Fix(deps): update npm dependencies (#37636)
-  * Refactor(log): replace log.Critical with log.Error (#37624)
-  * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
-  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
-  * Chore(deps): update action dependencies (#37603)
-  * Ci: allow `chore` type in PR title lint (#37575)
-  * Refactor: only reset a database table when the table's data was changed (#37573)
-  * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
-  * Refactor: use modernc sqlite driver as default (#37562)
-  * Docs: fix 4 typos in CHANGELOG.md (#37549)
-  * Fix(deps): update go dependencies (#37541)
-  * Chore(deps): update action dependencies (#37540)
-  * Refactor pull request view (6) (#37522)
-  * Fix: redirect early CLI console logger to stderr (#37507)
-  * Refactor "flex-list" to "flex-divided-list" (#37505)
-  * Refactor compare diff/pull page (1) (#37481)
-  * Refactor pull request view (4) (#37451)
-  * Update 1.26.1 changelog in main (#37442)
-  * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441)
-  * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405)
-  * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
-  * Update `Block a user` form (#37359)
-  * Move review request functions to a standalone file (#37358)
-  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
-  * Enable strict TypeScript, add `errorMessage` helper (#37292)
-  * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291)
-  * Update Nix flake (#37284)
-  * Fix Repository transferring page (#37277)
-  * Remove `SubmitEvent` polyfill (#37276)
-  * Remove dead code identified by `deadcode` tool (#37271)
-  * Upgrade go-git to v5.18.0 (#37268)
-  * Don't add useless labels which will bother changelog generation (#37267)
-  * Move heatmap to first-party code (#37262)
-  * Tests/integration: simplify code (#37249)
-  * Add pagination and search box to org teams list (#37245)
-  * Remove error returns from crypto random helpers and callers (#37240)
-  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
-  * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
-  * Refactor "htmx" to "fetch action" (#37208)
-  * Update go js py dependencies (#37204)
-  * Add comment for the design of "user activity time" (#37195)
-  * Remove outdated RunUser logic (#37180)
-  * Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150)
-  * Update javascript dependencies (#37142)
-  * Update go dependencies (#37141)
-  * Frontport changelog of v1.26.0-rc0 (#37138)
-  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
-  * Workflow Artifact Info Hover (#37100)
-  * Extend issue context popup beyond markdown content (#36908)
-  * Add bulk repository deletion for organizations (#36763)
-  * Feat: Add bypass allowlist for branch protection (#36514)
-
-## [1.26.4](https://github.com/go-gitea/gitea/releases/tag/1.26.4) - 2026-06-21
-
-* SECURITY
-  * fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
-
-* BUGFIXES
-  * fix: walk git log context error handling (#38182) (#38185)
-
-## [1.26.3](https://github.com/go-gitea/gitea/releases/tag/1.26.3) - 2026-06-18
-
-* BREAKING
-  * fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
-
-* SECURITY
-  * fix(hostmatcher): patch incorrect private list (#38170) (#38173)
-  * fix: Various security fixes (#38103) (#38151)
-  * fix: Various sec fixes (#38108) (#38147)
-  * fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
-  * fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
-  * fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
-  * fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
-  * fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
-  * fix: bound CODEOWNERS regex match time (#38011) (#38025)
-  * fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
-  * fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) (#37829)
-
-* API
-  * feat(api): add Link header in ListForks (#38052) (#38063)
-
-* BUGFIXES
-  * fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
-  * fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
-  * fix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
-  * fix: parse HEAD ref (#38119)
-  * fix: git cmd (#38084) (#38087)
-  * fix(releases): generate notes for initial tag (#37697) (#37986)
-  * fix(actions): return 404 when job log blob is missing (#38003) (#38004)
-  * fix(actions): exclude `workflow_call` from workflow trigger detection (#37894) (#37899)
-  * fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
-  * fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
-  * fix(actions): ack re-sent `UpdateLog` finalize idempotently (#37885) (#37892)
-  * fix: http content file render (#37850) (#37856)
-  * fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
-  * fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
-
-* BUILD
-  * fix(deps): update `@playwright/test` to 1.60.0 (#38144)
-  * ci: add `tools/ci-tools.ts` for the PR labeler workflow (#37831)
-  * fix(build): swagger css import (#37801) (#37803)
-
 ## [1.26.2](https://github.com/go-gitea/gitea/releases/tag/1.26.2) - 2026-05-20

 * SECURITY
@@ -2,17 +2,12 @@

 This document explains how to contribute changes to the Gitea project. Topic-specific guides live in separate files so the essentials are easier to find.

-| Topic                  | Document                                                         |
-|:-----------------------|:-----------------------------------------------------------------|
-| Setup and requirements | [docs/build-setup.md](docs/build-setup.md)                       |
-| Development workflow   | [docs/development.md](docs/development.md)                       |
-| Build from source      | [docs/build-source.md](docs/build-source.md)                     |
-| Running the tests      | [docs/testing.md](docs/testing.md)                               |
-| Frontend guidelines    | [docs/guidelines-frontend.md](docs/guidelines-frontend.md)       |
-| Backend guidelines     | [docs/guidelines-backend.md](docs/guidelines-backend.md)         |
-| Refactoring            | [docs/guidelines-refactoring.md](docs/guidelines-refactoring.md) |
-| Community Governance   | [docs/community-governance.md](docs/community-governance.md)     |
-| Release management     | [docs/release-management.md](docs/release-management.md)         |
+| Topic | Document |
+| :---- | :------- |
+| Backend (Go modules, API v1) | [docs/guideline-backend.md](docs/guideline-backend.md) |
+| Frontend (npm, UI guidelines) | [docs/guideline-frontend.md](docs/guideline-frontend.md) |
+| Maintainers, TOC, labels, merge queue, commit format for mergers | [docs/community-governance.md](docs/community-governance.md) |
+| Release cycle, backports, tagging releases | [docs/release-management.md](docs/release-management.md) |

 <details><summary>Table of Contents</summary>

@@ -48,7 +43,7 @@ This document explains how to contribute changes to the Gitea project. Topic-spe
 It assumes you have followed the [installation instructions](https://docs.gitea.com/category/installation). \
 Sensitive security-related issues should be reported to [security@gitea.io](mailto:security@gitea.io).

-For configuring IDEs for Gitea development, see the [IDE setup notes](docs/development.md#ide-configuration) and the [contributed configurations](contrib/development/).
+For configuring IDEs for Gitea development, see the [contributed IDE configurations](contrib/ide/).

 ## AI Contribution Policy

@@ -111,8 +106,7 @@ If further discussion is needed, we encourage you to open a new issue instead an

 ## Building Gitea

-See [docs/setup.md](docs/setup.md) for prerequisites and [docs/development.md](docs/development.md)
-for building Gitea and the development workflow.
+See the [development setup instructions](https://docs.gitea.com/development/hacking-on-gitea).

 ## Styleguide

@@ -131,7 +125,33 @@ Afterwards, copyright should only be modified when the copyright author changes.

 ## Testing

-Before submitting a pull request, run the linters (`make lint`, or the scoped `make lint-backend` / `make lint-frontend`) and the tests to make sure your changes don't cause a regression elsewhere. See [docs/testing.md](docs/testing.md) for how to run the unit, integration, end-to-end, and migration tests.
+Before submitting a pull request, run all tests to make sure your changes don't cause a regression elsewhere.
+
+Here's how to run the test suite:
+
+- code lint
+
+|                       |                                                                              |
+| :-------------------- | :--------------------------------------------------------------------------- |
+|``make lint``          | lint everything (not needed if you only change the front- **or** backend)    |
+|``make lint-frontend`` | lint frontend files                                                          |
+|``make lint-backend``  | lint backend files                                                           |
+
+- run tests (we suggest running them on Linux)
+
+| Command                                       | Action                                               |                                             |
+|:----------------------------------------------|:-----------------------------------------------------| ------------------------------------------- |
+| ``make test-backend[\#SpecificTestName]``     | run unit test(s)                                     |                                             |
+| ``make test-integration[\#SpecificTestName]`` | run [integration](tests/integration) test(s)         | [More details](tests/integration/README.md) |
+| ``make test-e2e``                             | run [end-to-end](tests/e2e) test(s) using Playwright |                                             |
+
+- E2E test environment variables
+
+| Variable                          | Description                                                 |
+| :-------------------------------- | :---------------------------------------------------------- |
+| ``GITEA_TEST_E2E_DEBUG``          | When set, show Gitea server output                          |
+| ``GITEA_TEST_E2E_FLAGS``          | Additional flags passed to Playwright, for example ``--ui`` |
+| ``GITEA_TEST_E2E_TIMEOUT_FACTOR`` | Timeout multiplier (default: 4 on CI, 1 locally)            |

 ## Translation

@@ -16,9 +16,9 @@ EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-che
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.1 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.0 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.4.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

@@ -127,7 +127,6 @@ BINDATA_DEST_WILDCARD := modules/migration/bindata.* modules/public/bindata.* mo
 GENERATED_GO_DEST := modules/charset/invisible_gen.go modules/charset/ambiguous_gen.go

 SVG_DEST_DIR := public/assets/img/svg
-SVG_DEST_DIRS := $(SVG_DEST_DIR) options/fileicon

 AIR_TMP_DIR := .air

@@ -634,10 +633,10 @@ svg: node_modules ## build svg files

 .PHONY: svg-check
 svg-check: svg
-	@git add $(SVG_DEST_DIRS)
-	@diff=$$(git diff --color=always --cached $(SVG_DEST_DIRS)); \
+	@git add $(SVG_DEST_DIR)
+	@diff=$$(git diff --color=always --cached $(SVG_DEST_DIR)); \
 	if [ -n "$$diff" ]; then \
-		echo "Please run 'make svg' and 'git add $(SVG_DEST_DIRS)' and commit the result:"; \
+		echo "Please run 'make svg' and 'git add $(SVG_DEST_DIR)' and commit the result:"; \
 		printf "%s" "$${diff}"; \
 		exit 1; \
 	fi
@@ -14,21 +14,21 @@

 ## Purpose

-The goal of Gitea is to make the easiest, fastest, and most painless way of
-setting up a self-hosted all-in-one software development service,
-including Git hosting, code management, code review, issue tracking, project kanban, wiki,
-team collaboration, package registry and CI/CD which can reuse GitHub Actions.
+The goal of this project is to make the easiest, fastest, and most
+painless way of setting up a self-hosted Git service.

 As Gitea is written in Go, it works across **all** the platforms and
-architectures that are supported by Go, including Linux, macOS, FreeBSD/OpenBSD and Windows
-on x86, amd64, ARM, RISC-V 64 and PowerPC architectures.
+architectures that are supported by Go, including Linux, macOS, and
+Windows on x86, amd64, ARM and PowerPC architectures.
+This project has been
+[forked](https://blog.gitea.com/welcome-to-gitea/) from
+[Gogs](https://gogs.io) since November of 2016, but a lot has changed.

 For online demonstrations, you can visit [demo.gitea.com](https://demo.gitea.com).

 For accessing free Gitea service (with a limited number of repositories), you can visit [gitea.com](https://gitea.com/user/login).

-To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at [cloud.gitea.com](https://cloud.gitea.com),
-or use container (docker/podman/etc) to deploy on your own server with the [official image](https://hub.docker.com/r/gitea/gitea).
+To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at [cloud.gitea.com](https://cloud.gitea.com).

 ## Documentation

@@ -40,12 +40,27 @@ If you have any suggestions or would like to contribute to it, you can visit the

 ## Building

-See [docs/build-setup.md](docs/build-setup.md) for prerequisites
-and [docs/development.md](docs/development.md) for setting up a local development environment, linting, and testing.
+From the root of the source tree, run:

-If you'd like to build from source or make a distribution package, see [docs/build-source.md](docs/build-source.md) for more information.
+    TAGS="bindata" make build

-After building, you can run `./gitea web` to start the server, or `./gitea help` to see all available commands.
+The `build` target is split into two sub-targets:
+
+- `make backend` which requires [Go Stable](https://go.dev/dl/), the required version is defined in [go.mod](/go.mod).
+- `make frontend` which requires [Node.js LTS](https://nodejs.org/en/download/) or greater and [pnpm](https://pnpm.io/installation).
+
+Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the `frontend` target will not be triggered, making it possible to build without Node.js.
+
+More info: https://docs.gitea.com/installation/install-from-source
+
+## Using
+
+After building, a binary file named `gitea` will be generated in the root of the source tree by default. To run it, use:
+
+    ./gitea web
+
+> [!NOTE]
+> If you're interested in using our APIs, we have experimental support with [documentation](https://docs.gitea.com/api).

 ## Contributing

@@ -54,8 +69,7 @@ Expected workflow is: Fork -> Patch -> Push -> Pull Request
 > [!NOTE]
 >
 > 1. **YOU MUST READ THE [CONTRIBUTORS GUIDE](CONTRIBUTING.md) BEFORE STARTING TO WORK ON A PULL REQUEST.**
-> 2. New to the codebase? The [development guide](docs/development.md) walks through setting up a local environment and building from source.
-> 3. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!
+> 2. If you have found a vulnerability in the project, please write privately to **security@gitea.io**. Thanks!

 ## Translating

@@ -112,19 +126,14 @@ Support this project by becoming a sponsor. Your logo will show up here with a l

 Gitea is pronounced [/ɡɪ’ti:/](https://youtu.be/EM71-2uDAoY) as in "gi-tea" with a hard g.

-**How do I configure Gitea?**
+**Why is this not hosted on a Gitea instance?**

-For dynamic config options, you can change it on your admin panel's configuration section.
-
-For static config options, you can edit your `app.ini` file and resart the instance.
-See [app.example.ini](https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini) or [configuration documentation](https://docs.gitea.com/administration/config-cheat-sheet) for more details.
+We're [working on it](https://github.com/go-gitea/gitea/issues/1029).

 **Where can I find the security patches?**

 In the [release log](https://github.com/go-gitea/gitea/releases) or the [change log](https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md), search for the keyword `SECURITY` to find the security patches.

-(more FAQs are listed in [FAQ documentation](https://docs.gitea.com/help/faq))
-
 ## License

 This project is licensed under the MIT License.
@@ -134,7 +143,7 @@ for the full license text.
 ## Further information

 <details>
-<summary>Looking for an overview of the interface? Check it out the screenshots!</summary>
+<summary>Looking for an overview of the interface? Check it out!</summary>

 ### Login/Register Page

@@ -158,8 +158,7 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 	}

 	isAdmin := c.Bool("admin")
-	// Only local, existing, regular users should be forced to update their password. Bot users for example are non-interactive
-	mustChangePassword := userType == user_model.UserTypeIndividual
+	mustChangePassword := true // always default to true
 	if c.IsSet("must-change-password") {
 		if userType != user_model.UserTypeIndividual {
 			return errors.New("must-change-password flag can only be set for individual users")
@@ -63,7 +63,6 @@ func TestAdminUserCreate(t *testing.T) {
 		u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "u"})
 		assert.Equal(t, user_model.UserTypeBot, u.Type)
 		assert.Empty(t, u.Passwd)
-		assert.False(t, u.MustChangePassword, "bot users should not be forced to change password")
 	})

 	t.Run("AccessToken", func(t *testing.T) {
@@ -203,7 +203,7 @@ func TestCliCmdError(t *testing.T) {
 	assert.Error(t, err)
 	assert.Equal(t, 1, r.ExitCode)
 	assert.Empty(t, r.Stdout)
-	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n", r.Stderr)
+	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n\n", r.Stderr)

 	app = newTestApp(cli.Command{Action: func(ctx context.Context, cmd *cli.Command) error { return nil }})
 	r, err = runTestApp(app, "./gitea", "test-cmd")
@@ -235,14 +235,3 @@ func TestCliCmdBefore(t *testing.T) {
 	assert.Equal(t, "/tmp/any.ini", configValues["before"], "BeforeFunc must be called before preparing config")
 	assert.Equal(t, "/dev/null", configValues["action"])
 }
-
-func TestCliCmdCompletion(t *testing.T) {
-	app := newTestApp(cli.Command{
-		Action: func(ctx context.Context, cmd *cli.Command) error { return nil },
-	})
-	res, err := runTestApp(app, "./gitea", "completion", "bash", "--nonexist")
-	assert.Error(t, err)
-	assert.Equal(t, 1, res.ExitCode)
-	assert.Equal(t, "", res.Stdout)
-	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -nonexist\n", res.Stderr)
-}
@@ -5,10 +5,10 @@ package cmd

 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
 	"os"
+	"strings"

 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
@@ -154,37 +154,16 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 	return app
 }

-// usageErr marks a usage error already reported by cliOnUsageError, so RunMainApp does not print it again.
-type usageErr struct{ err error }
-
-func (e usageErr) Error() string { return e.err.Error() }
-func (e usageErr) Unwrap() error { return e.err }
-
-// cliOnUsageError reports usage errors itself instead of letting urfave/cli dump the full help to stdout (since urfave/cli v3.10).
-func cliOnUsageError(_ context.Context, cmd *cli.Command, err error, _ bool) error {
-	_, _ = fmt.Fprintf(cmd.Root().ErrWriter, "Incorrect Usage: %s\n", err.Error())
-	return usageErr{err}
-}
-
-func setCLIOnUsageError(cmd *cli.Command) {
-	_ = cmd.Walk(func(c *cli.Command) error {
-		c.OnUsageError = cliOnUsageError
-		return nil
-	})
-}
-
 func RunMainApp(app *cli.Command, args ...string) error {
 	ctx, cancel := installSignals()
 	defer cancel()
-	setCLIOnUsageError(app)
-	// the completion subcommands are built during app.Run, after the Walk above, so cover them via this hook
-	app.ConfigureShellCompletionCommand = setCLIOnUsageError
 	err := app.Run(ctx, args)
 	if err == nil {
 		return nil
 	}
-	if _, ok := errors.AsType[usageErr](err); ok {
-		cli.OsExiter(1) // cliOnUsageError already reported it
+	if strings.HasPrefix(err.Error(), "flag provided but not defined:") {
+		// the cli package should already have output the error message, so just exit
+		cli.OsExiter(1)
 		return err
 	}
 	_, _ = fmt.Fprintf(app.ErrWriter, "Command error: %v\n", err)
@@ -5,14 +5,60 @@ package cmd

 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"

+	"gitea.dev/modules/log"
 	"gitea.dev/modules/private"

 	"github.com/urfave/cli/v3"
 )

+func defaultLoggingFlags() []cli.Flag {
+	return []cli.Flag{
+		&cli.StringFlag{
+			Name:  "logger",
+			Usage: `Logger name - will default to "default"`,
+		},
+		&cli.StringFlag{
+			Name:  "writer",
+			Usage: "Name of the log writer - will default to mode",
+		},
+		&cli.StringFlag{
+			Name:  "level",
+			Usage: "Logging level for the new logger",
+		},
+		&cli.StringFlag{
+			Name:    "stacktrace-level",
+			Aliases: []string{"L"},
+			Usage:   "Stacktrace logging level",
+		},
+		&cli.StringFlag{
+			Name:    "flags",
+			Aliases: []string{"F"},
+			Usage:   "Flags for the logger",
+		},
+		&cli.StringFlag{
+			Name:    "expression",
+			Aliases: []string{"e"},
+			Usage:   "Matching expression for the logger",
+		},
+		&cli.StringFlag{
+			Name:    "prefix",
+			Aliases: []string{"p"},
+			Usage:   "Prefix for the logger",
+		},
+		&cli.BoolFlag{
+			Name:  "color",
+			Usage: "Use color in the logs",
+		},
+		&cli.BoolFlag{
+			Name: "debug",
+		},
+	}
+}
+
 func newLoggingCommand() *cli.Command {
 	return &cli.Command{
 		Name:  "logging",
@@ -45,6 +91,92 @@ func newLoggingCommand() *cli.Command {
 					},
 				},
 				Action: runReleaseReopenLogging,
+			}, {
+				Name:      "remove",
+				Usage:     "Remove a logger",
+				ArgsUsage: "[name] Name of logger to remove",
+				Flags: []cli.Flag{
+					&cli.BoolFlag{
+						Name: "debug",
+					}, &cli.StringFlag{
+						Name:  "logger",
+						Usage: `Logger name - will default to "default"`,
+					},
+				},
+				Action: runRemoveLogger,
+			}, {
+				Name:  "add",
+				Usage: "Add a logger",
+				Commands: []*cli.Command{
+					{
+						Name:  "file",
+						Usage: "Add a file logger",
+						Flags: append(defaultLoggingFlags(), []cli.Flag{
+							&cli.StringFlag{
+								Name:    "filename",
+								Aliases: []string{"f"},
+								Usage:   "Filename for the logger - this must be set.",
+							},
+							&cli.BoolFlag{
+								Name:    "rotate",
+								Aliases: []string{"r"},
+								Usage:   "Rotate logs",
+							},
+							&cli.Int64Flag{
+								Name:    "max-size",
+								Aliases: []string{"s"},
+								Usage:   "Maximum size in bytes before rotation",
+							},
+							&cli.BoolFlag{
+								Name:    "daily",
+								Aliases: []string{"d"},
+								Usage:   "Rotate logs daily",
+							},
+							&cli.IntFlag{
+								Name:    "max-days",
+								Aliases: []string{"D"},
+								Usage:   "Maximum number of daily logs to keep",
+							},
+							&cli.BoolFlag{
+								Name:    "compress",
+								Aliases: []string{"z"},
+								Usage:   "Compress rotated logs",
+							},
+							&cli.IntFlag{
+								Name:    "compression-level",
+								Aliases: []string{"Z"},
+								Usage:   "Compression level to use",
+							},
+						}...),
+						Action: runAddFileLogger,
+					}, {
+						Name:  "conn",
+						Usage: "Add a net conn logger",
+						Flags: append(defaultLoggingFlags(), []cli.Flag{
+							&cli.BoolFlag{
+								Name:    "reconnect-on-message",
+								Aliases: []string{"R"},
+								Usage:   "Reconnect to host for every message",
+							},
+							&cli.BoolFlag{
+								Name:    "reconnect",
+								Aliases: []string{"r"},
+								Usage:   "Reconnect to host when connection is dropped",
+							},
+							&cli.StringFlag{
+								Name:    "protocol",
+								Aliases: []string{"P"},
+								Usage:   "Set protocol to use: tcp, unix, or udp (defaults to tcp)",
+							},
+							&cli.StringFlag{
+								Name:    "address",
+								Aliases: []string{"a"},
+								Usage:   "Host address and port to connect to (defaults to :7020)",
+							},
+						}...),
+						Action: runAddConnLogger,
+					},
+				},
 			}, {
 				Name:  "log-sql",
 				Usage: "Set LogSQL",
@@ -63,6 +195,107 @@ func newLoggingCommand() *cli.Command {
 	}
 }

+func runRemoveLogger(ctx context.Context, c *cli.Command) error {
+	setup(ctx, c.Bool("debug"))
+	logger := c.String("logger")
+	if len(logger) == 0 {
+		logger = log.DEFAULT
+	}
+	writer := c.Args().First()
+
+	extra := private.RemoveLogger(ctx, logger, writer)
+	return handleCliResponseExtra(extra)
+}
+
+func runAddConnLogger(ctx context.Context, c *cli.Command) error {
+	setup(ctx, c.Bool("debug"))
+	vals := map[string]any{}
+	mode := "conn"
+	vals["net"] = "tcp"
+	if c.IsSet("protocol") {
+		switch c.String("protocol") {
+		case "udp":
+			vals["net"] = "udp"
+		case "unix":
+			vals["net"] = "unix"
+		}
+	}
+	if c.IsSet("address") {
+		vals["address"] = c.String("address")
+	} else {
+		vals["address"] = ":7020"
+	}
+	if c.IsSet("reconnect") {
+		vals["reconnect"] = c.Bool("reconnect")
+	}
+	if c.IsSet("reconnect-on-message") {
+		vals["reconnectOnMsg"] = c.Bool("reconnect-on-message")
+	}
+	return commonAddLogger(ctx, c, mode, vals)
+}
+
+func runAddFileLogger(ctx context.Context, c *cli.Command) error {
+	setup(ctx, c.Bool("debug"))
+	vals := map[string]any{}
+	mode := "file"
+	if c.IsSet("filename") {
+		vals["filename"] = c.String("filename")
+	} else {
+		return errors.New("filename must be set when creating a file logger")
+	}
+	if c.IsSet("rotate") {
+		vals["rotate"] = c.Bool("rotate")
+	}
+	if c.IsSet("max-size") {
+		vals["maxsize"] = c.Int64("max-size")
+	}
+	if c.IsSet("daily") {
+		vals["daily"] = c.Bool("daily")
+	}
+	if c.IsSet("max-days") {
+		vals["maxdays"] = c.Int("max-days")
+	}
+	if c.IsSet("compress") {
+		vals["compress"] = c.Bool("compress")
+	}
+	if c.IsSet("compression-level") {
+		vals["compressionLevel"] = c.Int("compression-level")
+	}
+	return commonAddLogger(ctx, c, mode, vals)
+}
+
+func commonAddLogger(ctx context.Context, c *cli.Command, mode string, vals map[string]any) error {
+	if len(c.String("level")) > 0 {
+		vals["level"] = log.LevelFromString(c.String("level")).String()
+	}
+	if len(c.String("stacktrace-level")) > 0 {
+		vals["stacktraceLevel"] = log.LevelFromString(c.String("stacktrace-level")).String()
+	}
+	if len(c.String("expression")) > 0 {
+		vals["expression"] = c.String("expression")
+	}
+	if len(c.String("prefix")) > 0 {
+		vals["prefix"] = c.String("prefix")
+	}
+	if len(c.String("flags")) > 0 {
+		vals["flags"] = log.FlagsFromString(c.String("flags"))
+	}
+	if c.IsSet("color") {
+		vals["colorize"] = c.Bool("color")
+	}
+	logger := log.DEFAULT
+	if c.IsSet("logger") {
+		logger = c.String("logger")
+	}
+	writer := mode
+	if c.IsSet("writer") {
+		writer = c.String("writer")
+	}
+
+	extra := private.AddLogger(ctx, logger, writer, mode, vals)
+	return handleCliResponseExtra(extra)
+}
+
 func runPauseLogging(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))
 	userMsg := private.PauseLogging(ctx)
@@ -6,7 +6,6 @@ package cmd
 import (
 	"crypto/x509"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -94,21 +93,10 @@ func runACME(listenAddr string, m http.Handler) error {
 	myACME := certmagic.NewACMEIssuer(magic, certmagic.DefaultACME)
 	magic.Issuers = []certmagic.Issuer{myACME}

-	// Obtain certificates or renew them if necessary. ManageSync fails closed on
-	// renewal errors even when a still-valid certificate is already on disk, which
-	// takes HTTPS down on restart (https://github.com/go-gitea/gitea/issues/38519).
-	// Prefer keeping the existing cert and retrying renewals asynchronously.
-	ctx := graceful.GetManager().ShutdownContext()
-	err := magic.ManageSync(ctx, []string{setting.Domain})
+	// this obtains certificates or renews them if necessary
+	err := magic.ManageSync(graceful.GetManager().HammerContext(), []string{setting.Domain})
 	if err != nil {
-		cert, cacheErr := magic.CacheManagedCertificate(ctx, setting.Domain)
-		if cacheErr != nil || cert.Expired() {
-			return errors.Join(err, cacheErr)
-		}
-		log.Error("ACME certificate manage failed; continuing with existing certificate: %v", err)
-		if err := magic.ManageAsync(ctx, []string{setting.Domain}); err != nil {
-			log.Error("Failed to start async ACME management: %v", err)
-		}
+		return err
 	}

 	tlsConfig := magic.TLSConfig()
@@ -1,14 +1,12 @@
 # IDE and code editor configuration

 ## Table of Contents
-
 - [IDE and code editor configuration](#ide-and-code-editor-configuration)
  - [Microsoft Visual Studio Code](#microsoft-visual-studio-code)

 ## Microsoft Visual Studio Code
-
 Download Microsoft Visual Studio Code at https://code.visualstudio.com/ and follow instructions at https://code.visualstudio.com/docs/languages/go to setup Go extension for it.

-Create new directory `.vscode` in Gitea root folder and copy contents of folder [contrib/development/vscode](vscode/) to it. You can now use `Ctrl`+`Shift`+`B` to build gitea executable and `F5` to run it in debug mode.
+Create new directory `.vscode` in Gitea root folder and copy contents of folder [contrib/ide/vscode](vscode/) to it. You can now use `Ctrl`+`Shift`+`B` to build gitea executable and `F5` to run it in debug mode.

