fix(templates): move list tags out of paragraphs

djlint 1.40.4 adds rule H025, which flags `<ul>` nested inside `<p>`. Browsers already auto-close the `<p>` before the list, so this is a no-op visually. Assisted-by: Claude:Opus 4.8
chore(deps): update dependency djlint to v1.40.4
2026-09-10 06:53:25 +09:00 · 2026-07-14 11:31:36 +02:00 · 2026-07-14 09:21:00 +00:00 · 2026-07-14 08:48:58 +00:00 · 2026-07-14 10:24:40 +02:00 · 2026-07-13 08:38:41 +02:00
326 changed files with 3802 additions and 7131 deletions
@@ -9,10 +9,10 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+    - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
    - name: Build regular image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -20,7 +20,7 @@ runs:
        file: Dockerfile
        cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
    - name: Build rootless image
-      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
      with:
        context: .
        platforms: ${{ inputs.platform }}
@@ -16,34 +16,34 @@ runs:
  using: composite
  steps:
    - if: ${{ github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/go/pkg/mod
        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/go-build
        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/go-build
        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/golangci-lint
        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ~/.cache/golangci-lint
        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
@@ -13,10 +13,10 @@ runs:
    - if: ${{ inputs.cache == 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 24
+        node-version: 26
        cache: pnpm
        cache-dependency-path: pnpm-lock.yaml
    - if: ${{ inputs.cache != 'true' }}
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
-        node-version: 24
+        node-version: 26
@@ -21,12 +21,12 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: renovatebot/github-action@6d859fc95779be83a0335ca704879b47e5d79641 # v46.1.16
+      - uses: renovatebot/github-action@b50d2ba2bd928235abdcc14d06dfafc217f1c565 # v46.1.18
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
          token: ${{ secrets.RENOVATE_TOKEN }}
        env:
          RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg|generate-codemirror-languages)$"]'
          RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'
@@ -50,7 +50,7 @@ jobs:
      shell: ${{ steps.changes.outputs.shell }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: changes
        with:
          filters: |
@@ -42,7 +42,7 @@ jobs:
      - run: make lint-spell

      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          python-version: 3.14
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
@@ -131,7 +131,7 @@ jobs:
        ports:
          - "7700:7700"
      redis:
-        image: redis:latest@sha256:c904002d182255b6db3cbe3a1e8ce6c187d15390c39500b59fc07181aabff7bf
+        image: redis:latest@sha256:5d2c689b4b55fc3fab4b0cc8aaa950f85b508c76c1e0f35a90d8f411d55a8b2b
        options: >- # wait until redis has started
          --health-cmd "redis-cli ping"
          --health-interval 5s
@@ -17,7 +17,7 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        with:
          sync-labels: true

@@ -35,7 +35,7 @@ jobs:
          ref: ${{ github.event.pull_request.base.sha }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version: 24
+          node-version: 26
      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
      - run: node ./tools/ci-tools.ts lint-pr-title
        env:
@@ -6,40 +6,30 @@ on:
      - main
  workflow_dispatch:

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

 jobs:
  build-and-publish:
-    runs-on: ubuntu-latest
-
-    env:
-      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - name: Install snapcraft
-        run: sudo snap install snapcraft --classic
-
-      - name: Authenticate snapcraft
-        shell: bash
-        run: snapcraft login --with <(printf '%s' "$SNAPCRAFT_STORE_CREDENTIALS")
-
-      - name: Remote build
-        run: |
-          snapcraft remote-build \
-            --launchpad-accept-public-upload \
-            --build-for=amd64,arm64,armhf
-
-      - name: List built snaps
-        run: find . -maxdepth 1 -type f -name '*.snap' -print
-
-      - name: Upload and release snapcraft nightly build
-        run: |
-          set -euo pipefail
-
-          for snap in ./*.snap; do
-            echo "Uploading $snap to edge"
-            snapcraft upload --release="latest/edge" "$snap"
-          done
+        with:
+          fetch-depth: 0
+      - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
+        id: build
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+        with:
+          snap: ${{ steps.build.outputs.snap }}
+          release: latest/edge
@@ -23,12 +23,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -61,7 +56,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -72,18 +67,6 @@ jobs:
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          AWS_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress

  nightly-container:
    runs-on: namespace-profile-gitea-release-docker
@@ -95,8 +78,8 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Get cleaned branch name
        id: clean_name
        env:
@@ -104,7 +87,7 @@ jobs:
        run: |
          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |-
@@ -114,7 +97,7 @@ jobs:
            type=raw,value=${{ steps.clean_name.outputs.branch }}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta_rootless
        with:
          images: |-
@@ -128,18 +111,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -149,7 +132,7 @@ jobs:
          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
      - name: build rootless docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -24,12 +24,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -62,7 +57,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -73,18 +68,6 @@ jobs:
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          AWS_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
      - name: Install GH CLI
        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
@@ -106,9 +89,9 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |-
@@ -121,7 +104,7 @@ jobs:
            type=semver,pattern={{version}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta_rootless
        with:
          images: |-
@@ -137,18 +120,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -156,7 +139,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -27,12 +27,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -65,7 +60,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -76,18 +71,6 @@ jobs:
          BRANCH: ${{ steps.clean_name.outputs.branch }}
        run: |
          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
-      # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here
-      - name: upload binaries to cloudflare r2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          AWS_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
-          BRANCH: ${{ steps.clean_name.outputs.branch }}
-        run: |
-          aws s3 sync dist/release "s3://$CLOUDFLARE_R2_BUCKET/gitea/$BRANCH" --endpoint-url "https://$CLOUDFLARE_R2_ACCOUNT_ID.r2.cloudflarestorage.com" --no-progress
      - name: Install GH CLI
        uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
        with:
@@ -109,9 +92,9 @@ jobs:
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |-
@@ -128,7 +111,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta_rootless
        with:
          images: |-
@@ -149,18 +132,18 @@ jobs:
          annotations: |
            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: build regular container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -168,7 +151,7 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
      - name: build rootless container image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -4,405 +4,6 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.27.2](https://github.com/go-gitea/gitea/releases/tag/v1.27.2) - 2026-08-14
-
-* SECURITY
-  * Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
-  * Refactor: external render (#38885) (#38898)
-  * Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
-  * Refactor: markup render (#38864) (#38869)
-  * Fix(deps): update dependency mermaid to v11.16.1 (#38816)
-  * Fix(auth): set WebAuthn user verification per request (#38805) (#38810)
-  * Fix: render highlight language (#38793) (#38795)
-
-* ENHANCEMENTS
-  * enhance: add missing npm package metadata properties (#38826) (#38831)
-
-* BUGFIXES
-  * fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
-  * fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901)
-  * fix(lfs): accept successful transfer responses (#38866) (#38875)
-  * fix(packages): ignore nested Package.swift (#38788) (#38836)
-  * fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
-  * fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
-  * fix(migration): migration deletion returned json redirection (#38796) (#38825)
-  * fix(ui): change underlines to default browser style (#38819) (#38823)
-  * fix(actions): allow cancelling runs without running jobs (#35842) (#38812)
-  * fix(actions): evaluate each `${{ }}` part on its own (#38754) (#38797)
-  * fix(actions): write an action task report in one transaction (#38792) (#38794)
-  * fix: markup link (#38764) (#38765)
-  * fix: set a minio part size when the content size is unknown (#38753) (#38755)
-  * fix: bad path escape in subpath archive download (#38749) (#38750)
-  * fix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744)
-  * fix(markdown): fix double strikethough on code (#38707) (#38729)
-  * fix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722)
-  * fix: correct full url when using sub-path (#38712) (#38716)
-  * fix: avoid markup render panic (#38698) (#38703)
-  * fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
-  * fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)
-  * fix(migrations): use all configured GitHub tokens (#38841) (#38846)
-
-## [1.27.1](https://github.com/go-gitea/gitea/releases/tag/v1.27.1) - 2026-07-27
-
-* SECURITY
-  * fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
-
-* API
-  * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)
-
-* ENHANCEMENTS
-  * enhance: improve diff contrast in light and dark themes (#37477) (#38574)
-
-* BUGFIXES
-  * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666)
-  * fix: make Actions log parser support multiple line message encoding (#38659) (#38664)
-  * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657)
-  * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654)
-  * fix: orgmode render include path (#38642) (#38645)
-  * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644)
-  * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643)
-  * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633)
-  * fix(actions): correctness and hardening fixes (#38518) (#38631)
-  * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628)
-  * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618)
-  * fix(webhook): remove slack channel name check (#38608) (#38612)
-  * fix: download dropdown menu clipped on the branches page (#38604) (#38609)
-  * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602)
-  * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599)
-  * fix(file-tree): handle submodule links and missing view container (#38033) (#38589)
-  * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587)
-  * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583)
-  * fix: branch protection user list (#38570) (#38584)
-  * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578)
-  * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580)
-  * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557)
-  * fix(actions): align status icon span for Safari rendering (#38558) (#38562)
-  * fix: revert git clone http redirection forbidden (#38530) (#38545)
-  * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514)
-  * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521)
-  * fix: make the merge box button red if some checks fail (#38508) (#38516)
-  * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499)
-  * fix: make commit message merge correctly (#38490) (#38502)
-  * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498)
-  * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497)
-  * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493)
-  * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492)
-  * fix: full file highlighting for git diff with CR char (#38484) (#38491)
-  * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486)
-  * fix: 500 error when updating user visibility (#38480) (#38483)
-  * fix(actions): make job list item fully clickable (#38462) (#38471)
-  * fix: mail template for push event (#38467) (#38468)
-  * fix: make "test push webhook" always work (#38425) (#38455)
-  * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457)
-  * fix(org): align follow button and wrap description (#38448) (#38454)
-  * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452)
-
-* MISC
-  * refactor: git patch apply (#38637) (#38638)
-
-## [1.27.0](https://github.com/go-gitea/gitea/releases/tag/v1.27.0) - 2026-07-13
-
-* BREAKING
-  * Feat(actions)!: improve support for reusable workflows (#37478)
-  * Use Content-Security-Policy: script nonce (#37232)
-
-* SECURITY
-  * Fix: various security fixes (#38406) (#38426)
-  * Fix(security): harden access checks and migration validation (#38324) (#38400)
-  * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399)
-  * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402)
-  * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)
-  * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389)
-  * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367)
-  * Fix: golang html template url escaping (#38363) (#38369)
-  * Fix(release): validate web attachment renames against allowed types (#38314) (#38328)
-  * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)
-  * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
-  * Fix(oauth): restrict introspection to the token's client (#38042)
-  * Fix(api): don't expose private org membership via public_members (#38145)
-  * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214)
-  * Fix(migrations): prevent path traversal in repository restore (#38215)
-
-* FEATURES
-  * Feat(actions): add workflow status badge modal (#38196)
-  * Feat(actions): support owner-level and global scoped workflows (#38154)
-  * Feat(api): support ref suffixes in compare (#38148)
-  * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100)
-  * Feat(actions): show run status on browser tab favicon (#38071)
-  * Feat(api): add token introspection and self-deletion endpoint (#37995)
-  * Feat(api): add q parameter to list branches API for server-side filtering (#37982)
-  * Feat(repo): split repository creation limit into user and org scopes (#37872)
-  * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869)
-  * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835)
-  * Feat(org): add team visibility so org members can discover teams (#37680)
-  * Feat: add raw diff/patch endpoint for repository comparisons (#37632)
-  * Feat: Add avatar stacks (#37594)
-  * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)
-  * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)
-  * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356)
-  * Feat(orgs): Add search bar for organization members tab page (#37347)
-  * Feat(api): Add assignees APIs (#37330)
-  * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196)
-  * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038)
-  * Add project column picker to issue and pull request sidebar (#37037)
-  * Allow multiple projects per issue and pull requests (#36784)
-  * Feat(ui): add "follow rename" to file commit history list (#34994)
-  * Feat(ssh): auto generate additional ssh keys (#33974)
-
-* ENHANCEMENTS
-  * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385)
-  * Enhance: allow builtin default git config options to be overridden (#38172)
-  * Enhance: allow MathML core elements (#38034)
-  * Enhance(markup): improve issue title rendering (#37908)
-  * Enhance(actions): set descriptive browser tab title on run view (#37870)
-  * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)
-  * Enhance(actions): show workflow name from YAML instead of filename (#37833)
-  * Feat(actions): add before/after to PR synchronize event payload (#37827)
-  * Enhance(actions): add branch filters to run list (#37826)
-  * Enhance(actions): Make Summary UI more beautiful with more infos (#37824)
-  * Feat: add copy button to action step header, improve other copy buttons (#37744)
-  * Fix(icon): use repo-forked icon to display forks count (#37731)
-  * Feat(api): add sort and order query parameters to job list endpoints (#37672)
-  * Feat(api): add last_sync to repository API (#37566)
-  * Enhance: Adjust Workflow Graph styling (#37497)
-  * Improve code editor text selection and clean up lint enablement (#37474)
-  * Add mirror auth updates to repo edit API and settings (#37468)
-  * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411)
-  * Feat: Add default PR branch update style setting (#37410)
-  * Fix inconsistent disabled styling on logged-out repo header buttons (#37406)
-  * Allow fast-forward-only merge when signed commits are required (#37335)
-  * Enhance styling in actions page (#37323)
-  * Fix: improve actions status icons and texts (#37206)
-  * Make Markdown fenced code block work with more syntaxes (#37154)
-  * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
-  * Add API endpoint to reply to pull request review comments (#36683)
-
-* PERFORMANCE
-  * Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368)
-  * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155)
-  * Perf: Various performance regression fixes (#38078)
-  * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076)
-  * Batch-load related data in actions run, job, and task API endpoints (#37032)
-
-* BUGFIXES
-  * Fix(util): reject invalid characters between time-estimate units (#38416) (#38423)
-  * Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419)
-  * Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420)
-  * Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411)
-  * Fix: actions task state concurrent update (#38405) (#38409)
-  * Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403)
-  * Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401)
-  * Fix: co-author detection (#38392) (#38397)
-  * Fix: incorrect co-author detection on commit page (#38386) (#38387)
-  * Fix(ui): restore commits table column widths (#38379) (#38383)
-  * Fix: minio init check (#38355) (#38361)
-  * Fix: org project view assignee list (#38357) (#38360)
-  * Fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347)
-  * Fix(actions): make runner list pagination order deterministic (#38313) (#38327)
-  * Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304)
-  * Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307)
-  * Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302)
-  * Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)
-  * Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293)
-  * Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287)
-  * Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283)
-  * Fix: update npm dependencies, fix misc issues (#38257)
-  * Fix(api): respect since/until when counting commits for X-Total-Count (#38204)
-  * Fix: codemirror regressions (#38248)
-  * Fix(api): support HEAD requests on all API GET endpoints (#38245)
-  * Fix(actions): Cleanup workflow status badge code (#38241)
-  * Fix(web): Correctly align the "disabled" label on larger workflow names (#38240)
-  * Fix(actions): don't swallow HTML entities into linkified URLs (#38239)
-  * Fix(packages): accept npm "repository" and "bin" in string form (#38236)
-  * Fix(actions): fix 500 error when canceling a canceling task (#38223)
-  * Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219)
-  * Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216)
-  * Fix(api): deny private org member enumeration via /members (#38213)
-  * Fix(actions): ensure all waiting jobs get runners in large workflows (#38200)
-  * Fix(deps): update go dependencies (#38194)
-  * Fix(deps): update npm dependencies (#38193)
-  * Fix(cli): default must-change-password to false for bot users (#38175)
-  * Fix(actions): show run index in run view and fix summary graph height (#38165)
-  * Fix: csp (#38162)
-  * Fix(deps): update npm dependencies (#38123)
-  * Fix(mssql): expand legacy issue and comment long-text columns (#38120)
-  * Fix(packages): validate debian distribution and component names (#38116)
-  * Fix(packages): validate module version in goproxy ParsePackage (#38104)
-  * Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097)
-  * Fix: git push hook post receive (#38089)
-  * Fix(ui): prevent commit status popup overflowing its row (#38081)
-  * Fix: validate gem name in rubygems parseMetadataFile (#38061)
-  * Fix: commit display name (#38057)
-  * Fix: csp regressions (#38047)
-  * Fix: api error message (#38031)
-  * Fix(deps): update npm dependencies (#38029)
-  * Fix: pgsql lint (#38022)
-  * Fix(indexer): fix assignee filters in issue search (#38021)
-  * Fix: various dropdown problems (#38020)
-  * Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007)
-  * Fix: raise git required version to 2.13 (#37996)
-  * Fix: remove "no-transfrom" from the cache-control header (#37985)
-  * Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971)
-  * Fix: use committer time where ever possible as default (#37969)
-  * Fix(deps): update npm dependencies, remove nolyfill (#37968)
-  * Fix(deps): update go dependencies (#37967)
-  * Fix(pull): preserve squash message trailers and additional commit messages (#37954)
-  * Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)
-  * Fix: support ##[command] log prefix in action run UI (#37882)
-  * Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845)
-  * Fix(deps): update npm dependencies (#37844)
-  * Fix(deps): update go dependencies (#37841)
-  * Fix(frontend): resolve Vite assets by manifest source path (#37836)
-  * Fix(locales): Replace hardcoded strings (#37788)
-  * Fix(packages): render markdown links relative to linked repo (#37676)
-  * Fix: persist mirror repository metadata (#37519)
-  * Fix cmd tests by mocking builtin paths (#37369)
-  * Add `form-fetch-action` to some forms, fix "fetch action" resp bug (#37305)
-  * Feat: execute post run cleanup when workflow is cancelled (#37275)
-  * Fix `relative-time` error and improve global error handler (#37241)
-  * Refactor flash message and remove SanitizeHTML template func (#37179)
-
-* TESTING
-  * Test(e2e): fix race in pdf file render test (#38380) (#38381)
-  * Test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331)
-  * Test: speed up two tests (#37905)
-  * Test: Fix random failure test (#37887)
-  * Test: fix flaky `issue-comment` close test (#37880)
-  * Test: enable WAL for sqlite integration tests (#37861)
-  * Test: fix flaky `TestResourceIndex` and reduce its runtime (#37847)
-  * Test: run `TestAPIRepoMigrate` offline via a local clone source (#37817)
-  * Ci: shard tests and reduce redundant work (#37618)
-  * Test(e2e): run playwright via container (#37300)
-  * Remove external service dependencies in migration tests (#36866)
-
-* BUILD
-  * Fix(actions): authenticate snapcraft before nightly remote build (#38252)
-  * Ci: cap Elasticsearch heap in db-tests (#37816)
-  * Build(snap): publish nightly version to snapcraft via actions (#37814)
-  * Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
-  * Ci: narrow files-changed frontend filter (#37749)
-  * Ci: add `zizmor` to `lint-actions` (#37720)
-  * Chore: clean up "contrib" dir (#37690)
-  * Fix: snap build (main branch) (#37685)
-  * Ci: Also lint json5 files (#37659)
-  * Feat(editor): broaden language detection in web code editor (#37619)
-  * Build: update pnpm to v11 (#37591)
-  * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557)
-  * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543)
-  * Update go js py dependencies (#37525)
-  * Ci: lint PR titles with commitlint (#37498)
-  * Chore: upgrade Go version in devcontainer image to 1.26 (#37374)
-  * Update GitHub Actions to latest major versions (#37313)
-  * Update go js dependencies (#37312)
-  * Fail vite build on rolldown warnings via NODE_ENV=test (#37270)
-  * Remove htmx (#37224)
-  * Replace custom Go formatter with `golangci-lint fmt` (#37194)
-  * Refactor htmx and fetch-action related code (#37186)
-  * Integrate renovate bot for all dependency updates (#37050)
-  * Build(sign): move to sigstore (#38250)
-
-* DOCS
-  * Docs: update changelog for 1.26.3 & 1.26.4 (#38178)
-  * Docs: fix duplicated word in foreachref doc comment (#38161)
-  * Docs: Clarify criteria for becoming a merger (#38113)
-  * Docs: Publish TOC Election Result 2026 (#38111)
-  * Docs: mark openapi3 as autogenerated in attributes (#37963)
-  * Docs: add development setup guide (#37960)
-
-* MISC
-  * Revert(sign): restore gpg (#38251)
-  * Refactor: replace legacy `delete-button` with `link-action` (#38143)
-  * Refactor(actions): read runner capabilities from proto field (#38068)
-  * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012)
-  * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)
-  * Fix(deps): update go dependencies (#37851)
-  * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825)
-  * Ci: tweak `files-changed`, add `free-disk-space` (#37819)
-  * Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
-  * Test(e2e): add comment, release, star, PR and fork tests (#37800)
-  * Chore: simplify issue and pull request templates (#37799)
-  * Chore: Update giteabot to fix failure when backport (#37789)
-  * Fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
-  * Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
-  * Ci: split giteabot workflow (#37770)
-  * Fix(deps): update npm dependencies (#37768)
-  * Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
-  * Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
-  * Ci: fix cache-related issues (#37761)
-  * Chore: fix tests (#37760)
-  * Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
-  * Fix(deps): update npm dependencies (#37753)
-  * Fix(deps): update go dependencies (#37752)
-  * Chore(deps): update action dependencies (#37751)
-  * Fix(markup): wrap indented code blocks for the code-copy button (#37748)
-  * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746)
-  * Feat(web): also display PR counts in repo list (#37739)
-  * Refactor(glob): use strings.Builder for regexp compilation (#37730)
-  * Chore(doctor): remove four obsolete doctor check implementations (#37728)
-  * Refactor(org): simplify owner-team org repo creation logic (#37727)
-  * Refactor: move `workflowpattern` into `modules/actions` (#37717)
-  * Chore: clean up tests (#37715)
-  * Style: misc UI fixes (#37691)
-  * Ci: add shellcheck linter (#37682)
-  * Fix: catch and fix more lint problems (#37674)
-  * Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
-  * Fix(deps): update npm dependencies (#37647)
-  * Ci(renovate): update Go import paths on major bumps (#37641)
-  * Fix(deps): update go dependencies (major) (#37639)
-  * Chore(deps): update action dependencies (major) (#37638)
-  * Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
-  * Fix(deps): update npm dependencies (#37636)
-  * Refactor(log): replace log.Critical with log.Error (#37624)
-  * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616)
-  * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607)
-  * Chore(deps): update action dependencies (#37603)
-  * Ci: allow `chore` type in PR title lint (#37575)
-  * Refactor: only reset a database table when the table's data was changed (#37573)
-  * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565)
-  * Refactor: use modernc sqlite driver as default (#37562)
-  * Docs: fix 4 typos in CHANGELOG.md (#37549)
-  * Fix(deps): update go dependencies (#37541)
-  * Chore(deps): update action dependencies (#37540)
-  * Refactor pull request view (6) (#37522)
-  * Fix: redirect early CLI console logger to stderr (#37507)
-  * Refactor "flex-list" to "flex-divided-list" (#37505)
-  * Refactor compare diff/pull page (1) (#37481)
-  * Refactor pull request view (4) (#37451)
-  * Update 1.26.1 changelog in main (#37442)
-  * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441)
-  * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405)
-  * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364)
-  * Update `Block a user` form (#37359)
-  * Move review request functions to a standalone file (#37358)
-  * Feat(security): set X-Content-Type-Options: nosniff by default (#37354)
-  * Enable strict TypeScript, add `errorMessage` helper (#37292)
-  * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291)
-  * Update Nix flake (#37284)
-  * Fix Repository transferring page (#37277)
-  * Remove `SubmitEvent` polyfill (#37276)
-  * Remove dead code identified by `deadcode` tool (#37271)
-  * Upgrade go-git to v5.18.0 (#37268)
-  * Don't add useless labels which will bother changelog generation (#37267)
-  * Move heatmap to first-party code (#37262)
-  * Tests/integration: simplify code (#37249)
-  * Add pagination and search box to org teams list (#37245)
-  * Remove error returns from crypto random helpers and callers (#37240)
-  * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229)
-  * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210)
-  * Refactor "htmx" to "fetch action" (#37208)
-  * Update go js py dependencies (#37204)
-  * Add comment for the design of "user activity time" (#37195)
-  * Remove outdated RunUser logic (#37180)
-  * Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150)
-  * Update javascript dependencies (#37142)
-  * Update go dependencies (#37141)
-  * Frontport changelog of v1.26.0-rc0 (#37138)
-  * Introduce `ActionRunAttempt` to represent each execution of a run (#37119)
-  * Workflow Artifact Info Hover (#37100)
-  * Extend issue context popup beyond markdown content (#36908)
-  * Add bulk repository deletion for organizations (#36763)
-  * Feat: Add bypass allowlist for branch protection (#36514)
-
 ## [1.26.4](https://github.com/go-gitea/gitea/releases/tag/1.26.4) - 2026-06-21