 Supported on Debian, Ubuntu, Red Hat, Fedora, SUSE Linux, MacOS and Microsoft Windows.
@@ -536,13 +536,6 @@ INTERNAL_TOKEN =
 ;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy.
 ;CONTENT_SECURITY_POLICY_GENERAL =

-;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
-;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
-;; CIDR list: 1.2.3.0/8, 2001:db8::/32
-;; Wildcard hosts: *.mydomain.com, 192.168.100.*
-;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
-;ALLOWED_HOST_LIST = external
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [camo]
@@ -606,8 +599,7 @@ ENABLED = true
 ;; * https://github.com/hickford/git-credential-oauth
 ;; * https://github.com/git-ecosystem/git-credential-manager
 ;; * https://gitea.com/gitea/tea
-;; * Gitea App (the official Gitea mobile app)
-;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea, gitea-app
+;DEFAULT_APPLICATIONS = git-credential-oauth, git-credential-manager, tea
 ;;
 ;; By default, OAuth2 applications can only use "http" and "https" as their redirect URI schemes.
 ;; If you need to use other schemes (e.g. for desktop applications), you can specify them here as a comma-separated list.
@@ -770,12 +762,7 @@ LEVEL = Info

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Git config options
-;; The format is `some.configKey = value`.
-;; These options will be written into the gitconfig file under "[git] HOME_PATH" when Gitea web starts.
-;; ATTENTION:
-;; * It only does "set" config, a removed config key from this section won't be removed from git config automatically.
-;; * Some config options might affect the behavior of git and fail Gitea's git operation,
-;;   make sure you know what you are doing before making changes.
+;; This section only does "set" config, a removed config key from this section won't be removed from git config automatically. The format is `some.configKey = value`.
 ;[git.config]
 ;diff.algorithm = histogram
 ;core.logAllRefUpdates = true
@@ -1123,6 +1110,7 @@ LEVEL = Info
 ;ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT = true

 ;; Allow to fork repositories into the same owner (user or organization)
+;; This feature is experimental, not fully tested, and may be changed in the future
 ;ALLOW_FORK_INTO_SAME_OWNER = false

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1761,6 +1749,13 @@ LEVEL = Info
 ;; Deliver timeout in seconds
 ;DELIVER_TIMEOUT = 5
 ;;
+;; Webhook can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com
+;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts)
+;; CIDR list: 1.2.3.0/8, 2001:db8::/32
+;; Wildcard hosts: *.mydomain.com, 192.168.100.*
+;; Since 1.15.7. Default to * for 1.15.x, external for 1.16 and later
+;ALLOWED_HOST_LIST = external
+;;
 ;; Allow insecure certification
 ;SKIP_TLS_VERIFY = false
 ;;
@@ -3002,16 +2997,8 @@ LEVEL = Info
 ;; Comma-separated list of workflow directories, the first one to exist
 ;; in a repo is used to find Actions workflow files
 ;WORKFLOW_DIRS = .gitea/workflows,.github/workflows
-;; Comma-separated list of scoped workflow directories in a source repository, the first one to exist is used.
-;; Files here are picked up only when the repo is registered as a scoped-workflow source; in any other repo they neither run repo-level nor scope-level.
-;; Must not overlap with WORKFLOW_DIRS. Leave empty so no directory is scanned; no scoped workflows are found or run.
-;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows
 ;; Maximum number of attempts a single workflow run can have. Default value is 50.
 ;MAX_RERUN_ATTEMPTS = 50
-;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance.
-;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll.
-;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16.
-;MAX_CONCURRENT_TASK_PICKS = 16

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1,67 +0,0 @@
-# Setup and requirements
-
-This document lists the tools you need to build Gitea from source and how to get
-the code. Once your environment is ready, see [development.md](development.md) for
-the build and development workflow, and [testing.md](testing.md) for running tests.
-
-For the contribution workflow and review process, see [CONTRIBUTING.md](../CONTRIBUTING.md).
-
-## Requirements
-
-### Go
-
-[Install Go](https://go.dev/doc/install) and set up your Go environment. The
-required version is the one declared in [`go.mod`](../go.mod); installing the same
-version your continuous integration uses avoids `gofmt` differences between Go
-releases.
-
-> [!NOTE]
-> Some `make` tasks build external Go tools on demand (for example `make
-> watch-backend`). To use them, the `"$GOPATH"/bin` directory must be on your
-> executable `PATH`; otherwise you have to manage those tools yourself.
-
-### Node.js and pnpm
-
-[Install Node.js](https://nodejs.org/en/download/) to build the JavaScript and CSS
-files. The minimum supported version is the one declared in
-[`package.json`](../package.json) (`engines.node`); the latest LTS is recommended.
-
-Gitea manages frontend dependencies with [pnpm](https://pnpm.io/). The `make`
-targets invoke it for you, so installing pnpm manually is only needed if you want
-to run `pnpm` commands directly.
-
-### Make
-
-Gitea uses [Make](https://www.gnu.org/software/make/) to drive builds, linting, and
-tests. On Windows it can be installed via [MSYS2](https://www.msys2.org/) or
-[Chocolatey](https://chocolatey.org/packages/make).
-
-### Python with uv (optional)
-
-Linting the templates, workflow files, and YAML requires Python tooling that Gitea
-runs through [uv](https://docs.astral.sh/uv/). After installing uv, `make` creates
-the environment automatically (`uv sync`); you only need this if you run
-`make lint-templates`, `make lint-yaml`, or `make lint-actions` locally.
-
-### Git LFS
-
-The integration tests require [Git LFS](https://git-lfs.com/) to be installed.
-
-## Getting the source code
-
-Clone the repository:
-
-```bash
-git clone https://github.com/go-gitea/gitea
-```
-
-To contribute changes, [fork the repository](https://github.com/go-gitea/gitea) on
-GitHub and add your fork as a git remote so you can push branches and open pull
-requests. See GitHub's [working with forks](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks)
-documentation for the details.
-
-## Installing dependencies
-
-Most build and test targets install the dependencies they need on their own. To
-fetch everything up front, run `make deps` (or the per-group `make deps-frontend`,
-`make deps-backend`, `make deps-tools`, `make deps-py`).
@@ -1,92 +0,0 @@
-# Prepare build environment
-
-Complete the steps in [build-setup.md](build-setup.md) to prepare your environment for building Gitea from source.
-
-## Choose a branch
-
-By default, the cloned repository is on main branch (the current development branch for next major release, aka: main nightly).
-
-You can switch to a versioned branch (the branch for the next minor stable release, aka: stable nightly )
-or a versioned tag (matches the official releases with version numbers)
-
-To test a Pull Request, you can fetch its code by its Pull Request number (take `PR #123456` as example):
-
-```bash
-git fetch origin pull/123456/head:pr-123456
-```
-
-# Build
-
-Various [make tasks](https://github.com/go-gitea/gitea/blob/main/Makefile)
-are provided to keep the build process as simple as possible.
-
-Depending on requirements, the following build tags can be included.
-
- `bindata`: Build a single monolithic binary, with all assets included. Required for distribution and production build.
- `pam`: Enable support for PAM (Linux Pluggable Authentication Modules).
-  Can be used to authenticate local users or extend authentication to methods available to PAM.
- `gogit`: (EXPERIMENTAL) Use go-git variants of Git commands.
-
-To include all assets, use the `bindata` tag:
-
-```bash
-TAGS="bindata" make build
-```
-
-Tag `gogit` is used to try to resolve some Windows-specific performance problems, POSIX systems don't need it.
-You can build a Windows binary by:
-
-```bash
-GOOS=windows TAGS="bindata gogit" make build
-```
-
-## Changing default paths
-
-Gitea will search for a number of things from the _`CustomPath`_.
-By default, this is the `custom/` directory in the current working directory when running Gitea.
-It will also look for its configuration file _`CustomConf`_ in `$(CustomPath)/conf/app.ini`,
-and will use the current working directory as the relative base path _`AppWorkPath`_.
-
-These values, although useful when developing, may conflict with downstream users preferences.
-
-For packagers who need to use paths like `/etc/gitea/app.ini`,
-they should define these values at build time for `make build` by environment variable like
-`LDFLAGS='-X "module.Var1=Value1" -X "module.Var2=Value2"' TAGS="bindata" make build`.
-
- _`CustomConf`_: `-X "code.gitea.io/gitea/modules/setting.CustomConf=/etc/gitea/app.ini"`
- _`AppWorkPath`_: `-X "code.gitea.io/gitea/modules/setting.AppWorkPath=/var/lib/gitea"`
- _`CustomPath`_: `-X "code.gitea.io/gitea/modules/setting.CustomPath=/var/lib/gitea/custom"`
- Default PID file location: `-X "code.gitea.io/gitea/cmd.PIDFile=/run/gitea.pid"`
-
-Add as many of the strings with their preceding `-X` to the `LDFLAGS` variable and run `make build`
-with the appropriate `TAGS` as above.
-
-Running `gitea help` will allow you to review what the computed settings will be for your `gitea`.
-
-## Cross Build
-
-Gitea use's Golang's toolchain variables for cross-building.
-
-For example, to cross build for Linux ARM64:
-
-```
-GOOS=linux GOARCH=arm64 TAGS="bindata" make build
-```
-
-### Adding shell autocompletion
-
-Shell completion can be generated directly from binary with:
-```sh
-gitea completion <shell>
-```
-
-Supported values for `<shell>` are `bash`, `fish`, `pwsh` and `zsh`.
-Details on how to load the completion for your shell can be found in the completion command help.
-
-## Source Maps
-
-By default, gitea generates reduced source maps for frontend files to conserve space. This can be controlled with the `ENABLE_SOURCEMAP` environment variable:
-
- `ENABLE_SOURCEMAP=true` generates all source maps, the default for development builds
- `ENABLE_SOURCEMAP=reduced` generates limited source maps, the default for production builds
- `ENABLE_SOURCEMAP=false` generates no source maps
@@ -1,141 +0,0 @@
-# Development
-
-This document describes how to build Gitea from source and the day-to-day
-development workflow. For prerequisites and how to obtain the code, see
-[build-setup.md](build-setup.md). For running tests, see [testing.md](testing.md). For the
-contribution workflow and review process, see [CONTRIBUTING.md](../CONTRIBUTING.md).
-
-Area-specific guidelines:
-
- [Backend development guidelines](guidelines-backend.md)
- [Frontend development guidelines](guidelines-frontend.md)
- [Refactoring guidelines](guidelines-refactoring.md)
-
-## Building
-
-To build Gitea for development, run:
-
-```bash
-make build
-```
-
-No build tags are required: SQLite support is compiled in by default, which is
-enough for local development. The `build` target runs two sub-targets, `frontend`
-and `backend`. The `bindata` tag embeds the frontend assets into the binary and is
-only needed when packaging a self-contained build, so leave it out during
-development.
-
-See `make help` for all available targets, and the workflows in
-[`.github/workflows`](https://github.com/go-gitea/gitea/tree/main/.github/workflows)
-to see how continuous integration builds and checks Gitea.
-
-## Building continuously
-
-To rebuild automatically when source files change:
-
-```bash
-# watch both frontend and backend
-make watch
-
-# or watch only the frontend (starts the Vite dev server)
-make watch-frontend
-
-# or watch only the backend (Go)
-make watch-backend
-```
-
-Watching all backend source files may hit the default open-files limit on macOS or
-Linux; raise it with `ulimit -n 12288` for the current shell, or in your shell
-startup file to make it permanent.
-
-## Formatting, linting and checks
-
-Continuous integration rejects pull requests that fail formatting, linting, or
-consistency checks. Format your code first:
-
-```bash
-make fmt
-```
-
-Then lint:
-
-```bash
-# lint everything
-make lint
-# or only one side
-make lint-backend
-make lint-frontend
-```
-
-Many linters can fix issues automatically with `make lint-fix` (or the scoped
-`make lint-backend-fix` / `make lint-frontend-fix`). The combined consistency
-checks that CI runs are available as `make checks`.
-
-## Building and adding SVGs
-
-SVG icons are built with `make svg`, which compiles the icon sources into
-`public/assets/img/svg`. Custom icons can be added under `web_src/svg`.
-
-## Updating the API
-
-When you create or change API routes, you **must** update the
-[Swagger](https://swagger.io/docs/specification/2-0/what-is-swagger/) documentation
-using [go-swagger](https://goswagger.io/) comments. See the
-[backend development guidelines](guidelines-backend.md) for how API routes,
-request/response structs, and swagger definitions fit together.
-
-Regenerate and validate the spec after changing an endpoint, then commit the
-updated JSON:
-
-```bash
-make generate-swagger
-make swagger-validate
-```
-
-CI verifies the committed spec is up to date with:
-
-```bash
-make swagger-check
-```
-
-## Creating new configuration options
-
-When adding configuration options it is not enough to add them to the
-`modules/setting` files. Also update
-[`custom/conf/app.example.ini`](../custom/conf/app.example.ini), and document them in
-the [configuration cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet),
-which lives in the [documentation repository](https://gitea.com/gitea/docs).
-
-## Database migrations
-
-If you make breaking changes to a database-persisted struct under `models/`, add a
-new migration in `models/migrations/`. See [testing.md](testing.md#migration-tests)
-for running the migration tests.
-
-## Testing
-
-For unit, integration, end-to-end, and migration tests, see [testing.md](testing.md).
-
-## IDE configuration
-
-### Visual Studio Code
-
-A `launch.json` and `tasks.json` are provided in
-[`contrib/development/vscode`](../contrib/development/vscode). See
-[`contrib/development/README.md`](../contrib/development/README.md) for details.
-
-### GoLand
-
-Clicking the `Run Application` arrow on `func main()` in `/main.go` starts a
-debuggable Gitea instance.
-
-The `Output Directory` in `Run/Debug Configuration` **must** be set to the Gitea
-project directory (the one containing `main.go` and `go.mod`). Otherwise the working
-directory is a GoLand temporary directory, which prevents Gitea from loading dynamic
-resources (such as templates) in development.
-
-## Submitting your changes
-
-Push your branch and open a pull request. See [CONTRIBUTING.md](../CONTRIBUTING.md)
-for the review process and PR requirements. For help, join the `#Develop` channel on
-[Discord](https://discord.gg/gitea).
@@ -0,0 +1,63 @@
+# Backend development
+
+This document covers backend-specific contribution expectations. For general contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+For coding style and architecture, see also the [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend) on the documentation site.
+
+## Dependencies
+
+Go dependencies are managed using [Go Modules](https://go.dev/cmd/go/#hdr-Module_maintenance). \
+You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).
+
+Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
+Apart from that, these files should only be modified by Pull Requests whose only purpose is to update dependencies.
+
+The `go.mod`, `go.sum` update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
+
+## API v1
+
+The API is documented by [swagger](https://gitea.com/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
+
+### GitHub API compatibility
+
+Gitea's API should use the same endpoints and fields as the GitHub API as far as possible, unless there are good reasons to deviate. \
+If Gitea provides functionality that GitHub does not, a new endpoint can be created. \
+If information is provided by Gitea that is not provided by the GitHub API, a new field can be used that doesn't collide with any GitHub fields. \
+Updating an existing API should not remove existing fields unless there is a really good reason to do so. \
+The same applies to status responses. If you notice a problem, feel free to leave a comment in the code for future refactoring to API v2 (which is currently not planned).
+
+### Adding/Maintaining API routes
+
+All expected results (errors, success, fail messages) must be documented ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L319-L327)). \
+All JSON input types must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L76-L91)) \
+and referenced in [routers/api/v1/swagger/options.go](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/options.go). \
+They can then be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L318). \
+All JSON responses must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L36-L68)) \
+and referenced in its category in [routers/api/v1/swagger/](routers/api/v1/swagger/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/issue.go#L11-L16)) \
+They can be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L277-L279).
+
+### When to use what HTTP method
+
+In general, HTTP methods are chosen as follows:
+
+- **GET** endpoints return the requested object(s) and status **OK (200)**
+- **DELETE** endpoints return the status **No Content (204)** and no content either
+- **POST** endpoints are used to **create** new objects (e.g. a User) and return the status **Created (201)** and the created object
+- **PUT** endpoints are used to **add/assign** existing Objects (e.g. a user to a team) and return the status **No Content (204)** and no content either
+- **PATCH** endpoints are used to **edit/change** an existing object and return the changed object and the status **OK (200)**
+
+### Requirements for API routes
+
+All parameters of endpoints changing/editing an object must be optional (except the ones to identify the object, which are required).
+
+Endpoints returning lists must
+
+- support pagination (`page` & `limit` options in query)
+- set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
+
+### Knowledge
+
+- Partially database table migration must use `SyncWithOptions(IgnoreDrop...)`
+- Template variables with "camelCase" or "snake_case" are used for restoring the form values from a submitted form
@@ -0,0 +1,17 @@
+# Frontend development
+
+This document covers frontend-specific contribution expectations. For general contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+## Dependencies
+
+For the frontend, we use [npm](https://www.npmjs.com/).
+
+The same restrictions apply for frontend dependencies as for [backend dependencies](guideline-backend.md#dependencies), with the exceptions that the files for it are `package.json` and `package-lock.json`, and that new versions must always reference an existing version.
+
+## Design guideline
+
+Depending on your change, please read the
+
+- [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend)
+- [frontend development guideline](https://docs.gitea.com/contributing/guidelines-frontend)
+- [refactoring guideline](https://docs.gitea.com/contributing/guidelines-refactoring)
@@ -1,132 +0,0 @@
-# Backend development guidelines
-
-This document covers backend-specific architecture and contribution expectations.
-For the general workflow see [CONTRIBUTING.md](../CONTRIBUTING.md), and for building
-and testing see [development.md](development.md) and [testing.md](testing.md).
-
-## Background
-
-The backend is written in Go. Web routing is handled by
-[chi](https://github.com/go-chi/chi) and database access goes through the
-[XORM](https://xorm.io/) ORM. Understanding how the packages depend on each other is
-essential before contributing backend code.
-
-## Package design
-
-### Package layout
-
-The backend is split into top-level packages, each with a focused responsibility:
-
- `build`: helper scripts used at compile time
- `cmd`: subcommands such as `web`, `serv`, `hooks`, `doctor`, and admin utilities
- `models`: data structures and database operations (XORM); keeps external
-  dependencies to a minimum
-  - `models/db`: core database operations
-  - `models/fixtures`: sample data used by tests
-  - `models/migrations`: schema migration scripts
- `modules`: standalone functionality with few dependencies
-  - `modules/setting`: configuration handling
-  - `modules/git`: interaction with the Git command line
- `routers`: request handlers, split into `api`, `web`, `install`, and `private`
- `services`: business logic that ties routers and models together
- `templates`: Go HTML templates
- `public`: compiled frontend assets
- `tests`: integration and end-to-end test helpers
-
-### Dependency direction
-
-Dependencies only flow in one direction:
-
-```text
-cmd → routers → services → models → modules
-```
-
-A package on the left may import a package on its right, but never the reverse.
-
-### Naming conventions
-
- Top-level packages use the plural form: `services`, `models`, `routers`.
- Subpackages use the singular form: `services/user`, `models/repository`.
-
-When packages from different layers share a name, use a snake_case import alias to
-disambiguate:
-
-```go
-import user_service "gitea.dev/services/user"
-```
-
-### Database transactions
-
-Operations that must roll back together should run inside `db.WithTx()` (or
-`db.WithTx2()` when a value must be returned), defined in `models/db/context.go`.
-Functions that participate in a transaction take a `context.Context` as their first
-parameter so the transaction can be propagated.
-
-### XORM gotchas
-
- Never call `x.Update(exemplar)` without an explicit `WHERE` clause — it updates
-  every row in the table.
- Partial table migrations must use `SyncWithOptions(IgnoreDrop...)` rather than a
-  plain `Sync`.
- When inserting rows with preset IDs, MSSQL requires `SET IDENTITY_INSERT` to be
-  enabled and PostgreSQL requires the sequence to be updated afterwards.
-
-## Dependencies
-
-Go dependencies are managed with [Go Modules](https://go.dev/ref/mod).
-
-Pull requests should only modify `go.mod` and `go.sum` where it relates to the
-change at hand, be it a bug fix or a new feature. Otherwise, these files should only
-be touched by pull requests whose sole purpose is updating dependencies. Run
-`make tidy` after any change to `go.mod`.
-
-Any `go.mod` / `go.sum` update must be justified in the PR description and must be
-verified by reviewers and the merger to reference an existing upstream commit.
-
-## API v1
-
-The API is documented with [Swagger](https://gitea.com/api/swagger) and is modelled
-on [the GitHub API](https://docs.github.com/en/rest).
-
-### GitHub API compatibility
-
-Gitea's API should use the same endpoints and fields as the GitHub API where
-possible, unless there is a good reason to deviate.
-
- If Gitea offers functionality GitHub does not, a new endpoint may be added.
- If Gitea exposes information the GitHub API does not, a new field may be added as
-  long as it does not collide with a GitHub field.
- Existing fields should not be removed unless there is a strong reason; the same
-  applies to status responses.
-
-If you notice a problem that would require a breaking change, leave a comment in the
-code for a future refactor to API v2 (which is currently not planned) rather than
-breaking v1.
-
-### Adding and maintaining API routes
-
- All possible results (errors, success, and failure messages) must be documented in
-  the swagger comments on the route.
- Every JSON request body must be defined as a struct in `modules/structs/` and
-  registered in [`routers/api/v1/swagger/options.go`](../routers/api/v1/swagger/options.go).
- Every JSON response must be defined as a struct in `modules/structs/` and
-  registered with its category under [`routers/api/v1/swagger/`](../routers/api/v1/swagger).
-
-### HTTP methods and status codes
-
-In general, choose HTTP methods as follows:
-
- **GET** returns the requested object(s) with status **200 OK**.
- **POST** creates a new object (e.g. a user) and returns **201 Created** with the
-  created object.
- **PUT** adds or assigns an existing object (e.g. a user to a team) and returns
-  **204 No Content** with no body.
- **PATCH** edits an existing object and returns the changed object with **200 OK**.
- **DELETE** removes an object and returns **204 No Content** with no body.
-
-### Requirements for API routes
-
- All parameters of endpoints that edit an object must be optional, except those
-  needed to identify the object, which are required.
- Endpoints returning lists must support pagination (`page` and `limit` query
-  options) and set the `X-Total-Count` header via `ctx.SetTotalCountHeader(...)`.
@@ -1,98 +0,0 @@
-# Frontend development guidelines
-
-This document covers frontend-specific architecture and contribution expectations.
-For the general workflow see [CONTRIBUTING.md](../CONTRIBUTING.md), and for building
-and testing see [development.md](development.md) and [testing.md](testing.md).
-
-## Background
-
-The frontend uses [Vue 3](https://vuejs.org/), [Fomantic-UI](https://fomantic-ui.com/) (built on jQuery)
-and [Tailwind CSS](https://tailwindcss.com/). Pages are rendered with Go HTML templates.
-Source files live in:
-
- `web_src/css/`: CSS styles
- `web_src/js/`: JavaScript and TypeScript
- `web_src/js/components/`: Vue components
- `web_src/js/features/`: feature modules wired up at page load
- `templates/`: Go HTML templates
-
-## Dependencies
-
-Frontend dependencies are managed with [pnpm](https://pnpm.io/). The same rules as
-for [backend dependencies](guidelines-backend.md#dependencies) apply, except the
-relevant files are `package.json` and `pnpm-lock.yaml`, and new versions must always
-reference an existing published version.
-
-## Framework usage
-
-Mixing frameworks arbitrarily makes code hard to maintain. Recommended combinations:
-
- Vue3
- Vanilla JavaScript
- Fomantic-UI (jQuery), deprecated, we vendored a specific version with a lot of changes.
-
-Avoid combinations such as Vue with Fomantic-UI.
-Vue components may reuse Fomantic-UI CSS classes for visual consistency.
-Use Go templates for simple or SEO-relevant pages and Vue for complex, interactive pages.
-Gitea uses Vue 3 **without** JSX to keep HTML and JavaScript separate.
-
-> [!NOTE]
-> Fomantic-UI is not an accessibility-friendly framework. Gitea patches some ARIA
-> behavior, but accessibility work is ongoing — prefer semantic HTML and test
-> keyboard/screen-reader behavior where you can.
-
-## Gitea-specific conventions
-
- Keep features in their own files or directories.
- Use kebab-case for HTML `id`s and classes, ideally with 2-3 feature keywords.
- Prefix classes to avoid short-name conflicts between different frameworks.
- Create a new class name when overriding framework styles instead of editing the framework's own classes,
-  or fix the framework's source to fix all cases.
- Prefer semantic elements such as `<button>` over generic `<div>`s.
- Avoid `!important`; when it is unavoidable, document why.
- Prefix custom DOM events with `ce-`.
-
-## CSS
-
-Prefer Tailwind utility classes with the `tw-` prefix, and the `flex-*` layout
-helpers over per-child margins. Gitea also ships a small set of custom helpers:
-`gt-` for general helpers and `g-` for framework-level helpers (see
-`web_src/css/helpers.css`); use these only when a Tailwind utility does not exist.
-
-Write class attributes as a single readable unit in templates:
-
-```html
-<div class="flex-text-inline {{if .IsFoo}}tw-hidden{{end}}"></div>
-```
-
-## TypeScript
-
- Use `import type` for type-only imports.
- Prefer `@ts-expect-error` over `@ts-ignore`.
- Use the `!` non-null assertion (rather than `?.`/`??`) when a value is known to always exist.
- Only mark a function `async` when it actually uses `await` or returns a `Promise`.
-  Avoid async event listeners; if unavoidable, call `e.preventDefault()` before the
-  first `await`. For a deliberately un-awaited call, assign it: `const _promise = asyncFoo()`.
-
-## Data fetching
-
-Use the `GET`, `POST`, `PUT`, `PATCH`, and `DELETE` wrappers from
-[`web_src/js/modules/fetch.ts`](../web_src/js/modules/fetch.ts).
-
-## DOM attributes
-
-Avoid `node.dataset` because of its camel-casing behavior; use `node.getAttribute`
-in new code. Never bind user-provided data directly onto DOM nodes.
-
-## Showing and hiding elements
-
- In Vue, use `v-if` and `v-show`.
- In Go templates and plain JavaScript, use the `.tw-hidden` class together with the
-  `showElem()`, `hideElem()`, and `toggleElem()` helpers from
-  [`web_src/js/utils/dom.ts`](../web_src/js/utils/dom.ts).
-
-## UI component gallery
-
-When running Gitea in development mode, standardized UI components are available at
-`/devtest` (for example `http://localhost:3000/devtest`). These pages are also used
-by the e2e tests.
@@ -1,38 +0,0 @@
-# Refactoring guidelines
-
-This document covers expectations for refactoring work. For the general workflow see
-[CONTRIBUTING.md](../CONTRIBUTING.md).
-
-## Background
-
-Gitea is a large, long-lived project. Over time the codebase has accumulated
-outdated mechanisms, mixed frameworks, and legacy code that can cause bugs or slow
-down new features. Refactoring keeps the codebase maintainable, but it needs to be
-done carefully so it improves things without introducing regressions.
-
-## Writing a refactoring PR
-
- Be forward-looking: address the root cause, not just the immediate symptom.
- Aim to reduce ambiguity and conflicts and to improve maintainability.
- Explain the rationale in the PR description: why the refactor is necessary, how it
-  resolves the legacy problem, and its advantages and disadvantages.
- Keep the scope tight: preserve existing behavior where feasible and avoid bundling
-  unrelated changes.
- Break large refactors into intermediate steps across multiple PRs so each one is
-  easy to review.
- Include tests that verify the behavior stays correct.
- Prefer scheduling non-bugfix refactoring early in a milestone, so any issues
-  surface well before a release.
- If there is disagreement about a refactor, escalate to the Technical Oversight
-  Committee (TOC) for a decision.
-
-## Reviewing and merging
-
- Keep refactoring PRs short-lived (typically no more than 7 days) with quick review
-  cycles, and merge them promptly so they do not block on unrelated work.
- A non-author core member may approve and merge a refactoring PR after 7 days if the
-  TOC has raised no objection.
- Accept imperfect intermediate implementations as long as the final result improves
-  the codebase.
- A temporary regression caused by a necessary refactor is acceptable if it is fixed
-  promptly afterwards.
@@ -1,151 +0,0 @@
-# Testing
-
-Gitea has four kinds of automated tests: backend unit tests, integration tests,
-end-to-end (e2e) tests, and migration tests. Local runs default to SQLite, so no
-extra services are required to get started.
-
-For prerequisites see [build-setup.md](build-setup.md); for the build workflow see
-[development.md](development.md).
-
-## Unit tests
-
-Backend unit tests live in `*_test.go` files next to the code they cover. Set
-`GITEA_TEST_LOG_SQL=1` to log all SQL statements executed during the tests.
-
-```bash
-make test-backend
-```
-
-To run a single backend test, use `go test` directly or the `#` selector:
-
-```bash
-go test -run '^TestName$' ./modulepath/
-make test-backend#TestName
-```
-
-Frontend unit tests run with [Vitest](https://vitest.dev/):
-
-```bash
-make test-frontend
-# single file:
-pnpm exec vitest <path-filter>
-```
-
-## Integration tests
-
-Integration tests exercise Gitea against a real database. They live in
-`tests/integration/` and require [Git LFS](https://git-lfs.com/) to be installed.
-The database is selected with `GITEA_TEST_DATABASE`; an empty value defaults to
-SQLite, which needs no external service:
-
-```bash
-make test-integration
-```
-
-Run a single integration test with the `#` selector:
-
-```bash
-make test-integration#TestName
-```
-
-If you hit errors such as a mismatched database version or SSH push failures, try a
-clean rebuild first:
-
-```bash
-make clean build
-```
-
-### Running against other databases
-
-Set `GITEA_TEST_DATABASE` together with the matching `TEST_*` connection variables.
-The commands below start a throwaway database container (press `Ctrl-C` to stop and
-remove it) and then run the tests against it.
-
-#### MySQL
-
-```bash
-docker run -e "MYSQL_DATABASE=test" -e "MYSQL_ALLOW_EMPTY_PASSWORD=yes" -p 3306:3306 --rm --name mysql mysql:latest
-```
-
-```bash
-GITEA_TEST_DATABASE=mysql TEST_MYSQL_HOST=localhost:3306 TEST_MYSQL_DBNAME=test TEST_MYSQL_USERNAME=root TEST_MYSQL_PASSWORD='' make test-integration
-```
-
-#### PostgreSQL
-
-PostgreSQL tests also use a MinIO container for object storage:
-
-```bash
-docker run -e "POSTGRES_DB=test" -e "POSTGRES_USER=postgres" -e "POSTGRES_PASSWORD=postgres" -p 5432:5432 --rm --name pgsql postgres:latest
-docker run --rm -p 9000:9000 -e MINIO_ROOT_USER=123456 -e MINIO_ROOT_PASSWORD=12345678 --name minio bitnamilegacy/minio:2023.8.31
-```
-
-```bash
-GITEA_TEST_DATABASE=pgsql TEST_MINIO_ENDPOINT=localhost:9000 TEST_PGSQL_HOST=localhost:5432 TEST_PGSQL_DBNAME=postgres TEST_PGSQL_USERNAME=postgres TEST_PGSQL_PASSWORD=postgres make test-integration
-```
-
-#### MSSQL
-
-```bash
-docker run -e "ACCEPT_EULA=Y" -e "MSSQL_PID=Standard" -e "SA_PASSWORD=MwantsaSecurePassword1" -p 1433:1433 --rm --name mssql microsoft/mssql-server-linux:latest
-```
-
-```bash
-GITEA_TEST_DATABASE=mssql TEST_MSSQL_HOST=localhost:1433 TEST_MSSQL_DBNAME=gitea_test TEST_MSSQL_USERNAME=sa TEST_MSSQL_PASSWORD=MwantsaSecurePassword1 make test-integration
-```
-
-### Running the database test workflow with Gitea Runner
-
-The CI database test jobs can be run locally with
-[Gitea Runner](https://gitea.com/gitea/runner). Running every job is
-resource-intensive and not recommended:
-
-```bash
-gitea-runner exec -W ./.github/workflows/pull-db-tests.yml --event=pull_request --default-actions-url="https://github.com" -i catthehacker/ubuntu:runner-latest
-```
-
-List the available job names, then run a single one:
-
-```bash
-gitea-runner exec -W ./.github/workflows/pull-db-tests.yml --event=pull_request --default-actions-url="https://github.com" -i catthehacker/ubuntu:runner-latest -l
-gitea-runner exec -W ./.github/workflows/pull-db-tests.yml --event=pull_request --default-actions-url="https://github.com" -i catthehacker/ubuntu:runner-latest -j <job_name>
-```
-
-## End-to-end tests
-
-End-to-end tests drive a running Gitea instance with [Playwright](https://playwright.dev/):
-
-```bash
-make test-e2e
-```
-
-To run a single e2e test file, pass it via `GITEA_TEST_E2E_FLAGS`:
-
-```bash
-GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e
-```
-
-Useful environment variables:
-
-| Variable | Description |
-| :--- | :--- |
-| `GITEA_TEST_E2E_DEBUG` | When set, show the Gitea server output. |
-| `GITEA_TEST_E2E_FLAGS` | Additional flags passed to Playwright, e.g. `--ui`. |
-| `GITEA_TEST_E2E_TIMEOUT_FACTOR` | Timeout multiplier (default: 4 on CI, 1 locally). |
-
-## Migration tests
-
-If you change a database-persisted struct under `models/` you will usually need a
-new migration in `models/migrations/`. Run the migration tests with:
-
-```bash
-make test-migration
-```
-
-## Continuous integration
-
-CI runs the unit tests, runs the integration tests against every supported database,
-and tests migration from several recent Gitea versions. Please submit your pull
-request with additional unit and integration tests as appropriate. Prefer unit tests
-when the logic can be tested in isolation, and keep local integration and e2e tests
-fast (aim for sub-2s runtime).
@@ -1,6 +1,7 @@
 import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
 import deMorgan from 'eslint-plugin-de-morgan';
+import github from 'eslint-plugin-github';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
@@ -71,6 +72,7 @@ export default defineConfig([
      regexp,
      sonarjs,
      unicorn,
+      github,
      wc,
    },
    settings: {
@@ -84,6 +86,7 @@ export default defineConfig([
      '@eslint-community/eslint-comments/no-duplicate-disable': [2],
      '@eslint-community/eslint-comments/no-restricted-disable': [0],
      '@eslint-community/eslint-comments/no-unlimited-disable': [2],
+      '@eslint-community/eslint-comments/no-unused-disable': [2],
      '@eslint-community/eslint-comments/no-unused-enable': [2],
      '@eslint-community/eslint-comments/no-use': [0],
      '@eslint-community/eslint-comments/require-description': [0],
@@ -190,6 +193,7 @@ export default defineConfig([
      '@typescript-eslint/no-duplicate-type-constituents': [2, {ignoreUnions: true}],
      '@typescript-eslint/no-dynamic-delete': [0],
      '@typescript-eslint/no-empty-function': [0],
+      '@typescript-eslint/no-empty-interface': [0],
      '@typescript-eslint/no-empty-object-type': [2],
      '@typescript-eslint/no-explicit-any': [0],
      '@typescript-eslint/no-extra-non-null-assertion': [2],
@@ -202,6 +206,7 @@ export default defineConfig([
      '@typescript-eslint/no-invalid-this': [0],
      '@typescript-eslint/no-invalid-void-type': [0],
      '@typescript-eslint/no-loop-func': [0],
+      '@typescript-eslint/no-loss-of-precision': [0],
      '@typescript-eslint/no-magic-numbers': [0],
      '@typescript-eslint/no-meaningless-void-operator': [0],
      '@typescript-eslint/no-misused-new': [2],
@@ -230,7 +235,7 @@ export default defineConfig([
      '@typescript-eslint/no-unsafe-assignment': [0],
      '@typescript-eslint/no-unsafe-call': [0],
      '@typescript-eslint/no-unsafe-declaration-merging': [2],
-      '@typescript-eslint/no-unsafe-enum-comparison': [0],
+      '@typescript-eslint/no-unsafe-enum-comparison': [2],
      '@typescript-eslint/no-unsafe-function-type': [2],
      '@typescript-eslint/no-unsafe-member-access': [0],
      '@typescript-eslint/no-unsafe-return': [0],
@@ -274,6 +279,7 @@ export default defineConfig([
      '@typescript-eslint/strict-void-return': [0],
      '@typescript-eslint/switch-exhaustiveness-check': [0],
      '@typescript-eslint/triple-slash-reference': [2],
+      '@typescript-eslint/typedef': [0],
      '@typescript-eslint/unbound-method': [0], // too many false-positives
      '@typescript-eslint/unified-signatures': [2],
      'accessor-pairs': [2],
@@ -306,9 +312,32 @@ export default defineConfig([
      'func-names': [0],
      'func-style': [0],
      'getter-return': [2],
+      'github/a11y-aria-label-is-well-formatted': [0],
+      'github/a11y-no-title-attribute': [0],
+      'github/a11y-no-visually-hidden-interactive-element': [0],
+      'github/a11y-role-supports-aria-props': [0],
+      'github/a11y-svg-has-accessible-name': [0],
+      'github/array-foreach': [0],
+      'github/async-currenttarget': [2],
+      'github/async-preventdefault': [0], // https://github.com/github/eslint-plugin-github/issues/599
+      'github/authenticity-token': [0],
+      'github/get-attribute': [0],
+      'github/js-class-name': [0],
+      'github/no-blur': [0],
+      'github/no-d-none': [0],
+      'github/no-dataset': [2],
+      'github/no-dynamic-script-tag': [2],
+      'github/no-implicit-buggy-globals': [2],
+      'github/no-inner-html': [0],
+      'github/no-innerText': [2],
+      'github/no-then': [2],
+      'github/no-useless-passive': [2],
+      'github/prefer-observers': [0],
+      'github/require-passive-events': [2],
+      'gitea/unescaped-html-literal': [2],
      'grouped-accessor-pairs': [2],
      'guard-for-in': [0],
-      'id-denylist': [0],
+      'id-blacklist': [0],
      'id-length': [0],
      'id-match': [0],
      'import-x/consistent-type-specifier-style': [0],
@@ -355,6 +384,7 @@ export default defineConfig([
      'import-x/prefer-default-export': [0],
      'import-x/unambiguous': [0],
      'init-declarations': [0],
+      'line-comment-position': [0],
      'logical-assignment-operators': [0],
      'max-classes-per-file': [0],
      'max-depth': [0],
@@ -363,12 +393,14 @@ export default defineConfig([
      'max-nested-callbacks': [0],
      'max-params': [0],
      'max-statements': [0],
+      'multiline-comment-style': [0],
      'new-cap': [0],
      'no-alert': [0],
      'no-array-constructor': [0], // handled by @typescript-eslint/no-array-constructor
      'no-async-promise-executor': [0],
      'no-await-in-loop': [0],
      'no-bitwise': [0],
+      'no-buffer-constructor': [0],
      'no-caller': [2],
      'no-case-declarations': [2],
      'no-class-assign': [2],
@@ -525,11 +557,12 @@ export default defineConfig([
      'no-nested-ternary': [0],
      'no-new-func': [0], // handled by @typescript-eslint/no-implied-eval
      'no-new-native-nonconstructor': [2],
+      'no-new-object': [2],
+      'no-new-symbol': [0], // handled by no-new-native-nonconstructor
      'no-new-wrappers': [2],
      'no-new': [0],
      'no-nonoctal-decimal-escape': [2],
      'no-obj-calls': [2],
-      'no-object-constructor': [2],
      'no-octal-escape': [2],
      'no-octal': [2],
      'no-param-reassign': [0],
@@ -589,8 +622,10 @@ export default defineConfig([
      'no-warning-comments': [0],
      'no-with': [0], // handled by no-restricted-syntax
      'object-shorthand': [2, 'always'],
+      'one-var-declaration-per-line': [0],
      'one-var': [0],
      'operator-assignment': [2, 'always'],
+      'operator-linebreak': [0], // handled by @stylistic/operator-linebreak
      'prefer-arrow-callback': [2, {allowNamedFunctions: true, allowUnboundThis: true}],
      'prefer-const': [2, {destructuring: 'all', ignoreReadBeforeAssign: true}],
      'prefer-destructuring': [0],
@@ -726,309 +761,139 @@ export default defineConfig([
      'strict': [0],
      'symbol-description': [2],
      'unicode-bom': [2, 'never'],
-      'unicorn/better-dom-traversing': [2],
+      'unicorn/better-regex': [0],
      'unicorn/catch-error-name': [0],
-      'unicorn/class-reference-in-static-methods': [2],
-      'unicorn/comment-content': [0],
-      'unicorn/consistent-assert': [0],
-      'unicorn/consistent-boolean-name': [0],
-      'unicorn/consistent-class-member-order': [0],
-      'unicorn/consistent-compound-words': [0], // too opinionated
-      'unicorn/consistent-conditional-object-spread': [2],
-      'unicorn/consistent-date-clone': [2],
      'unicorn/consistent-destructuring': [2],
      'unicorn/consistent-empty-array-spread': [2],
-      'unicorn/consistent-existence-index-check': [0],
-      'unicorn/consistent-export-decorator-position': [2],
-      'unicorn/consistent-function-scoping': [0],
-      'unicorn/consistent-function-style': [2],
-      'unicorn/consistent-json-file-read': [2],
-      'unicorn/consistent-optional-chaining': [2],
      'unicorn/consistent-template-literal-escape': [2],
+      'unicorn/consistent-existence-index-check': [0],
+      'unicorn/consistent-function-scoping': [0],
      'unicorn/custom-error-definition': [0],
-      'unicorn/default-export-style': [2],
-      'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
      'unicorn/empty-brace-spaces': [2],
      'unicorn/error-message': [0],
      'unicorn/escape-case': [0],
      'unicorn/expiring-todo-comments': [0],
      'unicorn/explicit-length-check': [0],
-      'unicorn/explicit-timer-delay': [2],
      'unicorn/filename-case': [0],
-      'unicorn/id-match': [2],
+      'unicorn/import-index': [0],
      'unicorn/import-style': [0],
      'unicorn/isolated-functions': [2, {functions: []}],
-      'unicorn/logical-assignment-operators': [0],
-      'unicorn/max-nested-calls': [0],
-      'unicorn/name-replacements': [0],
      'unicorn/new-for-builtins': [2],
      'unicorn/no-abusive-eslint-disable': [0],
-      'unicorn/no-accessor-recursion': [2],
-      'unicorn/no-accidental-bitwise-operator': [2],
      'unicorn/no-anonymous-default-export': [0],
      'unicorn/no-array-callback-reference': [0],
-      'unicorn/no-array-concat-in-loop': [2],
-      'unicorn/no-array-fill-with-reference-type': [2],
-      'unicorn/no-array-from-fill': [2],
-      'unicorn/no-array-front-mutation': [0],
+      'unicorn/no-array-for-each': [2],
      'unicorn/no-array-method-this-argument': [2],
+      'unicorn/no-array-push-push': [2],
      'unicorn/no-array-reduce': [2],
-      'unicorn/no-array-reverse': [0],
-      'unicorn/no-array-sort': [0],
-      'unicorn/no-array-sort-for-min-max': [2],
-      'unicorn/no-array-splice': [0],
-      'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
      'unicorn/no-await-expression-member': [0],
      'unicorn/no-await-in-promise-methods': [2],
-      'unicorn/no-blob-to-file': [2],
-      'unicorn/no-boolean-sort-comparator': [2],
-      'unicorn/no-break-in-nested-loop': [0],
-      'unicorn/no-canvas-to-image': [2],
-      'unicorn/no-chained-comparison': [2],
-      'unicorn/no-collection-bracket-access': [2],
-      'unicorn/no-computed-property-existence-check': [0],
-      'unicorn/no-confusing-array-splice': [2],
-      'unicorn/no-confusing-array-with': [2],
      'unicorn/no-console-spaces': [0],
-      'unicorn/no-constant-zero-expression': [2],
-      'unicorn/no-declarations-before-early-exit': [0],
      'unicorn/no-document-cookie': [2],
-      'unicorn/no-double-comparison': [2],
-      'unicorn/no-duplicate-if-branches': [2],
-      'unicorn/no-duplicate-logical-operands': [2],
-      'unicorn/no-duplicate-loops': [0],
-      'unicorn/no-duplicate-set-values': [2],
      'unicorn/no-empty-file': [2],
-      'unicorn/no-error-property-assignment': [2],
-      'unicorn/no-exports-in-scripts': [2],
-      'unicorn/no-for-each': [2],
      'unicorn/no-for-loop': [0],
-      'unicorn/no-global-object-property-assignment': [0],
+      'unicorn/no-hex-escape': [0],
      'unicorn/no-immediate-mutation': [0],
-      'unicorn/no-impossible-length-comparison': [2],
-      'unicorn/no-incorrect-query-selector': [2],
-      'unicorn/no-incorrect-template-string-interpolation': [0],
-      'unicorn/no-instanceof-builtins': [2],
-      'unicorn/no-invalid-argument-count': [0],
-      'unicorn/no-invalid-character-comparison': [2],
+      'unicorn/no-instanceof-array': [0],
      'unicorn/no-invalid-fetch-options': [2],
-      'unicorn/no-invalid-file-input-accept': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
      'unicorn/no-keyword-prefix': [0],
-      'unicorn/no-late-current-target-access': [2],
+      'unicorn/no-length-as-slice-end': [2],
      'unicorn/no-lonely-if': [2],
-      'unicorn/no-loop-iterable-mutation': [2],
      'unicorn/no-magic-array-flat-depth': [0],
-      'unicorn/no-manually-wrapped-comments': [0], // too opinionated
-      'unicorn/no-mismatched-map-key': [2],
-      'unicorn/no-misrefactored-assignment': [2],
-      'unicorn/no-named-default': [2],
-      'unicorn/no-negated-array-predicate': [2],
-      'unicorn/no-negated-comparison': [2],
      'unicorn/no-negated-condition': [0],
      'unicorn/no-negation-in-equality-check': [2],
      'unicorn/no-nested-ternary': [0],
      'unicorn/no-new-array': [0],
      'unicorn/no-new-buffer': [0],
-      'unicorn/no-non-function-verb-prefix': [0],
-      'unicorn/no-nonstandard-builtin-properties': [2],
      'unicorn/no-null': [0],
      'unicorn/no-object-as-default-parameter': [0],
-      'unicorn/no-object-methods-with-collections': [2],
-      'unicorn/no-optional-chaining-on-undeclared-variable': [2],
      'unicorn/no-process-exit': [0],
-      'unicorn/no-redundant-comparison': [2],
-      'unicorn/no-return-array-push': [2],
-      'unicorn/no-selector-as-dom-name': [2],
      'unicorn/no-single-promise-in-promise-methods': [2],
      'unicorn/no-static-only-class': [2],
-      'unicorn/no-subtraction-comparison': [2],
      'unicorn/no-thenable': [2],
      'unicorn/no-this-assignment': [2],
-      'unicorn/no-this-outside-of-class': [0], // gitea uses `this` in non-class functions
-      'unicorn/no-top-level-assignment-in-function': [0],
-      'unicorn/no-top-level-side-effects': [0],
      'unicorn/no-typeof-undefined': [2],
-      'unicorn/no-uncalled-method': [2],
-      'unicorn/no-undeclared-class-members': [2],
-      'unicorn/no-unnecessary-array-flat-depth': [2],
-      'unicorn/no-unnecessary-array-splice-count': [2],
      'unicorn/no-unnecessary-await': [2],
-      'unicorn/no-unnecessary-boolean-comparison': [2],
-      'unicorn/no-unnecessary-global-this': [0],
-      'unicorn/no-unnecessary-nested-ternary': [2],
      'unicorn/no-unnecessary-polyfills': [2],
-      'unicorn/no-unnecessary-slice-end': [2],
-      'unicorn/no-unnecessary-splice': [2],
      'unicorn/no-unreadable-array-destructuring': [0],
-      'unicorn/no-unreadable-for-of-expression': [0],
      'unicorn/no-unreadable-iife': [0],
-      'unicorn/no-unreadable-new-expression': [0],
-      'unicorn/no-unreadable-object-destructuring': [0],
-      'unicorn/no-unsafe-buffer-conversion': [2],
-      'unicorn/no-unsafe-dom-html': [0],
-      'unicorn/no-unsafe-property-key': [0],
-      'unicorn/no-unsafe-string-replacement': [0],
-      'unicorn/no-unused-array-method-return': [2],
      'unicorn/no-unused-properties': [2],
-      'unicorn/no-useless-boolean-cast': [2],
-      'unicorn/no-useless-coercion': [2],
      'unicorn/no-useless-collection-argument': [2],
-      'unicorn/no-useless-compound-assignment': [2],
-      'unicorn/no-useless-concat': [2],
-      'unicorn/no-useless-continue': [2],
-      'unicorn/no-useless-delete-check': [2],
-      'unicorn/no-useless-else': [0],
-      'unicorn/no-useless-error-capture-stack-trace': [2],
      'unicorn/no-useless-fallback-in-spread': [2],
      'unicorn/no-useless-iterator-to-array': [2],
      'unicorn/no-useless-length-check': [2],
-      'unicorn/no-useless-logical-operand': [2],
-      'unicorn/no-useless-override': [2],
      'unicorn/no-useless-promise-resolve-reject': [2],
-      'unicorn/no-useless-recursion': [0],
      'unicorn/no-useless-spread': [2],
      'unicorn/no-useless-switch-case': [2],
-      'unicorn/no-useless-template-literals': [2],
      'unicorn/no-useless-undefined': [0],
-      'unicorn/no-xor-as-exponentiation': [2],
      'unicorn/no-zero-fractions': [2],
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
-      'unicorn/operator-assignment': [2],
      'unicorn/prefer-add-event-listener': [2],
-      'unicorn/prefer-add-event-listener-options': [2],
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
-      'unicorn/prefer-array-from-async': [2],
-      'unicorn/prefer-array-from-map': [2],
      'unicorn/prefer-array-index-of': [2],
-      'unicorn/prefer-array-iterable-methods': [2],
-      'unicorn/prefer-array-last-methods': [2],
-      'unicorn/prefer-array-slice': [2],
      'unicorn/prefer-array-some': [2],
      'unicorn/prefer-at': [0],
-      'unicorn/prefer-await': [2],
-      'unicorn/prefer-bigint-literals': [2],
      'unicorn/prefer-blob-reading-methods': [2],
-      'unicorn/prefer-boolean-return': [2],
-      'unicorn/prefer-class-fields': [2],
-      'unicorn/prefer-classlist-toggle': [2],
      'unicorn/prefer-code-point': [0],
-      'unicorn/prefer-continue': [0],
      'unicorn/prefer-date-now': [2],
      'unicorn/prefer-default-parameters': [0],
-      'unicorn/prefer-direct-iteration': [2],
-      'unicorn/prefer-dispose': [2],
      'unicorn/prefer-dom-node-append': [2],
-      'unicorn/prefer-dom-node-html-methods': [0],
+      'unicorn/prefer-dom-node-dataset': [0],
      'unicorn/prefer-dom-node-remove': [2],
      'unicorn/prefer-dom-node-text-content': [2],
-      'unicorn/prefer-early-return': [0],
-      'unicorn/prefer-else-if': [2],
      'unicorn/prefer-event-target': [2],
      'unicorn/prefer-export-from': [0],
-      'unicorn/prefer-flat-math-min-max': [2],
-      'unicorn/prefer-get-or-insert-computed': [2],
-      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
-      'unicorn/prefer-has-check': [2],
-      'unicorn/prefer-hoisting-branch-code': [2],
-      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
-      'unicorn/prefer-identifier-import-export-specifiers': [2],
-      'unicorn/prefer-import-meta-properties': [2],
      'unicorn/prefer-includes': [0], // handled by @typescript-eslint/prefer-includes
-      'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
-      'unicorn/prefer-iterable-in-constructor': [2],
-      'unicorn/prefer-iterator-concat': [0], // too opinionated
-      'unicorn/prefer-iterator-to-array': [2],
-      'unicorn/prefer-iterator-to-array-at-end': [2],
+      'unicorn/prefer-json-parse-buffer': [0],
      'unicorn/prefer-keyboard-event-key': [2],
-      'unicorn/prefer-location-assign': [2],
      'unicorn/prefer-logical-operator-over-ternary': [2],
-      'unicorn/prefer-map-from-entries': [0],
-      'unicorn/prefer-math-abs': [2],
-      'unicorn/prefer-math-constants': [2],
      'unicorn/prefer-math-min-max': [2],
      'unicorn/prefer-math-trunc': [2],
-      'unicorn/prefer-minimal-ternary': [0],
      'unicorn/prefer-modern-dom-apis': [0],
      'unicorn/prefer-modern-math-apis': [2],
      'unicorn/prefer-module': [2],
      'unicorn/prefer-native-coercion-functions': [2],
      'unicorn/prefer-negative-index': [2],
      'unicorn/prefer-node-protocol': [2],
-      'unicorn/prefer-number-coercion': [0],
-      'unicorn/prefer-number-is-safe-integer': [0],
      'unicorn/prefer-number-properties': [0],
-      'unicorn/prefer-object-define-properties': [2],
-      'unicorn/prefer-object-destructuring-defaults': [2],
      'unicorn/prefer-object-from-entries': [2],
-      'unicorn/prefer-object-iterable-methods': [2],
+      'unicorn/prefer-object-has-own': [0],
      'unicorn/prefer-optional-catch-binding': [2],
-      'unicorn/prefer-path2d': [2],
-      'unicorn/prefer-private-class-fields': [0],
-      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [0],
      'unicorn/prefer-query-selector': [2],
-      'unicorn/prefer-queue-microtask': [2],
      'unicorn/prefer-reflect-apply': [0],
-      'unicorn/prefer-regexp-escape': [0],
      'unicorn/prefer-regexp-test': [2],
      'unicorn/prefer-response-static-json': [2],
-      'unicorn/prefer-scoped-selector': [0],
      'unicorn/prefer-set-has': [0],
      'unicorn/prefer-set-size': [2],
-      'unicorn/prefer-short-arrow-method': [2],
      'unicorn/prefer-simple-condition-first': [0],
-      'unicorn/prefer-simple-sort-comparator': [2],
-      'unicorn/prefer-single-array-predicate': [2],
-      'unicorn/prefer-single-call': [2],
-      'unicorn/prefer-single-object-destructuring': [2],
-      'unicorn/prefer-single-replace': [2],
-      'unicorn/prefer-smaller-scope': [2],
-      'unicorn/prefer-split-limit': [0], // too opinionated
      'unicorn/prefer-spread': [0],
-      'unicorn/prefer-string-match-all': [2],
-      'unicorn/prefer-string-pad-start-end': [2],
      'unicorn/prefer-string-raw': [0],
-      'unicorn/prefer-string-repeat': [2],
      'unicorn/prefer-string-replace-all': [0],
      'unicorn/prefer-string-slice': [0],
      'unicorn/prefer-string-starts-ends-with': [0], // handled by @typescript-eslint/prefer-string-starts-ends-with
      'unicorn/prefer-string-trim-start-end': [2],
      'unicorn/prefer-structured-clone': [2],
      'unicorn/prefer-switch': [0],
-      'unicorn/prefer-temporal': [0],
      'unicorn/prefer-ternary': [0],
      'unicorn/prefer-top-level-await': [0],
      'unicorn/prefer-type-error': [0],
-      'unicorn/prefer-type-literal-last': [0],
-      'unicorn/prefer-uint8array-base64': [0],
-      'unicorn/prefer-unary-minus': [2],
-      'unicorn/prefer-unicode-code-point-escapes': [0],
-      'unicorn/prefer-url-can-parse': [2],
-      'unicorn/prefer-url-href': [2],
-      'unicorn/prefer-while-loop-condition': [2],
      'unicorn/prevent-abbreviations': [0],
      'unicorn/relative-url-style': [2],
      'unicorn/require-array-join-separator': [2],
-      'unicorn/require-array-sort-compare': [0],
-      'unicorn/require-css-escape': [2],
-      'unicorn/require-module-attributes': [2],
-      'unicorn/require-module-specifiers': [0],
      'unicorn/require-number-to-fixed-digits-argument': [2],
-      'unicorn/require-passive-events': [2],
      'unicorn/require-post-message-target-origin': [0],
-      'unicorn/require-proxy-trap-boolean-return': [2],
      'unicorn/string-content': [0],
      'unicorn/switch-case-braces': [0],
      'unicorn/switch-case-break-position': [2],
      'unicorn/template-indent': [2],
      'unicorn/text-encoding-identifier-case': [0],
      'unicorn/throw-new-error': [2],
-      'unicorn/try-complexity': [0],
      'use-isnan': [2],
      'valid-typeof': [2, {requireStringLiterals: true}],
      'vars-on-top': [0],
@@ -1091,7 +956,6 @@ export default defineConfig([
    languageOptions: {globals: globals.vitest},
    rules: {
      'gitea/unescaped-html-literal': [0],
-      'unicorn/no-error-property-assignment': [0],
      'vitest/consistent-test-filename': [0],
      'vitest/consistent-test-it': [0],
      'vitest/expect-expect': [0],
@@ -1103,6 +967,7 @@ export default defineConfig([
      'vitest/no-conditional-in-test': [0],
      'vitest/no-conditional-tests': [0],
      'vitest/no-disabled-tests': [0],
+      'vitest/no-done-callback': [0],
      'vitest/no-duplicate-hooks': [0],
      'vitest/no-focused-tests': [2],
      'vitest/no-hooks': [0],
@@ -23,17 +23,17 @@ require (
 	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
-	github.com/alecthomas/chroma/v2 v2.27.0
+	github.com/alecthomas/chroma/v2 v2.26.1
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
 	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
 	github.com/buildkite/terminal-to-html/v3 v3.16.8
-	github.com/caddyserver/certmagic v0.25.4
+	github.com/caddyserver/certmagic v0.25.3
 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635
 	github.com/chi-middleware/proxy v1.1.1
-	github.com/dlclark/regexp2/v2 v2.2.2
+	github.com/dlclark/regexp2/v2 v2.2.1
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.0.1
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.4
@@ -73,7 +73,7 @@ require (
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.22
-	github.com/mattn/go-sqlite3 v1.14.47
+	github.com/mattn/go-sqlite3 v1.14.45
 	github.com/meilisearch/meilisearch-go v0.36.3
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
@@ -86,8 +86,7 @@ require (
 	github.com/pquerna/otp v1.5.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.21.0
-	github.com/rhysd/actionlint v1.7.12
+	github.com/redis/go-redis/v9 v9.20.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/sassoftware/go-rpmutils v0.4.0
@@ -97,15 +96,15 @@ require (
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.0
+	github.com/urfave/cli/v3 v3.9.1
 	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.42.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.38.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
 	golang.org/x/crypto v0.53.0
-	golang.org/x/image v0.43.0
+	golang.org/x/image v0.42.0
 	golang.org/x/mod v0.37.0
 	golang.org/x/net v0.56.0
 	golang.org/x/oauth2 v0.36.0
@@ -115,7 +114,7 @@ require (
 	google.golang.org/grpc v1.81.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
-	modernc.org/sqlite v1.53.0
+	modernc.org/sqlite v1.52.0
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
@@ -245,6 +244,7 @@ require (
 	github.com/prometheus/common v0.68.1 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rhysd/actionlint v1.7.12 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
@@ -273,7 +273,7 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.73.4 // indirect
+	modernc.org/libc v1.73.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )
@@ -76,8 +76,8 @@ github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:I28hc9eaiqK
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
-github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
+github.com/alecthomas/chroma/v2 v2.26.1 h1:2X21EdxGZNv5GF9mG5u+uzc02GCFyGxbcBm3Grd9A78=
+github.com/alecthomas/chroma/v2 v2.26.1/go.mod h1:lxhRRa9H4hPmRLOOdYga4zkQIQjq3dtrrdwQeCfu78Y=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
@@ -187,8 +187,8 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/buildkite/terminal-to-html/v3 v3.16.8 h1:QN/daUob6cmK8GcdKnwn9+YTlPr1vNj+oeAIiJK6fPc=
 github.com/buildkite/terminal-to-html/v3 v3.16.8/go.mod h1:+k1KVKROZocrTLsEQ9PEf9A+8+X8uaVV5iO1ZIOwKYM=
-github.com/caddyserver/certmagic v0.25.4 h1:8eIXh0HC3MsGnNo8One+BCxMGTbe5zb/oz+2KsxBFQg=
-github.com/caddyserver/certmagic v0.25.4/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
+github.com/caddyserver/certmagic v0.25.3 h1:mGf5ba8F7xA4c5jfDZZbK2buY1VEkbnwpMDixaju94A=
+github.com/caddyserver/certmagic v0.25.3/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
 github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
 github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
@@ -240,8 +240,8 @@ github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55k
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2/v2 v2.2.2 h1:MYWvNYw8okuqNhwTYO587EZMiDruVa2vhV6fsGpfya0=
-github.com/dlclark/regexp2/v2 v2.2.2/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dlclark/regexp2/v2 v2.2.1 h1:mf4KkFUj0gJuarK8P+LgiS+Lit7m9N1yAwEfPbee7R0=
+github.com/dlclark/regexp2/v2 v2.2.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
@@ -514,8 +514,8 @@ github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/a
 github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.13 h1:DC0OMEpGjm6LfNFU4ckYcvbQKyp2vE8atyFGXNtDcf4=
 github.com/mattn/go-shellwords v1.0.13/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.47 h1:jOBI62gS7nKeZv+as1oGEy0+1qISgXwH/QBlR6KbfIo=
-github.com/mattn/go-sqlite3 v1.14.47/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
+github.com/mattn/go-sqlite3 v1.14.45 h1:6KA/spDguL3KV8rnybG7ezSaE4SeMR3KC9VbUoAQaIk=
+github.com/mattn/go-sqlite3 v1.14.45/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/meilisearch/meilisearch-go v0.36.3 h1:Yx1aTY5jDgtbStPVkhJTDoLnZTy5sejQSPyjfNMy6e4=
 github.com/meilisearch/meilisearch-go v0.36.3/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
 github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
@@ -618,8 +618,8 @@ github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4Ul
 github.com/quasoft/websspi v1.1.2 h1:/mA4w0LxWlE3novvsoEL6BBA1WnjJATbjkh1kFrTidw=
 github.com/quasoft/websspi v1.1.2/go.mod h1:HmVdl939dQ0WIXZhyik+ARdI03M6bQzaSEKcgpFmewk=
 github.com/rcrowley/go-metrics v0.0.0-20190826022208-cac0b30c2563/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=
-github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
+github.com/redis/go-redis/v9 v9.20.0 h1:WnQYxLkgO2xiXTCJY0ldIiI8dNqCDlQAG+AtaH7a2a0=
+github.com/redis/go-redis/v9 v9.20.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
 github.com/redis/rueidis v1.0.71 h1:pODtnAR5GAB7j4ekhldZ29HKOxe4Hph0GTDGk1ayEQY=
 github.com/redis/rueidis v1.0.71/go.mod h1:lfdcZzJ1oKGKL37vh9fO3ymwt+0TdjkkUCJxbgpmcgQ=
 github.com/redis/rueidis/rueidiscompat v1.0.71 h1:wNZ//kEjMZgBM0KCk7ncOX8KmAgROU2kDdDNpwheG4w=
@@ -709,8 +709,8 @@ github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
-github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.9.1 h1:OLU13atWZ0M+a4xmyBuBNOLZsSRYXyPeMeNjOvgYP54=
+github.com/urfave/cli/v3 v3.9.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
 github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
@@ -740,8 +740,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0 h1:Bq5YIYgUJVbt4Hbh7ibBwNR4SNEafsyDVhIXl7dXDdg=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
+gitlab.com/gitlab-org/api/client-go/v2 v2.38.0 h1:gZSMTTnLcUeY5mH4z3G6GEzbaBTOCUfBCAJXMRyuzEM=
+gitlab.com/gitlab-org/api/client-go/v2 v2.38.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -780,8 +780,8 @@ golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
 golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
-golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
-golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/image v0.42.0 h1:1gSs6ehNWXLbkHBIPcWztk3D/6aIA/8hauiAYtlodVY=
+golang.org/x/image v0.42.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -940,8 +940,8 @@ modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
 modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA=
-modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
+modernc.org/libc v1.73.0 h1:Y/KmTxbIN5T3x+NFjYOzV/+Ha7wKClfIecmTCTuYlqQ=
+modernc.org/libc v1.73.0/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -950,8 +950,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
-modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
+modernc.org/sqlite v1.52.0 h1:p4dhYh2tXZCiyaqHwRVJDjIGKWyXayiQpThxgDzJaxo=
+modernc.org/sqlite v1.52.0/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -9,10 +9,10 @@ package actions
 import (
 	"context"
 	"errors"
-	"slices"
 	"time"

 	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"

@@ -147,7 +147,7 @@ type FindArtifactsOptions struct {
 	db.ListOptions
 	RepoID               int64
 	RunID                int64
-	RunAttemptIDs        []int64 // empty means every attempt; pass 0 to target legacy artifacts, which have run_attempt_id=0
+	RunAttemptID         optional.Option[int64] // use optional to allow filtering by zero (legacy artifacts have run_attempt_id=0)
 	ArtifactName         string
 	Status               int
 	FinalizedArtifactsV4 bool
@@ -167,8 +167,8 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	if opts.RunID > 0 {
 		cond = cond.And(builder.Eq{"run_id": opts.RunID})
 	}
-	if len(opts.RunAttemptIDs) > 0 {
-		cond = cond.And(builder.In("run_attempt_id", opts.RunAttemptIDs))
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"run_attempt_id": opts.RunAttemptID.Value()})
 	}
 	if opts.ArtifactName != "" {
 		cond = cond.And(builder.Eq{"artifact_name": opts.ArtifactName})
@@ -185,27 +185,6 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	return cond
 }

-// FindReadableArtifacts returns the artifacts of opts.RunAttemptIDs, only keeps the ones from a newer attempt.
-func FindReadableArtifacts(ctx context.Context, opts FindArtifactsOptions) ([]*ActionArtifact, error) {
-	arts, err := db.Find[ActionArtifact](ctx, opts)
-	if err != nil || len(opts.RunAttemptIDs) <= 1 {
-		return arts, err
-	}
-	return keepLatestAttemptArtifacts(arts), nil
-}
-
-// keepLatestAttemptArtifacts keeps, per name, only the artifacts of the newest attempt that has it.
-// A v3 artifact is one row per uploaded file, so the whole group of the winning attempt is kept.
-func keepLatestAttemptArtifacts(arts []*ActionArtifact) []*ActionArtifact {
-	latest := make(map[string]int64)
-	for _, art := range arts {
-		latest[art.ArtifactName] = max(latest[art.ArtifactName], art.RunAttemptID)
-	}
-	return slices.DeleteFunc(arts, func(art *ActionArtifact) bool {
-		return art.RunAttemptID != latest[art.ArtifactName]
-	})
-}
-
 // ActionArtifactMeta is the meta-data of an artifact
 type ActionArtifactMeta struct {
 	ArtifactName string
@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestKeepLatestAttemptArtifacts(t *testing.T) {
-	arts := []*ActionArtifact{
-		{ID: 1, RunAttemptID: 1, ArtifactName: "inherited"},
-		{ID: 2, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "a.txt"},
-		{ID: 3, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "b.txt"},
-		{ID: 4, RunAttemptID: 2, ArtifactName: "shadowed", ArtifactPath: "c.txt"},
-		{ID: 5, RunAttemptID: 2, ArtifactName: "own"},
-	}
-
-	// the whole "shadowed" group of attempt 1 is dropped, its multi-file rows must not mix with attempt 2
-	var ids []int64
-	for _, art := range keepLatestAttemptArtifacts(arts) {
-		ids = append(ids, art.ID)
-	}
-	assert.Equal(t, []int64{1, 4, 5}, ids)
-}
@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/url"
 	"strings"
 	"time"