 * SECURITY
@@ -41,7 +41,6 @@ Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
 Jason Song <i@wolfogre.com> (@wolfogre)
-Yarden Shoham <git@yardenshoham.com> (@yardenshoham)
 Yu Tian <zettat123@gmail.com> (@Zettat123)
 Dong Ge <gedong_1994@163.com> (@sillyguodong)
 Xinyi Gong <hestergong@gmail.com> (@HesterG)
@@ -12,13 +12,13 @@ COMMA := ,
 XGO_VERSION := go-1.26.x

 AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.8.0 # renovate: datasource=go
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.34.1 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.35.0 # renovate: datasource=go
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.4.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.5.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
 SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker

@@ -231,7 +231,9 @@ endif
 generate-swagger: $(SWAGGER_SPEC) $(OPENAPI3_SPEC) ## generate the swagger spec from code comments

 $(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
-	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'
+	@output="$$($(GO) run $(SWAGGER_PACKAGE) generate spec --enable-allof-compounding --skip-enum-desc --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)' 2>&1)" || { printf '%s\n' "$$output" >&2; exit 1; }; \
+	warnings="$$(printf '%s\n' "$$output" | grep -v '^go: ')"; \
+	if [ -n "$$warnings" ]; then printf '%s\n' "$$warnings" >&2; exit 1; fi

 .PHONY: swagger-check
 swagger-check: generate-swagger
@@ -246,9 +248,11 @@ swagger-check: generate-swagger
 swagger-validate: ## check if the swagger spec is valid
 	@# swagger "validate" requires that the "basePath" must start with a slash, but we are using Golang template "{{...}}"
 	@$(SED_INPLACE) -E -e 's|"basePath":( *)"(.*)"|"basePath":\1"/\2"|g' './$(SWAGGER_SPEC)' # add a prefix slash to basePath
-	@# FIXME: there are some warnings
-	$(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)'
-	@$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)' # remove the prefix slash from basePath
+	@output="$$($(GO) run $(SWAGGER_PACKAGE) validate './$(SWAGGER_SPEC)' 2>&1)"; status=$$?; \
+	$(SED_INPLACE) -E -e 's|"basePath":( *)"/(.*)"|"basePath":\1"\2"|g' './$(SWAGGER_SPEC)'; \
+	printf '%s\n' "$$output" | grep -v '^go: '; \
+	[ $$status -eq 0 ] || exit $$status; \
+	case "$$output" in *WARNING:*) exit 1;; esac

 .PHONY: generate-openapi3
 generate-openapi3: $(OPENAPI3_SPEC) ## generate the OpenAPI 3.0 spec from the Swagger 2.0 spec
@@ -436,6 +436,7 @@
      "jsonl",
      "mcmeta",
      "sarif",
+      "slnlaunch",
      "tact",
      "tfstate",
      "topojson",
@@ -691,10 +692,17 @@
    "extensions": [
      "ini",
      "cnf",
+      "container",
      "dof",
      "lektorproject",
+      "mount",
+      "network",
      "prefs",
      "properties",
+      "service",
+      "socket",
+      "target",
+      "timer",
      "url",
      "conf"
    ],
@@ -18,6 +18,7 @@ func newUserCommand() *cli.Command {
 			microcmdUserDelete(),
 			newUserGenerateAccessTokenCommand(),
 			microcmdUserMustChangePassword(),
+			microcmdUserDisableTwoFactor(),
 		},
 	}
 }
@@ -0,0 +1,72 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+
+	"github.com/urfave/cli/v3"
+)
+
+func microcmdUserDisableTwoFactor() *cli.Command {
+	return &cli.Command{
+		Name:  "disable-2fa",
+		Usage: "Disable two-factor authentication for a user",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "username",
+				Aliases: []string{"u"},
+				Usage:   "Username of the user to disable 2FA for",
+			},
+			&cli.Int64Flag{
+				Name:  "id",
+				Usage: "ID of the user to disable 2FA for",
+			},
+		},
+		Action: runDisableTwoFactor,
+	}
+}
+
+func runDisableTwoFactor(ctx context.Context, c *cli.Command) error {
+	if !c.IsSet("id") && !c.IsSet("username") {
+		return errors.New("either --id or --username must be provided")
+	}
+
+	if !setting.IsInTesting {
+		if err := initDB(ctx); err != nil {
+			return err
+		}
+	}
+
+	var user *user_model.User
+	var err error
+	if c.IsSet("id") {
+		user, err = user_model.GetUserByID(ctx, c.Int64("id"))
+	} else {
+		user, err = user_model.GetUserByName(ctx, c.String("username"))
+	}
+	if err != nil {
+		return err
+	}
+
+	// When both selectors are given, make sure they refer to the same user.
+	if c.IsSet("id") && c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
+		return fmt.Errorf("the user with id %d is %q, which does not match the provided username %q", user.ID, user.Name, c.String("username"))
+	}
+
+	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, user.ID)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Disabled 2FA for user %q (removed %d TOTP and %d WebAuthn credential(s))\n", user.Name, totp, webAuthn)
+	return nil
+}
@@ -0,0 +1,119 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"io"
+	"strconv"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	"github.com/go-webauthn/webauthn/webauthn"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDisableTwoFactorCommand(t *testing.T) {
+	ctx := t.Context()
+
+	defer func() {
+		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}, &auth_model.TwoFactor{}, &auth_model.WebAuthnCredential{}))
+	}()
+
+	t.Run("disable TOTP and WebAuthn", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "tfuser", "--email", "tfuser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "tfuser"})
+
+		// Enroll TOTP.
+		tf := &auth_model.TwoFactor{UID: user.ID}
+		require.NoError(t, tf.SetSecret("test-secret"))
+		_, err := tf.GenerateScratchToken()
+		require.NoError(t, err)
+		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
+
+		// Register a WebAuthn credential.
+		_, err = auth_model.CreateCredential(ctx, user.ID, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
+		require.NoError(t, err)
+
+		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		require.True(t, has)
+
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "tfuser"}))
+
+		// Both factors must be gone afterwards.
+		has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		assert.False(t, has)
+	})
+
+	t.Run("disable by id", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "iduser", "--email", "iduser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "iduser"})
+
+		tf := &auth_model.TwoFactor{UID: user.ID}
+		require.NoError(t, tf.SetSecret("test-secret"))
+		require.NoError(t, auth_model.NewTwoFactor(ctx, tf))
+
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", strconv.FormatInt(user.ID, 10)}))
+
+		has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, user.ID)
+		require.NoError(t, err)
+		assert.False(t, has)
+	})
+
+	t.Run("no enrollment is a no-op", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "plainuser", "--email", "plainuser@gitea.local", "--random-password"}))
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--username", "plainuser"}))
+	})
+
+	t.Run("id and username must match when both given", func(t *testing.T) {
+		require.NoError(t, microcmdUserCreate().Run(ctx, []string{"create", "--username", "matchuser", "--email", "matchuser@gitea.local", "--random-password"}))
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "matchuser"})
+		id := strconv.FormatInt(user.ID, 10)
+
+		// Matching id + username is accepted.
+		require.NoError(t, microcmdUserDisableTwoFactor().Run(ctx, []string{"disable-2fa", "--id", id, "--username", "matchuser"}))
+
+		// Mismatched id + username is rejected.
+		cmd := microcmdUserDisableTwoFactor()
+		cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+		err := cmd.Run(ctx, []string{"disable-2fa", "--id", id, "--username", "someotheruser"})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "does not match the provided username")
+	})
+
+	t.Run("failure cases", func(t *testing.T) {
+		testCases := []struct {
+			name        string
+			args        []string
+			expectedErr string
+		}{
+			{
+				name:        "user does not exist",
+				args:        []string{"disable-2fa", "--username", "nonexistentuser"},
+				expectedErr: "user does not exist",
+			},
+			{
+				name:        "neither id nor username",
+				args:        []string{"disable-2fa"},
+				expectedErr: "either --id or --username must be provided",
+			},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				cmd := microcmdUserDisableTwoFactor()
+				cmd.Writer, cmd.ErrWriter = io.Discard, io.Discard
+				err := cmd.Run(ctx, tc.args)
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.expectedErr)
+			})
+		}
+	})
+}
@@ -6,7 +6,6 @@ package cmd
 import (
 	"crypto/x509"
 	"encoding/pem"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -94,21 +93,10 @@ func runACME(listenAddr string, m http.Handler) error {
 	myACME := certmagic.NewACMEIssuer(magic, certmagic.DefaultACME)
 	magic.Issuers = []certmagic.Issuer{myACME}

-	// Obtain certificates or renew them if necessary. ManageSync fails closed on
-	// renewal errors even when a still-valid certificate is already on disk, which
-	// takes HTTPS down on restart (https://github.com/go-gitea/gitea/issues/38519).
-	// Prefer keeping the existing cert and retrying renewals asynchronously.
-	ctx := graceful.GetManager().ShutdownContext()
-	err := magic.ManageSync(ctx, []string{setting.Domain})
+	// this obtains certificates or renews them if necessary
+	err := magic.ManageSync(graceful.GetManager().HammerContext(), []string{setting.Domain})
 	if err != nil {
-		cert, cacheErr := magic.CacheManagedCertificate(ctx, setting.Domain)
-		if cacheErr != nil || cert.Expired() {
-			return errors.Join(err, cacheErr)
-		}
-		log.Error("ACME certificate manage failed; continuing with existing certificate: %v", err)
-		if err := magic.ManageAsync(ctx, []string{setting.Domain}); err != nil {
-			log.Error("Failed to start async ACME management: %v", err)
-		}
+		return err
 	}

 	tlsConfig := magic.TLSConfig()
@@ -1198,6 +1198,7 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
+;; "branch-name" always uses the PR's branch name.
 ;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
@@ -95,8 +95,15 @@ However, if there are no objections from maintainers, the PR can be merged with
 ### Commit messages

 Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
+Usually the Pull Request description and commit message body should not be empty, unless the title is already clear enough or the description would be a copy of the comments in code.

-The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+The final commit message:
+
+- should match the code changes.
+- should only keep true co-authors, false-positive co-authors should be removed.
+- should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+- should not contain hidden information like `<!-- -->` or extra information after the description's divider `----`.
+- should not contain unrelated contents (e.g.: Release Notes, Configuration, etc.) from a Renovate update PR.

 #### PR Co-authors

@@ -158,9 +165,16 @@ Any account with write access (including bots and TOC members) **must** use [2FA
 Mergers are the maintainers who carry out the final merge of approved PRs. Their responsibilities, described throughout this guide, are:

 - Merging PRs from the [merge queue](#getting-prs-merged) in order, once a PR has `lgtm/done`, no open discussions, and no merge conflicts.
- Rewriting the PR title and summary so the squash [commit message](#commit-messages) is clear, removing false-positive co-authors while keeping every true co-author.
+- Rewriting the PR title and description prior to the merge, making the [commit message](#commit-messages) clear.\
+  In particular, mergers should edit the PR description.\
+  Mergers should **not** edit the actual commit message except to remove unnecessary information. Because of that, even if users are looking at the PR, they can understand what changed.
 - Assigning the correct labels (including `type/…`) needed for changelog and backport decisions.
 - Agreeing, together with the owners, on when a release is ready (see [release management](release-management.md)).
+- Merging a PR also means the PR looks good to the merger and is approved by the merger.
+
+If a merger violates these merge guides more than 3 times in the past 365 days
+(e.g.: merge with unresolved reviews without TOC decision to ignore the review, merge with garbage commit messages),
+they may lose their merging privileges for at least three months.