@@ -22,8 +21,6 @@ import (
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
 	webhook_module "gitea.dev/modules/webhook"
-
-	"xorm.io/builder"
 )

 // ActionRun represents a run of a workflow file
@@ -51,13 +48,6 @@ type ActionRun struct {
 	Version           int                          `xorm:"version default 0"` // Status could be updated concomitantly, so an optimistic lock is needed
 	RawConcurrency    string                       // raw concurrency

-	// WorkflowRepoID/WorkflowCommitSHA record the (repo, commit) the run's workflow file content came from.
-	// Always filled (repo-level run = the repo itself; scoped run = the source repo).
-	WorkflowRepoID    int64  `xorm:"NOT NULL DEFAULT 0"`
-	WorkflowCommitSHA string `xorm:"VARCHAR(64) NOT NULL DEFAULT ''"`
-
-	IsScopedRun bool `xorm:"NOT NULL DEFAULT false"` // IsScopedRun explicitly classifies scoped runs.
-
 	// Started and Stopped are identical to the latest attempt after ActionRunAttempt was introduced.
 	// When a rerun creates a new latest attempt, they are reset until the new attempt starts and stops.
 	Started timeutil.TimeStamp
@@ -96,11 +86,7 @@ func (run *ActionRun) WorkflowLink() string {
 	if run.Repo == nil {
 		return ""
 	}
-	// A scoped run's workflow is disambiguated by its source repo, so carry scoped_workflow_source_repo_id back to the run list
-	if run.IsScopedRun {
-		return fmt.Sprintf("%s/actions/?workflow=%s&scoped_workflow_source_repo_id=%d", run.Repo.Link(), url.QueryEscape(run.WorkflowID), run.WorkflowRepoID)
-	}
-	return fmt.Sprintf("%s/actions/?workflow=%s", run.Repo.Link(), url.QueryEscape(run.WorkflowID))
+	return fmt.Sprintf("%s/actions/?workflow=%s", run.Repo.Link(), run.WorkflowID)
 }

 // RefLink return the url of run's ref
@@ -121,7 +107,7 @@ func (run *ActionRun) PrettyRef() string {
 	return refName.ShortName()
 }

-// RefTooltip return a tooltip of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
+// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
 func (run *ActionRun) RefTooltip() string {
 	payload, err := run.GetPullRequestEventPayload()
 	if err == nil && payload != nil && payload.PullRequest != nil {
@@ -278,7 +264,11 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 }

 func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
-	run, has, err := db.Get[ActionRun](ctx, builder.Eq{"repo_id": repoID, "`index`": runIndex})
+	run := &ActionRun{
+		RepoID: repoID,
+		Index:  runIndex,
+	}
+	has, err := db.GetEngine(ctx).Get(run)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -289,7 +279,9 @@ func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionR
 }

 func GetLatestRun(ctx context.Context, repoID int64) (*ActionRun, error) {
-	run := &ActionRun{}
+	run := &ActionRun{
+		RepoID: repoID,
+	}
 	has, err := db.GetEngine(ctx).Where("repo_id=?", repoID).Desc("index").Get(run)
 	if err != nil {
 		return nil, err
@@ -303,10 +295,7 @@ func GetWorkflowLatestRun(ctx context.Context, repoID int64, workflowFile, branc
 	var run ActionRun
 	q := db.GetEngine(ctx).Where("repo_id=?", repoID).
 		And("ref = ?", branch).
-		And("workflow_id = ?", workflowFile).
-		// TODO: the badge only reflects the repo's own (repo-level) runs; a same-named scoped run must not leak in.
-		// Support a scoped-workflow badge later by making this source-aware.
-		And("is_scoped_run = ?", false)
+		And("workflow_id = ?", workflowFile)
 	if event != "" {
 		q.And("event = ?", event)
 	}
@@ -11,7 +11,6 @@ import (

 	"gitea.dev/models/db"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
@@ -63,16 +62,14 @@ func (attempt *ActionRunAttempt) LoadAttributes(ctx context.Context) (err error)
 		attempt.Run = run
 	}

-	return attempt.LoadTriggerUser(ctx)
-}
-
-// LoadTriggerUser loads the attempt's trigger user if not already loaded.
-func (attempt *ActionRunAttempt) LoadTriggerUser(ctx context.Context) (err error) {
-	if attempt.TriggerUser != nil {
-		return nil
+	if attempt.TriggerUser == nil {
+		attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
+		if err != nil {
+			return err
+		}
 	}
-	attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
-	return err
+
+	return nil
 }

 func GetRunAttemptByRepoAndID(ctx context.Context, repoID, attemptID int64) (*ActionRunAttempt, error) {
@@ -97,56 +94,6 @@ func GetRunAttemptByRunIDAndAttemptNum(ctx context.Context, runID, attemptNum in
 	return &attempt, nil
 }

-// GetArtifactAttemptIDs returns the IDs of the attempts whose artifacts the job may read, newest first,
-// always including the job's own attempt.
-// An attempt that re-ran only some of the run's jobs keeps the artifacts of the attempt it re-ran from,
-// because the jobs it passed through never upload them again; a rerun of the whole run starts over.
-func GetArtifactAttemptIDs(ctx context.Context, job *ActionRunJob) ([]int64, error) {
-	if job.Attempt <= 1 || job.RunAttemptID == 0 {
-		return []int64{job.RunAttemptID}, nil
-	}
-
-	attempts, err := ListRunAttemptsByRunID(ctx, job.RunID)
-	if err != nil {
-		return nil, err
-	}
-	// a newer attempt is never readable, and attempt 1 has nothing older to continue into
-	candidateIDs := container.FilterSlice(attempts, func(a *ActionRunAttempt) (int64, bool) {
-		return a.ID, a.Attempt > 1 && a.Attempt <= job.Attempt
-	})
-	passThroughAttemptIDs, err := findPassThroughAttemptIDs(ctx, candidateIDs)
-	if err != nil {
-		return nil, err
-	}
-
-	ids := make([]int64, 0, len(attempts))
-	for _, attempt := range attempts {
-		if attempt.Attempt > job.Attempt {
-			continue
-		}
-		ids = append(ids, attempt.ID)
-		if !slices.Contains(passThroughAttemptIDs, attempt.ID) {
-			// stops at the first attempt that passed no job through
-			break
-		}
-	}
-	return ids, nil
-}
-
-// findPassThroughAttemptIDs narrows the given attempts to those that were a rerun of selected jobs:
-// only such a rerun clones jobs carrying a source task.
-// TODO: best-effort. Needs a better way to distinguish between "partial re-run" and "full re-run".
-func findPassThroughAttemptIDs(ctx context.Context, attemptIDs []int64) ([]int64, error) {
-	passThroughAttemptIDs := make([]int64, 0, len(attemptIDs))
-	return passThroughAttemptIDs, db.GetEngine(ctx).
-		Table("action_run_job").
-		Cols("run_attempt_id").
-		In("run_attempt_id", attemptIDs).
-		Where("source_task_id <> 0").
-		Distinct("run_attempt_id").
-		Find(&passThroughAttemptIDs)
-}
-
 // FindConcurrentRunAttempts returns attempts in the given concurrency group and status set.
 // Results are unordered; callers must not depend on any particular row order.
 func FindConcurrentRunAttempts(ctx context.Context, repoID int64, concurrencyGroup string, statuses []Status) ([]*ActionRunAttempt, error) {
@@ -108,10 +108,6 @@ type ActionRunJob struct {
 	// ParentJobID scopes `Needs` resolution: name lookups happen only among rows sharing the same ParentJobID. 0 for top-level rows.
 	ParentJobID int64 `xorm:"index NOT NULL DEFAULT 0"`

-	// ContinueOnError mirrors the job-level continue-on-error field from the workflow YAML.
-	// When true, a failure of this job does not fail the overall workflow run.
-	ContinueOnError bool `xorm:"NOT NULL DEFAULT FALSE"`
-
 	Started timeutil.TimeStamp
 	Stopped timeutil.TimeStamp
 	Created timeutil.TimeStamp `xorm:"created"`
@@ -333,14 +329,6 @@ func GetDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) (A
 	return jobs, nil
 }

-// DeleteDirectChildJobsByParent deletes the direct child jobs of a parent job.
-func DeleteDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) error {
-	_, err := db.GetEngine(ctx).
-		Where("run_id=? AND parent_job_id=?", parentJob.RunID, parentJob.ID).
-		Delete(new(ActionRunJob))
-	return err
-}
-
 // CollectAllDescendantJobs returns every job in `allJobs` that lives under parent's subtree (recursively), excluding `parent` itself
 func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*ActionRunJob {
 	parents := map[int64]bool{parent.ID: true}
@@ -369,14 +357,6 @@ func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*
 	return out
 }

-// hasWaitingJobsToPick reports whether any waiting, unclaimed, non-reusable job
-// remains in the repo, i.e. work that an idle runner could still pick up.
-func hasWaitingJobsToPick(ctx context.Context, repoID int64) (bool, error) {
-	return db.GetEngine(ctx).
-		Where("repo_id = ? AND task_id = ? AND status = ? AND is_reusable_caller = ?", repoID, 0, StatusWaiting, false).
-		Exist(&ActionRunJob{})
-}
-
 func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, cols ...string) (int64, error) {
 	e := db.GetEngine(ctx)

@@ -401,41 +381,18 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return affected, nil
 	}

-	if job.RunID == 0 {
-		var err error
-		if job, err = GetRunJobByRepoAndID(ctx, job.RepoID, job.ID); err != nil {
+	// Reusable workflow caller jobs are never picked up by runners, so they don't need a task-version bump.
+	if statusUpdated && job.Status.IsWaiting() && !job.IsReusableCaller {
+		// if the status of job changes to waiting again, increase tasks version.
+		if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
 			return 0, err
 		}
 	}

-	// Reusable workflow caller jobs are never picked up by runners, so they don't need a task-version bump.
-	if statusUpdated && !job.IsReusableCaller {
-		switch {
-		case job.Status.IsWaiting():
-			// A job returning to the waiting queue is work a runner can pick up, so bump the
-			// version to wake idle runners whose tasksVersion already equals latestVersion.
-			if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
-				return 0, err
-			}
-		case job.Status.IsDone():
-			// When a job finishes, bump the version so that idle runners — whose
-			// tasksVersion already equals the current latestVersion — learn that
-			// remaining waiting jobs are still available and attempt PickTask again.
-			// Without this bump, runners that completed their tasks would see
-			// tasksVersion==latestVersion and skip PickTask, leaving the other jobs
-			// permanently unassigned until the version changes for another reason.
-			// Only bump when waiting work actually remains for this repo, otherwise
-			// every job completion would needlessly bump the global version and wake
-			// every idle runner instance-wide for nothing.
-			hasWaiting, err := hasWaitingJobsToPick(ctx, job.RepoID)
-			if err != nil {
-				return 0, err
-			}
-			if hasWaiting {
-				if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
-					return 0, err
-				}
-			}
+	if job.RunID == 0 {
+		var err error
+		if job, err = GetRunJobByRepoAndID(ctx, job.RepoID, job.ID); err != nil {
+			return 0, err
 		}
 	}

@@ -448,74 +405,58 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return affected, RefreshReusableCallerStatus(ctx, parent)
 	}

-	if err := refreshRunStatus(ctx, job.RepoID, job.RunID, job.RunAttemptID, StatusUnknown); err != nil {
-		return 0, err
+	{
+		// Other goroutines may aggregate the status of the attempt/run and update it too.
+		// So we need to load the current jobs before updating the aggregate state.
+		if job.RunAttemptID > 0 {
+			attempt, err := GetRunAttemptByRepoAndID(ctx, job.RepoID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetRunJobsByRunAndAttemptID(ctx, job.RunID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			attempt.Status = AggregateJobStatus(jobs)
+			if attempt.Started.IsZero() && attempt.Status.IsRunning() {
+				attempt.Started = timeutil.TimeStampNow()
+			}
+			if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
+				attempt.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
+			}
+		} else {
+			// TODO: Remove this fallback in the future.
+			// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
+			// This path keeps those runs' status consistent when their jobs finish, including:
+			//   - jobs created before migration v331 and complete on the new version starts
+			//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
+			run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			run.Status = AggregateJobStatus(jobs)
+			if run.Started.IsZero() && run.Status.IsRunning() {
+				run.Started = timeutil.TimeStampNow()
+			}
+			if run.Stopped.IsZero() && run.Status.IsDone() {
+				run.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run %d: %w", run.ID, err)
+			}
+		}
 	}

 	return affected, nil
 }

-// refreshRunStatus recomputes the status of an attempt from the jobs currently stored and persists it.
-// The latest attempt propagates its status to its run, an older one only updates itself.
-// noJobsStatus settles an attempt without any job, which AggregateJobStatus cannot conclude on its own.
-func refreshRunStatus(ctx context.Context, repoID, runID, runAttemptID int64, noJobsStatus Status) error {
-	// Other goroutines may aggregate the status of the attempt/run and update it too.
-	// So we need to load the current jobs before updating the aggregate state.
-	if runAttemptID > 0 {
-		attempt, err := GetRunAttemptByRepoAndID(ctx, repoID, runAttemptID)
-		if err != nil {
-			return err
-		}
-		jobs, err := GetRunJobsByRunAndAttemptID(ctx, runID, runAttemptID)
-		if err != nil {
-			return err
-		}
-		attempt.Status = AggregateJobStatus(jobs)
-		if len(jobs) == 0 {
-			attempt.Status = noJobsStatus
-		}
-		if attempt.Started.IsZero() && attempt.Status.IsRunning() {
-			attempt.Started = timeutil.TimeStampNow()
-		}
-		if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
-			attempt.Stopped = timeutil.TimeStampNow()
-		}
-		if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
-			return fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
-		}
-		return nil
-	}
-
-	// TODO: Remove this fallback in the future.
-	// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
-	// This path keeps those runs' status consistent when their jobs finish, including:
-	//   - jobs created before migration v331 and complete on the new version starts
-	//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
-	//   - cancelling a legacy run whose jobs are all already done
-	run, err := GetRunByRepoAndID(ctx, repoID, runID)
-	if err != nil {
-		return err
-	}
-	jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, repoID, runID)
-	if err != nil {
-		return err
-	}
-	run.Status = AggregateJobStatus(jobs)
-	if len(jobs) == 0 {
-		run.Status = noJobsStatus
-	}
-	if run.Started.IsZero() && run.Status.IsRunning() {
-		run.Started = timeutil.TimeStampNow()
-	}
-	if run.Stopped.IsZero() && run.Status.IsDone() {
-		run.Stopped = timeutil.TimeStampNow()
-	}
-	if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
-		return fmt.Errorf("update run %d: %w", run.ID, err)
-	}
-	return nil
-}
-
 // RefreshReusableCallerStatus recomputes a reusable workflow caller's Status, Started and Stopped from its current direct children and persists the change.
 // No-op if caller is not a reusable caller.
 //
@@ -559,12 +500,9 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
 	allSkipped := len(jobs) != 0
 	var hasFailure, hasCancelled, hasCancelling, hasWaiting, hasRunning, hasBlocked bool
 	for _, job := range jobs {
-		// A failed job with continue-on-error:true does not fail the workflow run.
-		// It counts as a "continued failure" and is treated like success for aggregation.
-		isContinuedFailure := job.ContinueOnError && job.Status == StatusFailure
-		allSuccessOrSkipped = allSuccessOrSkipped && (job.Status == StatusSuccess || job.Status == StatusSkipped || isContinuedFailure)
+		allSuccessOrSkipped = allSuccessOrSkipped && (job.Status == StatusSuccess || job.Status == StatusSkipped)
 		allSkipped = allSkipped && job.Status == StatusSkipped
-		hasFailure = hasFailure || (job.Status == StatusFailure && !job.ContinueOnError)
+		hasFailure = hasFailure || job.Status == StatusFailure
 		hasCancelled = hasCancelled || job.Status == StatusCancelled
 		hasCancelling = hasCancelling || job.Status == StatusCancelling
 		hasWaiting = hasWaiting || job.Status == StatusWaiting
@@ -676,8 +614,6 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 	return CancelJobs(ctx, jobsToCancel)
 }

-// CancelJobs cancels every cancellable job it is given. It leaves the status of a run it
-// cancelled nothing in untouched, SettleRunAfterCancel is what gives such a run a final one.
 func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
 	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))

@@ -702,16 +638,6 @@ func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, err
 	return cancelledJobs, nil
 }

-// SettleRunAfterCancel gives a run a final status when cancelling it updated no job at all.
-// A run's status is otherwise only ever written as a side effect of a job update, so a run whose
-// jobs are all done already, or that has no job at all, would stay unfinished forever.
-func SettleRunAfterCancel(ctx context.Context, run *ActionRun) error {
-	if run.Status.IsDone() {
-		return nil
-	}
-	return refreshRunStatus(ctx, run.RepoID, run.ID, run.LatestAttemptID, StatusCancelled)
-}
-
 // cancelOneJob cancels a single job and returns the post-cancel row
 func cancelOneJob(ctx context.Context, job *ActionRunJob) (*ActionRunJob, error) {
 	if job.Status.IsDone() {
@@ -99,10 +99,6 @@ type FindRunJobOptions struct {
 	UpdatedBefore    timeutil.TimeStamp
 	ConcurrencyGroup string
 	OrderBy          db.SearchOrderBy
-	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
-	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
-	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
-	AccessibleRepoIDsSubQuery *builder.Builder
 }

 var JobOrderByMap = map[string]map[string]db.SearchOrderBy{
@@ -136,9 +132,6 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 		}
 		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
 	}
-	if opts.AccessibleRepoIDsSubQuery != nil {
-		cond = cond.And(builder.In("`action_run_job`.repo_id", opts.AccessibleRepoIDsSubQuery))
-	}
 	return cond
 }

@@ -159,12 +152,3 @@ func (opts FindRunJobOptions) ToOrders() string {
 }

 var _ db.FindOptionsOrder = FindRunJobOptions{}
-
-// CountRunJobsByRunAndAttemptID counts the jobs belonging to the given run attempt.
-// It is used to enforce MaxJobNumPerRun when reusable-workflow expansion inserts new jobs.
-func CountRunJobsByRunAndAttemptID(ctx context.Context, runID, runAttemptID int64) (int64, error) {
-	return db.Count[ActionRunJob](ctx, FindRunJobOptions{
-		RunID:        runID,
-		RunAttemptID: optional.Some(runAttemptID),
-	})
-}
@@ -8,7 +8,6 @@ import (

 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
-	"gitea.dev/modules/timeutil"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -198,91 +197,3 @@ func TestCancelJobs_NestedBlockedReusableCaller(t *testing.T) {
 	gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
 	assert.Equal(t, StatusCancelled, gotRun.Status, "run must aggregate to Cancelled, not stay Blocked")
 }
-
-func TestSettleRunAfterCancel(t *testing.T) {
-	// A run that cancelling updates no job in, because its jobs all reached a final status already
-	// or because it has none at all. Its own row has to be settled explicitly, or the run can never
-	// finish and can never be deleted either.
-
-	newStuckRun := func(t *testing.T, withAttempt, withJob bool) (*ActionRun, []*ActionRunJob) {
-		t.Helper()
-		ctx := t.Context()
-
-		run := &ActionRun{
-			Title:         "stuck-waiting",
-			RepoID:        4,
-			Index:         9801,
-			OwnerID:       1,
-			WorkflowID:    "test.yaml",
-			TriggerUserID: 1,
-			Ref:           "refs/heads/master",
-			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-			Event:         "push",
-			TriggerEvent:  "push",
-			EventPayload:  "{}",
-			Status:        StatusWaiting,
-		}
-		require.NoError(t, db.Insert(ctx, run))
-
-		var runAttemptID int64
-		if withAttempt {
-			attempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1, Status: StatusWaiting}
-			require.NoError(t, db.Insert(ctx, attempt))
-			run.LatestAttemptID = attempt.ID
-			require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
-			runAttemptID = attempt.ID
-		}
-
-		if !withJob {
-			return run, nil
-		}
-		job := &ActionRunJob{
-			RunID:        run.ID,
-			RunAttemptID: runAttemptID,
-			RepoID:       run.RepoID,
-			OwnerID:      run.OwnerID,
-			CommitSHA:    run.CommitSHA,
-			Name:         "job1",
-			JobID:        "job1",
-			Attempt:      1,
-			Status:       StatusSuccess,
-			Stopped:      timeutil.TimeStampNow(),
-		}
-		require.NoError(t, db.Insert(ctx, job))
-		return run, []*ActionRunJob{job}
-	}
-
-	cases := []struct {
-		name        string
-		withAttempt bool
-		withJob     bool
-		want        Status
-	}{
-		{"done job", true, true, StatusSuccess},
-		// Runs created before migration v331 have no attempt, their status lives on the run row itself.
-		{"done job on a legacy run without attempt", false, true, StatusSuccess},
-		// Aggregation cannot reach a final status without any job, so cancelling has to end the run itself.
-		{"no job at all", true, false, StatusCancelled},
-		{"no job at all on a legacy run without attempt", false, false, StatusCancelled},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			require.NoError(t, unittest.PrepareTestDatabase())
-			run, jobs := newStuckRun(t, tc.withAttempt, tc.withJob)
-
-			// mirrors what the CancelRun service does
-			cancelled, err := CancelJobs(t.Context(), jobs)
-			require.NoError(t, err)
-			assert.Empty(t, cancelled, "nothing is cancellable, so the run row has to be settled explicitly")
-			require.NoError(t, SettleRunAfterCancel(t.Context(), run))
-
-			if tc.withAttempt {
-				gotAttempt := unittest.AssertExistsAndLoadBean(t, &ActionRunAttempt{ID: run.LatestAttemptID})
-				assert.Equal(t, tc.want, gotAttempt.Status)
-			}
-			gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
-			assert.Equal(t, tc.want, gotRun.Status)
-			assert.NotZero(t, gotRun.Stopped)
-		})
-	}
-}
@@ -10,7 +10,6 @@ import (
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/container"
-	"gitea.dev/modules/optional"
 	"gitea.dev/modules/translation"
 	webhook_module "gitea.dev/modules/webhook"

@@ -62,18 +61,12 @@ type FindRunOptions struct {
 	RepoID           int64
 	OwnerID          int64
 	WorkflowID       string
-	WorkflowRepoID   int64                 // source-aware filter: the repo a run's workflow content came from (0 = any)
-	IsScopedRun      optional.Option[bool] // is the run from a scoped workflow
-	Ref              string                // the commit/tag/… that caused this workflow
+	Ref              string // the commit/tag/… that caused this workflow
 	TriggerUserID    int64
 	TriggerEvent     webhook_module.HookEventType
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
-	// AccessibleRepoIDsSubQuery, when non-nil, restricts results to the repo IDs selected by the
-	// subquery (the caller's accessible repos). A nil value means no restriction. Using a subquery
-	// instead of a materialized ID slice avoids exceeding DB parameter limits for large owners.
-	AccessibleRepoIDsSubQuery *builder.Builder
 }

 func (opts FindRunOptions) ToConds() builder.Cond {
@@ -84,12 +77,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.WorkflowID != "" {
 		cond = cond.And(builder.Eq{"`action_run`.workflow_id": opts.WorkflowID})
 	}
-	if opts.WorkflowRepoID > 0 {
-		cond = cond.And(builder.Eq{"`action_run`.workflow_repo_id": opts.WorkflowRepoID})
-	}
-	if opts.IsScopedRun.Has() {
-		cond = cond.And(builder.Eq{"`action_run`.is_scoped_run": opts.IsScopedRun.Value()})
-	}
 	if opts.TriggerUserID > 0 {
 		cond = cond.And(builder.Eq{"`action_run`.trigger_user_id": opts.TriggerUserID})
 	}
@@ -105,9 +92,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.CommitSHA != "" {
 		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
 	}
-	if opts.AccessibleRepoIDsSubQuery != nil {
-		cond = cond.And(builder.In("`action_run`.repo_id", opts.AccessibleRepoIDsSubQuery))
-	}
 	return cond
 }

@@ -122,15 +106,6 @@ func (opts FindRunOptions) ToJoins() []db.JoinFunc {
 }

 func (opts FindRunOptions) ToOrders() string {
-	// When scoped to a repo, sort by `index`: it reuses the unique
-	// `repo_index` (repo_id, index) index, so the query seeks repo_id and
-	// walks index descending instead of filesorting all matching rows.
-	// Within a repo `index` is co-monotonic with `id`, so the order is the same.
-	if opts.RepoID > 0 {
-		return "`action_run`.`index` DESC"
-	}
-	// `index` is scoped per repo, so it is meaningless across repos. With no
-	// RepoID, sort by the global, PK-indexed `id` for a deterministic order.
 	return "`action_run`.`id` DESC"
 }

@@ -142,8 +117,8 @@ type StatusInfo struct {

 // GetStatusInfoList returns a slice of StatusInfo
 func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInfo {
-	// same as those in aggregateJobStatus (StatusUnknown excluded; it's the "shouldn't happen" fallback)
-	allStatus := []Status{StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped, StatusWaiting, StatusRunning, StatusBlocked, StatusCancelling}
+	// same as those in aggregateJobStatus
+	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning, StatusCancelling}
 	statusInfoList := make([]StatusInfo, 0, len(allStatus))
 	for _, s := range allStatus {
 		statusInfoList = append(statusInfoList, StatusInfo{
@@ -172,20 +147,9 @@ func GetRunBranches(ctx context.Context, repoID int64) ([]string, error) {
 // GetRunWorkflowIDs returns all distinct WorkflowIDs that have at least
 // one ActionRun in the given repo.
 func GetRunWorkflowIDs(ctx context.Context, repoID int64) ([]string, error) {
-	return getRunWorkflowIDs(ctx, repoID, builder.NewCond())
-}
-
-// GetRepoRunWorkflowIDs returns all distinct WorkflowIDs that have at least
-// one repo-level ActionRun in the given repo.
-func GetRepoRunWorkflowIDs(ctx context.Context, repoID int64) ([]string, error) {
-	return getRunWorkflowIDs(ctx, repoID, builder.Eq{"is_scoped_run": false})
-}
-
-func getRunWorkflowIDs(ctx context.Context, repoID int64, extraCond builder.Cond) ([]string, error) {
 	ids := make([]string, 0, 10)
-	cond := builder.Eq{"repo_id": repoID}
 	return ids, db.GetEngine(ctx).Table("action_run").
-		Where(cond.And(extraCond)).
+		Where(builder.Eq{"repo_id": repoID}).
 		Distinct("workflow_id").
 		Cols("workflow_id").
 		Asc("workflow_id").
@@ -6,13 +6,10 @@ package actions
 import (
 	"testing"

-	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
-	"gitea.dev/modules/optional"
 	"gitea.dev/modules/translation"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestGetRunWorkflowIDs(t *testing.T) {
@@ -27,139 +24,14 @@ func TestGetRunWorkflowIDs(t *testing.T) {
 	assert.Empty(t, ids)
 }