 #### Becoming a merger

@@ -200,20 +214,20 @@ random.seed("Gitea TOC <YEAR> Election")
 random.choice([<CANDIDATE_1>, <CANDIDATE_2>, ...])
 ```

-The result of this script needs then to be published in the TOC election issue to ensure transparency of the process. 
+The result of this script needs then to be published in the TOC election issue to ensure transparency of the process.

 ### Current TOC members

 - 2026-06-14 ~ 2026-12-31
  - Company
-    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
+    - [Yu Tian](https://gitea.com/Zettat123) <zettat123@gmail.com>
    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
  - Community
    - [bircni](https://gitea.com/bircni) <bircni@icloud.com>
    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
    - [TheFox0x7](https://gitea.com/TheFox0x7) <thefox0x7@gmail.com>
-    
+

 ### Previous TOC/owners members

@@ -227,7 +241,7 @@ Here's the history of the owners and the time they served:
 - [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
 - [6543](https://gitea.com/6543) - 2023, 2025
 - [John Olheiser](https://gitea.com/jolheiser) - 2023, 2024
- [Jason Song](https://gitea.com/wolfogre) - 2023
+- [Jason Song](https://gitea.com/wolfogre) - 2023, 2025

 ## Governance Compensation

@@ -1,6 +1,4 @@
-import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
-import deMorgan from 'eslint-plugin-de-morgan';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
 import playwright from 'eslint-plugin-playwright';
@@ -15,7 +13,6 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
-import type {ESLint} from 'eslint';

 import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts';

@@ -64,10 +61,8 @@ export default defineConfig([
      '@eslint-community/eslint-comments': comments,
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
-      'array-func': arrayFunc,
-      'de-morgan': deMorgan,
      'gitea': {rules: {'unescaped-html-literal': unescapedHtmlLiteral}},
-      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      'import-x': importPlugin,
      regexp,
      sonarjs,
      unicorn,
@@ -278,12 +273,6 @@ export default defineConfig([
      '@typescript-eslint/unified-signatures': [2],
      'accessor-pairs': [2],
      'array-callback-return': [2, {checkForEach: true}],
-      'array-func/avoid-reverse': [2],
-      'array-func/from-map': [2],
-      'array-func/no-unnecessary-this-arg': [2],
-      'array-func/prefer-array-from': [2],
-      'array-func/prefer-flat-map': [0], // handled by unicorn/prefer-array-flat-map
-      'array-func/prefer-flat': [0], // handled by unicorn/prefer-array-flat
      'arrow-body-style': [0],
      'block-scoped-var': [2],
      'camelcase': [0],
@@ -294,8 +283,6 @@ export default defineConfig([
      'consistent-this': [0],
      'constructor-super': [2],
      'curly': [0],
-      'de-morgan/no-negated-conjunction': [2],
-      'de-morgan/no-negated-disjunction': [2],
      'default-case-last': [2],
      'default-case': [0],
      'default-param-last': [0],
@@ -745,6 +732,7 @@ export default defineConfig([
      'unicorn/consistent-json-file-read': [2],
      'unicorn/consistent-optional-chaining': [2],
      'unicorn/consistent-template-literal-escape': [2],
+      'unicorn/consistent-tuple-labels': [2],
      'unicorn/custom-error-definition': [0],
      'unicorn/default-export-style': [2],
      'unicorn/dom-node-dataset': [2, {preferAttributes: true}],
@@ -778,6 +766,7 @@ export default defineConfig([
      'unicorn/no-array-sort-for-min-max': [2],
      'unicorn/no-array-splice': [0],
      'unicorn/no-asterisk-prefix-in-documentation-comments': [0],
+      'unicorn/no-async-promise-finally': [2],
      'unicorn/no-await-expression-member': [0],
      'unicorn/no-await-in-promise-methods': [2],
      'unicorn/no-blob-to-file': [2],
@@ -814,8 +803,10 @@ export default defineConfig([
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-file-input-accept': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
+      'unicorn/no-invalid-well-known-symbol-methods': [2],
      'unicorn/no-keyword-prefix': [0],
      'unicorn/no-late-current-target-access': [2],
+      'unicorn/no-late-event-control': [2],
      'unicorn/no-lonely-if': [2],
      'unicorn/no-loop-iterable-mutation': [2],
      'unicorn/no-magic-array-flat-depth': [0],
@@ -852,9 +843,11 @@ export default defineConfig([
      'unicorn/no-uncalled-method': [2],
      'unicorn/no-undeclared-class-members': [2],
      'unicorn/no-unnecessary-array-flat-depth': [2],
+      'unicorn/no-unnecessary-array-flat-map': [2],
      'unicorn/no-unnecessary-array-splice-count': [2],
      'unicorn/no-unnecessary-await': [2],
      'unicorn/no-unnecessary-boolean-comparison': [2],
+      'unicorn/no-unnecessary-fetch-options': [0],
      'unicorn/no-unnecessary-global-this': [0],
      'unicorn/no-unnecessary-nested-ternary': [2],
      'unicorn/no-unnecessary-polyfills': [2],
@@ -867,6 +860,7 @@ export default defineConfig([
      'unicorn/no-unreadable-object-destructuring': [0],
      'unicorn/no-unsafe-buffer-conversion': [2],
      'unicorn/no-unsafe-dom-html': [0],
+      'unicorn/no-unsafe-promise-all-settled-values': [2],
      'unicorn/no-unsafe-property-key': [0],
      'unicorn/no-unsafe-string-replacement': [0],
      'unicorn/no-unused-array-method-return': [2],
@@ -896,13 +890,17 @@ export default defineConfig([
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
      'unicorn/operator-assignment': [2],
+      'unicorn/prefer-abort-signal-any': [2],
+      'unicorn/prefer-abort-signal-timeout': [2],
      'unicorn/prefer-add-event-listener': [2],
      'unicorn/prefer-add-event-listener-options': [2],
+      'unicorn/prefer-aggregate-error': [2],
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
      'unicorn/prefer-array-from-async': [2],
      'unicorn/prefer-array-from-map': [2],
+      'unicorn/prefer-array-from-range': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-iterable-methods': [2],
      'unicorn/prefer-array-last-methods': [2],
@@ -912,6 +910,7 @@ export default defineConfig([
      'unicorn/prefer-await': [2],
      'unicorn/prefer-bigint-literals': [2],
      'unicorn/prefer-blob-reading-methods': [2],
+      'unicorn/prefer-block-statement-over-iife': [2],
      'unicorn/prefer-boolean-return': [2],
      'unicorn/prefer-class-fields': [2],
      'unicorn/prefer-classlist-toggle': [2],
@@ -924,15 +923,18 @@ export default defineConfig([
      'unicorn/prefer-dom-node-append': [2],
      'unicorn/prefer-dom-node-html-methods': [0],
      'unicorn/prefer-dom-node-remove': [2],
+      'unicorn/prefer-dom-node-replace-children': [2],
      'unicorn/prefer-dom-node-text-content': [2],
      'unicorn/prefer-early-return': [0],
      'unicorn/prefer-else-if': [2],
+      'unicorn/prefer-error-is-error': [0],
      'unicorn/prefer-event-target': [2],
      'unicorn/prefer-export-from': [0],
      'unicorn/prefer-flat-math-min-max': [2],
      'unicorn/prefer-get-or-insert-computed': [2],
      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
+      'unicorn/prefer-group-by': [2],
      'unicorn/prefer-has-check': [2],
      'unicorn/prefer-hoisting-branch-code': [2],
      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
@@ -942,6 +944,7 @@ export default defineConfig([
      'unicorn/prefer-includes-over-repeated-comparisons': [0], // too opinionated
      'unicorn/prefer-iterable-in-constructor': [2],
      'unicorn/prefer-iterator-concat': [0], // too opinionated
+      'unicorn/prefer-iterator-helpers': [2],
      'unicorn/prefer-iterator-to-array': [2],
      'unicorn/prefer-iterator-to-array-at-end': [2],
      'unicorn/prefer-keyboard-event-key': [2],
@@ -966,9 +969,11 @@ export default defineConfig([
      'unicorn/prefer-object-destructuring-defaults': [2],
      'unicorn/prefer-object-from-entries': [2],
      'unicorn/prefer-object-iterable-methods': [2],
+      'unicorn/prefer-observer-apis': [2],
      'unicorn/prefer-optional-catch-binding': [2],
      'unicorn/prefer-path2d': [2],
      'unicorn/prefer-private-class-fields': [0],
+      'unicorn/prefer-promise-try': [2],
      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [0],
      'unicorn/prefer-query-selector': [2],
@@ -979,10 +984,12 @@ export default defineConfig([
      'unicorn/prefer-response-static-json': [2],
      'unicorn/prefer-scoped-selector': [0],
      'unicorn/prefer-set-has': [0],
+      'unicorn/prefer-set-methods': [0],
      'unicorn/prefer-set-size': [2],
      'unicorn/prefer-short-arrow-method': [2],
      'unicorn/prefer-simple-condition-first': [0],
      'unicorn/prefer-simple-sort-comparator': [2],
+      'unicorn/prefer-simplified-conditions': [2],
      'unicorn/prefer-single-array-predicate': [2],
      'unicorn/prefer-single-call': [2],
      'unicorn/prefer-single-object-destructuring': [2],
@@ -1002,6 +1009,7 @@ export default defineConfig([
      'unicorn/prefer-switch': [0],
      'unicorn/prefer-temporal': [0],
      'unicorn/prefer-ternary': [0],
+      'unicorn/prefer-toggle-attribute': [2],
      'unicorn/prefer-top-level-await': [0],
      'unicorn/prefer-type-error': [0],
      'unicorn/prefer-type-literal-last': [0],
@@ -1010,6 +1018,7 @@ export default defineConfig([
      'unicorn/prefer-unicode-code-point-escapes': [0],
      'unicorn/prefer-url-can-parse': [2],
      'unicorn/prefer-url-href': [2],
+      'unicorn/prefer-url-search-parameters': [2],
      'unicorn/prefer-while-loop-condition': [2],
      'unicorn/prevent-abbreviations': [0],
      'unicorn/relative-url-style': [2],
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1776877367,
-        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "lastModified": 1782723713,
+        "narHash": "sha256-oPXCU/SSUokcGaJREHibG1CBX3+s/W7orDWQOZDsEeQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "rev": "b5aa0fbd538984f6e3d201be0005b4463d8b09f8",
        "type": "github"
      },
      "original": {
@@ -34,7 +34,7 @@

              # only bump toolchain versions here
              go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_24;
+              nodejs = pkgs.nodejs_26;
              python3 = pkgs.python314;
              pnpm = pkgs.pnpm_10;

@@ -13,7 +13,7 @@ require (
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
 	gitea.dev/actions-proto-go v0.6.0
-	gitea.dev/sdk v1.1.0
+	gitea.dev/sdk v1.2.0
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
@@ -24,8 +24,8 @@ require (
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
 	github.com/alecthomas/chroma/v2 v2.27.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.24
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.25
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
@@ -57,7 +57,7 @@ require (
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v88 v88.0.0
+	github.com/google/go-github/v89 v89.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
 	github.com/google/pprof v0.0.0-20260604005048-7023385849c0
 	github.com/google/uuid v1.6.0
@@ -68,8 +68,8 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jhillyerd/enmime/v2 v2.4.1
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.18.6
-	github.com/klauspost/cpuid/v2 v2.3.0
+	github.com/klauspost/compress v1.19.0
+	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.22
@@ -78,7 +78,7 @@ require (
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.10.0
-	github.com/minio/minio-go/v7 v7.2.0
+	github.com/minio/minio-go/v7 v7.2.1
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
@@ -87,7 +87,6 @@ require (
 	github.com/prometheus/client_golang v1.23.2
 	github.com/quasoft/websspi v1.1.2
 	github.com/redis/go-redis/v9 v9.21.0
-	github.com/rhysd/actionlint v1.7.12
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/sassoftware/go-rpmutils v0.4.0
@@ -97,12 +96,12 @@ require (
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.0
+	github.com/urfave/cli/v3 v3.10.1
 	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.42.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.44.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
 	golang.org/x/crypto v0.53.0
 	golang.org/x/image v0.43.0
@@ -112,14 +111,14 @@ require (
 	golang.org/x/sync v0.21.0
 	golang.org/x/sys v0.46.0
 	golang.org/x/text v0.38.0
-	google.golang.org/grpc v1.81.1
+	google.golang.org/grpc v1.82.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.3
 	modernc.org/sqlite v1.53.0
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.3.11
+	xorm.io/xorm v1.4.1
 )

 require (
@@ -245,6 +244,7 @@ require (
 	github.com/prometheus/common v0.68.1 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rhysd/actionlint v1.7.12 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
@@ -28,8 +28,8 @@ gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGq
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
 gitea.dev/actions-proto-go v0.6.0 h1:gjllYQ5vmwlkqOeofTQu5qKTZpmf7kWsafoHvoPCSzY=
 gitea.dev/actions-proto-go v0.6.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
-gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
-gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
+gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
+gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -94,14 +94,14 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aws/aws-sdk-go-v2 v1.42.0 h1:XvXMJTkFQtpBKIWZnmr9ZEOc2InWM2yldjXEJ/bymhA=
 github.com/aws/aws-sdk-go-v2 v1.42.0/go.mod h1:27+ACypSLljLAEKsCYOmrjKh83vuTRkuAe9Uv/3A4bg=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24 h1:2hQqYCV9yqyePQ9o6dCrZc/zO8U3TwPr9mIKlZnPu/I=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.24/go.mod h1:IDwpACtwqHLISdzfwUUNq4P9DsB/h5BLg4FwJPNfqFY=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.25 h1:TzPVjfUZ1hsKafvYE+DIzKXIik2KufQxsPHanlkttbo=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.25/go.mod h1:K4hw0buguVvtC74HnVfTRr0LzQQHAWPqJbBU9QGk2Pg=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 h1:f3vKqSo13fhTYb+JEcXwXefZQE26I1FB5eTSniU67ko=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29/go.mod h1:MzoLFUArKGpGD+ukmPiTPG1X5x4o6M2kq4v2dr1FiEc=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 h1:RdwIf/CuUsvJX3RgJagbOyotl/cxoLY4xviKuE7p2GY=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29/go.mod h1:71wt8W2EgswdZy9Mf9KNnzxZ3TiZlv4caKghPktDOkA=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4 h1:Uu+wqrOXozYYvaxcNIqjFsMTjoIJIZDN3R0f70ZIjyQ=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.4/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5 h1:mY0qCJuWfbRxok5sRkGxehMGshSYAVIskDvPE4zIZwM=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.34.5/go.mod h1:pYrBdL1tMTZO7PaKRsa1cTUB8HtQh3fFM3zJHGhTQcE=
 github.com/aws/smithy-go v1.27.2 h1:y9NPmSE6am6LjEFPfqHqG/jJk7AauQvhCJONKh7kpzk=
 github.com/aws/smithy-go v1.27.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
@@ -376,8 +376,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
-github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
+github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0=
+github.com/google/go-github/v89 v89.0.0/go.mod h1:QLcbU0ipeAqQuR5KSg8c2lql4Qk1EwJ2dWz/0rP4Nho=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -413,8 +413,6 @@ github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pw
 github.com/gorilla/sessions v1.2.0/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
-github.com/graph-gophers/graphql-go v1.10.2 h1:HXu6Wu5klCH4ALn1fQHVI20cjEIa4wftavHIgbLA4Fo=
-github.com/graph-gophers/graphql-go v1.10.2/go.mod h1:AsADheC4CCFwd8n1/QbkduTlHgYYMsRgtPihYVAlEsk=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -471,12 +469,12 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
+github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
 github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
 github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/klauspost/pgzip v1.2.6 h1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=
@@ -534,8 +532,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
-github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
+github.com/minio/minio-go/v7 v7.2.1 h1:PfBfwvKB/MmqyN8Vb1G9voWisaM9OrLv+WwOvMwS9Dw=
+github.com/minio/minio-go/v7 v7.2.1/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/minio/minlz v1.1.1 h1:OGmft1V6AnI/Wme332U6bhG54nxEan+VFgkD7lat4KM=
 github.com/minio/minlz v1.1.1/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -709,8 +707,8 @@ github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
-github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.1 h1:7Kx9H50hrHbRbyxgO1KP6/BcbiGRz0uYh5YyQ30JEEY=
+github.com/urfave/cli/v3 v3.10.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
 github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
 github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
@@ -740,8 +738,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0 h1:Bq5YIYgUJVbt4Hbh7ibBwNR4SNEafsyDVhIXl7dXDdg=
-gitlab.com/gitlab-org/api/client-go/v2 v2.42.0/go.mod h1:SKUbKSS59KPt6WeGNJoYF8HDaf/rFMUSITlftj/HkLg=
+gitlab.com/gitlab-org/api/client-go/v2 v2.44.0 h1:Vtv2WKC8p9BAygu5VCZlZUwDhTQ7UMlS3PErXyjUmeY=
+gitlab.com/gitlab-org/api/client-go/v2 v2.44.0/go.mod h1:pTbeBowtVA+0/ZExWEZYUGOrpu5qlRN5ZyOUf27BnVY=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -898,8 +896,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -964,5 +962,5 @@ strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab h1:3IZDVyI
 strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
-xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.4.1 h1:m7QlNd0eBGb31IV4Q/ow0Du83rtdC1CiwlvJZGvYde8=
+xorm.io/xorm v1.4.1/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
@@ -9,10 +9,10 @@ package actions
 import (
 	"context"
 	"errors"
-	"slices"
 	"time"

 	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"

@@ -147,7 +147,7 @@ type FindArtifactsOptions struct {
 	db.ListOptions
 	RepoID               int64
 	RunID                int64
-	RunAttemptIDs        []int64 // empty means every attempt; pass 0 to target legacy artifacts, which have run_attempt_id=0
+	RunAttemptID         optional.Option[int64] // use optional to allow filtering by zero (legacy artifacts have run_attempt_id=0)
 	ArtifactName         string
 	Status               int
 	FinalizedArtifactsV4 bool
@@ -167,8 +167,8 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	if opts.RunID > 0 {
 		cond = cond.And(builder.Eq{"run_id": opts.RunID})
 	}
-	if len(opts.RunAttemptIDs) > 0 {
-		cond = cond.And(builder.In("run_attempt_id", opts.RunAttemptIDs))
+	if opts.RunAttemptID.Has() {
+		cond = cond.And(builder.Eq{"run_attempt_id": opts.RunAttemptID.Value()})
 	}
 	if opts.ArtifactName != "" {
 		cond = cond.And(builder.Eq{"artifact_name": opts.ArtifactName})
@@ -185,27 +185,6 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	return cond
 }

-// FindReadableArtifacts returns the artifacts of opts.RunAttemptIDs, only keeps the ones from a newer attempt.
-func FindReadableArtifacts(ctx context.Context, opts FindArtifactsOptions) ([]*ActionArtifact, error) {
-	arts, err := db.Find[ActionArtifact](ctx, opts)
-	if err != nil || len(opts.RunAttemptIDs) <= 1 {
-		return arts, err
-	}
-	return keepLatestAttemptArtifacts(arts), nil
-}
-
-// keepLatestAttemptArtifacts keeps, per name, only the artifacts of the newest attempt that has it.
-// A v3 artifact is one row per uploaded file, so the whole group of the winning attempt is kept.
-func keepLatestAttemptArtifacts(arts []*ActionArtifact) []*ActionArtifact {
-	latest := make(map[string]int64)
-	for _, art := range arts {
-		latest[art.ArtifactName] = max(latest[art.ArtifactName], art.RunAttemptID)
-	}
-	return slices.DeleteFunc(arts, func(art *ActionArtifact) bool {
-		return art.RunAttemptID != latest[art.ArtifactName]
-	})
-}
-
 // ActionArtifactMeta is the meta-data of an artifact
 type ActionArtifactMeta struct {
 	ArtifactName string
@@ -1,27 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestKeepLatestAttemptArtifacts(t *testing.T) {
-	arts := []*ActionArtifact{
-		{ID: 1, RunAttemptID: 1, ArtifactName: "inherited"},
-		{ID: 2, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "a.txt"},
-		{ID: 3, RunAttemptID: 1, ArtifactName: "shadowed", ArtifactPath: "b.txt"},
-		{ID: 4, RunAttemptID: 2, ArtifactName: "shadowed", ArtifactPath: "c.txt"},
-		{ID: 5, RunAttemptID: 2, ArtifactName: "own"},
-	}
-
-	// the whole "shadowed" group of attempt 1 is dropped, its multi-file rows must not mix with attempt 2
-	var ids []int64
-	for _, art := range keepLatestAttemptArtifacts(arts) {
-		ids = append(ids, art.ID)
-	}
-	assert.Equal(t, []int64{1, 4, 5}, ids)
-}
@@ -277,6 +277,12 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }

+func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) ([]*ActionRun, error) {
+	var runs []*ActionRun
+	err := db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).Find(&runs)
+	return runs, err
+}
+
 func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
 	run, has, err := db.Get[ActionRun](ctx, builder.Eq{"repo_id": repoID, "`index`": runIndex})
 	if err != nil {
@@ -11,7 +11,6 @@ import (

 	"gitea.dev/models/db"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/timeutil"
 	"gitea.dev/modules/util"
@@ -63,16 +62,14 @@ func (attempt *ActionRunAttempt) LoadAttributes(ctx context.Context) (err error)
 		attempt.Run = run
 	}

-	return attempt.LoadTriggerUser(ctx)
-}
-
-// LoadTriggerUser loads the attempt's trigger user if not already loaded.
-func (attempt *ActionRunAttempt) LoadTriggerUser(ctx context.Context) (err error) {
-	if attempt.TriggerUser != nil {
-		return nil
+	if attempt.TriggerUser == nil {
+		attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
+		if err != nil {
+			return err
+		}
 	}
-	attempt.TriggerUserID, attempt.TriggerUser, err = user_model.GetPossibleUserByID(ctx, attempt.TriggerUserID)
-	return err
+
+	return nil
 }

 func GetRunAttemptByRepoAndID(ctx context.Context, repoID, attemptID int64) (*ActionRunAttempt, error) {
@@ -97,56 +94,6 @@ func GetRunAttemptByRunIDAndAttemptNum(ctx context.Context, runID, attemptNum in
 	return &attempt, nil
 }

-// GetArtifactAttemptIDs returns the IDs of the attempts whose artifacts the job may read, newest first,
-// always including the job's own attempt.
-// An attempt that re-ran only some of the run's jobs keeps the artifacts of the attempt it re-ran from,
-// because the jobs it passed through never upload them again; a rerun of the whole run starts over.
-func GetArtifactAttemptIDs(ctx context.Context, job *ActionRunJob) ([]int64, error) {
-	if job.Attempt <= 1 || job.RunAttemptID == 0 {
-		return []int64{job.RunAttemptID}, nil
-	}
-
-	attempts, err := ListRunAttemptsByRunID(ctx, job.RunID)
-	if err != nil {
-		return nil, err
-	}
-	// a newer attempt is never readable, and attempt 1 has nothing older to continue into
-	candidateIDs := container.FilterSlice(attempts, func(a *ActionRunAttempt) (int64, bool) {
-		return a.ID, a.Attempt > 1 && a.Attempt <= job.Attempt
-	})
-	passThroughAttemptIDs, err := findPassThroughAttemptIDs(ctx, candidateIDs)
-	if err != nil {
-		return nil, err
-	}
-
-	ids := make([]int64, 0, len(attempts))
-	for _, attempt := range attempts {
-		if attempt.Attempt > job.Attempt {
-			continue
-		}
-		ids = append(ids, attempt.ID)
-		if !slices.Contains(passThroughAttemptIDs, attempt.ID) {
-			// stops at the first attempt that passed no job through
-			break
-		}
-	}
-	return ids, nil
-}
-
-// findPassThroughAttemptIDs narrows the given attempts to those that were a rerun of selected jobs:
-// only such a rerun clones jobs carrying a source task.
-// TODO: best-effort. Needs a better way to distinguish between "partial re-run" and "full re-run".
-func findPassThroughAttemptIDs(ctx context.Context, attemptIDs []int64) ([]int64, error) {
-	passThroughAttemptIDs := make([]int64, 0, len(attemptIDs))
-	return passThroughAttemptIDs, db.GetEngine(ctx).
-		Table("action_run_job").
-		Cols("run_attempt_id").
-		In("run_attempt_id", attemptIDs).
-		Where("source_task_id <> 0").
-		Distinct("run_attempt_id").
-		Find(&passThroughAttemptIDs)
-}
-
 // FindConcurrentRunAttempts returns attempts in the given concurrency group and status set.
 // Results are unordered; callers must not depend on any particular row order.
 func FindConcurrentRunAttempts(ctx context.Context, repoID int64, concurrencyGroup string, statuses []Status) ([]*ActionRunAttempt, error) {
@@ -333,14 +333,6 @@ func GetDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) (A
 	return jobs, nil
 }

-// DeleteDirectChildJobsByParent deletes the direct child jobs of a parent job.
-func DeleteDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) error {
-	_, err := db.GetEngine(ctx).
-		Where("run_id=? AND parent_job_id=?", parentJob.RunID, parentJob.ID).
-		Delete(new(ActionRunJob))
-	return err
-}
-
 // CollectAllDescendantJobs returns every job in `allJobs` that lives under parent's subtree (recursively), excluding `parent` itself
 func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*ActionRunJob {
 	parents := map[int64]bool{parent.ID: true}
@@ -448,74 +440,58 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return affected, RefreshReusableCallerStatus(ctx, parent)
 	}

-	if err := refreshRunStatus(ctx, job.RepoID, job.RunID, job.RunAttemptID, StatusUnknown); err != nil {
-		return 0, err
+	{
+		// Other goroutines may aggregate the status of the attempt/run and update it too.
+		// So we need to load the current jobs before updating the aggregate state.
+		if job.RunAttemptID > 0 {
+			attempt, err := GetRunAttemptByRepoAndID(ctx, job.RepoID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetRunJobsByRunAndAttemptID(ctx, job.RunID, job.RunAttemptID)
+			if err != nil {
+				return 0, err
+			}
+			attempt.Status = AggregateJobStatus(jobs)
+			if attempt.Started.IsZero() && attempt.Status.IsRunning() {
+				attempt.Started = timeutil.TimeStampNow()
+			}
+			if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
+				attempt.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
+			}
+		} else {
+			// TODO: Remove this fallback in the future.
+			// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
+			// This path keeps those runs' status consistent when their jobs finish, including:
+			//   - jobs created before migration v331 and complete on the new version starts
+			//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
+			run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, job.RepoID, job.RunID)
+			if err != nil {
+				return 0, err
+			}
+			run.Status = AggregateJobStatus(jobs)
+			if run.Started.IsZero() && run.Status.IsRunning() {
+				run.Started = timeutil.TimeStampNow()
+			}
+			if run.Stopped.IsZero() && run.Status.IsDone() {
+				run.Stopped = timeutil.TimeStampNow()
+			}
+			if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
+				return 0, fmt.Errorf("update run %d: %w", run.ID, err)
+			}
+		}
 	}

 	return affected, nil
 }

-// refreshRunStatus recomputes the status of an attempt from the jobs currently stored and persists it.
-// The latest attempt propagates its status to its run, an older one only updates itself.
-// noJobsStatus settles an attempt without any job, which AggregateJobStatus cannot conclude on its own.
-func refreshRunStatus(ctx context.Context, repoID, runID, runAttemptID int64, noJobsStatus Status) error {
-	// Other goroutines may aggregate the status of the attempt/run and update it too.
-	// So we need to load the current jobs before updating the aggregate state.
-	if runAttemptID > 0 {
-		attempt, err := GetRunAttemptByRepoAndID(ctx, repoID, runAttemptID)
-		if err != nil {
-			return err
-		}
-		jobs, err := GetRunJobsByRunAndAttemptID(ctx, runID, runAttemptID)
-		if err != nil {
-			return err
-		}
-		attempt.Status = AggregateJobStatus(jobs)
-		if len(jobs) == 0 {
-			attempt.Status = noJobsStatus
-		}
-		if attempt.Started.IsZero() && attempt.Status.IsRunning() {
-			attempt.Started = timeutil.TimeStampNow()
-		}
-		if attempt.Stopped.IsZero() && attempt.Status.IsDone() {
-			attempt.Stopped = timeutil.TimeStampNow()
-		}
-		if err := UpdateRunAttempt(ctx, attempt, "status", "started", "stopped"); err != nil {
-			return fmt.Errorf("update run attempt %d: %w", attempt.ID, err)
-		}
-		return nil
-	}
-
-	// TODO: Remove this fallback in the future.
-	// Legacy fallback: jobs created before migration v331 have RunAttemptID=0 and are NOT backfilled.
-	// This path keeps those runs' status consistent when their jobs finish, including:
-	//   - jobs created before migration v331 and complete on the new version starts
-	//   - zombie/abandoned cleanup cron tasks that call UpdateRunJob on legacy jobs
-	//   - cancelling a legacy run whose jobs are all already done
-	run, err := GetRunByRepoAndID(ctx, repoID, runID)
-	if err != nil {
-		return err
-	}
-	jobs, err := GetLatestAttemptJobsByRepoAndRunID(ctx, repoID, runID)
-	if err != nil {
-		return err
-	}
-	run.Status = AggregateJobStatus(jobs)
-	if len(jobs) == 0 {
-		run.Status = noJobsStatus
-	}
-	if run.Started.IsZero() && run.Status.IsRunning() {
-		run.Started = timeutil.TimeStampNow()
-	}
-	if run.Stopped.IsZero() && run.Status.IsDone() {
-		run.Stopped = timeutil.TimeStampNow()
-	}
-	if err := UpdateRun(ctx, run, "status", "started", "stopped"); err != nil {
-		return fmt.Errorf("update run %d: %w", run.ID, err)
-	}
-	return nil
-}
-
 // RefreshReusableCallerStatus recomputes a reusable workflow caller's Status, Started and Stopped from its current direct children and persists the change.
 // No-op if caller is not a reusable caller.
 //
@@ -676,8 +652,6 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 	return CancelJobs(ctx, jobsToCancel)
 }

-// CancelJobs cancels every cancellable job it is given. It leaves the status of a run it
-// cancelled nothing in untouched, SettleRunAfterCancel is what gives such a run a final one.
 func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
 	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))

@@ -702,16 +676,6 @@ func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, err
 	return cancelledJobs, nil
 }

-// SettleRunAfterCancel gives a run a final status when cancelling it updated no job at all.
-// A run's status is otherwise only ever written as a side effect of a job update, so a run whose
-// jobs are all done already, or that has no job at all, would stay unfinished forever.
-func SettleRunAfterCancel(ctx context.Context, run *ActionRun) error {
-	if run.Status.IsDone() {
-		return nil
-	}
-	return refreshRunStatus(ctx, run.RepoID, run.ID, run.LatestAttemptID, StatusCancelled)
-}
-
 // cancelOneJob cancels a single job and returns the post-cancel row
 func cancelOneJob(ctx context.Context, job *ActionRunJob) (*ActionRunJob, error) {
 	if job.Status.IsDone() {
@@ -159,12 +159,3 @@ func (opts FindRunJobOptions) ToOrders() string {
 }

 var _ db.FindOptionsOrder = FindRunJobOptions{}
-
-// CountRunJobsByRunAndAttemptID counts the jobs belonging to the given run attempt.
-// It is used to enforce MaxJobNumPerRun when reusable-workflow expansion inserts new jobs.
-func CountRunJobsByRunAndAttemptID(ctx context.Context, runID, runAttemptID int64) (int64, error) {
-	return db.Count[ActionRunJob](ctx, FindRunJobOptions{
-		RunID:        runID,
-		RunAttemptID: optional.Some(runAttemptID),
-	})
-}
@@ -8,7 +8,6 @@ import (

 	"gitea.dev/models/db"
 	"gitea.dev/models/unittest"
-	"gitea.dev/modules/timeutil"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -198,91 +197,3 @@ func TestCancelJobs_NestedBlockedReusableCaller(t *testing.T) {
 	gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
 	assert.Equal(t, StatusCancelled, gotRun.Status, "run must aggregate to Cancelled, not stay Blocked")
 }
-
-func TestSettleRunAfterCancel(t *testing.T) {
-	// A run that cancelling updates no job in, because its jobs all reached a final status already
-	// or because it has none at all. Its own row has to be settled explicitly, or the run can never
-	// finish and can never be deleted either.
-
-	newStuckRun := func(t *testing.T, withAttempt, withJob bool) (*ActionRun, []*ActionRunJob) {
-		t.Helper()
-		ctx := t.Context()
-
-		run := &ActionRun{
-			Title:         "stuck-waiting",
-			RepoID:        4,
-			Index:         9801,
-			OwnerID:       1,
-			WorkflowID:    "test.yaml",
-			TriggerUserID: 1,
-			Ref:           "refs/heads/master",
-			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-			Event:         "push",
-			TriggerEvent:  "push",
-			EventPayload:  "{}",
-			Status:        StatusWaiting,
-		}
-		require.NoError(t, db.Insert(ctx, run))
-
-		var runAttemptID int64
-		if withAttempt {
-			attempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1, Status: StatusWaiting}
-			require.NoError(t, db.Insert(ctx, attempt))
-			run.LatestAttemptID = attempt.ID
-			require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
-			runAttemptID = attempt.ID
-		}
-
-		if !withJob {
-			return run, nil
-		}
-		job := &ActionRunJob{
-			RunID:        run.ID,
-			RunAttemptID: runAttemptID,
-			RepoID:       run.RepoID,
-			OwnerID:      run.OwnerID,
-			CommitSHA:    run.CommitSHA,
-			Name:         "job1",
-			JobID:        "job1",
-			Attempt:      1,
-			Status:       StatusSuccess,
-			Stopped:      timeutil.TimeStampNow(),
-		}
-		require.NoError(t, db.Insert(ctx, job))
-		return run, []*ActionRunJob{job}
-	}
-
-	cases := []struct {
-		name        string
-		withAttempt bool
-		withJob     bool
-		want        Status
-	}{
-		{"done job", true, true, StatusSuccess},
-		// Runs created before migration v331 have no attempt, their status lives on the run row itself.
-		{"done job on a legacy run without attempt", false, true, StatusSuccess},
-		// Aggregation cannot reach a final status without any job, so cancelling has to end the run itself.
-		{"no job at all", true, false, StatusCancelled},
-		{"no job at all on a legacy run without attempt", false, false, StatusCancelled},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			require.NoError(t, unittest.PrepareTestDatabase())
-			run, jobs := newStuckRun(t, tc.withAttempt, tc.withJob)
-
-			// mirrors what the CancelRun service does
-			cancelled, err := CancelJobs(t.Context(), jobs)
-			require.NoError(t, err)
-			assert.Empty(t, cancelled, "nothing is cancellable, so the run row has to be settled explicitly")
-			require.NoError(t, SettleRunAfterCancel(t.Context(), run))
-
-			if tc.withAttempt {
-				gotAttempt := unittest.AssertExistsAndLoadBean(t, &ActionRunAttempt{ID: run.LatestAttemptID})
-				assert.Equal(t, tc.want, gotAttempt.Status)
-			}
-			gotRun := unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID})
-			assert.Equal(t, tc.want, gotRun.Status)
-			assert.NotZero(t, gotRun.Stopped)
-		})
-	}
-}
@@ -270,31 +270,15 @@ func (opts FindRunnerOptions) ToConds() builder.Cond {
 	return cond
 }

-// runnerStatusOrderExpr builds an ORDER BY fragment that ranks runners by their
-// computed status (see ActionRunner.Status): active (0), idle (1), offline (2).
-// The thresholds are evaluated against the current time, mirroring ToConds, so
-// sorting by status groups active and idle runners instead of interleaving them
-// by raw last_online.
-func runnerStatusOrderExpr() string {
-	now := time.Now()
-	offlineThreshold := now.Add(-RunnerOfflineTime).Unix()
-	idleThreshold := now.Add(-RunnerIdleTime).Unix()
-	return fmt.Sprintf("CASE WHEN last_online <= %d THEN 2 WHEN last_active <= %d THEN 1 ELSE 0 END", offlineThreshold, idleThreshold)
-}
-
 func (opts FindRunnerOptions) ToOrders() string {
 	// A unique tiebreaker (id) is appended so that runners sharing the same
-	// status, last_online or name keep a deterministic order across paginated
-	// queries, otherwise the same runner may appear on more than one page.
-	statusRank := runnerStatusOrderExpr()
+	// last_online or name keep a deterministic order across paginated queries,
+	// otherwise the same runner may appear on more than one page.
 	switch opts.Sort {
 	case "online":
-		// Rank by computed status first so idle runners are not interleaved with
-		// active ones; disabled runners sink to the bottom of their status group
-		// (is_disabled ASC), then last_online breaks ties within a group.
-		return statusRank + " ASC, is_disabled ASC, last_online DESC, id ASC"
+		return "last_online DESC, id ASC"
 	case "offline":
-		return statusRank + " DESC, is_disabled ASC, last_online ASC, id ASC"
+		return "last_online ASC, id ASC"
 	case "alphabetically":
 		return "name ASC, id ASC"
 	case "reversealphabetically":
@@ -304,7 +288,7 @@ func (opts FindRunnerOptions) ToOrders() string {
 	case "oldest":
 		return "id ASC"
 	}
-	return statusRank + " ASC, is_disabled ASC, last_online DESC, id ASC"
+	return "last_online DESC, id ASC"
 }

 // GetRunnerByUUID returns a runner via uuid
@@ -4,12 +4,16 @@
 package actions

 import (
+	"fmt"
 	"testing"
 	"time"

+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
 	"gitea.dev/modules/timeutil"

 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

 func TestShouldPersistLastOnline(t *testing.T) {
@@ -81,3 +85,65 @@ func TestShouldPersistLastActive(t *testing.T) {
 		})
 	}
 }
+
+func TestFindRunnerOptions_ToOrders_StableTiebreaker(t *testing.T) {
+	// Sorts on a non-unique column must end with the unique id tiebreaker so
+	// pagination is deterministic; without it, runners sharing the same
+	// last_online or name can appear on more than one page. Sorts already on
+	// the unique id need no tiebreaker.
+	expected := map[string]string{
+		"":                      "last_online DESC, id ASC",
+		"online":                "last_online DESC, id ASC",
+		"offline":               "last_online ASC, id ASC",
+		"alphabetically":        "name ASC, id ASC",
+		"reversealphabetically": "name DESC, id ASC",
+		"newest":                "id DESC",
+		"oldest":                "id ASC",
+	}
+	for sort, want := range expected {
+		assert.Equal(t, want, FindRunnerOptions{Sort: sort}.ToOrders(), "sort %q", sort)
+	}
+}
+
+func TestFindRunners_PaginationNoDuplicates(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	// Create several runners that all share the same last_online value so the
+	// primary sort key (last_online) is tied for all of them.
+	const ownerID = 1000
+	const count = 6
+	for i := range count {
+		runner := &ActionRunner{
+			Name:       "paginated-runner",
+			UUID:       fmt.Sprintf("PAGINATE-TEST-0000-0000-00000000000%d", i),
+			TokenHash:  fmt.Sprintf("paginate-test-token-hash-%d", i),
+			OwnerID:    ownerID,
+			RepoID:     0,
+			LastOnline: 42,
+		}
+		require.NoError(t, db.Insert(ctx, runner))
+	}
+
+	// Page through the runners and ensure every id is returned exactly once.
+	seen := make(map[int64]int)
+	const pageSize = 2
+	for page := 1; ; page++ {
+		runners, err := db.Find[ActionRunner](ctx, FindRunnerOptions{
+			ListOptions: db.ListOptions{Page: page, PageSize: pageSize},
+			OwnerID:     ownerID,
+		})
+		require.NoError(t, err)
+		if len(runners) == 0 {
+			break
+		}
+		for _, r := range runners {
+			seen[r.ID]++
+		}
+	}
+
+	assert.Len(t, seen, count, "each runner should be returned exactly once across all pages")
+	for id, n := range seen {
+		assert.Equal(t, 1, n, "runner %d appeared on %d pages", id, n)
+	}
+}
@@ -60,12 +60,6 @@ type ActionTask struct {
 	Updated timeutil.TimeStamp `xorm:"updated index"`
 }

-// taskReportTimeout is how long a task may go without contact from its runner before the
-// runner is assumed gone. Runners report state and stream logs every few seconds, both of
-// which refresh ActionTask.Updated. Shorter than setting.Actions.ZombieTaskTimeout because
-// it only decides whether the runner is reachable, not whether the task should be killed.
-const taskReportTimeout = time.Minute
-
 var successfulTokenTaskCache *lru.Cache[string, any]

 func init() {
@@ -91,15 +85,11 @@ func (task *ActionTask) IsStopped() bool {
 	return task.Stopped > 0
 }

-func (task *ActionTask) GetRunJobLink() string {
-	// Run.Repo can be nil when the repository was deleted while task/run rows remain
-	// (TaskList.LoadAttributes copies job.Repo into run.Repo, leaving it nil on a miss).
-	// Run.Link() already returns "" in that case, so guard here to avoid emitting a
-	// broken relative "/jobs/N" link from the Sprintf below.
-	if task.Job == nil || task.Job.Run == nil || task.Job.Run.Repo == nil {
+func (task *ActionTask) GetRunLink() string {
+	if task.Job == nil || task.Job.Run == nil {
 		return ""
 	}
-	return fmt.Sprintf("%s/jobs/%d", task.Job.Run.Link(), task.Job.ID)