-func TestGetRepoRunWorkflowIDs(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	const (
-		repoID             = int64(4)
-		repoWorkflowID     = "repo-orphan.yaml"
-		scopedWorkflowID   = "scoped-only.yaml"
-		sharedWorkflowID   = "shared-name.yaml"
-		scopedWorkflowRepo = int64(111)
-	)
-	for _, spec := range []struct {
-		id             int64
-		workflowID     string
-		workflowRepoID int64
-		isScopedRun    bool
-	}{
-		{99811, repoWorkflowID, repoID, false},
-		{99812, scopedWorkflowID, scopedWorkflowRepo, true},
-		{99813, sharedWorkflowID, repoID, false},
-		{99814, sharedWorkflowID, scopedWorkflowRepo, true},
-	} {
-		require.NoError(t, db.Insert(t.Context(), &ActionRun{
-			ID:             spec.id,
-			Index:          spec.id,
-			RepoID:         repoID,
-			OwnerID:        1,
-			TriggerUserID:  1,
-			WorkflowID:     spec.workflowID,
-			WorkflowRepoID: spec.workflowRepoID,
-			IsScopedRun:    spec.isScopedRun,
-		}))
-	}
-
-	ids, err := GetRepoRunWorkflowIDs(t.Context(), repoID)
-	require.NoError(t, err)
-	assert.Contains(t, ids, repoWorkflowID)
-	assert.Contains(t, ids, sharedWorkflowID)
-	assert.NotContains(t, ids, scopedWorkflowID)
-}
-
 func TestGetStatusInfoList(t *testing.T) {
 	statusInfoList := GetStatusInfoList(t.Context(), translation.MockLocale{})

 	assert.Equal(t, []StatusInfo{
 		{Status: int(StatusSuccess), StatusName: StatusSuccess.String(), DisplayedStatus: "actions.status.success"},
 		{Status: int(StatusFailure), StatusName: StatusFailure.String(), DisplayedStatus: "actions.status.failure"},
-		{Status: int(StatusCancelled), StatusName: StatusCancelled.String(), DisplayedStatus: "actions.status.cancelled"},
-		{Status: int(StatusSkipped), StatusName: StatusSkipped.String(), DisplayedStatus: "actions.status.skipped"},
 		{Status: int(StatusWaiting), StatusName: StatusWaiting.String(), DisplayedStatus: "actions.status.waiting"},
 		{Status: int(StatusRunning), StatusName: StatusRunning.String(), DisplayedStatus: "actions.status.running"},
-		{Status: int(StatusBlocked), StatusName: StatusBlocked.String(), DisplayedStatus: "actions.status.blocked"},
 		{Status: int(StatusCancelling), StatusName: StatusCancelling.String(), DisplayedStatus: "actions.status.cancelling"},
 	}, statusInfoList)
 }
-
-// TestFindRunOptions_WorkflowRepoID: two runs share the bare WorkflowID but come from different content-source repos;
-// the source-aware WorkflowRepoID filter must separate them.
-func TestFindRunOptions_WorkflowRepoID(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	const (
-		repoID     = int64(4)
-		sourceA    = int64(111)
-		sourceB    = int64(222)
-		workflowID = "u3-shared.yaml"
-	)
-	for _, spec := range []struct{ id, workflowRepoID int64 }{
-		{99801, sourceA},
-		{99802, sourceB},
-	} {
-		require.NoError(t, db.Insert(t.Context(), &ActionRun{
-			ID:             spec.id,
-			Index:          spec.id,
-			RepoID:         repoID,
-			OwnerID:        1,
-			TriggerUserID:  1,
-			WorkflowID:     workflowID,
-			WorkflowRepoID: spec.workflowRepoID,
-			IsScopedRun:    true,
-		}))
-	}
-
-	// no source filter -> both
-	all, err := db.Find[ActionRun](t.Context(), FindRunOptions{RepoID: repoID, WorkflowID: workflowID})
-	require.NoError(t, err)
-	assert.Len(t, all, 2)
-
-	// filter by source A -> only the run whose content came from A
-	onlyA, err := db.Find[ActionRun](t.Context(), FindRunOptions{RepoID: repoID, WorkflowID: workflowID, WorkflowRepoID: sourceA})
-	require.NoError(t, err)
-	require.Len(t, onlyA, 1)
-	assert.EqualValues(t, 99801, onlyA[0].ID)
-
-	// filter by source B -> only the run whose content came from B
-	onlyB, err := db.Find[ActionRun](t.Context(), FindRunOptions{RepoID: repoID, WorkflowID: workflowID, WorkflowRepoID: sourceB})
-	require.NoError(t, err)
-	require.Len(t, onlyB, 1)
-	assert.EqualValues(t, 99802, onlyB[0].ID)
-}
-
-func TestFindRunOptions_IsScopedRun(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	const (
-		repoID     = int64(4)
-		workflowID = "scoped-flag.yaml"
-	)
-	for _, spec := range []struct {
-		id     int64
-		scoped bool
-	}{
-		{99821, false},
-		{99822, true},
-	} {
-		require.NoError(t, db.Insert(t.Context(), &ActionRun{
-			ID:             spec.id,
-			Index:          spec.id,
-			RepoID:         repoID,
-			OwnerID:        1,
-			TriggerUserID:  1,
-			WorkflowID:     workflowID,
-			WorkflowRepoID: repoID,
-			IsScopedRun:    spec.scoped,
-		}))
-	}
-
-	repoLevel, err := db.Find[ActionRun](t.Context(), FindRunOptions{RepoID: repoID, WorkflowID: workflowID, IsScopedRun: optional.Some(false)})
-	require.NoError(t, err)
-	require.Len(t, repoLevel, 1)
-	assert.EqualValues(t, 99821, repoLevel[0].ID)
-
-	scoped, err := db.Find[ActionRun](t.Context(), FindRunOptions{RepoID: repoID, WorkflowID: workflowID, IsScopedRun: optional.Some(true)})
-	require.NoError(t, err)
-	require.Len(t, scoped, 1)
-	assert.EqualValues(t, 99822, scoped[0].ID)
-}
@@ -13,7 +13,6 @@ import (
 	"gitea.dev/modules/timeutil"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestUpdateRepoRunsNumbers(t *testing.T) {
@@ -45,57 +44,3 @@ func TestActionRun_Duration_NonNegative(t *testing.T) {
 	}
 	assert.Equal(t, time.Duration(0), run.Duration())
 }
-
-func TestActionRun_WorkflowLink(t *testing.T) {
-	repo := &repo_model.Repository{OwnerName: "org", Name: "consumer"}
-
-	// a repo-level run links by file name only
-	repoLevel := &ActionRun{Repo: repo, WorkflowID: "ci.yaml", WorkflowRepoID: repo.ID}
-	assert.Equal(t, repo.Link()+"/actions/?workflow=ci.yaml", repoLevel.WorkflowLink())
-
-	// a scoped run carries its source repo id back, so the list stays filtered to that source
-	scoped := &ActionRun{Repo: repo, WorkflowID: "ci.yaml", WorkflowRepoID: 42, IsScopedRun: true}
-	assert.Equal(t, repo.Link()+"/actions/?workflow=ci.yaml&scoped_workflow_source_repo_id=42", scoped.WorkflowLink())
-}
-
-func TestGetWorkflowLatestRun_RepoLevelOnly(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	const (
-		repoID     = int64(4)
-		workflowID = "badge-source-aware.yaml"
-		ref        = "refs/heads/main"
-	)
-	require.NoError(t, db.Insert(t.Context(), &ActionRun{
-		ID:                99811,
-		Index:             99811,
-		RepoID:            repoID,
-		OwnerID:           1,
-		TriggerUserID:     1,
-		WorkflowID:        workflowID,
-		Ref:               ref,
-		Event:             "push",
-		Status:            StatusSuccess,
-		WorkflowRepoID:    repoID,
-		WorkflowCommitSHA: "repo-level-sha",
-	}))
-	require.NoError(t, db.Insert(t.Context(), &ActionRun{
-		ID:                99812,
-		Index:             99812,
-		RepoID:            repoID,
-		OwnerID:           1,
-		TriggerUserID:     1,
-		WorkflowID:        workflowID,
-		Ref:               ref,
-		Event:             "push",
-		Status:            StatusFailure,
-		WorkflowRepoID:    111,
-		WorkflowCommitSHA: "scoped-sha",
-		IsScopedRun:       true,
-	}))
-
-	run, err := GetWorkflowLatestRun(t.Context(), repoID, workflowID, ref, "push")
-	require.NoError(t, err)
-	assert.EqualValues(t, 99811, run.ID)
-	assert.False(t, run.IsScopedRun)
-}
@@ -75,28 +75,8 @@ type ActionRunner struct {
 const (
 	RunnerOfflineTime = time.Minute
 	RunnerIdleTime    = 10 * time.Second
-	// RunnerHeartbeatInterval is how often last_online is persisted on poll.
-	// Must stay well below RunnerOfflineTime so runners don't flap to offline.
-	RunnerHeartbeatInterval = 30 * time.Second
-	// RunnerActiveInterval is how often last_active is persisted while a runner
-	// streams task updates and logs. Must stay well below RunnerIdleTime so a
-	// busy runner keeps showing ACTIVE without a DB write on every RPC.
-	RunnerActiveInterval = 5 * time.Second
 )

-// ShouldPersistLastOnline reports whether last_online is stale enough to be
-// worth writing back. Avoids a DB write on every runner poll.
-func ShouldPersistLastOnline(last timeutil.TimeStamp, now time.Time) bool {
-	return now.Sub(last.AsTime()) >= RunnerHeartbeatInterval
-}
-
-// ShouldPersistLastActive reports whether last_active is stale enough to be
-// worth writing back. Avoids a DB write on every UpdateTask/UpdateLog RPC while
-// a runner is actively streaming logs.
-func ShouldPersistLastActive(last timeutil.TimeStamp, now time.Time) bool {
-	return now.Sub(last.AsTime()) >= RunnerActiveInterval
-}
-
 // BelongsToOwnerName before calling, should guarantee that all attributes are loaded
 func (r *ActionRunner) BelongsToOwnerName() string {
 	if r.RepoID != 0 {
@@ -270,41 +250,22 @@ func (opts FindRunnerOptions) ToConds() builder.Cond {
 	return cond
 }

-// runnerStatusOrderExpr builds an ORDER BY fragment that ranks runners by their
-// computed status (see ActionRunner.Status): active (0), idle (1), offline (2).
-// The thresholds are evaluated against the current time, mirroring ToConds, so
-// sorting by status groups active and idle runners instead of interleaving them
-// by raw last_online.
-func runnerStatusOrderExpr() string {
-	now := time.Now()
-	offlineThreshold := now.Add(-RunnerOfflineTime).Unix()
-	idleThreshold := now.Add(-RunnerIdleTime).Unix()
-	return fmt.Sprintf("CASE WHEN last_online <= %d THEN 2 WHEN last_active <= %d THEN 1 ELSE 0 END", offlineThreshold, idleThreshold)
-}
-
 func (opts FindRunnerOptions) ToOrders() string {
-	// A unique tiebreaker (id) is appended so that runners sharing the same
-	// status, last_online or name keep a deterministic order across paginated
-	// queries, otherwise the same runner may appear on more than one page.
-	statusRank := runnerStatusOrderExpr()
 	switch opts.Sort {
 	case "online":
-		// Rank by computed status first so idle runners are not interleaved with
-		// active ones; disabled runners sink to the bottom of their status group
-		// (is_disabled ASC), then last_online breaks ties within a group.
-		return statusRank + " ASC, is_disabled ASC, last_online DESC, id ASC"
+		return "last_online DESC"
 	case "offline":
-		return statusRank + " DESC, is_disabled ASC, last_online ASC, id ASC"
+		return "last_online ASC"
 	case "alphabetically":
-		return "name ASC, id ASC"
+		return "name ASC"
 	case "reversealphabetically":
-		return "name DESC, id ASC"
+		return "name DESC"
 	case "newest":
 		return "id DESC"
 	case "oldest":
 		return "id ASC"
 	}
-	return statusRank + " ASC, is_disabled ASC, last_online DESC, id ASC"
+	return "last_online DESC"
 }

 // GetRunnerByUUID returns a runner via uuid
@@ -1,83 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"testing"
-	"time"
-
-	"gitea.dev/modules/timeutil"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestShouldPersistLastOnline(t *testing.T) {
-	now := time.Now()
-	tests := []struct {
-		name string
-		last timeutil.TimeStamp
-		want bool
-	}{
-		{
-			name: "fresh, skip write",
-			last: timeutil.TimeStamp(now.Add(-5 * time.Second).Unix()),
-			want: false,
-		},
-		{
-			name: "exactly at interval, write",
-			last: timeutil.TimeStamp(now.Add(-RunnerHeartbeatInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "stale, write",
-			last: timeutil.TimeStamp(now.Add(-2 * RunnerHeartbeatInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "zero (never seen), write",
-			last: 0,
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ShouldPersistLastOnline(tt.last, now))
-		})
-	}
-}
-
-func TestShouldPersistLastActive(t *testing.T) {
-	now := time.Now()
-	tests := []struct {
-		name string
-		last timeutil.TimeStamp
-		want bool
-	}{
-		{
-			name: "fresh, skip write",
-			last: timeutil.TimeStamp(now.Add(-1 * time.Second).Unix()),
-			want: false,
-		},
-		{
-			name: "exactly at interval, write",
-			last: timeutil.TimeStamp(now.Add(-RunnerActiveInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "stale, write",
-			last: timeutil.TimeStamp(now.Add(-2 * RunnerActiveInterval).Unix()),
-			want: true,
-		},
-		{
-			name: "zero (never seen), write",
-			last: 0,
-			want: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, ShouldPersistLastActive(tt.last, now))
-		})
-	}
-}
@@ -1,179 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"context"
-	"fmt"
-
-	"gitea.dev/models/db"
-	repo_model "gitea.dev/models/repo"
-	"gitea.dev/modules/timeutil"
-	"gitea.dev/modules/util"
-
-	"xorm.io/builder"
-)
-
-// ActionScopedWorkflowSource registers a repository as a source of scoped workflows, either for an owner (user/org) or for the whole instance.
-type ActionScopedWorkflowSource struct {
-	ID int64 `xorm:"pk autoincr"`
-
-	// OwnerID is the scope the source applies to: a user/org ID (applies to that owner's repos), or 0 for instance-level (applies to every repo).
-	OwnerID int64 `xorm:"UNIQUE(owner_repo) NOT NULL DEFAULT 0"`
-	// SourceRepoID is the source repository providing the workflow files; always non-zero.
-	SourceRepoID int64 `xorm:"INDEX UNIQUE(owner_repo) NOT NULL DEFAULT 0"`
-
-	// WorkflowConfigs maps a workflow ID (entry name) to its merge-gate config.
-	WorkflowConfigs map[string]*ScopedWorkflowConfig `xorm:"JSON TEXT 'workflow_configs'"`
-
-	CreatedUnix timeutil.TimeStamp `xorm:"created"`
-	UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
-}
-
-// ScopedWorkflowConfig is one scoped workflow's config within a source registration.
-type ScopedWorkflowConfig struct {
-	Required bool     `json:"required"`
-	Patterns []string `json:"patterns"` // the status-check patterns that must be present and pass, only effective when Required is true
-}
-
-func init() {
-	db.RegisterModel(new(ActionScopedWorkflowSource))
-}
-
-// IsWorkflowRequired reports whether the given workflow ID (entry name) is marked required in this source.
-func (s *ActionScopedWorkflowSource) IsWorkflowRequired(workflowID string) bool {
-	c, ok := s.WorkflowConfigs[workflowID]
-	return ok && c.Required
-}
-
-type FindScopedWorkflowSourceOpts struct {
-	db.ListOptions
-	OwnerIDs     []int64
-	SourceRepoID int64
-}
-
-func (opts FindScopedWorkflowSourceOpts) ToConds() builder.Cond {
-	cond := builder.NewCond()
-	if len(opts.OwnerIDs) > 0 {
-		cond = cond.And(builder.In("owner_id", opts.OwnerIDs))
-	}
-	if opts.SourceRepoID != 0 {
-		cond = cond.And(builder.Eq{"source_repo_id": opts.SourceRepoID})
-	}
-	return cond
-}
-
-// GetEffectiveScopedWorkflowSources returns the scoped-workflow sources effective for a repo owned by repoOwnerID:
-// the owner's own sources plus instance-level (owner_id=0) sources.
-func GetEffectiveScopedWorkflowSources(ctx context.Context, repoOwnerID int64) ([]*ActionScopedWorkflowSource, error) {
-	owners := []int64{0}
-	if repoOwnerID != 0 {
-		owners = append(owners, repoOwnerID)
-	}
-	return db.Find[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: owners})
-}
-
-// IsScopedWorkflowSourceEffective reports whether sourceRepoID is a scoped-workflow source effective for a repo owned by repoOwnerID.
-func IsScopedWorkflowSourceEffective(ctx context.Context, repoOwnerID, sourceRepoID int64) (bool, error) {
-	owners := []int64{0}
-	if repoOwnerID != 0 {
-		owners = append(owners, repoOwnerID)
-	}
-	return db.Exist[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: owners, SourceRepoID: sourceRepoID}.ToConds())
-}
-
-// IsWorkflowRequiredInSources reports whether workflowID from sourceRepoID is required by any of the given sources.
-func IsWorkflowRequiredInSources(sources []*ActionScopedWorkflowSource, sourceRepoID int64, workflowID string) bool {
-	for _, s := range sources {
-		if s.SourceRepoID == sourceRepoID && s.IsWorkflowRequired(workflowID) {
-			return true
-		}
-	}
-	return false
-}
-
-// ScopedStatusContextPrefix returns the source-repo prefix that makes a scoped run's commit-status context distinct from same-named workflows.
-func ScopedStatusContextPrefix(ctx context.Context, sourceRepoID int64) string {
-	if sourceRepo, err := repo_model.GetRepositoryByID(ctx, sourceRepoID); err == nil {
-		return sourceRepo.FullName()
-	}
-	return fmt.Sprintf("scoped:%d", sourceRepoID)
-}
-
-// IsScopedWorkflowRequired reports whether workflowID from sourceRepoID is required for a repo owned by consumerOwnerID.
-func IsScopedWorkflowRequired(ctx context.Context, consumerOwnerID, sourceRepoID int64, workflowID string) (bool, error) {
-	sources, err := GetEffectiveScopedWorkflowSources(ctx, consumerOwnerID)
-	if err != nil {
-		return false, err
-	}
-	return IsWorkflowRequiredInSources(sources, sourceRepoID, workflowID), nil
-}
-
-// IsScopedWorkflowOptedOutloads the consumer's effective sources then calls ScopedWorkflowOptedOut
-func IsScopedWorkflowOptedOut(ctx context.Context, cfg *repo_model.ActionsConfig, consumerOwnerID, sourceRepoID int64, workflowID string) (bool, error) {
-	if !cfg.IsScopedWorkflowDisabled(sourceRepoID, workflowID) {
-		return false, nil
-	}
-	sources, err := GetEffectiveScopedWorkflowSources(ctx, consumerOwnerID)
-	if err != nil {
-		return false, err
-	}
-	return ScopedWorkflowOptedOut(cfg, sources, sourceRepoID, workflowID), nil
-}
-
-// ScopedWorkflowOptedOut reports whether a consumer's opt-out of (sourceRepoID, workflowID) is in effect.
-func ScopedWorkflowOptedOut(cfg *repo_model.ActionsConfig, sources []*ActionScopedWorkflowSource, sourceRepoID int64, workflowID string) bool {
-	return !IsWorkflowRequiredInSources(sources, sourceRepoID, workflowID) && cfg.IsScopedWorkflowDisabled(sourceRepoID, workflowID)
-}
-
-// GetScopedWorkflowSourcesByOwner returns the sources an owner (user/org, or 0 for instance) registered.
-func GetScopedWorkflowSourcesByOwner(ctx context.Context, ownerID int64) ([]*ActionScopedWorkflowSource, error) {
-	return db.Find[ActionScopedWorkflowSource](ctx, FindScopedWorkflowSourceOpts{OwnerIDs: []int64{ownerID}})
-}
-
-// GetScopedWorkflowSource returns the (owner, repo) source registration or a NotExist error.
-func GetScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) (*ActionScopedWorkflowSource, error) {
-	src := &ActionScopedWorkflowSource{}
-	has, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Get(src)
-	if err != nil {
-		return nil, err
-	}
-	if !has {
-		return nil, util.NewNotExistErrorf("scoped workflow source (owner %d, repo %d) does not exist", ownerID, repoID)
-	}
-	return src, nil
-}
-
-// AddScopedWorkflowSource registers repoID as a source for ownerID (no-op if already registered).
-func AddScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) error {
-	exists, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Exist(new(ActionScopedWorkflowSource))
-	if err != nil {
-		return err
-	}
-	if exists {
-		return nil
-	}
-	if err := db.Insert(ctx, &ActionScopedWorkflowSource{OwnerID: ownerID, SourceRepoID: repoID}); err != nil {
-		// Re-check and treat an already-present row as the intended no-op.
-		if exists, existErr := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Exist(new(ActionScopedWorkflowSource)); existErr == nil && exists {
-			return nil
-		}
-		return err
-	}
-	return nil
-}
-
-// SetScopedWorkflowSourceConfigs replaces the per-workflow merge-gate configs (workflow ID -> config).
-func SetScopedWorkflowSourceConfigs(ctx context.Context, ownerID, repoID int64, configs map[string]*ScopedWorkflowConfig) error {
-	_, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).
-		Cols("workflow_configs").
-		Update(&ActionScopedWorkflowSource{WorkflowConfigs: configs})
-	return err
-}
-
-// RemoveScopedWorkflowSource removes the (owner, repo) source registration.
-func RemoveScopedWorkflowSource(ctx context.Context, ownerID, repoID int64) error {
-	_, err := db.GetEngine(ctx).Where("owner_id = ? AND source_repo_id = ?", ownerID, repoID).Delete(new(ActionScopedWorkflowSource))
-	return err
-}
@@ -1,139 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"testing"
-
-	"gitea.dev/models/db"
-	"gitea.dev/models/unittest"
-	"gitea.dev/modules/util"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestScopedWorkflowSource_IsWorkflowRequired(t *testing.T) {
-	src := &ActionScopedWorkflowSource{WorkflowConfigs: map[string]*ScopedWorkflowConfig{
-		"a.yml": {Required: true, Patterns: []string{"p"}},
-		"b.yml": {Required: true, Patterns: []string{"p"}},
-		"c.yml": {Required: false, Patterns: []string{"p"}}, // patterns kept as history, not required
-	}}
-	assert.True(t, src.IsWorkflowRequired("a.yml"))
-	assert.True(t, src.IsWorkflowRequired("b.yml"))
-	assert.False(t, src.IsWorkflowRequired("c.yml"), "config kept as history but not required")
-	assert.False(t, src.IsWorkflowRequired("d.yml"))
-
-	empty := &ActionScopedWorkflowSource{}
-	assert.False(t, empty.IsWorkflowRequired("a.yml"))
-}
-
-func TestIsWorkflowRequiredInSources(t *testing.T) {
-	// repo 100 registered twice (org optional + instance required).
-	sources := []*ActionScopedWorkflowSource{
-		{OwnerID: 2, SourceRepoID: 100, WorkflowConfigs: nil},
-		{OwnerID: 0, SourceRepoID: 100, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"a.yml": {Required: true, Patterns: []string{"p"}}}},
-		{OwnerID: 0, SourceRepoID: 200, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"b.yml": {Required: true, Patterns: []string{"p"}}}},
-	}
-
-	assert.True(t, IsWorkflowRequiredInSources(sources, 100, "a.yml"), "required at instance level wins over org optional")
-	assert.False(t, IsWorkflowRequiredInSources(sources, 100, "z.yml"))
-	assert.False(t, IsWorkflowRequiredInSources(sources, 200, "a.yml"), "a.yml is required for repo 100, not repo 200")
-	assert.True(t, IsWorkflowRequiredInSources(sources, 200, "b.yml"))
-	assert.False(t, IsWorkflowRequiredInSources(sources, 999, "a.yml"), "unknown source repo")
-}
-
-func TestGetEffectiveScopedWorkflowSources(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	ctx := t.Context()
-
-	rows := []*ActionScopedWorkflowSource{
-		{OwnerID: 2, SourceRepoID: 100, WorkflowConfigs: nil}, // org 2 registers repo 100 (optional)
-		{OwnerID: 0, SourceRepoID: 100, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"a.yml": {Required: true, Patterns: []string{"p"}}}}, // instance also registers repo 100 (required)
-		{OwnerID: 0, SourceRepoID: 200, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"b.yml": {Required: true, Patterns: []string{"p"}}}}, // instance source 200
-		{OwnerID: 3, SourceRepoID: 300, WorkflowConfigs: map[string]*ScopedWorkflowConfig{"c.yml": {Required: true, Patterns: []string{"p"}}}}, // a different owner's source
-	}
-	for _, r := range rows {
-		require.NoError(t, db.Insert(ctx, r))
-	}
-
-	// owner 2 sees its own sources plus instance-level ones, but not owner 3's.
-	owner2, err := GetEffectiveScopedWorkflowSources(ctx, 2)
-	require.NoError(t, err)
-	assert.Len(t, owner2, 3)
-
-	required, err := IsScopedWorkflowRequired(ctx, 2, 100, "a.yml")
-	require.NoError(t, err)
-	assert.True(t, required, "instance marks a.yml required → required for owner 2 even though org left it optional")
-
-	required, err = IsScopedWorkflowRequired(ctx, 2, 100, "x.yml")
-	require.NoError(t, err)
-	assert.False(t, required)
-
-	required, err = IsScopedWorkflowRequired(ctx, 2, 200, "b.yml")
-	require.NoError(t, err)
-	assert.True(t, required)
-
-	// owner 3's source must not be effective for owner 2.
-	required, err = IsScopedWorkflowRequired(ctx, 2, 300, "c.yml")
-	require.NoError(t, err)
-	assert.False(t, required)
-
-	// IsScopedWorkflowSourceEffective: owner-level and instance-level sources are effective; another owner's is not.
-	effective, err := IsScopedWorkflowSourceEffective(ctx, 2, 100)
-	require.NoError(t, err)
-	assert.True(t, effective, "owner 2's own source")
-
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 200)
-	require.NoError(t, err)
-	assert.True(t, effective, "instance-level source is effective for any owner")
-
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 300)
-	require.NoError(t, err)
-	assert.False(t, effective, "owner 3's source is not effective for owner 2")
-
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 2, 999)
-	require.NoError(t, err)
-	assert.False(t, effective, "unknown source repo")
-
-	effective, err = IsScopedWorkflowSourceEffective(ctx, 3, 300)
-	require.NoError(t, err)
-	assert.True(t, effective, "owner 3's own source is effective for owner 3")
-}
-
-func TestScopedWorkflowSourceCRUD(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	ctx := t.Context()
-
-	// add is idempotent
-	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 10))
-	require.NoError(t, AddScopedWorkflowSource(ctx, 5, 10))
-	sources, err := GetScopedWorkflowSourcesByOwner(ctx, 5)
-	require.NoError(t, err)
-	assert.Len(t, sources, 1)
-
-	// set the per-workflow configs (entry name -> {required, patterns}); a.yml required, b.yml kept as history (not required)
-	configs := map[string]*ScopedWorkflowConfig{
-		"a.yml": {Required: true, Patterns: []string{"src: a.yml / *"}},
-		"b.yml": {Required: false, Patterns: []string{"src: b.yml / build (push)"}},
-	}
-	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 10, configs))
-	src, err := GetScopedWorkflowSource(ctx, 5, 10)
-	require.NoError(t, err)
-	assert.Equal(t, configs, src.WorkflowConfigs)
-
-	// clearing the configs works
-	require.NoError(t, SetScopedWorkflowSourceConfigs(ctx, 5, 10, nil))
-	src, err = GetScopedWorkflowSource(ctx, 5, 10)
-	require.NoError(t, err)
-	assert.Empty(t, src.WorkflowConfigs)
-
-	// remove
-	require.NoError(t, RemoveScopedWorkflowSource(ctx, 5, 10))
-	_, err = GetScopedWorkflowSource(ctx, 5, 10)
-	assert.ErrorIs(t, err, util.ErrNotExist)
-	sources, err = GetScopedWorkflowSourcesByOwner(ctx, 5)
-	require.NoError(t, err)
-	assert.Empty(t, sources)
-}
@@ -48,57 +48,3 @@ func TestStatusFromResult(t *testing.T) {
 		assert.Equal(t, tt.want, StatusFromResult(tt.result), "result=%s", tt.result)
 	}
 }
-
-func newJob(status Status, continueOnError bool) *ActionRunJob {
-	return &ActionRunJob{Status: status, ContinueOnError: continueOnError}
-}
-
-func TestAggregateJobStatusContinueOnError(t *testing.T) {
-	cases := []struct {
-		name string
-		jobs []*ActionRunJob
-		want Status
-	}{
-		{
-			name: "all success",
-			jobs: []*ActionRunJob{newJob(StatusSuccess, false), newJob(StatusSuccess, false)},
-			want: StatusSuccess,
-		},
-		{
-			name: "one failure without continue-on-error",
-			jobs: []*ActionRunJob{newJob(StatusSuccess, false), newJob(StatusFailure, false)},
-			want: StatusFailure,
-		},
-		{
-			name: "one failure with continue-on-error",
-			jobs: []*ActionRunJob{newJob(StatusSuccess, false), newJob(StatusFailure, true)},
-			want: StatusSuccess,
-		},
-		{
-			name: "only continued-failure",
-			jobs: []*ActionRunJob{newJob(StatusFailure, true)},
-			want: StatusSuccess,
-		},
-		{
-			name: "continued-failure plus real failure",
-			jobs: []*ActionRunJob{newJob(StatusFailure, true), newJob(StatusFailure, false)},
-			want: StatusFailure,
-		},
-		{
-			name: "all skipped",
-			jobs: []*ActionRunJob{newJob(StatusSkipped, false), newJob(StatusSkipped, false)},
-			want: StatusSkipped,
-		},
-		{
-			name: "continued-failure plus skipped counts as success",
-			jobs: []*ActionRunJob{newJob(StatusFailure, true), newJob(StatusSkipped, false)},
-			want: StatusSuccess,
-		},
-	}
-
-	for _, tt := range cases {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, AggregateJobStatus(tt.jobs))
-		})
-	}
-}
@@ -16,7 +16,6 @@ import (
 	"gitea.dev/models/db"
 	"gitea.dev/models/unit"
 	"gitea.dev/modules/actions/jobparser"
-	"gitea.dev/modules/globallock"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/timeutil"
@@ -60,12 +59,6 @@ type ActionTask struct {
 	Updated timeutil.TimeStamp `xorm:"updated index"`
 }

-// taskReportTimeout is how long a task may go without contact from its runner before the
-// runner is assumed gone. Runners report state and stream logs every few seconds, both of
-// which refresh ActionTask.Updated. Shorter than setting.Actions.ZombieTaskTimeout because
-// it only decides whether the runner is reachable, not whether the task should be killed.
-const taskReportTimeout = time.Minute
-
 var successfulTokenTaskCache *lru.Cache[string, any]

 func init() {
@@ -91,15 +84,11 @@ func (task *ActionTask) IsStopped() bool {
 	return task.Stopped > 0
 }

-func (task *ActionTask) GetRunJobLink() string {
-	// Run.Repo can be nil when the repository was deleted while task/run rows remain
-	// (TaskList.LoadAttributes copies job.Repo into run.Repo, leaving it nil on a miss).
-	// Run.Link() already returns "" in that case, so guard here to avoid emitting a
-	// broken relative "/jobs/N" link from the Sprintf below.
-	if task.Job == nil || task.Job.Run == nil || task.Job.Run.Repo == nil {
+func (task *ActionTask) GetRunLink() string {
+	if task.Job == nil || task.Job.Run == nil {
 		return ""
 	}
-	return fmt.Sprintf("%s/jobs/%d", task.Job.Run.Link(), task.Job.ID)
+	return task.Job.Run.Link()
 }

 func (task *ActionTask) GetCommitLink() string {
@@ -238,23 +227,13 @@ func makeTaskStepDisplayName(step *jobparser.Step, limit int) (name string) {
 	return util.EllipsisDisplayString(name, limit) // database column has a length limit
 }

-// errJobAlreadyClaimed is a sentinel used inside claimJobForRunner to signal that
-// another runner won the optimistic-lock race; it is never returned to callers.
-var errJobAlreadyClaimed = errors.New("job already claimed by another runner")
-
-// pickTaskBatchSize bounds how many waiting jobs each CreateTaskForRunner query loads,
-// so a large backlog is not fetched into memory on every runner poll.
-// It is a var only so tests can shrink it to exercise pagination cheaply.
-var pickTaskBatchSize = 100
-
-// CreateTaskForRunner finds a waiting job that matches the runner's labels and
-// atomically claims it. It iterates through all matching jobs so that a
-// concurrent claim by another runner (which would lose the optimistic lock on
-// job #1) does not leave the remaining jobs permanently unassigned.
 func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask, bool, error) {
-	if db.InTransaction(ctx) {
-		return nil, false, errors.New("CreateTaskForRunner must not be called within a database transaction")
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return nil, false, err
 	}
+	defer committer.Close()
+
 	e := db.GetEngine(ctx)

 	jobCond := builder.NewCond()
@@ -265,174 +244,93 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 			Join("INNER", "repo_unit", "`repository`.id = `repo_unit`.repo_id").
 			Where(builder.Eq{"`repository`.owner_id": runner.OwnerID, "`repo_unit`.type": unit.TypeActions}))
 	}
-	baseCond := builder.Eq{"task_id": 0, "status": StatusWaiting, "is_reusable_caller": false}.And(jobCond)
-
-	// TODO: a more efficient way to filter labels
-	log.Trace("runner labels: %v", runner.AgentLabels)
-
-	// Page through the waiting jobs oldest-first instead of loading the whole backlog into memory on every poll.
-	// Keyset pagination on (updated, id) is safe under concurrent claims:
-	// updated only moves forward, so the advancing cursor never skips a still-waiting job even as claimed jobs drop out.
-	var cursorUpdated timeutil.TimeStamp
-	var cursorID int64
-	for {
-		cond := baseCond
-		if cursorID > 0 {
-			cond = cond.And(builder.Or(
-				builder.Gt{"updated": cursorUpdated},
-				builder.And(builder.Eq{"updated": cursorUpdated}, builder.Gt{"id": cursorID}),
-			))
-		}
-
-		var jobs []*ActionRunJob
-		if err := e.Where(cond).Asc("updated", "id").Limit(pickTaskBatchSize).Find(&jobs); err != nil {
-			return nil, false, err
-		}
-
-		for _, v := range jobs {
-			if !runner.CanMatchLabels(v.RunsOn) {
-				continue
-			}
-			task, ok, err := claimJobForRunner(ctx, runner, v)
-			if err != nil {
-				return nil, false, err
-			}
-			if ok {
-				return task, true, nil
-			}
-			// Another runner claimed this job concurrently; try the next one.
-		}
-
-		// A short page means no waiting jobs remain beyond it.
-		if len(jobs) < pickTaskBatchSize {
-			return nil, false, nil
-		}
-		last := jobs[len(jobs)-1]
-		cursorUpdated, cursorID = last.Updated, last.ID
+	if jobCond.IsValid() {
+		jobCond = builder.In("run_id", builder.Select("id").From("action_run").Where(jobCond))
 	}
-}