+	return task.Job.Run.Link()
 }

 func (task *ActionTask) GetCommitLink() string {
@@ -478,7 +468,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 		return nil, err
 	}
 	task := &ActionTask{}
-	applyState := func(ctx context.Context) error {
+	err = globallock.LockAndDo(ctx, fmt.Sprintf("UpdateTaskByState-run-%d", runID), func(ctx context.Context) error {
 		if has, err := db.GetEngine(ctx).ID(taskID).Get(task); err != nil {
 			return err
 		} else if !has {
@@ -543,10 +533,6 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			}
 		}
 		return nil
-	}
-	err = globallock.LockAndDo(ctx, fmt.Sprintf("UpdateTaskByState-run-%d", runID), func(ctx context.Context) error {
-		// A half-written report leaves the task done with a running job, which no retry repairs.
-		return db.WithTx(ctx, applyState)
 	})
 	return task, err
 }
@@ -577,10 +563,6 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 			status = StatusCancelled
 		} else if !runner.HasCancellingSupport {
 			status = StatusCancelled
-		} else if task.Updated.AddDuration(taskReportTimeout) < now {
-			// A runner that stopped reporting will never acknowledge the cancellation either,
-			// so skip the handshake instead of waiting for the zombie task cleanup.
-			status = StatusCancelled
 		}
 	}

@@ -595,10 +577,7 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 			return err
 		}

-		// NoAutoTime keeps "updated" at the runner's last contact: re-cancelling an already
-		// cancelling task must not defer the timeout above or the zombie task cleanup.
-		_, err := e.ID(task.ID).Cols("status").NoAutoTime().Update(task)
-		return err
+		return UpdateTask(ctx, task, "status")
 	}

 	task.Status = status
@@ -4,15 +4,11 @@
 package actions

 import (
-	"context"
-	"errors"
 	"strings"
-	"sync/atomic"
 	"testing"

 	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
 	"gitea.dev/models/db"
-	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/actions/jobparser"
 	"gitea.dev/modules/timeutil"
@@ -20,24 +16,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/timestamppb"
-	"xorm.io/xorm/contexts"
 )

-func TestActionTask_GetRunJobLink(t *testing.T) {
-	repo := &repo_model.Repository{OwnerName: "org", Name: "consumer"}
-	run := &ActionRun{ID: 10, Repo: repo}
-	job := &ActionRunJob{ID: 42, Run: run}
-
-	// a task with a loaded job links to that specific job, not just the run
-	task := &ActionTask{Job: job}
-	assert.Equal(t, run.Link()+"/jobs/42", task.GetRunJobLink())
-
-	// missing job, run or repo yields an empty link instead of a broken URL
-	assert.Empty(t, (&ActionTask{}).GetRunJobLink())
-	assert.Empty(t, (&ActionTask{Job: &ActionRunJob{ID: 42}}).GetRunJobLink())
-	assert.Empty(t, (&ActionTask{Job: &ActionRunJob{ID: 42, Run: &ActionRun{ID: 10}}}).GetRunJobLink())
-}
-
 func TestMakeTaskStepDisplayName(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -103,11 +83,68 @@ func TestMakeTaskStepDisplayName(t *testing.T) {
 }

 func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
+	newRunningTask := func(t *testing.T) (*ActionTask, *ActionRunJob) {
+		t.Helper()
+
+		run := &ActionRun{
+			Title:         "cancelling-test-run",
+			RepoID:        1,
+			OwnerID:       2,
+			WorkflowID:    "test.yaml",
+			Index:         999,
+			TriggerUserID: 2,
+			Ref:           "refs/heads/master",
+			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+			Event:         "push",
+			TriggerEvent:  "push",
+			Status:        StatusRunning,
+			Started:       timeutil.TimeStampNow(),
+		}
+		require.NoError(t, db.Insert(t.Context(), run))
+
+		job := &ActionRunJob{
+			RunID:     run.ID,
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+			Name:      "cancelling-finalization-job",
+			Attempt:   1,
+			JobID:     "cancelling-finalization-job",
+			Status:    StatusRunning,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+
+		runner := &ActionRunner{
+			UUID:                 "runner-cancelling-supported",
+			Name:                 "runner-cancelling-supported",
+			HasCancellingSupport: true,
+		}
+		require.NoError(t, db.Insert(t.Context(), runner))
+
+		task := &ActionTask{
+			JobID:     job.ID,
+			Attempt:   1,
+			RunnerID:  runner.ID,
+			Status:    StatusRunning,
+			Started:   timeutil.TimeStampNow(),
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+		}
+		require.NoError(t, db.Insert(t.Context(), task))
+
+		job.TaskID = task.ID
+		_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+		require.NoError(t, err)
+
+		return task, job
+	}
+
 	testResult := func(t *testing.T, result runnerv1.Result) {
 		t.Helper()
 		require.NoError(t, unittest.PrepareTestDatabase())

-		task, job := newRunningTaskForCancelling(t, "cancelling-finalization-job", true)
+		task, job := newRunningTask(t)
 		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))

 		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
@@ -137,92 +174,137 @@ func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
 	})
 }

-// TestStopTaskCancellingFallsBackToCancelled covers the cases where the cancelling handshake can
-// never complete, so StopTask must cancel right away instead of waiting for the zombie task cleanup.
-func TestStopTaskCancellingFallsBackToCancelled(t *testing.T) {
-	assertCancelled := func(t *testing.T, task *ActionTask, job *ActionRunJob) {
-		t.Helper()
-
-		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-		assert.Equal(t, StatusCancelled, taskAfterStop.Status)
-		assert.NotZero(t, taskAfterStop.Stopped)
-
-		jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
-		assert.Equal(t, StatusCancelled, jobAfterStop.Status)
-		assert.NotZero(t, jobAfterStop.Stopped)
-	}
-
-	// A runner too old to know the cancelling state can only be stopped by a final status.
-	t.Run("legacy runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "legacy-cancelling-job", false)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-	})
-
-	// The runner is gone, e.g. an ephemeral runner was cleaned up, so nobody can acknowledge.
-	t.Run("missing runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "missing-runner-cancelling-job", true)
-
-		_, err := db.DeleteByID[ActionRunner](t.Context(), task.RunnerID)
-		require.NoError(t, err)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-	})
-
-	// The runner went silent, e.g. it gave up while Gitea was restarting, so it never picks up the request.
-	t.Run("silent runner", func(t *testing.T) {
-		require.NoError(t, unittest.PrepareTestDatabase())
-		task, job := newRunningTaskForCancelling(t, "silent-runner-cancelling-job", true)
-
-		// NoAutoTime because the point of the test is an "updated" older than xorm would write
-		task.Updated = timeutil.TimeStampNow().AddDuration(-2 * taskReportTimeout)
-		_, err := db.GetEngine(t.Context()).ID(task.ID).Cols("updated").NoAutoTime().Update(task)
-		require.NoError(t, err)
-
-		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-		assertCancelled(t, task, job)
-
-		// A runner coming back still learns the outcome from the UpdateTask response,
-		// and its late result does not overwrite the cancellation.
-		late, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{
-			Id:        task.ID,
-			Result:    runnerv1.Result_RESULT_SUCCESS,
-			StoppedAt: timestamppb.Now(),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, StatusCancelled, late.Status)
-		assert.Equal(t, runnerv1.Result_RESULT_CANCELLED, late.Status.AsResult())
-	})
-}
-
-// TestStopTaskCancellingKeepsReportTime makes sure persisting the cancelling status does not refresh
-// "updated": re-cancelling would otherwise defer both the fallback to cancelled and the zombie task
-// cleanup, no matter how long the runner has been silent.
-func TestStopTaskCancellingKeepsReportTime(t *testing.T) {
+func TestStopTaskCancellingFallsBackForLegacyRunner(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
-	task, _ := newRunningTaskForCancelling(t, "repeated-cancelling-job", true)

-	// NoAutoTime because the point of the test is an "updated" older than xorm would write
-	lastReport := timeutil.TimeStampNow().AddDuration(-taskReportTimeout / 2)
-	task.Updated = lastReport
-	_, err := db.GetEngine(t.Context()).ID(task.ID).Cols("updated").NoAutoTime().Update(task)
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "legacy-cancelling-job",
+		Attempt:   1,
+		JobID:     "legacy-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-legacy-no-cancelling",
+		Name:                 "runner-legacy-no-cancelling",
+		HasCancellingSupport: false,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
 	require.NoError(t, err)

-	// the runner reported recently enough, so the task waits for it to acknowledge
 	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-	assert.Equal(t, StatusCancelling, taskAfterStop.Status)
-	assert.Equal(t, lastReport, taskAfterStop.Updated)

-	// cancelling it again does not reset the clock either
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}
+
+func TestStopTaskCancellingFallsBackForMissingRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "missing-runner-cancelling-job",
+		Attempt:   1,
+		JobID:     "missing-runner-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-cleaned-up-before-cancel",
+		Name:                 "runner-cleaned-up-before-cancel",
+		HasCancellingSupport: true,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	_, err = db.DeleteByID[ActionRunner](t.Context(), runner.ID)
+	require.NoError(t, err)
+
 	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
-	taskAfterSecondStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
-	assert.Equal(t, StatusCancelling, taskAfterSecondStop.Status)
-	assert.Equal(t, lastReport, taskAfterSecondStop.Updated)
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
 }

 // TestReleaseTaskForRunner verifies that releasing a freshly-claimed task returns
@@ -360,91 +442,3 @@ func TestCreateTaskForRunnerPagination(t *testing.T) {
 	assert.Equal(t, StatusRunning, claimed.Status)
 	assert.Equal(t, task.ID, claimed.TaskID)
 }
-
-type failFirstStepWrite struct{ fired atomic.Bool }
-
-func (h *failFirstStepWrite) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
-	if !h.fired.Load() && strings.HasPrefix(c.SQL, "UPDATE") && strings.Contains(c.SQL, "action_task_step") {
-		h.fired.Store(true)
-		return nil, errors.New("interrupted")
-	}
-	return c.Ctx, nil
-}
-
-func (*failFirstStepWrite) AfterProcess(*contexts.ContextHook) error { return nil }
-
-// TestUpdateTaskByStateIsAtomic checks that an interrupted report writes nothing: a surviving task or
-// job write would hit the "state is final" early return, which no retry or cleanup repairs.
-func TestUpdateTaskByStateIsAtomic(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	task, job := newRunningTaskForCancelling(t, "atomic-report-job", true)
-	require.NoError(t, db.Insert(t.Context(), &ActionTaskStep{TaskID: task.ID, RepoID: task.RepoID, Status: StatusRunning}))
-	unittest.GetXORMEngine().AddHook(&failFirstStepWrite{})
-	finalState := &runnerv1.TaskState{Id: task.ID, Result: runnerv1.Result_RESULT_SUCCESS, StoppedAt: timestamppb.Now()}
-	_, err := UpdateTaskByState(t.Context(), task.RunnerID, finalState)
-	require.Error(t, err)
-	assert.Equal(t, StatusRunning, unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID}).Status)
-	assert.Equal(t, StatusRunning, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status)
-	_, err = UpdateTaskByState(t.Context(), task.RunnerID, finalState)
-	require.NoError(t, err)
-	assert.Equal(t, StatusSuccess, unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID}).Status)
-}
-
-// newRunningTaskForCancelling inserts a running run/job/task assigned to a fresh runner,
-// which is the state every cancellation test starts from.
-func newRunningTaskForCancelling(t *testing.T, name string, hasCancellingSupport bool) (*ActionTask, *ActionRunJob) {
-	t.Helper()
-
-	run := &ActionRun{
-		Title:         "cancelling-test-run",
-		RepoID:        1,
-		OwnerID:       2,
-		WorkflowID:    "test.yaml",
-		Index:         999,
-		TriggerUserID: 2,
-		Ref:           "refs/heads/master",
-		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
-		Event:         "push",
-		TriggerEvent:  "push",
-		Status:        StatusRunning,
-		Started:       timeutil.TimeStampNow(),
-	}
-	require.NoError(t, db.Insert(t.Context(), run))
-
-	job := &ActionRunJob{
-		RunID:     run.ID,
-		RepoID:    run.RepoID,
-		OwnerID:   run.OwnerID,
-		CommitSHA: run.CommitSHA,
-		Name:      name,
-		Attempt:   1,
-		JobID:     name,
-		Status:    StatusRunning,
-	}
-	require.NoError(t, db.Insert(t.Context(), job))
-
-	runner := &ActionRunner{
-		UUID:                 name,
-		Name:                 name,
-		HasCancellingSupport: hasCancellingSupport,
-	}
-	require.NoError(t, db.Insert(t.Context(), runner))
-
-	task := &ActionTask{
-		JobID:     job.ID,
-		Attempt:   1,
-		RunnerID:  runner.ID,
-		Status:    StatusRunning,
-		Started:   timeutil.TimeStampNow(),
-		RepoID:    run.RepoID,
-		OwnerID:   run.OwnerID,
-		CommitSHA: run.CommitSHA,
-	}
-	require.NoError(t, db.Insert(t.Context(), task))
-
-	job.TaskID = task.ID
-	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
-	require.NoError(t, err)
-
-	return task, job
-}
@@ -195,3 +195,18 @@ func HasTwoFactorOrWebAuthn(ctx context.Context, id int64) (bool, error) {
 	}
 	return HasWebAuthnRegistrationsByUID(ctx, id)
 }
+
+// DisableTwoFactor removes every two-factor method of the given user atomically,
+// returning the number of TOTP records and WebAuthn credentials removed.
+// It is a no-op for a user that has no 2FA enrolled.
+func DisableTwoFactor(ctx context.Context, uid int64) (totp, webAuthn int64, err error) {
+	err = db.WithTx(ctx, func(ctx context.Context) error {
+		var e error
+		if totp, e = db.GetEngine(ctx).Where("uid = ?", uid).Delete(&TwoFactor{}); e != nil {
+			return e
+		}
+		webAuthn, e = db.GetEngine(ctx).Where("user_id = ?", uid).Delete(&WebAuthnCredential{})
+		return e
+	})
+	return totp, webAuthn, err
+}
@@ -10,6 +10,7 @@ import (
 	auth_model "gitea.dev/models/auth"
 	"gitea.dev/models/unittest"

+	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/pquerna/otp/totp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -45,3 +46,37 @@ func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
 	require.NoError(t, err)
 	assert.False(t, ok)
 }
+
+func TestDisableTwoFactor(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	const uid = 1000 // a uid with no user/2FA fixtures
+
+	// Enroll TOTP and register a WebAuthn credential.
+	tfa := &auth_model.TwoFactor{UID: uid}
+	require.NoError(t, tfa.SetSecret("test-secret"))
+	require.NoError(t, auth_model.NewTwoFactor(ctx, tfa))
+	_, err := auth_model.CreateCredential(ctx, uid, "test-key", &webauthn.Credential{ID: []byte("test-cred-id")})
+	require.NoError(t, err)
+
+	has, err := auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
+	require.NoError(t, err)
+	require.True(t, has)
+
+	// Both records are removed and counted separately.
+	totp, webAuthn, err := auth_model.DisableTwoFactor(ctx, uid)
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, totp)
+	assert.EqualValues(t, 1, webAuthn)
+
+	has, err = auth_model.HasTwoFactorOrWebAuthn(ctx, uid)
+	require.NoError(t, err)
+	assert.False(t, has)
+
+	// A second call on a user without 2FA is a no-op.
+	totp, webAuthn, err = auth_model.DisableTwoFactor(ctx, uid)
+	require.NoError(t, err)
+	assert.EqualValues(t, 0, totp)
+	assert.EqualValues(t, 0, webAuthn)
+}
@@ -507,7 +507,7 @@ func updateApprovalWhitelist(ctx context.Context, repo *repo_model.Repository, c
 		return currentWhitelist, nil
 	}

-	prUserIDs, err := access_model.GetUserIDsWithAnyUnitAccess(ctx, repo, perm.AccessModeRead, unit.TypePullRequests)
+	prUserIDs, err := access_model.GetUserIDsWithUnitAccess(ctx, repo, perm.AccessModeRead, unit.TypePullRequests)
 	if err != nil {
 		return nil, err
 	}
@@ -7,7 +7,6 @@ import (
 	"context"

 	"gitea.dev/models/user"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/log"
 )
@@ -34,18 +33,11 @@ func BuildAvatarStackData(ctx context.Context, allParticipants []*git.CommitIden
 	ret := &AvatarStackData{
 		Participants: make([]*CommitParticipant, 0, len(allParticipants)),
 	}
-	uniqueUserIDs := make(container.Set[int64])
 	for _, p := range allParticipants {
 		var giteaUser *user.User
 		if emailUserMap != nil {
 			giteaUser = emailUserMap.GetByEmail(p.Email)
 		}
-		if giteaUser != nil {
-			// identities without a Gitea account can only be compared by their git identity
-			if !uniqueUserIDs.Add(giteaUser.ID) {
-				continue
-			}
-		}
 		ret.Participants = append(ret.Participants, &CommitParticipant{GiteaUser: giteaUser, GitIdentity: p})
 	}
 	return ret
@@ -39,7 +39,8 @@ func GetUserCommitsByGitCommits(ctx context.Context, gitCommits []*git.Commit, r
 	emailSet := make(container.Set[string])
 	for _, c := range gitCommits {
 		emailSet.Add(c.Author.Email)
-		for _, p := range c.AllAuthorIdentities() {
+		emailSet.Add(c.Committer.Email)
+		for _, p := range c.AllParticipantIdentities() {
 			emailSet.Add(p.Email)
 		}
 	}
@@ -54,7 +55,7 @@ func GetUserCommitsByGitCommits(ctx context.Context, gitCommits []*git.Commit, r
 		uc := &UserCommit{
 			AuthorUser:      emailUserMap.GetByEmail(c.Author.Email), // FIXME: why GetUserCommitsByGitCommits uses "Author", but ParseCommitsWithSignature uses "Committer"?
 			GitCommit:       c,
-			AvatarStackData: BuildAvatarStackData(ctx, c.AllAuthorIdentities(), emailUserMap),
+			AvatarStackData: BuildAvatarStackData(ctx, c.AllParticipantIdentities(), emailUserMap),
 		}
 		uc.AvatarStackData.SearchByEmailLink = searchByEmailLink
 		userCommits = append(userCommits, uc)
@@ -544,9 +544,6 @@ func (c *Comment) GetSanitizedContentHTML() template.HTML {

 // LoadLabel if comment.Type is CommentTypeLabel, then load Label
 func (c *Comment) LoadLabel(ctx context.Context) error {
-	if c.LabelID == 0 {
-		return nil
-	}
 	var label Label
 	has, err := db.GetEngine(ctx).ID(c.LabelID).Get(&label)
 	if err != nil {
@@ -554,8 +551,8 @@ func (c *Comment) LoadLabel(ctx context.Context) error {
 	} else if has {
 		c.Label = &label
 	} else {
-		// label was deleted but comment rows referencing it were not cleaned up
-		log.Debug("Comment %d references deleted label %d", c.ID, c.LabelID)
+		// Ignore Label is deleted, but not clear this table
+		log.Warn("Commit %d cannot load label %d", c.ID, c.LabelID)
 	}

 	return nil
@@ -81,7 +81,7 @@ func (comments CommentList) loadLabels(ctx context.Context) error {
 	}

 	for _, comment := range comments {
-		comment.Label = commentLabels[comment.LabelID]
+		comment.Label = commentLabels[comment.ID]
 	}
 	return nil
 }
@@ -599,8 +599,8 @@ func HasAnyUnitAccess(ctx context.Context, userID int64, repo *repo_model.Reposi
 	return perm.HasAnyUnitAccess(), nil
 }

-func GetUsersWithAnyUnitAccess(ctx context.Context, repo *repo_model.Repository, mode perm_model.AccessMode, unitType unit.Type, moreUnitTypes ...unit.Type) (users []*user_model.User, err error) {
-	userIDs, err := GetUserIDsWithAnyUnitAccess(ctx, repo, mode, unitType, moreUnitTypes...)
+func GetUsersWithUnitAccess(ctx context.Context, repo *repo_model.Repository, mode perm_model.AccessMode, unitType unit.Type) (users []*user_model.User, err error) {
+	userIDs, err := GetUserIDsWithUnitAccess(ctx, repo, mode, unitType)
 	if err != nil {
 		return nil, err
 	}
@@ -613,7 +613,7 @@ func GetUsersWithAnyUnitAccess(ctx context.Context, repo *repo_model.Repository,
 	return users, nil
 }

-func GetUserIDsWithAnyUnitAccess(ctx context.Context, repo *repo_model.Repository, mode perm_model.AccessMode, unitType unit.Type, moreUnitTypes ...unit.Type) (container.Set[int64], error) {
+func GetUserIDsWithUnitAccess(ctx context.Context, repo *repo_model.Repository, mode perm_model.AccessMode, unitType unit.Type) (container.Set[int64], error) {
 	userIDs := container.Set[int64]{}
 	e := db.GetEngine(ctx)
 	accesses := make([]*Access, 0, 10)
@@ -630,7 +630,7 @@ func GetUserIDsWithAnyUnitAccess(ctx context.Context, repo *repo_model.Repositor
 	if !repo.Owner.IsOrganization() {
 		userIDs.Add(repo.Owner.ID)
 	} else {
-		teamUserIDs, err := organization.GetTeamUserIDsWithAccessToAnyRepoUnit(ctx, repo.OwnerID, repo.ID, mode, unitType, moreUnitTypes...)
+		teamUserIDs, err := organization.GetTeamUserIDsWithAccessToAnyRepoUnit(ctx, repo.OwnerID, repo.ID, mode, unitType)
 		if err != nil {
 			return nil, err
 		}
@@ -226,12 +226,12 @@ func testGetIndividualUserRepoPermission(t *testing.T) {
 		assert.Equal(t, perm_model.AccessModeNone, perm.unitsMode[unit.TypeCode])
 		assert.Equal(t, perm_model.AccessModeRead, perm.unitsMode[unit.TypeIssues])

-		users, err := GetUsersWithAnyUnitAccess(ctx, repo3, perm_model.AccessModeRead, unit.TypeIssues)
+		users, err := GetUsersWithUnitAccess(ctx, repo3, perm_model.AccessModeRead, unit.TypeIssues)
 		require.NoError(t, err)
 		require.Len(t, users, 1)
 		assert.Equal(t, user.ID, users[0].ID)

-		users, err = GetUsersWithAnyUnitAccess(ctx, repo3, perm_model.AccessModeWrite, unit.TypeIssues)
+		users, err = GetUsersWithUnitAccess(ctx, repo3, perm_model.AccessModeWrite, unit.TypeIssues)
 		require.NoError(t, err)
 		require.Empty(t, users)
 	})
@@ -245,7 +245,7 @@ func testGetIndividualUserRepoPermission(t *testing.T) {
 		assert.Equal(t, perm_model.AccessModeWrite, perm.unitsMode[unit.TypeCode])
 		assert.Equal(t, perm_model.AccessModeWrite, perm.unitsMode[unit.TypeIssues])

-		users, err := GetUsersWithAnyUnitAccess(ctx, repo3, perm_model.AccessModeWrite, unit.TypeIssues)
+		users, err := GetUsersWithUnitAccess(ctx, repo3, perm_model.AccessModeWrite, unit.TypeIssues)
 		require.NoError(t, err)
 		require.Len(t, users, 1)
 		assert.Equal(t, user.ID, users[0].ID)
@@ -7,45 +7,41 @@ import (
 	"context"
 	"io"

-	repo_model "gitea.dev/models/repo"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/gitrepo"
 	"gitea.dev/modules/log"
 )

 type commitChecker struct {
-	ctx          context.Context
-	commitCache  map[string]bool
-	repoOptional *repo_model.Repository
+	ctx           context.Context
+	commitCache   map[string]bool
+	gitRepoFacade gitrepo.Repository

 	gitRepo       *git.Repository
 	gitRepoCloser io.Closer
 }

-func newCommitChecker(ctx context.Context, repo *repo_model.Repository) *commitChecker {
-	return &commitChecker{ctx: ctx, commitCache: make(map[string]bool), repoOptional: repo}
+func newCommitChecker(ctx context.Context, gitRepo gitrepo.Repository) *commitChecker {
+	return &commitChecker{ctx: ctx, commitCache: make(map[string]bool), gitRepoFacade: gitRepo}
 }

 func (c *commitChecker) Close() error {
-	if c.gitRepoCloser != nil {
+	if c != nil && c.gitRepoCloser != nil {
 		return c.gitRepoCloser.Close()
 	}
 	return nil
 }

 func (c *commitChecker) IsCommitIDExisting(commitID string) bool {
-	if c.repoOptional == nil {
-		return false
-	}
 	exist, inCache := c.commitCache[commitID]
 	if inCache {
 		return exist
 	}

 	if c.gitRepo == nil {
-		r, closer, err := gitrepo.RepositoryFromContextOrOpen(c.ctx, c.repoOptional)
+		r, closer, err := gitrepo.RepositoryFromContextOrOpen(c.ctx, c.gitRepoFacade)
 		if err != nil {
-			log.Error("unable to open repository: %s Error: %v", gitrepo.RepoGitURL(c.repoOptional), err)
+			log.Error("unable to open repository: %s Error: %v", gitrepo.RepoGitURL(c.gitRepoFacade), err)
 			return false
 		}
 		c.gitRepo, c.gitRepoCloser = r, closer
@@ -51,10 +51,10 @@ func NewRenderContextRepoComment(ctx context.Context, repo *repo_model.Repositor
 	helper := &RepoComment{opts: util.OptionalArg(opts)}
 	rctx := markup.NewRenderContext(ctx)
 	helper.ctx = rctx
-	helper.commitChecker = newCommitChecker(ctx, repo)
 	var metas map[string]string
 	if repo != nil {
 		helper.repoLink = repo.Link()
+		helper.commitChecker = newCommitChecker(ctx, repo)
 		metas = repo.ComposeCommentMetas(ctx)
 	} else {
 		// repo can be nil when rendering a commit message in user's dashboard feedback whose repository has been deleted
@@ -35,11 +35,11 @@ func (r *RepoFile) ResolveLink(link, preferLinkType string) (finalLink string) {
 	case markup.LinkTypeRoot:
 		finalLink = r.ctx.ResolveLinkRoot(link)
 	case markup.LinkTypeRaw:
-		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "raw", r.opts.CurrentRefSubURL), util.PathEscapeSegments(r.opts.CurrentTreePath), link)
+		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "raw", r.opts.CurrentRefSubURL), r.opts.CurrentTreePath, link)
 	case markup.LinkTypeMedia:
-		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "media", r.opts.CurrentRefSubURL), util.PathEscapeSegments(r.opts.CurrentTreePath), link)
+		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "media", r.opts.CurrentRefSubURL), r.opts.CurrentTreePath, link)
 	default:
-		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "src", r.opts.CurrentRefSubURL), util.PathEscapeSegments(r.opts.CurrentTreePath), link)
+		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "src", r.opts.CurrentRefSubURL), r.opts.CurrentTreePath, link)
 	}
 	return finalLink
 }
@@ -58,9 +58,9 @@ func NewRenderContextRepoFile(ctx context.Context, repo *repo_model.Repository,
 	helper := &RepoFile{opts: util.OptionalArg(opts)}
 	rctx := markup.NewRenderContext(ctx)
 	helper.ctx = rctx
-	helper.commitChecker = newCommitChecker(ctx, repo)
 	if repo != nil {
 		helper.repoLink = repo.Link()
+		helper.commitChecker = newCommitChecker(ctx, repo)
 		rctx = rctx.WithMetas(repo.ComposeRepoFileMetas(ctx))
 	} else {
 		// this is almost dead code, only to pass the incorrect tests
@@ -68,7 +68,7 @@ func TestRepoFile(t *testing.T) {
 	t.Run("WithCurrentRefSubURLByTag", func(t *testing.T) {
 		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{
 			CurrentRefSubURL: "/commit/1234",
-			CurrentTreePath:  "my dir",
+			CurrentTreePath:  "my-dir",
 		}).
 			WithMarkupType(markdown.MarkupName)
 		rendered, err := testRenderString(rctx, `
@@ -76,8 +76,8 @@ func TestRepoFile(t *testing.T) {
 <video src="LINK">
 `)
 		assert.NoError(t, err)
-		assert.Equal(t, `<a href="/user2/repo1/src/commit/1234/my%20dir/LINK" target="_blank" rel="nofollow noopener"><img src="/user2/repo1/media/commit/1234/my%20dir/LINK"/></a>
-<video src="/user2/repo1/media/commit/1234/my%20dir/LINK">
+		assert.Equal(t, `<a href="/user2/repo1/src/commit/1234/my-dir/LINK" target="_blank" rel="nofollow noopener"><img src="/user2/repo1/media/commit/1234/my-dir/LINK"/></a>
+<video src="/user2/repo1/media/commit/1234/my-dir/LINK">
 </video>`, rendered)
 	})
 }
@@ -89,8 +89,8 @@ func TestRepoFileOrgMode(t *testing.T) {
 	t.Run("Links", func(t *testing.T) {
 		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{
 			CurrentRefSubURL: "/commit/1234",
-			CurrentTreePath:  "my dir",
-		}).WithRelativePath("my dir/a.org")
+			CurrentTreePath:  "my-dir",
+		}).WithRelativePath("my-dir/a.org")

 		rendered, err := testRenderString(rctx, `
 [[https://google.com/]]
@@ -99,7 +99,7 @@ func TestRepoFileOrgMode(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, `<p>
 <a href="https://google.com/" rel="nofollow">https://google.com/</a>
-<a href="/user2/repo1/src/commit/1234/my%20dir/ImageLink.svg" rel="nofollow">The Image Desc</a></p>
+<a href="/user2/repo1/src/commit/1234/my-dir/ImageLink.svg" rel="nofollow">The Image Desc</a></p>
 `, rendered)
 	})

@@ -36,9 +36,9 @@ func (r *RepoWiki) ResolveLink(link, preferLinkType string) (finalLink string) {
 	case markup.LinkTypeRoot:
 		finalLink = r.ctx.ResolveLinkRoot(link)
 	case markup.LinkTypeMedia, markup.LinkTypeRaw:
-		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "wiki/raw", r.opts.currentRefSubURL), util.PathEscapeSegments(r.opts.currentTreePath), link)
+		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "wiki/raw", r.opts.currentRefSubURL), r.opts.currentTreePath, link)
 	default:
-		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "wiki", r.opts.currentRefSubURL), util.PathEscapeSegments(r.opts.currentTreePath), link)
+		finalLink = r.ctx.ResolveLinkRelative(path.Join(r.repoLink, "wiki", r.opts.currentRefSubURL), r.opts.currentTreePath, link)
 	}
 	return finalLink
 }
@@ -57,9 +57,9 @@ type RepoWikiOptions struct {
 func NewRenderContextRepoWiki(ctx context.Context, repo *repo_model.Repository, opts ...RepoWikiOptions) *markup.RenderContext {
 	helper := &RepoWiki{opts: util.OptionalArg(opts)}
 	rctx := markup.NewRenderContext(ctx).WithMarkupType(markdown.MarkupName)
-	helper.commitChecker = newCommitChecker(ctx, repo)
 	if repo != nil {
 		helper.repoLink = repo.Link()
+		helper.commitChecker = newCommitChecker(ctx, repo)
 		rctx = rctx.WithMetas(repo.ComposeWikiMetas(ctx))
 	} else {
 		// this is almost dead code, only to pass the incorrect tests
@@ -50,16 +50,14 @@ func TestRepoWiki(t *testing.T) {
 	})

 	t.Run("PathInTag", func(t *testing.T) {
-		rctx := NewRenderContextRepoWiki(t.Context(), repo1, RepoWikiOptions{
-			currentTreePath: "my dir",
-		}).WithMarkupType(markdown.MarkupName)
+		rctx := NewRenderContextRepoWiki(t.Context(), repo1).WithMarkupType(markdown.MarkupName)
 		rendered, err := testRenderString(rctx, `
 <img src="LINK">
 <video src="LINK">
 `)
 		assert.NoError(t, err)
-		assert.Equal(t, `<a href="/user2/repo1/wiki/my%20dir/LINK" target="_blank" rel="nofollow noopener"><img src="/user2/repo1/wiki/raw/my%20dir/LINK"/></a>
-<video src="/user2/repo1/wiki/raw/my%20dir/LINK">
+		assert.Equal(t, `<a href="/user2/repo1/wiki/LINK" target="_blank" rel="nofollow noopener"><img src="/user2/repo1/wiki/raw/LINK"/></a>
+<video src="/user2/repo1/wiki/raw/LINK">
 </video>`, rendered)
 	})
 }
@@ -111,6 +111,39 @@ func IsCollaborator(ctx context.Context, repoID, userID int64) (bool, error) {
 	return db.Exist[Collaboration](ctx, builder.Eq{"repo_id": repoID, "user_id": userID})
 }

+// ChangeCollaborationAccessMode sets new access mode for the collaboration.
+func ChangeCollaborationAccessMode(ctx context.Context, repo *Repository, uid int64, mode perm.AccessMode) error {
+	// Discard invalid input
+	if mode <= perm.AccessModeNone || mode > perm.AccessModeOwner {
+		return nil
+	}
+
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		collaboration, has, err := db.Get[Collaboration](ctx, builder.Eq{"repo_id": repo.ID, "user_id": uid})
+		if err != nil {
+			return fmt.Errorf("get collaboration: %w", err)
+		} else if !has {
+			return nil
+		}
+
+		if collaboration.Mode == mode {
+			return nil
+		}
+		collaboration.Mode = mode
+
+		if _, err = db.GetEngine(ctx).
+			ID(collaboration.ID).
+			Cols("mode").
+			Update(collaboration); err != nil {
+			return fmt.Errorf("update collaboration: %w", err)
+		} else if _, err = db.Exec(ctx, "UPDATE access SET mode = ? WHERE user_id = ? AND repo_id = ?", mode, uid, repo.ID); err != nil {
+			return fmt.Errorf("update access table: %w", err)
+		}
+
+		return nil
+	})
+}
+
 // IsOwnerMemberCollaborator checks if a provided user is the owner, a collaborator or a member of a team in a repository
 func IsOwnerMemberCollaborator(ctx context.Context, repo *Repository, userID int64) (bool, error) {
 	if repo.OwnerID == userID {
@@ -7,6 +7,8 @@ import (
 	"testing"

 	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"

@@ -67,6 +69,28 @@ func TestRepository_IsCollaborator(t *testing.T) {
 	test(4, 4, true)
 }

+func TestRepository_ChangeCollaborationAccessMode(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	assert.NoError(t, repo_model.ChangeCollaborationAccessMode(t.Context(), repo, 4, perm.AccessModeAdmin))
+
+	collaboration := unittest.AssertExistsAndLoadBean(t, &repo_model.Collaboration{RepoID: repo.ID, UserID: 4})
+	assert.Equal(t, perm.AccessModeAdmin, collaboration.Mode)
+
+	access := unittest.AssertExistsAndLoadBean(t, &access_model.Access{UserID: 4, RepoID: repo.ID})
+	assert.Equal(t, perm.AccessModeAdmin, access.Mode)
+
+	assert.NoError(t, repo_model.ChangeCollaborationAccessMode(t.Context(), repo, 4, perm.AccessModeAdmin))
+
+	assert.NoError(t, repo_model.ChangeCollaborationAccessMode(t.Context(), repo, unittest.NonexistentID, perm.AccessModeAdmin))
+
+	// Discard invalid input.
+	assert.NoError(t, repo_model.ChangeCollaborationAccessMode(t.Context(), repo, 4, perm.AccessMode(-1)))
+
+	unittest.CheckConsistencyFor(t, &repo_model.Repository{ID: repo.ID})
+}
+
 func TestRepository_IsOwnerMemberCollaborator(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())

@@ -6,10 +6,7 @@ package jobparser
 import (
 	"errors"
 	"fmt"
-	"math"
-	"reflect"
 	"regexp"
-	"strconv"
 	"strings"

 	"gitea.com/gitea/runner/act/exprparser"
@@ -26,6 +23,12 @@ func NewExpressionEvaluator(interpreter exprparser.Interpreter) *ExpressionEvalu
 	return &ExpressionEvaluator{interpreter: interpreter}
 }

+func (ee ExpressionEvaluator) evaluate(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
+	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
+
+	return evaluated, err
+}
+
 func (ee ExpressionEvaluator) evaluateScalarYamlNode(node *yaml.Node) error {
 	var in string
 	if err := node.Decode(&in); err != nil {
@@ -34,17 +37,17 @@ func (ee ExpressionEvaluator) evaluateScalarYamlNode(node *yaml.Node) error {
 	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
 		return nil
 	}
-	res, err := ee.evaluateScalar(in)
+	expr, _ := rewriteSubExpression(in, false)
+	res, err := ee.evaluate(expr, exprparser.DefaultStatusCheckNone)
 	if err != nil {
 		return err
 	}
 	return node.Encode(res)
 }

-// GitHub has this undocumented feature to merge maps, called insert directive
-var insertDirective = regexp.MustCompile(`\${{\s*insert\s*}}`)
-
 func (ee ExpressionEvaluator) evaluateMappingYamlNode(node *yaml.Node) error {
+	// GitHub has this undocumented feature to merge maps, called insert directive
+	insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`)
 	for i := 0; i < len(node.Content)/2; {
 		k := node.Content[i*2]
 		v := node.Content[i*2+1]
@@ -99,170 +102,88 @@ func (ee ExpressionEvaluator) EvaluateYamlNode(node *yaml.Node) error {
 	}
 }

-// interpolate evaluates every part on its own, so a malformed one cannot restructure its neighbours
-func (ee ExpressionEvaluator) interpolate(in string) (string, error) {
-	parts, err := splitSubExpressions(in)
-	if err != nil {
-		return "", err
+func (ee ExpressionEvaluator) Interpolate(in string) string {
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return in
 	}
-	if len(parts) == 1 && !parts[0].isExpr {
+
+	expr, _ := rewriteSubExpression(in, true)
+	evaluated, err := ee.evaluate(expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return ""
+	}
+
+	value, ok := evaluated.(string)
+	if !ok {
+		panic(fmt.Sprintf("Expression %s did not evaluate to a string", expr))
+	}
+
+	return value
+}
+
+func escapeFormatString(in string) string {
+	return strings.ReplaceAll(strings.ReplaceAll(in, "{", "{{"), "}", "}}")
+}
+
+func rewriteSubExpression(in string, forceFormat bool) (string, error) {
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
 		return in, nil
 	}
-	var out strings.Builder
-	out.Grow(len(in))
-	for _, part := range parts {
-		if !part.isExpr {
-			out.WriteString(part.text)
-			continue
-		}
-		evaluated, err := ee.interpreter.Evaluate(part.text, exprparser.DefaultStatusCheckNone)
-		if err != nil {
-			return "", err
-		}
-		out.WriteString(coerceToString(evaluated))
-	}
-	return out.String(), nil
-}

-// evaluateScalar keeps the type of a lone expression, so `${{ fromJSON('[1,2]') }}` stays an array
-func (ee ExpressionEvaluator) evaluateScalar(in string) (any, error) {
-	parts, err := splitSubExpressions(in)
-	if err != nil {
-		return nil, err
-	}
-	if len(parts) == 1 && parts[0].isExpr {
-		return ee.interpreter.Evaluate(parts[0].text, exprparser.DefaultStatusCheckNone)
-	}
-	return ee.interpolate(in)
-}
-
-// evaluateCondition evaluates an `if:`, an expression even without `${{ }}`. Mixed content
-// interpolates to a string, so the success() default applies to it separately.
-func (ee ExpressionEvaluator) evaluateCondition(in string) (bool, error) {
-	parts, err := splitSubExpressions(in)
-	if err != nil {
-		return false, err
-	}
-	if len(parts) == 1 {
-		evaluated, err := ee.interpreter.Evaluate(parts[0].text, exprparser.DefaultStatusCheckSuccess)
-		if err != nil {
-			return false, err
-		}
-		return exprparser.IsTruthy(evaluated), nil
-	}
-
-	// mixed content is a string, so the success() default applies to it separately
-	if !expressionCallsFunction(in, "success", "always", "failure", "cancelled") {
-		status, err := ee.interpreter.Evaluate("success()", exprparser.DefaultStatusCheckNone)
-		if err != nil {
-			return false, err
-		}
-		if !exprparser.IsTruthy(status) {
-			return false, nil
-		}
-	}
-	interpolated, err := ee.interpolate(in)
-	if err != nil {
-		return false, err
-	}
-	return exprparser.IsTruthy(interpolated), nil
-}
-
-// coerceToString converts an evaluated expression value to a string the way GitHub does,
-// see https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#operators
-// An already reflected value is accepted as-is, since Interface() would panic on an invalid one.
-func coerceToString(v any) string {
-	value, ok := v.(reflect.Value)
-	if !ok {
-		value = reflect.ValueOf(v)
-	}
-
-	switch value.Kind() {
-	case reflect.Invalid:
-		return ""
-
-	case reflect.Bool:
-		return strconv.FormatBool(value.Bool())
-
-	case reflect.String:
-		return value.String()
-
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return strconv.FormatInt(value.Int(), 10)
-
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return strconv.FormatUint(value.Uint(), 10)
-
-	case reflect.Float32, reflect.Float64:
-		if math.IsInf(value.Float(), 1) {
-			return "Infinity"
-		} else if math.IsInf(value.Float(), -1) {
-			return "-Infinity"
-		}
-		return fmt.Sprintf("%.15G", value.Float())
-
-	case reflect.Slice, reflect.Array:
-		return "Array"
-
-	// contexts such as `github` are pointers to structs, so they stringify as objects too
-	case reflect.Map, reflect.Struct:
-		return "Object"
-
-	case reflect.Interface, reflect.Pointer:
-		if value.IsNil() {
-			return ""
-		}
-		return coerceToString(value.Elem())
-	}
-
-	return fmt.Sprintf("%v", value)
-}
-
-type exprPart struct {
-	text   string
-	isExpr bool
-}
-
-// splitSubExpressions splits in the way GitHub's template reader does, leaving a value without a
-// complete expression literal.
-func splitSubExpressions(in string) ([]exprPart, error) {
-	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
-		return []exprPart{{text: in}}, nil
-	}
-
-	parts := make([]exprPart, 0, 2*strings.Count(in, "${{")+1)
-	for {
-		start := strings.Index(in, "${{")
-		if start < 0 {
-			if in != "" {
-				parts = append(parts, exprPart{text: in})
+	strPattern := regexp.MustCompile("(?:''|[^'])*'")
+	pos := 0
+	exprStart := -1
+	strStart := -1
+	var results []string
+	var formatOut strings.Builder
+	for pos < len(in) {
+		if strStart > -1 {
+			matches := strPattern.FindStringIndex(in[pos:])
+			if matches == nil {
+				return "", errors.New("unclosed string")
 			}
-			return parts, nil
-		}
-		if start > 0 {
-			parts = append(parts, exprPart{text: in[:start]})
-		}
-		rest := in[start+len("${{"):]
-		end := indexExprEnd(rest)
-		if end < 0 {
-			return nil, errors.New("unclosed expression")
-		}
-		parts = append(parts, exprPart{text: strings.TrimSpace(rest[:end]), isExpr: true})
-		in = rest[end+len("}}"):]
-	}
-}

-// indexExprEnd returns the offset of the `}}` ending an expression, or -1. A quote toggles string
-// state, so a `}}` inside a string does not end it.
-func indexExprEnd(in string) int {
-	inString := false
-	for i := range len(in) {
-		switch {
-		case in[i] == '\'':
-			inString = !inString
-		case !inString && in[i] == '}' && i+1 < len(in) && in[i+1] == '}':
-			return i
+			strStart = -1
+			pos += matches[1]
+		} else if exprStart > -1 {
+			exprEnd := strings.Index(in[pos:], "}}")
+			strStart = strings.Index(in[pos:], "'")
+
+			if exprEnd > -1 && strStart > -1 {
+				if exprEnd < strStart {
+					strStart = -1
+				} else {
+					exprEnd = -1
+				}
+			}
+
+			if exprEnd > -1 {
+				fmt.Fprintf(&formatOut, "{%d}", len(results))
+				results = append(results, strings.TrimSpace(in[exprStart:pos+exprEnd]))
+				pos += exprEnd + 2
+				exprStart = -1
+			} else if strStart > -1 {
+				pos += strStart + 1
+			} else {
+				panic("unclosed expression.")
+			}
+		} else {
+			exprStart = strings.Index(in[pos:], "${{")
+			if exprStart != -1 {
+				formatOut.WriteString(escapeFormatString(in[pos : pos+exprStart]))
+				exprStart = pos + exprStart + 3
+				pos = exprStart
+			} else {
+				formatOut.WriteString(escapeFormatString(in[pos:]))