-// claimJobForRunner attempts to atomically claim job for runner inside its own
-// transaction. Returns (task, true, nil) on success, or (nil, false, nil) when
-// another runner wins the optimistic-lock race (the caller should try the next
-// candidate job).
-func claimJobForRunner(ctx context.Context, runner *ActionRunner, job *ActionRunJob) (*ActionTask, bool, error) {
-	var resultTask *ActionTask
-
-	err := db.WithTx(ctx, func(ctx context.Context) error {
-		e := db.GetEngine(ctx)
-
-		if err := job.LoadAttributes(ctx); err != nil {
-			return err
-		}
-
-		now := timeutil.TimeStampNow()
-		job.Started = now
-		job.Status = StatusRunning
-
-		task := &ActionTask{
-			JobID:             job.ID,
-			Attempt:           job.Attempt,
-			RunnerID:          runner.ID,
-			Started:           now,
-			Status:            StatusRunning,
-			RepoID:            job.RepoID,
-			OwnerID:           job.OwnerID,
-			CommitSHA:         job.CommitSHA,
-			IsForkPullRequest: job.IsForkPullRequest,
-		}
-		task.GenerateAndFillToken()
-
-		workflowJob, err := job.ParseJob()
-		if err != nil {
-			return fmt.Errorf("load job %d: %w", job.ID, err)
-		}
-
-		if _, err := e.Insert(task); err != nil {
-			return err
-		}
-
-		task.LogFilename = logFileName(job.Run.Repo.FullName(), task.ID)
-		if err := UpdateTask(ctx, task, "log_filename"); err != nil {
-			return err
-		}
-
-		if len(workflowJob.Steps) > 0 {
-			steps := make([]*ActionTaskStep, len(workflowJob.Steps))
-			for i, v := range workflowJob.Steps {
-				steps[i] = &ActionTaskStep{
-					Name:   makeTaskStepDisplayName(v, 255),
-					TaskID: task.ID,
-					Index:  int64(i),
-					RepoID: task.RepoID,
-					Status: StatusWaiting,
-				}
-			}
-			if _, err := e.Insert(steps); err != nil {
-				return err
-			}
-			task.Steps = steps
-		}
-
-		job.TaskID = task.ID
-		n, err := UpdateRunJob(ctx, job, builder.And(builder.Eq{"task_id": 0}, builder.Eq{"status": StatusWaiting}))
-		if err != nil {
-			return err
-		}
-		if n != 1 {
-			// Another runner claimed this job between our scan and this update;
-			// signal the outer loop to move on without treating this as an error.
-			return errJobAlreadyClaimed
-		}
-
-		task.Job = job
-		resultTask = task
-		return nil
-	})
-
-	if errors.Is(err, errJobAlreadyClaimed) {
-		return nil, false, nil
-	}
-	if err != nil {
+	var jobs []*ActionRunJob
+	if err := e.Where("task_id=? AND status=? AND is_reusable_caller=?", 0, StatusWaiting, false).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
 		return nil, false, err
 	}
-	return resultTask, true, nil
-}

-// ReleaseTaskForRunner reverts a freshly-claimed but undelivered task: it deletes
-// the task together with its steps and returns the job to the waiting queue. It is
-// used when assembling the runner response fails after the job was already claimed,
-// so the job is not stranded in running state with no runner ever executing it.
-func ReleaseTaskForRunner(ctx context.Context, task *ActionTask) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		e := db.GetEngine(ctx)
+	// TODO: a more efficient way to filter labels
+	var job *ActionRunJob
+	log.Trace("runner labels: %v", runner.AgentLabels)
+	for _, v := range jobs {
+		if runner.CanMatchLabels(v.RunsOn) {
+			job = v
+			break
+		}
+	}
+	if job == nil {
+		return nil, false, nil
+	}
+	if err := job.LoadAttributes(ctx); err != nil {
+		return nil, false, err
+	}

-		job, err := GetRunJobByRepoAndID(ctx, task.RepoID, task.JobID)
-		if err != nil {
-			return err
-		}
+	now := timeutil.TimeStampNow()
+	job.Started = now
+	job.Status = StatusRunning

-		job.Status = StatusWaiting
-		job.Started = 0
-		job.TaskID = 0
-		// Guard on task_id and status so we only release while the job still
-		// references this task and has not progressed past running.
-		n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": task.ID, "status": StatusRunning}, "status", "started", "task_id")
-		if err != nil {
-			return err
-		}
-		if n != 1 {
-			return fmt.Errorf("release task %d: job %d no longer references it", task.ID, task.JobID)
-		}
+	task := &ActionTask{
+		JobID:             job.ID,
+		Attempt:           job.Attempt,
+		RunnerID:          runner.ID,
+		Started:           now,
+		Status:            StatusRunning,
+		RepoID:            job.RepoID,
+		OwnerID:           job.OwnerID,
+		CommitSHA:         job.CommitSHA,
+		IsForkPullRequest: job.IsForkPullRequest,
+	}
+	task.GenerateAndFillToken()

-		if _, err := e.Delete(&ActionTaskStep{TaskID: task.ID}); err != nil {
-			return err
+	workflowJob, err := job.ParseJob()
+	if err != nil {
+		return nil, false, fmt.Errorf("load job %d: %w", job.ID, err)
+	}
+
+	if _, err := e.Insert(task); err != nil {
+		return nil, false, err
+	}
+
+	task.LogFilename = logFileName(job.Run.Repo.FullName(), task.ID)
+	if err := UpdateTask(ctx, task, "log_filename"); err != nil {
+		return nil, false, err
+	}
+
+	if len(workflowJob.Steps) > 0 {
+		steps := make([]*ActionTaskStep, len(workflowJob.Steps))
+		for i, v := range workflowJob.Steps {
+			steps[i] = &ActionTaskStep{
+				Name:   makeTaskStepDisplayName(v, 255),
+				TaskID: task.ID,
+				Index:  int64(i),
+				RepoID: task.RepoID,
+				Status: StatusWaiting,
+			}
 		}
-		if _, err := e.ID(task.ID).Delete(&ActionTask{}); err != nil {
-			return err
+		if _, err := e.Insert(steps); err != nil {
+			return nil, false, err
 		}
-		return nil
-	})
+		task.Steps = steps
+	}
+
+	job.TaskID = task.ID
+	if n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}); err != nil {
+		return nil, false, err
+	} else if n != 1 {
+		return nil, false, nil
+	}
+
+	task.Job = job
+
+	if err := committer.Commit(); err != nil {
+		return nil, false, err
+	}
+
+	return task, true, nil
 }

 func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
@@ -449,18 +347,6 @@ func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
 	return err
 }

-func getRunIDByTaskID(ctx context.Context, taskID int64) (runID int64, _ error) {
-	if has, err := db.GetEngine(ctx).Cols("action_run_job.run_id").
-		Table("action_task").
-		Join("INNER", "action_run_job", "action_run_job.id = action_task.job_id").
-		Where(builder.Eq{"action_task.id": taskID}).Get(&runID); err != nil {
-		return runID, err
-	} else if !has {
-		return runID, util.ErrNotExist
-	}
-	return runID, nil
-}
-
 // UpdateTaskByState updates the task by the state.
 // It will always update the task if the state is not final, even there is no change.
 // So it will update ActionTask.Updated to avoid the task being judged as a zombie task.
@@ -470,26 +356,21 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 		stepStates[v.Id] = v
 	}

-	// Only one request can update the task because the final state needs to be calculated with all job states.
-	// Otherwise, concurrent requests with transaction will make the SQL read stale job state and result in wrong final state.
-	taskID := state.Id
-	runID, err := getRunIDByTaskID(ctx, taskID)
-	if err != nil {
-		return nil, err
-	}
-	task := &ActionTask{}
-	applyState := func(ctx context.Context) error {
-		if has, err := db.GetEngine(ctx).ID(taskID).Get(task); err != nil {
-			return err
+	return db.WithTx2(ctx, func(ctx context.Context) (*ActionTask, error) {
+		e := db.GetEngine(ctx)
+
+		task := &ActionTask{}
+		if has, err := e.ID(state.Id).Get(task); err != nil {
+			return nil, err
 		} else if !has {
-			return util.ErrNotExist
+			return nil, util.ErrNotExist
 		} else if runnerID != task.RunnerID {
-			return errors.New("invalid runner for task")
+			return nil, errors.New("invalid runner for task")
 		}

 		if task.Status.IsDone() {
 			// the state is final, do nothing
-			return nil
+			return task, nil
 		}

 		// state.Result is not unspecified means the task is finished
@@ -502,7 +383,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			}
 			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
 			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
-				return err
+				return nil, err
 			}
 			if _, err := UpdateRunJob(ctx, &ActionRunJob{
 				ID:      task.JobID,
@@ -510,18 +391,18 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 				Status:  task.Status,
 				Stopped: task.Stopped,
 			}, nil, "status", "stopped"); err != nil {
-				return err
+				return nil, err
 			}
 		} else {
 			// Force update ActionTask.Updated to avoid the task being judged as a zombie task
 			task.Updated = timeutil.TimeStampNow()
 			if err := UpdateTask(ctx, task, "updated"); err != nil {
-				return err
+				return nil, err
 			}
 		}

 		if err := task.LoadAttributes(ctx); err != nil {
-			return err
+			return nil, err
 		}

 		for _, step := range task.Steps {
@@ -538,17 +419,13 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			} else if step.Started != 0 {
 				step.Status = StatusRunning
 			}
-			if _, err := db.GetEngine(ctx).ID(step.ID).Update(step); err != nil {
-				return err
+			if _, err := e.ID(step.ID).Update(step); err != nil {
+				return nil, err
 			}
 		}
-		return nil
-	}
-	err = globallock.LockAndDo(ctx, fmt.Sprintf("UpdateTaskByState-run-%d", runID), func(ctx context.Context) error {
-		// A half-written report leaves the task done with a running job, which no retry repairs.
-		return db.WithTx(ctx, applyState)
+
+		return task, nil
 	})
-	return task, err
 }

 func StopTask(ctx context.Context, taskID int64, status Status) error {
@@ -577,10 +454,6 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 			status = StatusCancelled
 		} else if !runner.HasCancellingSupport {
 			status = StatusCancelled
-		} else if task.Updated.AddDuration(taskReportTimeout) < now {
-			// A runner that stopped reporting will never acknowledge the cancellation either,
-			// so skip the handshake instead of waiting for the zombie task cleanup.
-			status = StatusCancelled
 		}
 	}

@@ -595,10 +468,7 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 			return err
 		}

-		// NoAutoTime keeps "updated" at the runner's last contact: re-cancelling an already
-		// cancelling task must not defer the timeout above or the zombie task cleanup.
-		_, err := e.ID(task.ID).Cols("status").NoAutoTime().Update(task)
-		return err
+		return UpdateTask(ctx, task, "status")
 	}

 	task.Status = status
@@ -4,15 +4,11 @@
 package actions

 import (
-	"context"
-	"errors"
 	"strings"
-	"sync/atomic"
 	"testing"

 	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
 	"gitea.dev/models/db"
-	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/timeutil"
@@ -20,24 +16,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/timestamppb"
-	"xorm.io/xorm/contexts"
 )

-func TestActionTask_GetRunJobLink(t *testing.T) {
-	repo := &repo_model.Repository{OwnerName: "org", Name: "consumer"}
-	run := &ActionRun{ID: 10, Repo: repo}
-	job := &ActionRunJob{ID: 42, Run: run}
-
-	// a task with a loaded job links to that specific job, not just the run
-	task := &ActionTask{Job: job}
-	assert.Equal(t, run.Link()+"/jobs/42", task.GetRunJobLink())
-
-	// missing job, run or repo yields an empty link instead of a broken URL
-	assert.Empty(t, (&ActionTask{}).GetRunJobLink())
-	assert.Empty(t, (&ActionTask{Job: &ActionRunJob{ID: 42}}).GetRunJobLink())
-	assert.Empty(t, (&ActionTask{Job: &ActionRunJob{ID: 42, Run: &ActionRun{ID: 10}}}).GetRunJobLink())
-}
-
 func TestMakeTaskStepDisplayName(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -103,11 +83,68 @@ func TestMakeTaskStepDisplayName(t *testing.T) {
 }

 func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
+	newRunningTask := func(t *testing.T) (*ActionTask, *ActionRunJob) {
+		t.Helper()
+
+		run := &ActionRun{
+			Title:         "cancelling-test-run",
+			RepoID:        1,
+			OwnerID:       2,
+			WorkflowID:    "test.yaml",
+			Index:         999,
+			TriggerUserID: 2,
+			Ref:           "refs/heads/master",
+			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+			Event:         "push",
+			TriggerEvent:  "push",
+			Status:        StatusRunning,
+			Started:       timeutil.TimeStampNow(),
+		}
+		require.NoError(t, db.Insert(t.Context(), run))
+
+		job := &ActionRunJob{
+			RunID:     run.ID,
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+			Name:      "cancelling-finalization-job",
+			Attempt:   1,
+			JobID:     "cancelling-finalization-job",
+			Status:    StatusRunning,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+
+		runner := &ActionRunner{
+			UUID:                 "runner-cancelling-supported",
+			Name:                 "runner-cancelling-supported",
+			HasCancellingSupport: true,
+		}
+		require.NoError(t, db.Insert(t.Context(), runner))
+
+		task := &ActionTask{
+			JobID:     job.ID,
+			Attempt:   1,
+			RunnerID:  runner.ID,
+			Status:    StatusRunning,
+			Started:   timeutil.TimeStampNow(),
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+		}
+		require.NoError(t, db.Insert(t.Context(), task))
+
+		job.TaskID = task.ID
+		_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+		require.NoError(t, err)
+
+		return task, job
+	}
+
 	testResult := func(t *testing.T, result runnerv1.Result) {
 		t.Helper()
 		require.NoError(t, unittest.PrepareTestDatabase())

-		task, job := newRunningTaskForCancelling(t, "cancelling-finalization-job", true)
+		task, job := newRunningTask(t)
 		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))

 		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
@@ -137,263 +174,8 @@ func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
 	})
 }

-// TestStopTaskCancellingFallsBackToCancelled covers the cases where the cancelling handshake can
-// never complete, so StopTask must cancel right away instead of waiting for the zombie task cleanup.
-func TestStopTaskCancellingFallsBackToCancelled(t *testing.T) {
-	assertCancelled := func(t *testing.T, task *ActionTask, job *ActionRunJob) {
-		t.Helper()
-
-		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-		assert.Equal(t, StatusCancelled, taskAfterStop.Status)
-		assert.NotZero(t, taskAfterStop.Stopped)
-
-		jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-		assert.Equal(t, StatusCancelled, jobAfterStop.Status)
-		assert.NotZero(t, jobAfterStop.Stopped)
-	}
-
-	// A runner too old to know the cancelling state can only be stopped by a final status.
-	t.Run("legacy runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "legacy-cancelling-job", false)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-	})
-
-	// The runner is gone, e.g. an ephemeral runner was cleaned up, so nobody can acknowledge.
-	t.Run("missing runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "missing-runner-cancelling-job", true)
-
-		_, err := db.DeleteByID[ActionRunner](t.Context(), task.RunnerID)
-		require.NoError(t, err)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-	})
-
-	// The runner went silent, e.g. it gave up while Gitea was restarting, so it never picks up the request.
-	t.Run("silent runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "silent-runner-cancelling-job", true)
-
-		// NoAutoTime because the point of the test is an "updated" older than xorm would write
-		task.Updated = timeutil.TimeStampNow().AddDuration(-2 * taskReportTimeout)
-		_, err := db.GetEngine(t.Context()).ID(task.ID).Cols("updated").NoAutoTime().Update(task)
-		require.NoError(t, err)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-
-		// A runner coming back still learns the outcome from the UpdateTask response,
-		// and its late result does not overwrite the cancellation.
-		late, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{
-			Id:        task.ID,
-			Result:    runnerv1.Result_RESULT_SUCCESS,
-			StoppedAt: timestamppb.Now(),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, StatusCancelled, late.Status)
-		assert.Equal(t, runnerv1.Result_RESULT_CANCELLED, late.Status.AsResult())
-	})
-}
-
-// TestStopTaskCancellingKeepsReportTime makes sure persisting the cancelling status does not refresh
-// "updated": re-cancelling would otherwise defer both the fallback to cancelled and the zombie task
-// cleanup, no matter how long the runner has been silent.
-func TestStopTaskCancellingKeepsReportTime(t *testing.T) {
+func TestStopTaskCancellingFallsBackForLegacyRunner(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
-	task, _ := newRunningTaskForCancelling(t, "repeated-cancelling-job", true)
-
-	// NoAutoTime because the point of the test is an "updated" older than xorm would write
-	lastReport := timeutil.TimeStampNow().AddDuration(-taskReportTimeout / 2)
-	task.Updated = lastReport
-	_, err := db.GetEngine(t.Context()).ID(task.ID).Cols("updated").NoAutoTime().Update(task)
-	require.NoError(t, err)
-
-	// the runner reported recently enough, so the task waits for it to acknowledge
-	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-	assert.Equal(t, StatusCancelling, taskAfterStop.Status)
-	assert.Equal(t, lastReport, taskAfterStop.Updated)
-
-	// cancelling it again does not reset the clock either
-	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-	taskAfterSecondStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-	assert.Equal(t, StatusCancelling, taskAfterSecondStop.Status)
-	assert.Equal(t, lastReport, taskAfterSecondStop.Updated)
-}
-
-// TestReleaseTaskForRunner verifies that releasing a freshly-claimed task returns
-// its job to the waiting queue and deletes the task and its steps, so a failure
-// while assembling the runner response cannot strand the job in running state.
-func TestReleaseTaskForRunner(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	run := &ActionRun{
-		Title:         "release-task-test-run",
-		RepoID:        1,
-		OwnerID:       2,
-		WorkflowID:    "test.yaml",
-		Index:         9902,
-		TriggerUserID: 2,
-		Ref:           "refs/heads/main",
-		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-		Event:         "push",
-		TriggerEvent:  "push",
-		Status:        StatusWaiting,
-	}
-	require.NoError(t, db.Insert(t.Context(), run))
-
-	job := &ActionRunJob{
-		RunID:           run.ID,
-		RepoID:          run.RepoID,
-		OwnerID:         run.OwnerID,
-		CommitSHA:       run.CommitSHA,
-		Name:            "release-job",
-		Attempt:         1,
-		JobID:           "release-job",
-		Status:          StatusWaiting,
-		RunsOn:          []string{"ubuntu-latest"},
-		WorkflowPayload: []byte("on: push\njobs:\n  release-job:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hi\n"),
-	}
-	require.NoError(t, db.Insert(t.Context(), job))
-
-	runner := &ActionRunner{
-		UUID:        "release-runner-uuid",
-		Name:        "release-runner",
-		AgentLabels: []string{"ubuntu-latest"},
-	}
-	runner.GenerateAndFillToken()
-	require.NoError(t, db.Insert(t.Context(), runner))
-
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.NotNil(t, task)
-
-	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-	require.Equal(t, StatusRunning, claimed.Status)
-	require.Equal(t, task.ID, claimed.TaskID)
-
-	require.NoError(t, ReleaseTaskForRunner(t.Context(), task))
-
-	// Job is back in the waiting queue with no task assigned.
-	released := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-	assert.Equal(t, StatusWaiting, released.Status)
-	assert.Zero(t, released.TaskID)
-	assert.Zero(t, released.Started)
-
-	// The task and its steps are gone.
-	unittest.AssertNotExistsBean(t, &ActionTask{ID: task.ID})
-	unittest.AssertNotExistsBean(t, &ActionTaskStep{TaskID: task.ID})
-}
-
-// TestCreateTaskForRunnerPagination verifies that a job sitting beyond the first page is still claimed
-func TestCreateTaskForRunnerPagination(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	defer func(orig int) { pickTaskBatchSize = orig }(pickTaskBatchSize)
-	pickTaskBatchSize = 2
-
-	run := &ActionRun{
-		Title:         "pagination-test-run",
-		RepoID:        1,
-		OwnerID:       2,
-		WorkflowID:    "test.yaml",
-		Index:         9903,
-		TriggerUserID: 2,
-		Ref:           "refs/heads/main",
-		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-		Event:         "push",
-		TriggerEvent:  "push",
-		Status:        StatusWaiting,
-	}
-	require.NoError(t, db.Insert(t.Context(), run))
-
-	// Five waiting jobs the runner cannot run, then one it can.
-	// With a page size of 2 the matching job only appears on the third page.
-	for i := range 5 {
-		mismatch := &ActionRunJob{
-			RunID:     run.ID,
-			RepoID:    run.RepoID,
-			OwnerID:   run.OwnerID,
-			CommitSHA: run.CommitSHA,
-			Name:      "mismatch-" + string(rune('a'+i)),
-			Attempt:   1,
-			JobID:     "mismatch-" + string(rune('a'+i)),
-			Status:    StatusWaiting,
-			RunsOn:    []string{"windows-latest"},
-		}
-		require.NoError(t, db.Insert(t.Context(), mismatch))
-	}
-
-	target := &ActionRunJob{
-		RunID:           run.ID,
-		RepoID:          run.RepoID,
-		OwnerID:         run.OwnerID,
-		CommitSHA:       run.CommitSHA,
-		Name:            "target-job",
-		Attempt:         1,
-		JobID:           "target-job",
-		Status:          StatusWaiting,
-		RunsOn:          []string{"ubuntu-latest"},
-		WorkflowPayload: []byte("on: push\njobs:\n  target-job:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hi\n"),
-	}
-	require.NoError(t, db.Insert(t.Context(), target))
-
-	runner := &ActionRunner{
-		UUID:        "pagination-runner-uuid",
-		Name:        "pagination-runner",
-		AgentLabels: []string{"ubuntu-latest"},
-	}
-	runner.GenerateAndFillToken()
-	require.NoError(t, db.Insert(t.Context(), runner))
-
-	task, ok, err := CreateTaskForRunner(t.Context(), runner)
-	require.NoError(t, err)
-	require.True(t, ok)
-	require.NotNil(t, task)
-
-	claimed := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: target.ID})
-	assert.Equal(t, StatusRunning, claimed.Status)
-	assert.Equal(t, task.ID, claimed.TaskID)
-}
-
-type failFirstStepWrite struct{ fired atomic.Bool }
-
-func (h *failFirstStepWrite) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
-	if !h.fired.Load() && strings.HasPrefix(c.SQL, "UPDATE") && strings.Contains(c.SQL, "action_task_step") {
-		h.fired.Store(true)
-		return nil, errors.New("interrupted")
-	}
-	return c.Ctx, nil
-}
-
-func (*failFirstStepWrite) AfterProcess(*contexts.ContextHook) error { return nil }
-
-// TestUpdateTaskByStateIsAtomic checks that an interrupted report writes nothing: a surviving task or
-// job write would hit the "state is final" early return, which no retry or cleanup repairs.
-func TestUpdateTaskByStateIsAtomic(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	task, job := newRunningTaskForCancelling(t, "atomic-report-job", true)
-	require.NoError(t, db.Insert(t.Context(), &ActionTaskStep{TaskID: task.ID, RepoID: task.RepoID, Status: StatusRunning}))
-	unittest.GetXORMEngine().AddHook(&failFirstStepWrite{})
-	finalState := &runnerv1.TaskState{Id: task.ID, Result: runnerv1.Result_RESULT_SUCCESS, StoppedAt: timestamppb.Now()}
-	_, err := UpdateTaskByState(t.Context(), task.RunnerID, finalState)
-	require.Error(t, err)
-	assert.Equal(t, StatusRunning, unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID}).Status)
-	assert.Equal(t, StatusRunning, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status)
-	_, err = UpdateTaskByState(t.Context(), task.RunnerID, finalState)
-	require.NoError(t, err)
-	assert.Equal(t, StatusSuccess, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status)
-}
-
-// newRunningTaskForCancelling inserts a running run/job/task assigned to a fresh runner,
-// which is the state every cancellation test starts from.
-func newRunningTaskForCancelling(t *testing.T, name string, hasCancellingSupport bool) (*ActionTask, *ActionRunJob) {
-	t.Helper()

 	run := &ActionRun{
 		Title:         "cancelling-test-run",
@@ -416,17 +198,17 @@ func newRunningTaskForCancelling(t *testing.T, name string, hasCancellingSupport
 		RepoID:    run.RepoID,
 		OwnerID:   run.OwnerID,
 		CommitSHA: run.CommitSHA,
-		Name:      name,
+		Name:      "legacy-cancelling-job",
 		Attempt:   1,
-		JobID:     name,
+		JobID:     "legacy-cancelling-job",
 		Status:    StatusRunning,
 	}
 	require.NoError(t, db.Insert(t.Context(), job))

 	runner := &ActionRunner{
-		UUID:                 name,
-		Name:                 name,
-		HasCancellingSupport: hasCancellingSupport,
+		UUID:                 "runner-legacy-no-cancelling",
+		Name:                 "runner-legacy-no-cancelling",
+		HasCancellingSupport: false,
 	}
 	require.NoError(t, db.Insert(t.Context(), runner))

@@ -446,5 +228,81 @@ func newRunningTaskForCancelling(t *testing.T, name string, hasCancellingSupport
 	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
 	require.NoError(t, err)

-	return task, job
+	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}
+
+func TestStopTaskCancellingFallsBackForMissingRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "missing-runner-cancelling-job",
+		Attempt:   1,
+		JobID:     "missing-runner-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-cleaned-up-before-cancel",
+		Name:                 "runner-cleaned-up-before-cancel",
+		HasCancellingSupport: true,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	_, err = db.DeleteByID[ActionRunner](t.Context(), runner.ID)
+	require.NoError(t, err)
+
+	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
 }
@@ -166,7 +166,7 @@ func (a *Action) TableIndices() []*schemas.Index {
 	cudIndex.AddColumn("created_unix", "user_id", "is_deleted")

 	cuIndex := schemas.NewIndex("c_u", schemas.IndexType)
-	cuIndex.AddColumn("user_id", "is_deleted", "created_unix")
+	cuIndex.AddColumn("user_id", "is_deleted")

 	actUserUserIndex := schemas.NewIndex("au_c_u", schemas.IndexType)
 	actUserUserIndex.AddColumn("act_user_id", "created_unix", "user_id")
@@ -18,8 +18,6 @@ import (
 	"gitea.dev/modules/structs"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
-
-	"xorm.io/builder"
 )

 // Task represents a task
@@ -174,13 +172,17 @@ func (err ErrTaskDoesNotExist) Unwrap() error {

 // GetMigratingTask returns the migrating task by repo's id
 func GetMigratingTask(ctx context.Context, repoID int64) (*Task, error) {
-	task, has, err := db.Get[Task](ctx, builder.Eq{"repo_id": repoID, "`type`": structs.TaskTypeMigrateRepo})
+	task := Task{
+		RepoID: repoID,
+		Type:   structs.TaskTypeMigrateRepo,
+	}
+	has, err := db.GetEngine(ctx).Get(&task)
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, ErrTaskDoesNotExist{0, repoID, structs.TaskTypeMigrateRepo}
+		return nil, ErrTaskDoesNotExist{0, repoID, task.Type}
 	}
-	return task, nil
+	return &task, nil
 }

 // CreateTask creates a task on database
@@ -36,18 +36,7 @@ import (

 const ssh2keyStart = "---- BEGIN SSH2 PUBLIC KEY ----"

-const (
-	// the longest RSA key ssh-keygen allows to generate is 16384 bits (2048 bytes), we still relax the limit a little here
-	maxKeyBinaryBytes        = 4096
-	maxKeyContentBase64Bytes = maxKeyBinaryBytes * 4 / 3
-	maxKeyContentExtraBytes  = 4 * 1024 // header, footer, comment
-	maxKeyContentBytes       = maxKeyContentBase64Bytes + maxKeyContentExtraBytes
-)
-
 func extractTypeFromBase64Key(key string) (string, error) {
-	if len(key) > maxKeyContentBase64Bytes {
-		return "", util.NewInvalidArgumentErrorf("SSH public key base64 is too long")
-	}
 	b, err := base64.StdEncoding.DecodeString(key)
 	if err != nil || len(b) < 4 {
 		return "", fmt.Errorf("invalid key format: %w", err)
@@ -63,10 +52,6 @@ func extractTypeFromBase64Key(key string) (string, error) {

 // parseKeyString parses any key string in OpenSSH or SSH2 format to clean OpenSSH string (RFC4253).
 func parseKeyString(content string) (string, error) {
-	if len(content) > maxKeyContentBytes {
-		return "", util.NewInvalidArgumentErrorf("SSH public key content is too long")
-	}
-
 	// remove whitespace at start and end
 	content = strings.TrimSpace(content)

@@ -78,8 +63,6 @@ func parseKeyString(content string) (string, error) {
 		// Transform all legal line endings to a single "\n".
 		content = strings.NewReplacer("\r\n", "\n", "\r", "\n").Replace(content)

-		var b strings.Builder
-		b.Grow(len(content))
 		lines := strings.Split(content, "\n")
 		continuationLine := false

@@ -91,10 +74,9 @@ func parseKeyString(content string) (string, error) {
 			if continuationLine || strings.ContainsAny(line, ":-") {
 				continuationLine = strings.HasSuffix(line, "\\")
 			} else {
-				b.WriteString(line)
+				keyContent += line
 			}
 		}
-		keyContent = b.String()

 		t, err := extractTypeFromBase64Key(keyContent)
 		if err != nil {
@@ -473,20 +473,10 @@ func runErr(t *testing.T, stdin []byte, args ...string) {
 	}
 }

-func TestPublicKeysAreExternallyManaged(t *testing.T) {
+func Test_PublicKeysAreExternallyManaged(t *testing.T) {
 	key1 := unittest.AssertExistsAndLoadBean(t, &PublicKey{ID: 1})
 	externals, err := PublicKeysAreExternallyManaged(t.Context(), []*PublicKey{key1})
 	assert.NoError(t, err)
 	assert.Len(t, externals, 1)
 	assert.False(t, externals[0])
 }
-
-// TestCheckPublicKeyStringOversized tests if oversized SSH2 public key strings are rejected before triggering costly operations.
-func TestCheckPublicKeyStringOversized(t *testing.T) {
-	_, err := parseKeyString(strings.Repeat("a", maxKeyContentBytes+1))
-	assert.ErrorContains(t, err, "SSH public key content is too long")
-
-	content := "---- BEGIN SSH2 PUBLIC KEY ----\n" + strings.Repeat("a", maxKeyContentBase64Bytes+1) + "\n--- END SSH2 PUBLIC KEY ----"
-	_, err = parseKeyString(content)
-	assert.ErrorContains(t, err, "SSH public key base64 is too long")
-}
@@ -304,36 +304,6 @@ func (s AccessTokenScope) PublicOnly() (bool, error) {
 	return bitmap.hasScope(AccessTokenScopePublicOnly)
 }

-// CanCreateChildScope reports whether a request authenticated by this (parent) scope may mint a token
-// carrying the child scope. It rejects any grantable scope the parent does not hold, closing the
-// scope-escalation path. public-only is a restriction rather than a grantable permission, so it is
-// ignored here (a child may always be public-only); EnforcePublicOnlyFrom handles carrying it down.
-func (s AccessTokenScope) CanCreateChildScope(child AccessTokenScope) (bool, error) {
-	requested := child.StringSlice()
-	scopes := make([]AccessTokenScope, 0, len(requested))
-	for _, sc := range requested {
-		childScope := AccessTokenScope(sc)
-		if childScope == AccessTokenScopePublicOnly {
-			continue
-		}
-		scopes = append(scopes, childScope)
-	}
-	return s.HasScope(scopes...)
-}
-
-// EnforcePublicOnlyFrom adds the public-only restriction to s when the authorizing parent scope is
-// public-only, so a public-only token cannot mint a child token that drops the restriction.
-func (s AccessTokenScope) EnforcePublicOnlyFrom(parent AccessTokenScope) (AccessTokenScope, error) {
-	publicOnly, err := parent.PublicOnly()
-	if err != nil {
-		return "", err
-	}
-	if !publicOnly {
-		return s, nil
-	}
-	return AccessTokenScope(string(s) + "," + string(AccessTokenScopePublicOnly)).Normalize()
-}
-
 // HasScope returns true if the string has the given scope
 func (s AccessTokenScope) HasScope(scopes ...AccessTokenScope) (bool, error) {
 	bitmap, err := s.parse()
@@ -89,26 +89,3 @@ func TestAccessTokenScope_HasScope(t *testing.T) {
 		})
 	}
 }
-
-func TestAccessTokenScope_EnforcePublicOnlyFrom(t *testing.T) {
-	tests := []struct {
-		in     AccessTokenScope
-		parent AccessTokenScope
-		out    AccessTokenScope
-	}{
-		// public-only parent forces the restriction onto the minted scope
-		{"write:user", "write:user,public-only", "public-only,write:user"},
-		// already public-only stays public-only
-		{"public-only,read:user", "public-only", "public-only,read:user"},
-		// non-public-only parent leaves the scope untouched
-		{"write:user", "write:user", "write:user"},
-		{"all", "all", "all"},
-	}
-	for _, test := range tests {
-		t.Run(string(test.parent)+"->"+string(test.in), func(t *testing.T) {
-			got, err := test.in.EnforcePublicOnlyFrom(test.parent)
-			assert.NoError(t, err)
-			assert.Equal(t, test.out, got)
-		})
-	}
-}
@@ -83,11 +83,6 @@ func BuiltinApplications() map[string]*BuiltinOAuth2Application {
 		DisplayName:  "tea",
 		RedirectURIs: []string{"http://127.0.0.1", "https://127.0.0.1"},
 	}
-	m["b757811a-05c8-4c76-8d74-a5ee3d2073f2"] = &BuiltinOAuth2Application{
-		ConfigName:   "gitea-app",
-		DisplayName:  "Gitea App",
-		RedirectURIs: []string{"com.gitea.app://oauth/callback"},
-	}
 	return m
 }