+				pos = len(in)
+			}
 		}
 	}
-	return -1
+
+	if len(results) == 1 && formatOut.String() == "{0}" && !forceFormat {
+		return in, nil
+	}
+
+	out := fmt.Sprintf("format('%s', %s)", strings.ReplaceAll(formatOut.String(), "'", "''"), strings.Join(results, ", "))
+	return out, nil
 }
@@ -57,14 +57,9 @@ func NewInterpeter(
 	}

 	ee := &exprparser.EvaluationEnvironment{
-		Github: gitCtx,
-		Env:    nil, // no need
-		// Job must be non-nil because cancelled() dereferences Job.Status unconditionally.
-		// See: https://gitea.com/gitea/runner/src/commit/ad967330a8788c9b8ab723abbc1a86d53c3bc5e6/act/exprparser/functions.go#L299
-		// TODO: The empty JobContext.Status is right for now because Gitea never checks `if` condition when the workflow run is cancelled.
-		// This is an implementation gap in Gitea Actions. When a workflow run is cancelled, Gitea should check the job's `if` condition,
-		// and if the condition is met (e.g. `if: ${{ cancelled() }}` ), the job should be executed rather than cancelled.
-		Job:      &model.JobContext{},
+		Github:   gitCtx,
+		Env:      nil, // no need
+		Job:      nil, // no need
 		Steps:    nil, // no need
 		Runner:   nil, // no need
 		Secrets:  nil, // no need
@@ -6,13 +6,11 @@ package jobparser
 import (
 	"bytes"
 	"fmt"
-	"slices"
 	"sort"
 	"strings"

 	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
-	"github.com/rhysd/actionlint"
 	"go.yaml.in/yaml/v4"
 )

@@ -50,9 +48,7 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 	}

 	evaluator := NewExpressionEvaluator(exprparser.NewInterpeter(&exprparser.EvaluationEnvironment{Github: pc.gitContext, Vars: pc.vars, Inputs: pc.inputs}, exprparser.Config{}))
-	if workflow.RunName, err = evaluator.interpolate(workflow.RunName); err != nil {
-		return nil, fmt.Errorf("interpolate run-name: %w", err)
-	}
+	workflow.RunName = evaluator.Interpolate(workflow.RunName)

 	for i, id := range ids {
 		job := jobs[i]
@@ -67,14 +63,10 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 			}
 			job.Strategy.RawMatrix = encodeMatrix(matrix)
 			evaluator := NewExpressionEvaluator(NewInterpeter(id, origin.GetJob(id), matrix, pc.gitContext, results, pc.vars, pc.inputs))
-			if job.Name, err = nameWithMatrix(job.Name, matrix, evaluator); err != nil {
-				return nil, fmt.Errorf("interpolate name for job %q: %w", id, err)
-			}
+			job.Name = nameWithMatrix(job.Name, matrix, evaluator)
 			runsOn := origin.GetJob(id).RunsOn()
 			for i, v := range runsOn {
-				if runsOn[i], err = evaluator.interpolate(v); err != nil {
-					return nil, fmt.Errorf("interpolate runs-on for job %q: %w", id, err)
-				}
+				runsOn[i] = evaluator.Interpolate(v)
 			}
 			job.RawRunsOn = encodeRunsOn(runsOn)
 			if err := evaluator.EvaluateYamlNode(&job.RawContinueOnError); err != nil {
@@ -158,45 +150,16 @@ func encodeRunsOn(runsOn []string) yaml.Node {
 	return node
 }

-func nameWithMatrix(name string, m map[string]any, evaluator *ExpressionEvaluator) (string, error) {
+func nameWithMatrix(name string, m map[string]any, evaluator *ExpressionEvaluator) string {
 	if len(m) == 0 {
-		return name, nil
+		return name
 	}

 	if !strings.Contains(name, "${{") || !strings.Contains(name, "}}") {
-		return name + " " + matrixName(m), nil
+		return name + " " + matrixName(m)
 	}

-	return evaluator.interpolate(name)
-}
-
-// expressionCallsFunction reports whether any ${{ }} expression in value calls one of the functions.
-func expressionCallsFunction(value string, names ...string) bool {
-	parts, err := splitSubExpressions(value)
-	if err != nil {
-		return true // unparseable here, let the expansion report it against the real values
-	}
-	for _, part := range parts {
-		if !part.isExpr {
-			continue
-		}
-		// The lexer needs the closing `}}` that the scanner strips.
-		expr, err := actionlint.NewExprParser().Parse(actionlint.NewExprLexer(part.text + "}}"))
-		if err != nil {
-			return true // unparseable here, let the expansion report it against the real values
-		}
-		found := false
-		actionlint.VisitExprNode(expr, func(node, _ actionlint.ExprNode, entering bool) {
-			call, ok := node.(*actionlint.FuncCallNode)
-			if entering && ok && slices.Contains(names, strings.ToLower(call.Callee)) {
-				found = true
-			}
-		})
-		if found {
-			return true
-		}
-	}
-	return false
+	return evaluator.Interpolate(name)
 }

 func matrixName(m map[string]any) string {
@@ -7,7 +7,6 @@ import (
 	"strings"
 	"testing"

-	"gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
@@ -108,42 +107,3 @@ func TestParse(t *testing.T) {
 		})
 	}
 }
-
-func TestParseInterpolatesRunName(t *testing.T) {
-	workflow := func(runName string) []byte {
-		return []byte("name: t\nrun-name: \"" + runName + "\"\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps: [{run: echo}]\n")
-	}
-
-	for _, tt := range []struct{ name, runName, want string }{
-		{"bool", "${{ true }}", "true"},
-		{"int", "${{ 1 }}", "1"},
-		{"float", "${{ 1.0 }}", "1"},
-		{"null", "${{ null }}", ""},
-		{"object", `${{ fromJSON('{\"a\":1}') }}`, "Object"},
-		{"array", "${{ fromJSON('[1,2]') }}", "Array"},
-		{"context", "${{ github }}", "Object"},
-		{"surrounding literals", "run ${{ 1 }} now", "run 1 now"},
-		{"two expressions", "${{ 1 }}-${{ true }}", "1-true"},
-		{"closing brace inside a string", "${{ 'a}}b' }}", "a}}b"},
-		{"incomplete expression stays literal", "${{ 1", "${{ 1"},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := Parse(workflow(tt.runName), WithGitContext(&model.GithubContext{EventName: "push"}))
-			require.NoError(t, err)
-			require.Len(t, result, 1)
-			assert.Equal(t, tt.want, result[0].RunName)
-		})
-	}
-
-	// a malformed part must not restructure the surrounding expression
-	for _, runName := range []string{"${{ 1) && (2 }}", "run ${{ 1) && (2 }} now", "${{ 'a' }} ${{ b", "${{ 'a }}"} {
-		_, err := Parse(workflow(runName), WithGitContext(&model.GithubContext{EventName: "push"}))
-		assert.ErrorContains(t, err, "interpolate run-name")
-	}
-
-	// callers such as commit status parse without a git context, leaving `github` a nil pointer
-	result, err := Parse(workflow("${{ github }}"))
-	require.NoError(t, err)
-	require.Len(t, result, 1)
-	assert.Empty(t, result[0].RunName)
-}
@@ -8,8 +8,7 @@ import (
 	"errors"
 	"fmt"

-	"gitea.dev/modules/util"
-
+	"gitea.com/gitea/runner/act/exprparser"
 	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
@@ -33,11 +32,6 @@ func (w *SingleWorkflow) Job() (string, *Job) {
 	return "", nil
 }

-// WorkflowDispatchConfig returns the `on: workflow_dispatch` declaration, nil if there is none.
-func (w *SingleWorkflow) WorkflowDispatchConfig() *model.WorkflowDispatch {
-	return (&model.Workflow{RawOn: w.RawOn}).WorkflowDispatchConfig()
-}
-
 func (w *SingleWorkflow) jobs() ([]string, []*Job, error) {
 	ids, jobs, err := parseMappingNode[*Job](&w.RawJobs)
 	if err != nil {
@@ -81,22 +75,7 @@ func (w *SingleWorkflow) SetJob(id string, job *Job) error {
 }

 func (w *SingleWorkflow) Marshal() ([]byte, error) {
-	// Encode with the same indentation SetJob uses (2). yaml.Marshal's default
-	// indentation (4) makes the encoder emit multi-line block scalars (e.g. a
-	// `run:` step that begins with blank lines) with a wrong explicit indentation
-	// indicator (`run: |4`) that then fails to re-parse, which silently strands
-	// the job during concurrency evaluation. Keeping both encoders at indent 2
-	// makes the serialized single workflow round-trip.
-	var buf bytes.Buffer
-	enc := yaml.NewEncoder(&buf)
-	enc.SetIndent(2)
-	if err := enc.Encode(w); err != nil {
-		return nil, err
-	}
-	if err := enc.Close(); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
+	return yaml.Marshal(w)
 }

 type Job struct {
@@ -298,7 +277,7 @@ func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCt
 	if evaluated.RawExpression != "" {
 		return evaluated.RawExpression, false, nil
 	}
-	return evaluated.Group, util.ParseYamlBool(evaluated.CancelInProgress), nil
+	return evaluated.Group, evaluated.CancelInProgress == "true", nil
 }

 func toGitContext(input map[string]any) *model.GithubContext {
@@ -511,20 +490,16 @@ func EvaluateJobIfExpression(jobID string, job *Job, gitCtx map[string]any, resu
 			RawMatrix:         job.Strategy.RawMatrix,
 		},
 	}
-	// Each per-matrix job carries its single matrix combination in RawMatrix so resolve it and pass it in;
-	// otherwise `matrix.*` references in `if:` evaluate to null.
-	// GetMatrixes always returns at least one element (an empty map for a job without a matrix),
-	// so only a non-empty combination should populate `matrix.*`, leaving it nil otherwise.
-	var matrix map[string]any
-	matrixes, err := actJob.GetMatrixes()
+	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, nil, toGitContext(gitCtx), results, vars, inputs))
+	expr, err := rewriteSubExpression(job.If.Value, false)
 	if err != nil {
 		return false, err
 	}
-	if len(matrixes) > 0 && len(matrixes[0]) > 0 {
-		matrix = matrixes[0]
+	result, err := evaluator.evaluate(expr, exprparser.DefaultStatusCheckSuccess)
+	if err != nil {
+		return false, err
 	}
-	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
-	return evaluator.evaluateCondition(job.If.Value)
+	return exprparser.IsTruthy(result), nil
 }

 // parseMappingNode parse a mapping node and preserve order.
@@ -4,7 +4,6 @@
 package jobparser

 import (
-	"fmt"
 	"strings"
 	"testing"

@@ -465,110 +464,3 @@ func TestParseMappingNode(t *testing.T) {
 		})
 	}
 }
-
-func TestEvaluateJobIfExpressionMatrix(t *testing.T) {
-	ifExprs := []string{
-		`${{ contains(fromJSON('["linux","windows"]'), matrix.target) }}`,
-		`${{ contains('["linux","windows"]', matrix.target) }}`,
-	}
-
-	want := map[string]bool{
-		"build (linux)":   true,
-		"build (windows)": true,
-		"build (macos)":   false,
-	}
-
-	for _, ifExpr := range ifExprs {
-		t.Run(ifExpr, func(t *testing.T) {
-			content := fmt.Sprintf(`
-name: test
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    if: %s
-    strategy:
-      fail-fast: false
-      matrix:
-        target: [linux, windows, macos]
-    steps:
-      - run: echo ${{ matrix.target }}
-`, ifExpr)
-
-			swfs, err := Parse([]byte(content))
-			require.NoError(t, err)
-			require.Len(t, swfs, 3)
-
-			got := make(map[string]bool, len(swfs))
-			for _, swf := range swfs {
-				id, job := swf.Job()
-				shouldRun, err := EvaluateJobIfExpression(id, job, map[string]any{}, map[string]*JobResult{id: {}}, nil, nil)
-				require.NoError(t, err)
-				got[job.Name] = shouldRun
-			}
-			assert.Equal(t, want, got)
-		})
-	}
-}
-
-func TestEvaluateJobIfExpression(t *testing.T) {
-	kases := []struct {
-		name       string
-		ifCond     string
-		needResult string
-		expected   bool
-	}{
-		{name: "empty need success", ifCond: "${{ 1 == 1 }}", needResult: "success", expected: true},
-		{name: "always", ifCond: "${{ always() }}", needResult: "failure", expected: true},
-		{name: "failure true", ifCond: "${{ failure() }}", needResult: "failure", expected: true},
-		{name: "failure false", ifCond: "${{ failure() }}", needResult: "success", expected: false},
-		{name: "success true", ifCond: "${{ success() }}", needResult: "success", expected: true},
-		// cancelled() is always false on the server: a cancelled run never evaluates a blocked job's `if:`
-		{name: "cancelled", ifCond: "${{ cancelled() }}", needResult: "success", expected: false},
-		{name: "not cancelled or failure", ifCond: "${{ !(cancelled() || failure()) }}", needResult: "success", expected: true},
-		{name: "not cancelled or failure, need failed", ifCond: "${{ !(cancelled() || failure()) }}", needResult: "failure", expected: false},
-		// a condition is an expression with or without `${{ }}`, literal text around one makes it a string
-		{name: "bare expression", ifCond: "always()", needResult: "failure", expected: true},
-		{name: "literal text keeps the success() default", ifCond: "x ${{ 1 }}", needResult: "failure", expected: false},
-		{name: "literal text around a status function drops it", ifCond: "x ${{ always() }}", needResult: "failure", expected: true},
-	}
-	for _, kase := range kases {
-		t.Run(kase.name, func(t *testing.T) {
-			content := strings.ReplaceAll(`
-name: test
-on: push
-jobs:
-  job1:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo job1
-  job2:
-    runs-on: ubuntu-latest
-    needs: [job1]
-    if: IF_COND
-    steps:
-      - run: echo job2
-`, "IF_COND", kase.ifCond)
-
-			workflows, err := Parse([]byte(content))
-			require.NoError(t, err)
-
-			var job2 *Job
-			for _, wf := range workflows {
-				if id, job := wf.Job(); id == "job2" {
-					job2 = job
-				}
-			}
-			require.NotNil(t, job2)
-
-			// mirrors findJobNeedsAndFillJobResults: the needs' results plus a self entry carrying Needs
-			results := map[string]*JobResult{
-				"job1": {Result: kase.needResult},
-				"job2": {Needs: []string{"job1"}},
-			}
-			got, err := EvaluateJobIfExpression("job2", job2, map[string]any{}, results, nil, nil)
-			require.NoError(t, err)
-			assert.Equal(t, kase.expected, got)
-		})
-	}
-}
@@ -1,64 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package jobparser
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// A step whose `run:` block starts with blank lines must still survive the
-// Parse -> SingleWorkflow.Marshal -> Parse round-trip. Previously Marshal used a
-// different indentation than SetJob, which made the encoder emit the block scalar
-// with a wrong explicit indentation indicator (`run: |4`) that no longer parsed;
-// the job then stayed silently blocked during concurrency evaluation.
-func TestSingleWorkflowRoundTripRunBlockLeadingBlankLines(t *testing.T) {
-	const wf = `name: demo
-on:
-  workflow_call:
-    inputs:
-      app_name:
-        type: string
-        required: true
-jobs:
-  build:
-    name: build
-    env:
-      IMAGE_TAG: ${{ inputs.app_name }}
-    runs-on: ubuntu-latest
-    steps:
-      - if: ${{ inputs.app_name != '' }}
-        name: packages
-        run: |
-
-
-          echo start
-          echo done
-`
-	sws, err := Parse([]byte(wf))
-	require.NoError(t, err)
-	require.Len(t, sws, 1)
-
-	// pin the original run block as the baseline
-	_, origJob := sws[0].Job()
-	require.Len(t, origJob.Steps, 1)
-	const wantRun = "\n\necho start\necho done\n"
-	require.Equal(t, wantRun, origJob.Steps[0].Run)
-
-	payload, err := sws[0].Marshal()
-	require.NoError(t, err)
-
-	// the serialized single workflow must be parseable again -- this is what the
-	// server does in EvaluateJobConcurrencyFillModel -> ParseJob. Before the fix
-	// Marshal emitted `run: |4`, which failed here and left the job blocked.
-	roundTripped, err := Parse(payload)
-	require.NoError(t, err, "serialized single workflow must round-trip; got payload:\n%s", payload)
-	require.Len(t, roundTripped, 1)
-
-	// the round-trip must preserve the run block byte-for-byte
-	_, gotJob := roundTripped[0].Job()
-	require.Len(t, gotJob.Steps, 1)
-	require.Equal(t, wantRun, gotJob.Steps[0].Run, "round-trip must preserve run content; got payload:\n%s", payload)
-}
@@ -260,7 +260,7 @@ func MatchCallerInputsAgainstSpec(spec *WorkflowCallSpec, evaluated map[string]a
 func parseWorkflowCallInput(name string, typ InputType, v any) (any, error) {
 	switch typ {
 	case InputTypeString:
-		return coerceToString(v), nil
+		return toString(v), nil
 	case InputTypeBoolean:
 		// strict type matching: a boolean input only accepts a native bool, not a "true"/"false" string
 		if b, ok := v.(bool); ok {
@@ -361,11 +361,11 @@ func EvaluateWorkflowCallOutputs(spec *WorkflowCallSpec, gitCtx *model.GithubCon
 		Vars:   vars,
 		Inputs: inputs,
 	}
-	evaluator := NewExpressionEvaluator(exprparser.NewInterpeter(env, exprparser.Config{}))
+	interpreter := exprparser.NewInterpeter(env, exprparser.Config{})

 	out := make(map[string]string, len(spec.Outputs))
 	for name, o := range spec.Outputs {
-		v, err := evaluator.interpolate(o.Value)
+		v, err := evaluateWorkflowCallOutputValue(interpreter, o.Value)
 		if err != nil {
 			return nil, fmt.Errorf("workflow_call output %q: %w", name, err)
 		}
@@ -373,3 +373,29 @@ func EvaluateWorkflowCallOutputs(spec *WorkflowCallSpec, gitCtx *model.GithubCon
 	}
 	return out, nil
 }
+
+func evaluateWorkflowCallOutputValue(interpreter exprparser.Interpreter, value string) (string, error) {
+	if !strings.Contains(value, "${{") || !strings.Contains(value, "}}") {
+		return value, nil
+	}
+	expr, err := rewriteSubExpression(value, true)
+	if err != nil {
+		return "", err
+	}
+	evaluated, err := interpreter.Evaluate(expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return "", err
+	}
+	return toString(evaluated), nil
+}
+
+func toString(v any) string {
+	switch s := v.(type) {
+	case string:
+		return s
+	case nil:
+		return ""
+	default:
+		return fmt.Sprintf("%v", s)
+	}
+}
@@ -59,7 +59,6 @@ func ParseScopedWorkflows(sourceCommit *git.Commit) ([]*ParsedScopedWorkflow, er
 // It returns the workflows whose `on:` matches, and those that matched the event but were excluded by a branch/paths filter (filtered).
 func MatchScopedWorkflows(
 	parsed []*ParsedScopedWorkflow,
-	sourceCommitSHA string,
 	consumerGitRepo *git.Repository,
 	consumerCommit *git.Commit,
 	triggedEvent webhook_module.HookEventType,
@@ -72,10 +71,9 @@ func MatchScopedWorkflows(
 				continue
 			}
 			dwf := &DetectedWorkflow{
-				EntryName:       p.EntryName,
-				TriggerEvent:    evt,
-				Content:         p.Content,
-				SourceCommitSHA: sourceCommitSHA,
+				EntryName:    p.EntryName,
+				TriggerEvent: evt,
+				Content:      p.Content,
 			}
 			switch detectWorkflowMatch(consumerGitRepo, consumerCommit, triggedEvent, payload, evt) {
 			case detectMatched:
@@ -28,8 +28,6 @@ type DetectedWorkflow struct {
 	EntryName    string
 	TriggerEvent *jobparser.Event
 	Content      []byte
-	// SourceCommitSHA is the commit Content was read from, and must always be filled in together with Content.
-	SourceCommitSHA string
 }

 type detectResult int
@@ -205,19 +203,17 @@ func DetectWorkflows(
 			if evt.IsSchedule() {
 				if detectSchedule {
 					dwf := &DetectedWorkflow{
-						EntryName:       entry.Name(),
-						TriggerEvent:    evt,
-						Content:         content,
-						SourceCommitSHA: commit.ID.String(),
+						EntryName:    entry.Name(),
+						TriggerEvent: evt,
+						Content:      content,
 					}
 					schedules = append(schedules, dwf)
 				}
 			} else {
 				dwf := &DetectedWorkflow{
-					EntryName:       entry.Name(),
-					TriggerEvent:    evt,
-					Content:         content,
-					SourceCommitSHA: commit.ID.String(),
+					EntryName:    entry.Name(),
+					TriggerEvent: evt,
+					Content:      content,
 				}
 				switch detectWorkflowMatch(gitRepo, commit, triggedEvent, payload, evt) {
 				case detectMatched:
@@ -256,10 +252,9 @@ func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*D
 			if evt.IsSchedule() {
 				log.Trace("detect scheduled workflow: %q", entry.Name())
 				dwf := &DetectedWorkflow{
-					EntryName:       entry.Name(),
-					TriggerEvent:    evt,
-					Content:         content,
-					SourceCommitSHA: commit.ID.String(),
+					EntryName:    entry.Name(),
+					TriggerEvent: evt,
+					Content:      content,
 				}
 				wfs = append(wfs, dwf)
 			}
@@ -28,10 +28,13 @@ func Init() {

 	WebAuthn = &webauthn.WebAuthn{
 		Config: &webauthn.Config{
-			RPDisplayName:         setting.AppName,
-			RPID:                  setting.Domain,
-			RPOrigins:             []string{appURL},
-			AttestationPreference: protocol.PreferNoAttestation, // Gitea never verifies attestation
+			RPDisplayName: setting.AppName,
+			RPID:          setting.Domain,
+			RPOrigins:     []string{appURL},
+			AuthenticatorSelection: protocol.AuthenticatorSelection{
+				UserVerification: protocol.VerificationDiscouraged,
+			},
+			AttestationPreference: protocol.PreferDirectAttestation,
 		},
 	}
 }
@@ -39,7 +39,9 @@ type CommitMessage struct {

 	trailerValues CommitMessageTrailerValues

-	allAuthors []*CommitIdentity
+	allParticipants      []*CommitIdentity
+	committerCoAuthorIdx int
+	committerCoAuthor    *CommitIdentity
 }

 func (c *CommitMessage) MessageUTF8() string {
@@ -75,12 +77,8 @@ func (c *CommitMessage) MessageTrailer() CommitMessageTrailerValues {
 }