@@ -20,7 +20,6 @@ import (
 	"gitea.dev/modules/setting"

 	"strk.kbt.io/projects/go/libravatar"
-	"xorm.io/builder"
 )

 const (
@@ -100,13 +99,12 @@ func HashEmail(email string) string {
 // GetEmailForHash converts a provided md5sum to the email
 func GetEmailForHash(ctx context.Context, md5Sum string) (string, error) {
 	return cache.GetString("Avatar:"+md5Sum, func() (string, error) {
-		emailHash, has, err := db.Get[EmailHash](ctx, builder.Eq{"`hash`": strings.ToLower(strings.TrimSpace(md5Sum))})
-		if err != nil {
-			return "", err
-		} else if !has {
-			return "", nil
+		emailHash := EmailHash{
+			Hash: strings.ToLower(strings.TrimSpace(md5Sum)),
 		}
-		return emailHash.Email, nil
+
+		_, err := db.GetEngine(ctx).Get(&emailHash)
+		return emailHash.Email, err
 	})
 }

@@ -323,7 +323,13 @@ type RenamedBranch struct {

 // FindRenamedBranch check if a branch was renamed
 func FindRenamedBranch(ctx context.Context, repoID int64, from string) (branch *RenamedBranch, exist bool, err error) {
-	return db.Get[RenamedBranch](ctx, builder.Eq{"repo_id": repoID, "`from`": from})
+	branch = &RenamedBranch{
+		RepoID: repoID,
+		From:   from,
+	}
+	exist, err = db.GetEngine(ctx).Get(branch)
+
+	return branch, exist, err
 }

 // RenameBranch rename a branch
@@ -126,7 +126,8 @@ func GetLFSMetaObjectByOid(ctx context.Context, repoID int64, oid string) (*LFSM
 		return nil, ErrLFSObjectNotExist
 	}

-	m, has, err := db.Get[LFSMetaObject](ctx, builder.Eq{"repository_id": repoID, "oid": oid})
+	m := &LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}, RepositoryID: repoID}
+	has, err := db.GetEngine(ctx).Get(m)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -507,7 +507,7 @@ func updateApprovalWhitelist(ctx context.Context, repo *repo_model.Repository, c
 		return currentWhitelist, nil
 	}

-	prUserIDs, err := access_model.GetUserIDsWithAnyUnitAccess(ctx, repo, perm.AccessModeRead, unit.TypePullRequests)
+	prUserIDs, err := access_model.GetUserIDsWithUnitAccess(ctx, repo, perm.AccessModeRead, unit.TypePullRequests)
 	if err != nil {
 		return nil, err
 	}
@@ -13,8 +13,6 @@ import (
 	"gitea.dev/models/organization"
 	"gitea.dev/modules/glob"
 	"gitea.dev/modules/timeutil"
-
-	"xorm.io/builder"
 )

 // ProtectedTag struct
@@ -113,7 +111,8 @@ func GetProtectedTagByID(ctx context.Context, id int64) (*ProtectedTag, error) {

 // GetProtectedTagByNamePattern gets protected tag by name_pattern
 func GetProtectedTagByNamePattern(ctx context.Context, repoID int64, pattern string) (*ProtectedTag, error) {
-	tag, has, err := db.Get[ProtectedTag](ctx, builder.Eq{"name_pattern": pattern, "repo_id": repoID})
+	tag := &ProtectedTag{NamePattern: pattern, RepoID: repoID}
+	has, err := db.GetEngine(ctx).Get(tag)
 	if err != nil {
 		return nil, err
 	}
@@ -7,7 +7,6 @@ import (
 	"context"

 	"gitea.dev/models/user"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/log"
 )
@@ -34,18 +33,11 @@ func BuildAvatarStackData(ctx context.Context, allParticipants []*git.CommitIden
 	ret := &AvatarStackData{
 		Participants: make([]*CommitParticipant, 0, len(allParticipants)),
 	}
-	uniqueUserIDs := make(container.Set[int64])
 	for _, p := range allParticipants {
 		var giteaUser *user.User
 		if emailUserMap != nil {
 			giteaUser = emailUserMap.GetByEmail(p.Email)
 		}
-		if giteaUser != nil {
-			// identities without a Gitea account can only be compared by their git identity
-			if !uniqueUserIDs.Add(giteaUser.ID) {
-				continue
-			}
-		}
 		ret.Participants = append(ret.Participants, &CommitParticipant{GiteaUser: giteaUser, GitIdentity: p})
 	}
 	return ret
@@ -39,7 +39,8 @@ func GetUserCommitsByGitCommits(ctx context.Context, gitCommits []*git.Commit, r
 	emailSet := make(container.Set[string])
 	for _, c := range gitCommits {
 		emailSet.Add(c.Author.Email)
-		for _, p := range c.AllAuthorIdentities() {
+		emailSet.Add(c.Committer.Email)
+		for _, p := range c.AllParticipantIdentities() {
 			emailSet.Add(p.Email)
 		}
 	}
@@ -54,7 +55,7 @@ func GetUserCommitsByGitCommits(ctx context.Context, gitCommits []*git.Commit, r
 		uc := &UserCommit{
 			AuthorUser:      emailUserMap.GetByEmail(c.Author.Email), // FIXME: why GetUserCommitsByGitCommits uses "Author", but ParseCommitsWithSignature uses "Committer"?
 			GitCommit:       c,
-			AvatarStackData: BuildAvatarStackData(ctx, c.AllAuthorIdentities(), emailUserMap),
+			AvatarStackData: BuildAvatarStackData(ctx, c.AllParticipantIdentities(), emailUserMap),
 		}
 		uc.AvatarStackData.SearchByEmailLink = searchByEmailLink
 		userCommits = append(userCommits, uc)
@@ -27,7 +27,6 @@ import (
 	"gitea.dev/modules/markup"
 	"gitea.dev/modules/optional"
 	"gitea.dev/modules/references"
-	"gitea.dev/modules/setting"
 	"gitea.dev/modules/structs"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/translation"
@@ -544,9 +543,6 @@ func (c *Comment) GetSanitizedContentHTML() template.HTML {

 // LoadLabel if comment.Type is CommentTypeLabel, then load Label
 func (c *Comment) LoadLabel(ctx context.Context) error {
-	if c.LabelID == 0 {
-		return nil
-	}
 	var label Label
 	has, err := db.GetEngine(ctx).ID(c.LabelID).Get(&label)
 	if err != nil {
@@ -554,8 +550,8 @@ func (c *Comment) LoadLabel(ctx context.Context) error {
 	} else if has {
 		c.Label = &label
 	} else {
-		// label was deleted but comment rows referencing it were not cleaned up
-		log.Debug("Comment %d references deleted label %d", c.ID, c.LabelID)
+		// Ignore Label is deleted, but not clear this table
+		log.Warn("Commit %d cannot load label %d", c.ID, c.LabelID)
 	}

 	return nil
@@ -630,18 +626,11 @@ func UpdateCommentAttachments(ctx context.Context, c *Comment, uuids []string) e
 		return nil
 	}
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		issue, err := GetIssueByID(ctx, c.IssueID)
-		if err != nil {
-			return err
-		}
 		attachments, err := repo_model.GetAttachmentsByUUIDs(ctx, uuids)
 		if err != nil {
 			return fmt.Errorf("getAttachmentsByUUIDs [uuids: %v]: %w", uuids, err)
 		}
 		for i := range attachments {
-			if err := validateAttachmentForIssue(ctx, issue, attachments[i]); err != nil {
-				return err
-			}
 			attachments[i].IssueID = c.IssueID
 			attachments[i].CommentID = c.ID
 			if err := repo_model.UpdateAttachment(ctx, attachments[i]); err != nil {
@@ -654,18 +643,36 @@ func UpdateCommentAttachments(ctx context.Context, c *Comment, uuids []string) e
 }

 // LoadAssigneeUserAndTeam if comment.Type is CommentTypeAssignees, then load assignees
-func (c *Comment) LoadAssigneeUserAndTeam(ctx context.Context) (err error) {
+func (c *Comment) LoadAssigneeUserAndTeam(ctx context.Context) error {
+	var err error
+
 	if c.AssigneeID > 0 && c.Assignee == nil {
-		_, c.Assignee, err = user_model.GetPossibleUserByID(ctx, c.AssigneeID)
+		c.Assignee, err = user_model.GetUserByID(ctx, c.AssigneeID)
 		if err != nil {
+			if !user_model.IsErrUserNotExist(err) {
+				return err
+			}
+			c.Assignee = user_model.NewGhostUser()
+		}
+	} else if c.AssigneeTeamID > 0 && c.AssigneeTeam == nil {
+		if err = c.LoadIssue(ctx); err != nil {
 			return err
 		}
-	}
-	if c.AssigneeTeamID > 0 && c.AssigneeTeam == nil {
-		_, c.AssigneeTeam, err = organization.GetPossibleTeamByID(ctx, c.AssigneeTeamID)
-		if err != nil {
+
+		if err = c.Issue.LoadRepo(ctx); err != nil {
 			return err
 		}
+
+		if err = c.Issue.Repo.LoadOwner(ctx); err != nil {
+			return err
+		}
+
+		if c.Issue.Repo.Owner.IsOrganization() {
+			c.AssigneeTeam, err = organization.GetTeamByID(ctx, c.AssigneeTeamID)
+			if err != nil && !organization.IsErrTeamNotExist(err) {
+				return err
+			}
+		}
 	}
 	return nil
 }
@@ -788,7 +795,8 @@ func (c *Comment) MetaSpecialDoerTr(locale translation.Locale) template.HTML {
 }

 func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdStr template.HTML) template.HTML {
-	if c.Assignee != nil {
+	if c.AssigneeID > 0 {
+		// it guarantees LoadAssigneeUserAndTeam has been called, and c.Assignee is Ghost user but not nil if the user doesn't exist
 		if c.RemovedAssignee {
 			if c.PosterID == c.AssigneeID {
 				return locale.Tr("repo.issues.review.remove_review_request_self", createdStr)
@@ -797,20 +805,14 @@ func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdSt
 		}
 		return locale.Tr("repo.issues.review.add_review_request", c.Assignee.GetDisplayName(), createdStr)
 	}
+	teamName := "Ghost Team"
 	if c.AssigneeTeam != nil {
-		if c.RemovedAssignee {
-			return locale.Tr("repo.issues.review.remove_review_request", c.AssigneeTeam.Name, createdStr)
-		}
-		return locale.Tr("repo.issues.review.add_review_request", c.AssigneeTeam.Name, createdStr)
+		teamName = c.AssigneeTeam.Name
 	}
-
-	// impossible fallback
-	assigneePrompt := fmt.Sprintf("(AssigneeID=%d, AssigneeTeamID=%d)", c.AssigneeID, c.AssigneeTeam.ID)
-	setting.PanicInDevOrTesting("unknown timeline pull request review event comment: id=%d, %s", c.ID, assigneePrompt)
 	if c.RemovedAssignee {
-		return locale.Tr("repo.issues.review.remove_review_request", assigneePrompt, createdStr)
+		return locale.Tr("repo.issues.review.remove_review_request", teamName, createdStr)
 	}
-	return locale.Tr("repo.issues.review.add_review_request", assigneePrompt, createdStr)
+	return locale.Tr("repo.issues.review.add_review_request", teamName, createdStr)
 }

 // CreateComment creates comment with context
@@ -79,14 +79,6 @@ func findCodeComments(ctx context.Context, opts FindCommentsOptions, issue *Issu
 		return nil, err
 	}

-	if err := comments.loadResolveDoers(ctx); err != nil {
-		return nil, err
-	}
-
-	if err := comments.loadReactions(ctx, issue.Repo); err != nil {
-		return nil, err
-	}
-
 	// Find all reviews by ReviewID
 	reviews := make(map[int64]*Review)
 	ids := make([]int64, 0, len(comments))
@@ -115,6 +107,14 @@ func findCodeComments(ctx context.Context, opts FindCommentsOptions, issue *Issu
 		comments[n] = comment
 		n++

+		if err := comment.LoadResolveDoer(ctx); err != nil {
+			return nil, err
+		}
+
+		if err := comment.LoadReactions(ctx, issue.Repo); err != nil {
+			return nil, err
+		}
+
 		var err error
 		rctx := renderhelper.NewRenderContextRepoComment(ctx, issue.Repo, renderhelper.RepoCommentOptions{
 			FootnoteContextID: strconv.FormatInt(comment.ID, 10),
@@ -11,7 +11,6 @@ import (
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
-	"gitea.dev/modules/setting"
 )

 // CommentList defines a list of comments
@@ -81,7 +80,7 @@ func (comments CommentList) loadLabels(ctx context.Context) error {
 	}

 	for _, comment := range comments {
-		comment.Label = commentLabels[comment.LabelID]
+		comment.Label = commentLabels[comment.ID]
 	}
 	return nil
 }
@@ -445,73 +444,6 @@ func (comments CommentList) loadReviews(ctx context.Context) error {
 	return nil
 }

-// loadResolveDoers bulk-loads the resolve doer for all code comments that have one.
-func (comments CommentList) loadResolveDoers(ctx context.Context) error {
-	resolveDoerIDs := container.FilterSlice(comments, func(c *Comment) (int64, bool) {
-		return c.ResolveDoerID, c.ResolveDoerID != 0 && c.Type == CommentTypeCode
-	})
-	if len(resolveDoerIDs) == 0 {
-		return nil
-	}
-
-	userMaps, err := user_model.GetUsersMapByIDs(ctx, resolveDoerIDs)
-	if err != nil {
-		return err
-	}
-
-	for _, comment := range comments {
-		if comment.ResolveDoerID == 0 || comment.Type != CommentTypeCode {
-			continue
-		}
-		if u, ok := userMaps[comment.ResolveDoerID]; ok {
-			comment.ResolveDoer = u
-		} else {
-			comment.ResolveDoer = user_model.NewGhostUser()
-		}
-	}
-	return nil
-}
-
-// loadReactions bulk-loads reactions for all comments in the list.
-func (comments CommentList) loadReactions(ctx context.Context, repo *repo_model.Repository) error {
-	if len(comments) == 0 {
-		return nil
-	}
-
-	commentIDs := container.FilterSlice(comments, func(c *Comment) (int64, bool) {
-		return c.ID, c.Reactions == nil
-	})
-	if len(commentIDs) == 0 {
-		return nil
-	}
-
-	var allReactions ReactionList
-	if err := db.GetEngine(ctx).
-		Where("`comment_id` > 0").
-		In("comment_id", commentIDs).
-		In("`type`", setting.UI.Reactions).
-		Asc("issue_id", "comment_id", "created_unix", "id").
-		Find(&allReactions); err != nil {
-		return err
-	}
-
-	if _, err := allReactions.LoadUsers(ctx, repo); err != nil {
-		return err
-	}
-
-	reactByComment := make(map[int64]ReactionList, len(commentIDs))
-	for _, r := range allReactions {
-		reactByComment[r.CommentID] = append(reactByComment[r.CommentID], r)
-	}
-
-	for _, comment := range comments {
-		if comment.Reactions == nil {
-			comment.Reactions = reactByComment[comment.ID]
-		}
-	}
-	return nil
-}
-
 // LoadAttributes loads attributes of the comments, except for attachments and
 // comments
 func (comments CommentList) LoadAttributes(ctx context.Context) (err error) {
@@ -45,27 +45,12 @@ func TestCreateComment(t *testing.T) {
 	unittest.AssertInt64InRange(t, now, then, int64(updatedIssue.UpdatedUnix))
 }

-func TestLoadAssigneeUserAndTeam_DeletedTeamBecomesGhostTeam(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 15})
-	comment := &issues_model.Comment{
-		Type:           issues_model.CommentTypeAssignees,
-		IssueID:        issue.ID,
-		AssigneeTeamID: 999999, // non-existing team ID
-	}
-	assert.NoError(t, comment.LoadAssigneeUserAndTeam(t.Context()))
-	assert.NotNil(t, comment.AssigneeTeam)
-	assert.EqualValues(t, -1, comment.AssigneeTeam.ID)
-}
-
 func Test_UpdateCommentAttachment(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())

 	comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 1})
-	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: comment.IssueID})
 	attachment := repo_model.Attachment{
-		RepoID: issue.RepoID, // must match the comment's repo, else the cross-repo guard rejects it
-		Name:   "test.txt",
+		Name: "test.txt",
 	}
 	assert.NoError(t, db.Insert(t.Context(), &attachment))

@@ -361,8 +361,8 @@ func (issue *Issue) ResetAttributesLoaded() {

 // GetIsRead load the `IsRead` field of the issue
 func (issue *Issue) GetIsRead(ctx context.Context, userID int64) error {
-	issueUser, has, err := db.Get[IssueUser](ctx, builder.Eq{"issue_id": issue.ID, "uid": userID})
-	if err != nil {
+	issueUser := &IssueUser{IssueID: issue.ID, UID: userID}
+	if has, err := db.GetEngine(ctx).Get(issueUser); err != nil {
 		return err
 	} else if !has {
 		issue.IsRead = false
@@ -499,7 +499,11 @@ func GetIssueByIndex(ctx context.Context, repoID, index int64) (*Issue, error) {
 	if index < 1 {
 		return nil, ErrIssueNotExist{}
 	}
-	issue, has, err := db.Get[Issue](ctx, builder.Eq{"repo_id": repoID, "`index`": index})
+	issue := &Issue{
+		RepoID: repoID,
+		Index:  index,
+	}
+	has, err := db.GetEngine(ctx).Get(issue)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -591,12 +591,9 @@ func (issues IssueList) GetApprovalCounts(ctx context.Context) (map[int64][]*Rev

 func (issues IssueList) LoadIsRead(ctx context.Context, userID int64) error {
 	issueIDs := issues.getIssueIDs()
-	if len(issueIDs) == 0 {
-		return nil
-	}
 	issueUsers := make([]*IssueUser, 0, len(issueIDs))
 	if err := db.GetEngine(ctx).Where("uid =?", userID).
-		In("issue_id", issueIDs).
+		In("issue_id").
 		Find(&issueUsers); err != nil {
 		return err
 	}
@@ -11,7 +11,6 @@ import (
 	"gitea.dev/modules/setting"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestIssueList_LoadRepositories(t *testing.T) {
@@ -31,22 +30,6 @@ func TestIssueList_LoadRepositories(t *testing.T) {
 	}
 }

-func TestIssueList_LoadIsRead(t *testing.T) {
-	// Regression: In("issue_id") was missing the issueIDs argument, causing
-	// xorm to generate "0=1" and never mark any issue as read.
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	issue1 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
-	issue2 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 2})
-
-	// Fixture: uid=1 has is_read=true on issue 1 only.
-	issueList := issues_model.IssueList{issue1, issue2}
-	require.NoError(t, issueList.LoadIsRead(t.Context(), 1))
-
-	assert.True(t, issue1.IsRead, "issue 1 should be marked read for user 1")
-	assert.False(t, issue2.IsRead, "issue 2 should not be marked read for user 1")
-}
-
 func TestIssueList_LoadAttributes(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	setting.Service.EnableTimetracking = true
@@ -220,7 +220,7 @@ func applyRepoConditions(sess db.Session, opts *IssuesOptions) {
 		if opts.RepoCond == nil {
 			opts.RepoCond = builder.NewCond()
 		}
-		opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(repo_model.PublicRepoUnderPublicOwnerCond())))
+		opts.RepoCond = opts.RepoCond.Or(builder.In("issue.repo_id", builder.Select("id").From("repository").Where(builder.Eq{"is_private": false})))
 	}
 	if opts.RepoCond != nil {
 		sess.And(opts.RepoCond)
@@ -263,46 +263,14 @@ func AddDeletePRBranchComment(ctx context.Context, doer *user_model.User, repo *
 	return err
 }

-// validateAttachmentForIssue rejects a foreign or already-linked attachment before it is linked to
-// issue: a known UUID could otherwise re-link (and expose) another repo's private attachment. A
-// legacy attachment predating repo_id-on-upload is adopted into the issue's repo.
-func validateAttachmentForIssue(ctx context.Context, issue *Issue, attachment *repo_model.Attachment) error {
-	if attachment.RepoID == 0 && attachment.CreatedUnix < repo_model.LegacyAttachmentMissingRepoIDCutoff {
-		attachment.RepoID = issue.RepoID
-		if err := repo_model.UpdateAttachmentByUUID(ctx, attachment, "repo_id"); err != nil {
-			return fmt.Errorf("update attachment repo_id [id: %d]: %w", attachment.ID, err)
-		}
-	}
-	if attachment.RepoID != issue.RepoID {
-		return util.NewPermissionDeniedErrorf("attachment belongs to a different repository")
-	}
-	if attachment.IssueID != 0 && attachment.IssueID != issue.ID {
-		return util.NewPermissionDeniedErrorf("attachment is already linked to another issue")
-	}
-	if attachment.ReleaseID != 0 {
-		return util.NewPermissionDeniedErrorf("attachment is already linked to a release")
-	}
-	return nil
-}
-
 // UpdateIssueAttachments update attachments by UUIDs for the issue
 func UpdateIssueAttachments(ctx context.Context, issueID int64, uuids []string) (err error) {
-	if len(uuids) == 0 {
-		return nil
-	}
 	return db.WithTx(ctx, func(ctx context.Context) error {
-		issue, err := GetIssueByID(ctx, issueID)
-		if err != nil {
-			return err
-		}
 		attachments, err := repo_model.GetAttachmentsByUUIDs(ctx, uuids)
 		if err != nil {
 			return fmt.Errorf("getAttachmentsByUUIDs [uuids: %v]: %w", uuids, err)
 		}
 		for i := range attachments {
-			if err := validateAttachmentForIssue(ctx, issue, attachments[i]); err != nil {
-				return err
-			}
 			attachments[i].IssueID = issueID
 			if err := repo_model.UpdateAttachment(ctx, attachments[i]); err != nil {
 				return fmt.Errorf("update attachment [id: %d]: %w", attachments[i].ID, err)
@@ -631,7 +599,7 @@ func ResolveIssueMentionsByVisibility(ctx context.Context, issue *Issue, doer *u
 					resolved[issue.Repo.Owner.LowerName+"/"+team.LowerName] = true
 					continue
 				}
-				has, err := db.Exist[organization.TeamUnit](ctx, builder.Eq{"org_id": issue.Repo.Owner.ID, "team_id": team.ID, "`type`": unittype})
+				has, err := db.GetEngine(ctx).Get(&organization.TeamUnit{OrgID: issue.Repo.Owner.ID, TeamID: team.ID, Type: unittype})
 				if err != nil {
 					return nil, fmt.Errorf("get team units (%d): %w", team.ID, err)
 				}
@@ -1,33 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package issues_test
-
-import (
-	"testing"
-
-	issues_model "gitea.dev/models/issues"
-	repo_model "gitea.dev/models/repo"
-	"gitea.dev/models/unittest"
-	"gitea.dev/modules/util"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestUpdateIssueAttachmentsCrossRepo(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	// attachment id 2 belongs to repo 2 / issue 4; issue 1 lives in repo 1
-	issue1 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
-	foreign := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 2})
-	require.NotEqual(t, issue1.RepoID, foreign.RepoID)
-
-	// re-linking a foreign repo's attachment by UUID must be rejected
-	err := issues_model.UpdateIssueAttachments(t.Context(), issue1.ID, []string{foreign.UUID})
-	assert.ErrorIs(t, err, util.ErrPermissionDenied)
-
-	// the foreign attachment must be left untouched
-	reloaded := unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{ID: 2})
-	assert.Equal(t, foreign.IssueID, reloaded.IssueID)
-}
@@ -13,8 +13,6 @@ import (
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/references"
-
-	"xorm.io/builder"
 )

 type crossReference struct {
@@ -191,11 +189,11 @@ func (issue *Issue) updateCrossReferenceList(list []*crossReference, xref *cross
 func (issue *Issue) verifyReferencedIssue(stdCtx context.Context, ctx *crossReferencesContext, repo *repo_model.Repository,
 	ref references.IssueReference,
 ) (*Issue, references.XRefAction, error) {
+	refIssue := &Issue{RepoID: repo.ID, Index: ref.Index}
 	refAction := ref.Action
-	refIssue, has, err := db.Get[Issue](stdCtx, builder.Eq{"repo_id": repo.ID, "`index`": ref.Index})
-	if err != nil {
-		return nil, references.XRefActionNone, err
-	} else if !has {
+	e := db.GetEngine(stdCtx)
+
+	if has, _ := e.Get(refIssue); !has {
 		return nil, references.XRefActionNone, nil
 	}
 	if err := refIssue.LoadRepo(stdCtx); err != nil {
@@ -5,11 +5,8 @@
 package issues

 import (
-	"cmp"
 	"context"
-	"errors"
 	"fmt"
-	"math"
 	"slices"
 	"strconv"
 	"strings"
@@ -30,6 +27,12 @@ type ErrRepoLabelNotExist struct {
 	RepoID  int64
 }

+// IsErrRepoLabelNotExist checks if an error is a RepoErrLabelNotExist.
+func IsErrRepoLabelNotExist(err error) bool {
+	_, ok := err.(ErrRepoLabelNotExist)
+	return ok
+}
+
 func (err ErrRepoLabelNotExist) Error() string {
 	return fmt.Sprintf("label does not exist [label_id: %d, repo_id: %d]", err.LabelID, err.RepoID)
 }
@@ -193,42 +196,6 @@ func (l *Label) ExclusiveScope() string {
 	return l.Name[:lastIndex]
 }

-// CompareLabelForDisplay compares labels for displaying them in dropdowns or lists.
-// Labels are grouped by their exclusive scope, and labels within the same scope
-// are sorted by their exclusive order, where unordered labels (order 0) come last.
-// Labels without a scope are listed first and everything else falls back to name order.
-func CompareLabelForDisplay(a, b *Label) int {
-	scopeA, scopeB := a.ExclusiveScope(), b.ExclusiveScope()
-	if scopeA != scopeB {
-		if scopeA == "" {
-			return -1
-		}
-		if scopeB == "" {
-			return 1
-		}
-		return strings.Compare(scopeA, scopeB)
-	}
-	if scopeA != "" {
-		orderA, orderB := a.ExclusiveOrder, b.ExclusiveOrder
-		if orderA <= 0 {
-			orderA = math.MaxInt
-		}
-		if orderB <= 0 {
-			orderB = math.MaxInt
-		}
-		if orderA != orderB {
-			return cmp.Compare(orderA, orderB)
-		}
-	}
-	return strings.Compare(a.Name, b.Name)
-}
-
-// SortLabelsForDisplay sorts labels in place for displaying them in dropdowns or lists,
-// grouping them by their exclusive scope and respecting the exclusive order within each scope.
-func SortLabelsForDisplay(labels []*Label) {
-	slices.SortStableFunc(labels, CompareLabelForDisplay)
-}
-
 // NewLabel creates a new label
 func NewLabel(ctx context.Context, l *Label) error {
 	color, err := label.NormalizeColor(l.Color)
@@ -345,18 +312,6 @@ func GetLabelInRepoByName(ctx context.Context, repoID int64, labelName string) (
 	return l, nil
 }

-// GetLabelInRepoOrOrgByID returns the label with labelID scoped to the repo, falling back to the
-// repo's owning organization when ownerIsOrg is set. It returns ErrRepoLabelNotExist /
-// ErrOrgLabelNotExist when the label is in neither scope, so a foreign-but-existing label ID is
-// indistinguishable from a nonexistent one (no cross-repo enumeration oracle).
-func GetLabelInRepoOrOrgByID(ctx context.Context, repoID, ownerID int64, ownerIsOrg bool, labelID int64) (*Label, error) {
-	label, err := GetLabelInRepoByID(ctx, repoID, labelID)
-	if err != nil && errors.Is(err, util.ErrNotExist) && ownerIsOrg {
-		return GetLabelInOrgByID(ctx, ownerID, labelID)
-	}
-	return label, err
-}
-
 // GetLabelInRepoByID returns a label by ID in given repository.
 func GetLabelInRepoByID(ctx context.Context, repoID, labelID int64) (*Label, error) {
 	if labelID <= 0 || repoID <= 0 {
@@ -12,7 +12,6 @@ import (
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/timeutil"
-	"gitea.dev/modules/util"

 	"github.com/stretchr/testify/assert"
 )
@@ -54,47 +53,6 @@ func TestLabel_ExclusiveScope(t *testing.T) {
 	assert.Equal(t, "scope/subscope", label.ExclusiveScope())
 }

-func TestSortLabelsForDisplay(t *testing.T) {
-	labels := []*issues_model.Label{
-		{Name: "priority/low", Exclusive: true, ExclusiveOrder: 4},
-		{Name: "priority/critical", Exclusive: true, ExclusiveOrder: 1},
-		{Name: "priority/medium", Exclusive: true, ExclusiveOrder: 3},
-		{Name: "priority/high", Exclusive: true, ExclusiveOrder: 2},
-		{Name: "bug"},
-		{Name: "enhancement"},
-		{Name: "kind/question", Exclusive: true},
-	}
-	issues_model.SortLabelsForDisplay(labels)
-
-	names := make([]string, 0, len(labels))
-	for _, l := range labels {
-		names = append(names, l.Name)
-	}
-	assert.Equal(t, []string{
-		"bug",
-		"enhancement",
-		"kind/question",
-		"priority/critical",
-		"priority/high",
-		"priority/medium",
-		"priority/low",
-	}, names)
-
-	// labels without an exclusive order in the same scope are listed last, ordered by name
-	labels = []*issues_model.Label{
-		{Name: "scope/unordered-b", Exclusive: true},
-		{Name: "scope/ordered", Exclusive: true, ExclusiveOrder: 1},
-		{Name: "scope/unordered-a", Exclusive: true},
-	}
-	issues_model.SortLabelsForDisplay(labels)
-
-	names = names[:0]
-	for _, l := range labels {
-		names = append(names, l.Name)
-	}
-	assert.Equal(t, []string{"scope/ordered", "scope/unordered-a", "scope/unordered-b"}, names)
-}
-
 func TestNewLabels(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	labels := []*issues_model.Label{
@@ -136,10 +94,10 @@ func TestGetLabelInRepoByName(t *testing.T) {
 	assert.Equal(t, "label1", label.Name)

 	_, err = issues_model.GetLabelInRepoByName(t.Context(), 1, "")
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))

 	_, err = issues_model.GetLabelInRepoByName(t.Context(), unittest.NonexistentID, "nonexistent")
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
 }

 func TestGetLabelInRepoByNames(t *testing.T) {
@@ -173,10 +131,10 @@ func TestGetLabelInRepoByID(t *testing.T) {
 	assert.EqualValues(t, 1, label.ID)

 	_, err = issues_model.GetLabelInRepoByID(t.Context(), 1, -1)
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))

 	_, err = issues_model.GetLabelInRepoByID(t.Context(), unittest.NonexistentID, unittest.NonexistentID)
-	assert.ErrorIs(t, err, util.ErrNotExist)
+	assert.True(t, issues_model.IsErrRepoLabelNotExist(err))
 }

 func TestGetLabelsInRepoByIDs(t *testing.T) {
@@ -535,8 +535,12 @@ func GetPullRequestByIndex(ctx context.Context, repoID, index int64) (*PullReque
 	if index < 1 {
 		return nil, ErrPullRequestNotExist{}
 	}
+	pr := &PullRequest{
+		BaseRepoID: repoID,
+		Index:      index,
+	}

-	pr, has, err := db.Get[PullRequest](ctx, builder.Eq{"base_repo_id": repoID, "`index`": index})
+	has, err := db.GetEngine(ctx).Get(pr)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -324,59 +324,6 @@ func IsOfficialReviewerTeam(ctx context.Context, issue *Issue, team *organizatio
 	return slices.Contains(pb.ApprovalsWhitelistTeamIDs, team.ID), nil
 }

-// RecalculateReviewsOfficial re-evaluates the "official" flag of the latest approve
-// and reject reviews of an issue against its pull request's current base branch.
-// It must be called whenever the target branch changes, otherwise an approval that
-// was official on the previous (possibly unprotected) branch would keep satisfying
-// the new branch's protection rules.
-func RecalculateReviewsOfficial(ctx context.Context, issue *Issue) error {
-	if err := issue.LoadPullRequest(ctx); err != nil {
-		return err
-	}
-
-	// Clearing and restoring the official flags must happen atomically, otherwise a
-	// failure in between would leave the reviews without any official flag set.
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		// Only the latest approve/reject review of each reviewer counts as official, so
-		// clear the flag on all of them first and restore it only where it still applies.
-		if _, err := db.GetEngine(ctx).
-			Where("issue_id = ?", issue.ID).
-			In("type", ReviewTypeApprove, ReviewTypeReject).
-			Cols("official").
-			Update(&Review{Official: false}); err != nil {
-			return err
-		}
-
-		reviews, err := FindLatestReviews(ctx, FindReviewOptions{
-			Types:   []ReviewType{ReviewTypeApprove, ReviewTypeReject},
-			IssueID: issue.ID,
-		})
-		if err != nil {
-			return err
-		}
-
-		for _, review := range reviews {
-			if err := review.LoadReviewer(ctx); err != nil {
-				return err
-			}
-			if review.Reviewer == nil {
-				continue
-			}
-			official, err := IsOfficialReviewer(ctx, issue, review.Reviewer)
-			if err != nil {
-				return err
-			}
-			if official {
-				if _, err := db.GetEngine(ctx).ID(review.ID).Cols("official").Update(&Review{Official: true}); err != nil {
-					return err
-				}
-			}
-		}
-
-		return nil
-	})
-}
-
 // CreateReview creates a new review based on opts
 func CreateReview(ctx context.Context, opts CreateReviewOptions) (*Review, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Review, error) {
@@ -1065,23 +1012,19 @@ func (r *Review) GetCodeCommentsCount(ctx context.Context) int {
 	return int(count)
 }

-// HashTag returns unique hash tag for review.
-func (r *Review) HashTag() string {
-	return fmt.Sprintf("pullrequestreview-%d", r.ID)
-}
-
-// HTMLURL formats a URL-string to the review on the pull request page
+// HTMLURL formats a URL-string to the related review issue-comment
 func (r *Review) HTMLURL(ctx context.Context) string {
-	if r.Type != ReviewTypeApprove && r.Type != ReviewTypeComment && r.Type != ReviewTypeReject {
-		return "" // only submitted reviews get a timeline block carrying the anchor
+	opts := FindCommentsOptions{
+		Type:     CommentTypeReview,
+		IssueID:  r.IssueID,
+		ReviewID: r.ID,
 	}
-	if err := r.LoadIssue(ctx); err != nil {
+	comment := new(Comment)
+	has, err := db.GetEngine(ctx).Where(opts.ToConds()).Get(comment)
+	if err != nil || !has {
 		return ""
 	}
-	if err := r.Issue.LoadRepo(ctx); err != nil {
-		return ""
-	}
-	return r.Issue.HTMLURL(ctx) + "#" + r.HashTag()
+	return comment.HTMLURL(ctx)
 }

 // RemapExternalUser ExternalUserRemappable interface
@@ -6,13 +6,10 @@ package issues_test
 import (
 	"testing"

-	"gitea.dev/models/db"
-	git_model "gitea.dev/models/git"
 	issues_model "gitea.dev/models/issues"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/setting"

 	"github.com/stretchr/testify/assert"
 )
@@ -29,15 +26,6 @@ func TestGetReviewByID(t *testing.T) {
 	assert.True(t, issues_model.IsErrReviewNotExist(err), "IsErrReviewNotExist")
 }

-func TestReview_HTMLURL(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-	review := unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: 1})
-	assert.Equal(t, setting.AppURL+"user2/repo1/pulls/2#pullrequestreview-1", review.HTMLURL(t.Context()))
-
-	pendingReview := unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: 4})
-	assert.Empty(t, pendingReview.HTMLURL(t.Context()))
-}
-
 func TestReview_LoadAttributes(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	review := unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: 1})
@@ -398,45 +386,3 @@ func TestAddReviewRequest(t *testing.T) {
 	assert.NotNil(t, comment.CommentMetaData)
 	assert.Equal(t, issues_model.SpecialDoerNameCodeOwners, comment.CommentMetaData.SpecialDoerName)
 }
-
-func TestRecalculateReviewsOfficial(t *testing.T) {
-	assert.NoError(t, unittest.PrepareTestDatabase())
-
-	// PR #2 targets repo1's "master" branch. Simulate an approval that became
-	// official while the PR targeted an unprotected branch.
-	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3})
-	reviewer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
-	review, err := issues_model.CreateReview(t.Context(), issues_model.CreateReviewOptions{
-		Type:     issues_model.ReviewTypeApprove,
-		Issue:    issue,
-		Reviewer: reviewer,
-		Official: true,
-	})
-	assert.NoError(t, err)
-
-	// Protect the (now current) target branch with an approvals whitelist that
-	// does not include the reviewer, mirroring a retarget onto a protected branch.
-	rule := &git_model.ProtectedBranch{
-		RepoID:                    issue.RepoID,
-		RuleName:                  "master",
-		EnableApprovalsWhitelist:  true,
-		ApprovalsWhitelistUserIDs: []int64{2},
-		RequiredApprovals:         1,
-	}
-	assert.NoError(t, db.Insert(t.Context(), rule))
-
-	// Re-evaluating must strip the stale official flag, otherwise the approval
-	// would still satisfy the protected branch's required approvals.
-	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
-	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
-	assert.False(t, review.Official)
-
-	// Once the reviewer is whitelisted, re-evaluating restores the official flag.
-	rule.ApprovalsWhitelistUserIDs = []int64{2, reviewer.ID}
-	_, err = db.GetEngine(t.Context()).ID(rule.ID).Cols("approvals_whitelist_user_i_ds").Update(rule)
-	assert.NoError(t, err)
-
-	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
-	review = unittest.AssertExistsAndLoadBean(t, &issues_model.Review{ID: review.ID})
-	assert.True(t, review.Official)
-}
@@ -415,11 +415,6 @@ func prepareMigrationTasks() []*migration {
 		newMigration(335, "Add reusable workflow fields and action_run_attempt_job_id_index table for ActionRunJob", v1_27.AddReusableWorkflowFieldsToActionRunJob),
 		newMigration(336, "Add ActionRunJobSummary table", v1_27.AddActionRunJobSummaryTable),
 		newMigration(337, "Add visibility to team", v1_27.AddVisibilityToTeam),
-		newMigration(338, "Expand legacy MSSQL issue/comment long-text columns", v1_27.ExpandIssueAndCommentLongTextFieldsForMSSQL),
-		newMigration(339, "Extend action c_u index to include created_unix for faster dashboard feed queries", v1_27.AddCreatedUnixToActionUserIsDeletedIndex),
-		newMigration(340, "Add ContinueOnError column to ActionRunJob", v1_27.AddContinueOnErrorToActionRunJob),
-		newMigration(341, "Convert legacy MSSQL DATETIME columns to DATETIME2", v1_27.FixLegacyMSSQLDateTimeColumns),
-		newMigration(342, "Add scoped workflows schema", v1_27.AddScopedWorkflowsSchema),
 	}
 	return preparedMigrations
 }
@@ -1,73 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"fmt"
-	"strings"
-
-	"gitea.dev/models/db"
-	"gitea.dev/models/migrations/base"
-
-	"xorm.io/xorm/schemas"
-)
-
-type issueWithLongTextContent struct {
-	Content string `xorm:"LONGTEXT"`
-}
-
-func (issueWithLongTextContent) TableName() string {
-	return "issue"
-}
-
-type commentWithLongTextFields struct {
-	Content     string `xorm:"LONGTEXT"`
-	PatchQuoted string `xorm:"LONGTEXT patch"`
-}
-
-func (commentWithLongTextFields) TableName() string {
-	return "comment"
-}
-
-func isMSSQLMaxTextColumn(column *schemas.Column) bool {
-	if column.Length != -1 {
-		return false
-	}
-	return strings.EqualFold(column.SQLType.Name, schemas.Varchar) || strings.EqualFold(column.SQLType.Name, schemas.NVarchar)
-}
-
-func modifyLongTextColumnsForMSSQL(x db.EngineMigration, bean any, columnNames ...string) error {
-	table, err := x.TableInfo(bean)
-	if err != nil {
-		return err
-	}
-
-	for _, columnName := range columnNames {
-		column := table.GetColumn(columnName)
-		if column == nil {
-			return fmt.Errorf("column %s does not exist in table %s", columnName, table.Name)
-		}
-		if isMSSQLMaxTextColumn(column) {
-			continue
-		}
-		if err := base.ModifyColumn(x, table.Name, column); err != nil {
-			return fmt.Errorf("modify %s.%s: %w", table.Name, columnName, err)
-		}
-	}
-
-	return nil
-}
-
-// ExpandIssueAndCommentLongTextFieldsForMSSQL expands legacy MSSQL nvarchar(4000)
-// columns to nvarchar(max) so PR push comments and long issue content are not truncated.
-func ExpandIssueAndCommentLongTextFieldsForMSSQL(x db.EngineMigration) error {
-	if x.Dialect().URI().DBType != schemas.MSSQL {
-		return nil
-	}
-
-	if err := modifyLongTextColumnsForMSSQL(x, new(issueWithLongTextContent), "content"); err != nil {
-		return err
-	}
-	return modifyLongTextColumnsForMSSQL(x, new(commentWithLongTextFields), "content", "patch")
-}
@@ -1,52 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"strings"
-	"testing"
-
-	"gitea.dev/models/migrations/migrationtest"
-	"gitea.dev/modules/setting"
-
-	"github.com/stretchr/testify/require"
-)
-
-type issueBeforeLongTextMSSQLMigration struct {
-	ID      int64  `xorm:"pk autoincr"`
-	Content string `xorm:"VARCHAR(4000)"`
-}
-
-func (issueBeforeLongTextMSSQLMigration) TableName() string {
-	return "issue"
-}
-
-type commentBeforeLongTextMSSQLMigration struct {
-	ID      int64  `xorm:"pk autoincr"`
-	Content string `xorm:"VARCHAR(4000)"`
-	Patch   string `xorm:"VARCHAR(4000) patch"`
-}
-
-func (commentBeforeLongTextMSSQLMigration) TableName() string {
-	return "comment"
-}
-
-func Test_ExpandIssueAndCommentLongTextFieldsForMSSQL(t *testing.T) {
-	if !setting.Database.Type.IsMSSQL() {
-		t.Skip("Only MSSQL needs to expand legacy nvarchar(4000) long-text columns")
-	}
-
-	x, deferrable := migrationtest.PrepareTestEnv(t, 0, new(issueBeforeLongTextMSSQLMigration), new(commentBeforeLongTextMSSQLMigration))
-	defer deferrable()
-
-	require.NoError(t, ExpandIssueAndCommentLongTextFieldsForMSSQL(x))
-	require.NoError(t, ExpandIssueAndCommentLongTextFieldsForMSSQL(x))
-
-	longText := strings.Repeat("x", 5000)
-	_, err := x.Insert(&issueBeforeLongTextMSSQLMigration{Content: longText})
-	require.NoError(t, err)
-
-	_, err = x.Insert(&commentBeforeLongTextMSSQLMigration{Content: longText, Patch: longText})
-	require.NoError(t, err)
-}
@@ -1,40 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"context"
-
-	"gitea.dev/models/db"
-
-	"xorm.io/xorm/schemas"
-)
-
-// AddCreatedUnixToActionUserIsDeletedIndex extends the c_u composite index on
-// the action table to include created_unix, enabling efficient ORDER BY on the
-// dashboard feed query without a full sort of all matching rows.
-func AddCreatedUnixToActionUserIsDeletedIndex(x db.EngineMigration) error {
-	// xorm Sync cannot reliably update an index when another index already
-	// covers the same columns in a different order (Equal() is order-insensitive).
-	// Drop the old c_u index explicitly, then recreate it with the new column set.
-	indexes, err := x.Dialect().GetIndexes(x.DB(), context.Background(), "action")
-	if err != nil {
-		return err
-	}
-	for _, idx := range indexes {
-		if idx.Name == "c_u" {
-			if _, err := x.Exec(x.Dialect().DropIndexSQL("action", idx)); err != nil {
-				return err
-			}
-			break
-		}
-	}
-
-	newIndex := schemas.NewIndex("c_u", schemas.IndexType)
-	newIndex.AddColumn("user_id", "is_deleted", "created_unix")
-	if _, err := x.Exec(x.Dialect().CreateIndexSQL("action", newIndex)); err != nil {
-		return err
-	}
-	return nil
-}
@@ -1,72 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"context"
-	"testing"
-
-	"gitea.dev/models/migrations/migrationtest"
-	"gitea.dev/modules/timeutil"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"xorm.io/xorm/schemas"
-)
-
-type actionBeforeV339 struct {
-	ID          int64 `xorm:"pk autoincr"`
-	UserID      int64 `xorm:"INDEX"`
-	OpType      int
-	ActUserID   int64
-	RepoID      int64
-	CommentID   int64 `xorm:"INDEX"`
-	IsDeleted   bool  `xorm:"NOT NULL DEFAULT false"`
-	RefName     string
-	IsPrivate   bool               `xorm:"NOT NULL DEFAULT false"`
-	Content     string             `xorm:"TEXT"`
-	CreatedUnix timeutil.TimeStamp `xorm:"created"`
-}
-
-func (actionBeforeV339) TableName() string { return "action" }
-
-func (actionBeforeV339) TableIndices() []*schemas.Index {
-	repoIndex := schemas.NewIndex("r_u_d", schemas.IndexType)
-	repoIndex.AddColumn("repo_id", "user_id", "is_deleted")
-
-	actUserIndex := schemas.NewIndex("au_r_c_u_d", schemas.IndexType)
-	actUserIndex.AddColumn("act_user_id", "repo_id", "created_unix", "user_id", "is_deleted")
-
-	cudIndex := schemas.NewIndex("c_u_d", schemas.IndexType)
-	cudIndex.AddColumn("created_unix", "user_id", "is_deleted")
-
-	// old 2-column index, before the migration
-	cuIndex := schemas.NewIndex("c_u", schemas.IndexType)
-	cuIndex.AddColumn("user_id", "is_deleted")
-
-	actUserUserIndex := schemas.NewIndex("au_c_u", schemas.IndexType)
-	actUserUserIndex.AddColumn("act_user_id", "created_unix", "user_id")
-
-	return []*schemas.Index{actUserIndex, repoIndex, cudIndex, cuIndex, actUserUserIndex}
-}
-
-func Test_AddCreatedUnixToActionUserIsDeletedIndex(t *testing.T) {
-	x, deferable := migrationtest.PrepareTestEnv(t, 0, new(actionBeforeV339))
-	defer deferable()
-	if x == nil || t.Failed() {
-		return
-	}
-
-	indexes, err := x.Dialect().GetIndexes(x.DB(), context.Background(), "action")
-	require.NoError(t, err)
-	assert.True(t, hasIndexWithColumns(indexes, []string{"user_id", "is_deleted"}, false), "old c_u index should exist before migration")
-	assert.False(t, hasIndexWithColumns(indexes, []string{"user_id", "is_deleted", "created_unix"}, false), "new c_u index should not exist before migration")
-
-	require.NoError(t, AddCreatedUnixToActionUserIsDeletedIndex(x))
-
-	indexes, err = x.Dialect().GetIndexes(x.DB(), context.Background(), "action")
-	require.NoError(t, err)
-	assert.False(t, hasIndexWithColumns(indexes, []string{"user_id", "is_deleted"}, false), "old 2-column c_u index should be gone after migration")
-	assert.True(t, hasIndexWithColumns(indexes, []string{"user_id", "is_deleted", "created_unix"}, false), "new 3-column c_u index must exist after migration")
-}
@@ -1,24 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"gitea.dev/models/db"
-
-	"xorm.io/xorm"
-)
-
-// AddContinueOnErrorToActionRunJob adds the ContinueOnError column to ActionRunJob,
-// storing the job-level continue-on-error value from the workflow YAML.
-func AddContinueOnErrorToActionRunJob(x db.EngineMigration) error {
-	type ActionRunJob struct {
-		ContinueOnError bool `xorm:"NOT NULL DEFAULT FALSE"`
-	}
-
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-		IgnoreConstrains:  true,
-	}, new(ActionRunJob))
-	return err
-}
@@ -1,80 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"gitea.dev/models/db"
-	"gitea.dev/models/migrations/base"
-
-	"xorm.io/xorm/schemas"
-)
-
-// legacyDateTimeColumns are the persisted real datetime columns that old Gitea
-// versions created as MSSQL DATETIME. Every other time value is stored as a
-// unix timestamp integer, so these are the only columns affected.
-var legacyDateTimeColumns = []struct {
-	bean   any
-	column string
-}{
-	{new(externalLoginUserWithExpiresAt), "expires_at"},
-	{new(lfsLockWithCreated), "created"},
-}
-
-type externalLoginUserWithExpiresAt struct {
-	ExpiresAt time.Time
-}
-
-func (externalLoginUserWithExpiresAt) TableName() string {
-	return "external_login_user"
-}
-
-type lfsLockWithCreated struct {
-	Created time.Time `xorm:"created"`
-}
-
-func (lfsLockWithCreated) TableName() string {
-	return "lfs_lock"
-}
-
-// FixLegacyMSSQLDateTimeColumns converts legacy locale-dependent DATETIME columns
-// to DATETIME2. Databases created by old Gitea versions stored these columns as
-// DATETIME, which fails to parse ISO datetime strings ('YYYY-MM-DD HH:MM:SS')
-// when the MSSQL session language is not English, breaking external account
-// linking and LFS lock creation. New installs already use DATETIME2, so only
-// legacy MSSQL columns need converting.
-func FixLegacyMSSQLDateTimeColumns(x db.EngineMigration) error {
-	if x.Dialect().URI().DBType != schemas.MSSQL {
-		return nil
-	}
-
-	for _, c := range legacyDateTimeColumns {
-		table, err := x.TableInfo(c.bean)
-		if err != nil {
-			return err
-		}
-
-		var dataType string
-		has, err := x.SQL("SELECT DATA_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = ? AND COLUMN_NAME = ?", table.Name, c.column).Get(&dataType)
-		if err != nil {
-			return err
-		}
-		if !has || !strings.EqualFold(dataType, "datetime") {
-			continue
-		}
-
-		column := table.GetColumn(c.column)
-		if column == nil {
-			return fmt.Errorf("column %s does not exist in table %s", c.column, table.Name)
-		}
-		if err := base.ModifyColumn(x, table.Name, column); err != nil {
-			return fmt.Errorf("modify %s.%s: %w", table.Name, c.column, err)
-		}
-	}
-
-	return nil
-}
@@ -1,80 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"testing"
-	"time"
-
-	"gitea.dev/models/db"
-	"gitea.dev/models/migrations/migrationtest"
-	"gitea.dev/modules/setting"
-
-	"github.com/stretchr/testify/require"
-)
-
-type externalLoginUserBeforeDateTimeMigration struct {
-	ExternalID    string    `xorm:"pk NOT NULL"`
-	LoginSourceID int64     `xorm:"pk NOT NULL"`
-	ExpiresAt     time.Time // sync creates DATETIME2; downgraded to legacy DATETIME via raw SQL below
-}
-
-func (externalLoginUserBeforeDateTimeMigration) TableName() string {
-	return "external_login_user"
-}
-
-type lfsLockBeforeDateTimeMigration struct {
-	ID      int64     `xorm:"pk autoincr"`
-	Created time.Time `xorm:"created"`
-}
-
-func (lfsLockBeforeDateTimeMigration) TableName() string {
-	return "lfs_lock"
-}
-
-func Test_FixLegacyMSSQLDateTimeColumns(t *testing.T) {
-	if !setting.Database.Type.IsMSSQL() {
-		t.Skip("Only MSSQL needs to convert the legacy locale-dependent DATETIME columns")
-	}
-
-	x, deferrable := migrationtest.PrepareTestEnv(t, 0,
-		new(externalLoginUserBeforeDateTimeMigration),
-		new(lfsLockBeforeDateTimeMigration),
-	)
-	defer deferrable()
-
-	// Force the legacy DATETIME column type that old Gitea versions created.
-	_, err := x.Exec("ALTER TABLE [external_login_user] ALTER COLUMN [expires_at] DATETIME")
-	require.NoError(t, err)
-	_, err = x.Exec("ALTER TABLE [lfs_lock] ALTER COLUMN [created] DATETIME")
-	require.NoError(t, err)
-	require.Equal(t, "datetime", mssqlColumnType(t, x, "external_login_user", "expires_at"))
-	require.Equal(t, "datetime", mssqlColumnType(t, x, "lfs_lock", "created"))
-
-	require.NoError(t, FixLegacyMSSQLDateTimeColumns(x))
-	require.NoError(t, FixLegacyMSSQLDateTimeColumns(x)) // idempotent
-
-	require.Equal(t, "datetime2", mssqlColumnType(t, x, "external_login_user", "expires_at"))
-	require.Equal(t, "datetime2", mssqlColumnType(t, x, "lfs_lock", "created"))
-
-	// Inserting an ISO-formatted datetime must succeed even under a non-English
-	// locale, which is the failure the legacy DATETIME columns produced. The
-	// SET LANGUAGE and INSERT run in one Exec so they share a single connection.
-	_, err = x.Exec("SET LANGUAGE German; " +
-		"INSERT INTO [external_login_user] ([external_id], [login_source_id], [expires_at]) " +
-		"VALUES ('ext-id', 1, '2026-06-25 11:58:39')")
-	require.NoError(t, err)
-	_, err = x.Exec("SET LANGUAGE German; " +
-		"INSERT INTO [lfs_lock] ([created]) VALUES ('2026-06-25 11:58:39')")
-	require.NoError(t, err)
-}
-
-func mssqlColumnType(t *testing.T, x db.EngineMigration, table, column string) string {
-	t.Helper()
-	var dataType string
-	has, err := x.SQL("SELECT DATA_TYPE FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = ? AND COLUMN_NAME = ?", table, column).Get(&dataType)
-	require.NoError(t, err)
-	require.True(t, has)
-	return dataType
-}
@@ -1,42 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_27
-
-import (
-	"gitea.dev/models/db"
-	"gitea.dev/modules/timeutil"
-
-	"xorm.io/xorm"
-)
-
-func AddScopedWorkflowsSchema(x db.EngineMigration) error {
-	// Create the action_scoped_workflow_source table
-	type ScopedWorkflowConfig struct {
-		Required bool     `json:"required"`
-		Patterns []string `json:"patterns"`
-	}
-	type ActionScopedWorkflowSource struct {
-		ID              int64                            `xorm:"pk autoincr"`
-		OwnerID         int64                            `xorm:"UNIQUE(owner_repo) NOT NULL DEFAULT 0"`
-		SourceRepoID    int64                            `xorm:"INDEX UNIQUE(owner_repo) NOT NULL DEFAULT 0"`
-		WorkflowConfigs map[string]*ScopedWorkflowConfig `xorm:"JSON TEXT 'workflow_configs'"`
-		CreatedUnix     timeutil.TimeStamp               `xorm:"created"`
-		UpdatedUnix     timeutil.TimeStamp               `xorm:"updated"`
-	}
-	if err := x.Sync(new(ActionScopedWorkflowSource)); err != nil {
-		return err
-	}
-
-	// Add the columns that record where a run's workflow content came from
-	type ActionRun struct {
-		WorkflowRepoID    int64  `xorm:"NOT NULL DEFAULT 0"`
-		WorkflowCommitSHA string `xorm:"VARCHAR(64) NOT NULL DEFAULT ''"`
-		IsScopedRun       bool   `xorm:"NOT NULL DEFAULT false"`
-	}
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-		IgnoreConstrains:  true,
-	}, new(ActionRun))
-	return err
-}
@@ -91,14 +91,6 @@ func (org *Organization) IsOwnedBy(ctx context.Context, uid int64) (bool, error)
 	return IsOrganizationOwner(ctx, org.ID, uid)
 }

-// CanChangeRepoTeamAccess reports whether a repository administrator can change team access.
-func (org *Organization) CanChangeRepoTeamAccess(ctx context.Context, doer *user_model.User) (bool, error) {
-	if org.RepoAdminChangeTeamAccess || doer.IsAdmin {
-		return true, nil
-	}
-	return org.IsOwnedBy(ctx, doer.ID)
-}
-
 // IsOrgAdmin returns true if given user is in the owner team or an admin team.
 func (org *Organization) IsOrgAdmin(ctx context.Context, uid int64) (bool, error) {
 	return IsOrganizationAdmin(ctx, org.ID, uid)
@@ -311,7 +303,7 @@ func (org *Organization) UnitPermission(ctx context.Context, doer *user_model.Us
 		}
 	}

-	if ownerVisibilitySatisfiesDoer(org.AsUser(), doer) {
+	if org.Visibility.IsPublic() {
 		return perm.AccessModeRead
 	}

@@ -419,8 +411,11 @@ func GetOrgByName(ctx context.Context, name string) (*Organization, error) {
 	if len(name) == 0 {
 		return nil, ErrOrgNotExist{0, name}
 	}
-
-	u, has, err := db.Get[Organization](ctx, builder.Eq{"lower_name": strings.ToLower(name), "`type`": user_model.UserTypeOrganization})
+	u := &Organization{
+		LowerName: strings.ToLower(name),
+		Type:      user_model.UserTypeOrganization,
+	}
+	has, err := db.GetEngine(ctx).Get(u)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -453,7 +448,8 @@ func GetUsersWhoCanCreateOrgRepo(ctx context.Context, orgID int64) (map[int64]*u
 		And("team_user.org_id = ?", orgID).Find(&users)
 }

-func ownerVisibilitySatisfiesDoer(orgOrUser, user *user_model.User) bool {
+// HasOrgOrUserVisible tells if the given user can see the given org or user
+func HasOrgOrUserVisible(ctx context.Context, orgOrUser, user *user_model.User) bool {
 	// If user is nil, it's an anonymous user/request.
 	// The Ghost user is handled like an anonymous user.
 	if user == nil || user.IsGhost() {
@@ -468,13 +464,10 @@ func ownerVisibilitySatisfiesDoer(orgOrUser, user *user_model.User) bool {
 		return true
 	}

-	return orgOrUser.Visibility != structs.VisibleTypePrivate && !user.IsRestricted
-}
-
-// HasOrgOrUserVisible tells if the given user can see the given org or user
-func HasOrgOrUserVisible(ctx context.Context, owner, doer *user_model.User) bool {
-	return ownerVisibilitySatisfiesDoer(owner, doer) ||
-		(doer != nil && OrgFromUser(owner).HasMemberWithUserID(ctx, doer.ID))
+	if (orgOrUser.Visibility == structs.VisibleTypePrivate || user.IsRestricted) && !OrgFromUser(orgOrUser).hasMemberWithUserID(ctx, user.ID) {
+		return false
+	}
+	return true
 }

 // HasOrgsVisible tells if the given user can see at least one of the orgs provided
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
wxiaoguang	63bc4eae68	no need to "clean up test fixture"	2026-06-16 08:51:21 +08:00
wxiaoguang	6b416d6135	fix	2026-06-16 08:48:53 +08:00
Nicolas	95a300e1f4	Merge remote-tracking branch 'origin/main' into various-sec-fixes # Conflicts: # routers/api/v1/api.go	2026-06-15 22:12:27 +02:00
Nicolas	2f5a735c75	unexport	2026-06-15 22:11:23 +02:00
Nicolas	8819eee696	derive maintainer edit	2026-06-15 22:08:10 +02:00
wxiaoguang	0c8be7bee0	FIXME	2026-06-15 14:22:38 +08:00
Nicolas	f25811942c	fix: re-check branch write permission for every ref in a push The pre-receive hook cached the result of CanWriteCode() after the first ref in a batch push, but CanMaintainerWriteToBranch depends on the current branch name. A user holding a per-branch maintainer-edit grant (an open PR with "allow edits from maintainers") could batch that branch with protected branches or tags and have the cached approval reused, escalating to full repository write. Evaluate the permission fresh for every ref; the pusher and base permission remain cached via loadPusherAndPermission. Assisted-by: Claude:claude-opus-4-8	2026-06-13 18:38:06 +02:00
Nicolas	c0c11c551c	fix: enforce single-use TOTP passcodes across all 2FA surfaces The web 2FA login and password-reset paths validated the passcode and then wrote LastUsedPasscode in a non-atomic read-check-write sequence, so two parallel submissions of the same code could each authenticate (TOCTOU). The Basic-Auth X-Gitea-OTP path never recorded the used passcode at all, letting a captured code be replayed for its whole validity window. Add TwoFactor.ValidateAndConsumeTOTP, which validates and atomically marks the passcode used via a conditional UPDATE (rejecting replays and racing duplicates), and route the web login, password-reset, and Basic-Auth paths through it. Assisted-by: Claude:claude-opus-4-8	2026-06-13 18:38:06 +02:00
Nicolas	e99e24cb04	fix: stop trusting all proxies by default in docker app.ini templates The Docker app.ini templates hard-coded REVERSE_PROXY_TRUSTED_PROXIES = *, so with ENABLE_REVERSE_PROXY_AUTHENTICATION enabled any source IP reaching the container could impersonate any user via the X-WEBAUTH-USER header. Align the templates with the documented loopback-only default (127.0.0.0/8,::1/128), matching app.example.ini and the in-code default. Assisted-by: Claude:claude-opus-4-8	2026-06-13 18:38:06 +02:00
Nicolas	c20df84548	fix: block fork sync when base repo is no longer readable POST /api/v1/repos/{owner}/{repo}/merge-upstream kept importing commits from the parent repository even after the parent was switched from public to private, leaking commits a fork owner could no longer access directly. Require the doer to still have read access to the base repo's code before syncing, and map the permission error to 403 (API) / not-found (web). Assisted-by: Claude:claude-opus-4-8	2026-06-13 17:36:35 +02:00
Nicolas	24ce5ae082	fix: enforce org visibility on organization label read endpoints The GET /api/v1/orgs/{org}/labels and GET /api/v1/orgs/{org}/labels/{id} endpoints did not check whether the caller could see the organization, so labels of a private org were disclosed to non-members (and anonymously for the list route). Add a reqOrgVisible() middleware mirroring the visibility check used by org.Get and apply it to the labels group.	2026-06-13 17:30:10 +02:00