 var commitMessageTrailerSplit = sync.OnceValue(func() *regexp.Regexp {
-	// ref: https://git-scm.com/docs/git-interpret-trailers
-	// TODO: the regexp is not able to perfectly parse the all kinds of trailers
-	// It was just copied from legacy code, it is not exactly the same as how Git parses the trailer and not quite right in some cases.
-	// For the key characters: it follows RFC 822 field name syntax (or RFC 2822/RFC 5322): printable ASCII characters between 33 and 126 except the colon (:),
-	// but maybe we don't want to make it that complicated, so here we only support some common "symbol-like" characters.
-	return regexp.MustCompile(`(?s)^(?P<content>.*?)(?P<sep>^|^\n|^-{3,}\n+|\n+-{3,}\n+|\n{2,})(?P<trailer>(?:[A-Za-z0-9][-\w]*:[^\n]*(\n\s+[^\n]*)*\n?)*\n*)$`)
+	// the sep is either something like "\n---\n" or "\n\n" in the body, or at the start of the body like "---\n"
+	return regexp.MustCompile(`(?s)^(?P<content>.*?)(?P<sep>^|^\n|^-{3,}\n+|\n-{3,}\n+|\n\n)(?P<trailer>(?:[A-Za-z0-9][-A-Za-z0-9]*:[^\n]*\n?)*\n*)$`)
 })

 // CommitMessageSplitTrailer tries to split the message by the trailer separator
@@ -95,41 +93,6 @@ func CommitMessageSplitTrailer(s string) (content, sep, trailer string) {
 	return v[re.SubexpIndex("content")], v[re.SubexpIndex("sep")], v[re.SubexpIndex("trailer")]
 }

-// CommitMessageMerge merges two commit messages with their trailers
-func CommitMessageMerge(m1, m2 string) string {
-	c1, s1, t1 := CommitMessageSplitTrailer(m1)
-	c2, s2, t2 := CommitMessageSplitTrailer(m2)
-	c1, t1 = strings.TrimSpace(c1), strings.TrimSpace(t1)
-	c2, t2 = strings.TrimSpace(c2), strings.TrimSpace(t2)
-	out := strings.Builder{}
-	if c1 != "" && c2 != "" {
-		out.WriteString(c1)
-		out.WriteString("\n\n")
-		out.WriteString(c2)
-	} else if c1 != "" {
-		out.WriteString(c1)
-	} else if c2 != "" {
-		out.WriteString(c2)
-	}
-	if t1 != "" || t2 != "" {
-		sep := util.Iif(t1 == "", s2, s1)
-		sep = util.IfZero(sep, "\n\n")
-		if c1 != "" || c2 != "" {
-			out.WriteString(sep)
-		}
-		if t1 != "" {
-			out.WriteString(t1)
-		}
-		if t1 != "" && t2 != "" {
-			out.WriteString("\n")
-		}
-		if t2 != "" {
-			out.WriteString(t2)
-		}
-	}
-	return out.String()
-}
-
 func CommitMessageParseTrailer(s string) CommitMessageTrailerValues {
 	ret := CommitMessageTrailerValues{}
 	for line := range strings.SplitSeq(util.NormalizeStringEOL(s), "\n") {
@@ -144,50 +107,63 @@ func CommitMessageParseTrailer(s string) CommitMessageTrailerValues {
 	return ret
 }

-// AllAuthorIdentities returns all the author and co-authors in the commit. Committer is not included:
-// * Author & Co-author: they changed the code (attribution)
-// * Committer: they submitted the commit but didn't change the code (e.g.: maintainer signed a commit)
-func (c *Commit) AllAuthorIdentities() []*CommitIdentity {
-	if c.allAuthors != nil {
-		return c.allAuthors
-	}
-	trailerCoAuthors := c.MessageTrailer()["co-authored-by"]
-	c.allAuthors = make([]*CommitIdentity, 0, 1+len(trailerCoAuthors))
-	exclude := map[string]int{}
-	addAuthor := func(name, email string, role int) {
-		if name == "" && email == "" {
-			return
-		}
-		key := strings.ToLower(email)
-		if key == "" {
-			key = strings.ToLower(name)
-		}
-		if existingRole := exclude[key]; key != "" && existingRole != 0 {
-			return
-		}
-		c.allAuthors = append(c.allAuthors, &CommitIdentity{Name: name, Email: email, role: role})
-		exclude[key] = role
+// AllParticipantIdentities returns all the participants in the commit, the first one is the commit's author
+func (c *Commit) AllParticipantIdentities() []*CommitIdentity {
+	if c.allParticipants != nil {
+		return c.allParticipants
 	}

-	addAuthor(c.Author.Name, c.Author.Email, commitIdentityRoleAuthor)
-	for _, coAuthorValue := range trailerCoAuthors {
+	exclude := map[string]int{}
+	addParticipant := func(name, email string, role int) (existingRole int) {
+		if name == "" && email == "" {
+			return 0
+		}
+		emailLower := strings.ToLower(email)
+		if existingRole = exclude[emailLower]; emailLower != "" && existingRole != 0 {
+			return existingRole
+		}
+		c.allParticipants = append(c.allParticipants, &CommitIdentity{Name: name, Email: email, role: role})
+		exclude[emailLower] = role
+		return 0
+	}
+
+	c.committerCoAuthorIdx = -1
+	addParticipant(c.Author.Name, c.Author.Email, commitIdentityRoleAuthor)
+	addParticipant(c.Committer.Name, c.Committer.Email, commitIdentityRoleCommitter)
+	for _, coAuthorValue := range c.MessageTrailer()["co-authored-by"] {
 		addr, err := mail.ParseAddress(coAuthorValue)
 		coAuthorName, coAuthorEmail := coAuthorValue, ""
 		if err == nil {
 			coAuthorName, coAuthorEmail = addr.Name, addr.Address
 		}
-		addAuthor(coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor)
+		existingRole := addParticipant(coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor)
+		if existingRole == commitIdentityRoleCommitter && c.committerCoAuthorIdx == -1 {
+			c.committerCoAuthorIdx = len(c.allParticipants)
+			c.committerCoAuthor = &CommitIdentity{coAuthorName, coAuthorEmail, commitIdentityRoleCoAuthor}
+		}
 	}
-	return c.allAuthors
+	return c.allParticipants
 }

+// CoAuthorIdentities returns co-author identities defined by "Co-authored-by:" in the git message trailer
+// Only the commit's author is excluded. If committer is declared as co-author, it will be included in the result.
+// * Author & Co-author: they changed the code (attribution)
+// * Committer: they submitted the commit but didn't change the code (e.g.: maintainer signed a commit)
+// So, a committer can also be a co-author if they changed the code.
 func (c *Commit) CoAuthorIdentities() (coAuthors []*CommitIdentity) {
-	all := c.AllAuthorIdentities()
-	if len(all) == 0 {
-		return nil
+	all := c.AllParticipantIdentities()
+	if len(all) <= 1 {
+		return nil // no co-author list
 	}
-	if all[0].role == commitIdentityRoleAuthor {
-		return all[1:]
+	if all[1].role != commitIdentityRoleCommitter {
+		return all[1:] // no committer, so all after author are co-authors
 	}
-	return all
+	if c.committerCoAuthorIdx == -1 {
+		return all[2:] // the committer is not in the co-author list, so just return the co-author list
+	}
+	// the committer is in the co-author list but de-duplicated, so include them as co-author again
+	coAuthors = append(coAuthors, all[2:c.committerCoAuthorIdx]...)
+	coAuthors = append(coAuthors, c.committerCoAuthor)
+	coAuthors = append(coAuthors, all[c.committerCoAuthorIdx:]...)
+	return coAuthors
 }
@@ -26,12 +26,10 @@ func TestCommitMessageTrailer(t *testing.T) {
 		{"a", "a", "", ""},
 		{"a\n\nk", "a\n\nk", "", ""},
 		{"a\n\nk:v", "a", "\n\n", "k:v"},
-		{"a\n\nk:v\n  next-line", "a", "\n\n", "k:v\n  next-line"},
-		{"a\n\nk:v\n  next-line\nother: v", "a", "\n\n", "k:v\n  next-line\nother: v"},
 		{"a\n\nk:v\n\n", "a", "\n\n", "k:v\n\n"},
 		{"a\n--\nk:v", "a\n--\nk:v", "", ""},
-		{"a\n---\nk:v", "a", "\n---\n", "k:v"}, // TODO: should we support such case? No empty line between "---" and the trailer
-		{"a\n\n---\n\nk:v", "a", "\n\n---\n\n", "k:v"},
+		{"a\n---\nk:v", "a", "\n---\n", "k:v"},
+		{"a\n\n---\n\nk:v", "a\n", "\n---\n\n", "k:v"},

 		{"k: v", "", "", "k: v"},
 		{"\nk:v", "", "\n", "k:v"},
@@ -52,44 +50,41 @@ func TestCommitMessageTrailer(t *testing.T) {
 func TestCommitMessageParticipants(t *testing.T) {
 	sig := func(n, e string) *Signature { return &Signature{Name: n, Email: e} }
 	idt := func(n, e string, r int) *CommitIdentity { return &CommitIdentity{n, e, r} }
-	roleAuthor, _, roleCoAuthor := commitIdentityRoleAuthor, commitIdentityRoleCommitter, commitIdentityRoleCoAuthor
+	roleAuthor, roleCommitter, roleCoAuthor := commitIdentityRoleAuthor, commitIdentityRoleCommitter, commitIdentityRoleCoAuthor
 	type testCase struct {
 		name       string
 		commit     *Commit
 		identities []*CommitIdentity
 	}
-
-	t.Run("AllAuthors", func(t *testing.T) {
+	t.Run("AllParticipants", func(t *testing.T) {
 		cases := []testCase{
 			{
-				"CommitterExcluded",
+				"DifferentUsers",
 				&Commit{
 					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: Full Name <x@m.com>"},
+					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: x@m.com"},
 				},
-				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("Full Name", "x@m.com", roleCoAuthor)},
+				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("c", "c@m.com", roleCommitter), idt("", "x@m.com", roleCoAuthor)},
 			},
 			{
-				"AuthorIsCoAuthor",
+				"SameUser",
 				&Commit{
-					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: other-name <a@m.com>"},
+					Author: sig("a", "a@m.com"), Committer: sig("a", "A@M.com"),
+					CommitMessage: CommitMessage{MessageRaw: "CO-Authored-BY: a@m.com"},
 				},
 				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor)},
 			},
 			{
-				"EmptyAuthor", // synthesized commits (push feed) may have no author signature at all
+				"NoCommitter",
 				&Commit{
-					Author: sig("", ""), Committer: sig("", ""),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: c <c@m.com>"},
+					Author: sig("a", "a@m.com"), Committer: sig("", ""),
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: Full Name <X@M.com>"},
 				},
-				// but if the commit message contains co-authors, the co-authors are still parsed for "all authors"
-				// if it is a problem, the caller should fix the problem (provide correct "author")
-				[]*CommitIdentity{idt("c", "c@m.com", roleCoAuthor)},
+				[]*CommitIdentity{idt("a", "a@m.com", roleAuthor), idt("Full Name", "X@M.com", roleCoAuthor)},
 			},
 		}
 		for _, c := range cases {
-			assert.Equal(t, c.identities, c.commit.AllAuthorIdentities(), "case: %s", c.name)
+			assert.Equal(t, c.identities, c.commit.AllParticipantIdentities(), "case: %s", c.name)
 		}
 	})
 	t.Run("CoAuthors", func(t *testing.T) {
@@ -119,12 +114,12 @@ func TestCommitMessageParticipants(t *testing.T) {
 				[]*CommitIdentity{},
 			},
 			{
-				"CoAuthorNameOnlyAndDuplicate",
+				"CoAuthorCommitterNameWithIndex", // restore the committer co-author to the co-author list by the index with correct name
 				&Commit{
 					Author: sig("a", "a@m.com"), Committer: sig("c", "c@m.com"),
-					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: b\nCo-authored-by: b\nCo-authored-by: c"},
+					CommitMessage: CommitMessage{MessageRaw: "Co-authored-by: x <x@m.com>\nCo-authored-by: c-other <c@m.com>\nCo-authored-by: y <y@m.com>"},
 				},
-				[]*CommitIdentity{idt("b", "", roleCoAuthor), idt("c", "", roleCoAuthor)},
+				[]*CommitIdentity{idt("x", "x@m.com", roleCoAuthor), idt("c-other", "c@m.com", roleCoAuthor), idt("y", "y@m.com", roleCoAuthor)},
 			},
 		}
 		for _, c := range cases {
@@ -132,31 +127,3 @@ func TestCommitMessageParticipants(t *testing.T) {
 		}
 	})
 }
-
-func TestCommitMessageMerge(t *testing.T) {
-	cases := []struct {
-		m1, m2 string
-		out    string
-	}{
-		{"", "", ""},
-		{"msg1", "", "msg1"},
-		{"", "msg2", "msg2"},
-		{"msg1", "msg2", "msg1\n\nmsg2"},
-		{"k1: a", "", "k1: a"},
-		{"", "k2: b", "k2: b"},
-		{"k1: a", "k2: b", "k1: a\nk2: b"},
-		{"msg1", "k2: b", "msg1\n\nk2: b"},
-		{"k1: a", "msg2", "msg2\n\nk1: a"},
-		{"msg1\n\nk1: a", "msg2", "msg1\n\nmsg2\n\nk1: a"},
-		{"msg1\n----\nk1: a", "msg2", "msg1\n\nmsg2\n----\nk1: a"},
-		{"msg1\n\n----\n\nk1: a", "msg2", "msg1\n\nmsg2\n\n----\n\nk1: a"},
-		{"msg1", "msg2\n----\nk2: b", "msg1\n\nmsg2\n----\nk2: b"},
-		{"msg1", "msg2\n\nk2: b", "msg1\n\nmsg2\n\nk2: b"},
-		{"msg1\n\nk1: a", "msg2\n\nk2: b", "msg1\n\nmsg2\n\nk1: a\nk2: b"},
-	}
-
-	for i, c := range cases {
-		out := CommitMessageMerge(c.m1, c.m2)
-		assert.Equal(t, c.out, out, "idx=%d, m1=%q m2=%q", i, c.m1, c.m2)
-	}
-}
@@ -91,7 +91,7 @@ func syncGitConfig(ctx context.Context) (err error) {
 		}
 	}

-	// By default, partial clones are disabled, enable them from git v2.22
+	// By default partial clones are disabled, enable them from git v2.22
 	if !setting.Git.DisablePartialClone && DefaultFeatures().CheckVersionAtLeast("2.22") {
 		if err = configSet(ctx, "uploadpack.allowfilter", "true"); err != nil {
 			return err
@@ -114,23 +114,9 @@ func syncGitConfig(ctx context.Context) (err error) {
 		}
 	}

-	GlobalConfig = &GlobalConfigStruct{}
-	// HINT: GIT-DIFF-TREE-UI-CONFIG: Git's bug: git-diff-tree loads config with /* no "diff" UI options */ (since 20 years ago).
-	// https://github.com/git/git/blame/5d2e7709234afea1b6ddb25cd4f60d3d5fb3c200/builtin/diff-tree.c#L127
-	// Although document and manual say that "git-diff-tree" supports "diff.orderfile" option, but it is not actually supported.
-	// So we need to apply the diff.orderfile explicitly in our code.
-	GlobalConfig.DiffOrderFile, _ = configGet(ctx, "diff.orderfile")
 	return nil
 }

-func configGet(ctx context.Context, key string) (string, error) {
-	stdout, _, err := gitcmd.NewCommand("config", "--global", "--get").AddDynamicArguments(key).RunStdString(ctx)
-	if err != nil && !gitcmd.IsErrorExitCode(err, 1) {
-		return "", fmt.Errorf("failed to get git config %s, err: %w", key, err)
-	}
-	return strings.TrimRight(stdout, "\r\n"), nil
-}
-
 func configSet(ctx context.Context, key, value string) error {
 	stdout, _, err := gitcmd.NewCommand("config", "--global", "--get").
 		AddDynamicArguments(key).
@@ -36,14 +36,7 @@ type Features struct {
 	SupportGitMergeTree        bool           // >= 2.40 // we also need "--merge-base"
 }

-type GlobalConfigStruct struct {
-	DiffOrderFile string
-}
-
-var (
-	defaultFeatures *Features
-	GlobalConfig    *GlobalConfigStruct
-)
+var defaultFeatures *Features

 func (f *Features) CheckVersionAtLeast(atLeast string) bool {
 	return f.gitVersion.Compare(version.Must(version.NewVersion(atLeast))) >= 0
@@ -10,10 +10,10 @@ import (
 	"strconv"
 )

-// sha1Pattern can be used to determine if a string is an valid sha
+// sha1Pattern can be used to determine if a string is a valid sha
 var sha1Pattern = regexp.MustCompile(`^[0-9a-f]{4,40}$`)

-// sha256Pattern can be used to determine if a string is an valid sha
+// sha256Pattern can be used to determine if a string is a valid sha
 var sha256Pattern = regexp.MustCompile(`^[0-9a-f]{4,64}$`)

 type ObjectFormat interface {
@@ -1,15 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package git
-
-import "gitea.dev/modules/git/gitcmd"
-
-func HandleGitCmdHTTPRedirection(cmd *gitcmd.Command, targets ...string) {
-	// Protect from SSRF vector (e.g. migrating from an attacker URL).
-	// cmd.AddConfig("http.followRedirects", "false")
-	// However, we can't do so at the moment:
-	// this fails due to 301: git -c http.followRedirects=false clone -v https://gitlab.com/{owner}/{repo}
-	// this succeeds: git -c http.followRedirects=false clone -v https://gitlab.com/{owner}/{repo}.git
-	// FIXME: GIT-CLONE-HTTP-REDIRECT-SSRF: need a complete solution in the future
-}
@@ -121,7 +121,9 @@ func Clone(ctx context.Context, from, to string, opts CloneRepoOptions) error {
 	}

 	cmd := gitcmd.NewCommand().AddArguments("clone")
-	HandleGitCmdHTTPRedirection(cmd, from, to)
+	// Never follow HTTP redirects: no clone caller needs them, and a remote redirecting to an
+	// otherwise-blocked address would be an SSRF vector (e.g. migrating from an attacker URL).
+	cmd.AddArguments("-c", "http.followRedirects=false")
 	if opts.SkipTLSVerify {
 		cmd.AddArguments("-c", "http.sslVerify=false")
 	}
@@ -26,7 +26,6 @@ func TestRepoIsEmpty(t *testing.T) {
 // TestCloneRefusesRedirects ensures Clone never follows HTTP redirects, so a remote
 // cannot redirect to an otherwise-blocked address (SSRF, e.g. during migration).
 func TestCloneRefusesRedirects(t *testing.T) {
-	t.Skip("FIXME: GIT-CLONE-HTTP-REDIRECT-SSRF: need a complete solution in the future")
 	var targetHit atomic.Bool
 	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		targetHit.Store(true)
@@ -167,7 +167,7 @@ func validateOptions(field *api.IssueFormField, idx int) error {

 	options, ok := field.Attributes["options"].([]any)
 	if !ok || len(options) == 0 {
-		return position.Errorf("'options' is required and should be a array")
+		return position.Errorf("'options' is required and should be an array")
 	}

 	for optIdx, option := range options {
@@ -270,7 +270,7 @@ func validateDropdownDefault(position errorPosition, attributes map[string]any)
 	options, ok := attributes["options"].([]any)
 	if !ok {
 		// should not happen
-		return position.Errorf("'options' is required and should be a array")
+		return position.Errorf("'options' is required and should be an array")
 	}
 	if defaultValue < 0 || defaultValue >= len(options) {
 		return position.Errorf("the value of 'default' is out of range")
@@ -268,7 +268,7 @@ body:
    attributes:
      label: "a"
 `,
-			wantErr: "body[0](dropdown): 'options' is required and should be a array",
+			wantErr: "body[0](dropdown): 'options' is required and should be an array",
 		},
 		{
 			name: "dropdown invalid options",
@@ -249,7 +249,7 @@ func createRequest(ctx context.Context, method, url string, headers map[string]s
 }

 // performRequest sends a request, optionally performs a callback on the request and returns the response.
-// If the status code is in the 2xx range, the response is returned, and it will contain a non-nil Body.
+// If the status code is 200, the response is returned, and it will contain a non-nil Body.
 // Otherwise, it will return an error, and the Body will be nil or closed.
 func performRequest(ctx context.Context, client *http.Client, req *http.Request) (*http.Response, error) {
 	log.Trace("performRequest: %s", req.URL)
@@ -264,7 +264,7 @@ func performRequest(ctx context.Context, client *http.Client, req *http.Request)
 		return res, err
 	}

-	if res.StatusCode < 200 || res.StatusCode >= 300 {
+	if res.StatusCode != http.StatusOK {
 		defer res.Body.Close()
 		return res, handleErrorResponse(res)
 	}
@@ -135,15 +135,6 @@ func TestBasicTransferAdapter(t *testing.T) {
 		}
 	})

-	t.Run("Upload created", func(t *testing.T) {
-		client := &http.Client{Transport: RoundTripFunc(func(req *http.Request) *http.Response {
-			return &http.Response{StatusCode: http.StatusCreated, Body: io.NopCloser(strings.NewReader(""))}
-		})}
-		adapter := &BasicTransferAdapter{client: client}
-		err := adapter.Upload(t.Context(), &Link{Href: "https://upload-created-request.io"}, p, strings.NewReader("dummy"))
-		assert.NoError(t, err)
-	})
-
 	t.Run("Verify", func(t *testing.T) {
 		cases := []struct {
 			link          *Link
@@ -5,11 +5,11 @@ package external

 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"io"
 	"os"
 	"os/exec"
+	"runtime"
 	"strings"

 	"gitea.dev/modules/markup"
@@ -91,63 +91,52 @@ func (p *Renderer) GetExternalRendererOptions() (ret markup.ExternalRendererOpti
 	return ret
 }

-func (p *Renderer) prepareExternalCommand(vars map[string]string) (string, []string, error) {
-	fields, err := shellquote.Split(strings.TrimSpace(p.Command))
-	if err != nil {
-		return "", nil, err
+func envMark(envName string) string {
+	if runtime.GOOS == "windows" {
+		return "%" + envName + "%"
 	}
-	if len(fields) == 0 {
-		return "", nil, errors.New("no command")
-	}
-	var replacements []string
-	for k, v := range vars {
-		replacements = append(replacements, "$"+k, v)
-		replacements = append(replacements, "%"+k+"%", v) // for legacy Windows-style support
-	}
-	r := strings.NewReplacer(replacements...)
-	for i := range fields {
-		fields[i] = r.Replace(fields[i])
-	}
-	return fields[0], fields[1:], nil
+	return "$" + envName
 }

 // Render renders the data of the document to HTML via the external tool.
 func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
 	baseLinkSrc := ctx.RenderHelper.ResolveLink("", markup.LinkTypeDefault)
 	baseLinkRaw := ctx.RenderHelper.ResolveLink("", markup.LinkTypeRaw)
-	cmdVars := map[string]string{
-		"GITEA_PREFIX_SRC": baseLinkSrc,
-		"GITEA_PREFIX_RAW": baseLinkRaw,
-	}
-	cmdProg, cmdArgs, err := p.prepareExternalCommand(cmdVars)
-	if err != nil {
-		return fmt.Errorf("invalid external render (%s) command %q: %w", p.Name(), p.Command, err)
+	command := strings.NewReplacer(
+		envMark("GITEA_PREFIX_SRC"), baseLinkSrc,
+		envMark("GITEA_PREFIX_RAW"), baseLinkRaw,
+	).Replace(p.Command)
+	commands, err := shellquote.Split(command)
+	if err != nil || len(commands) == 0 {
+		return fmt.Errorf("%s invalid command %q: %w", p.Name(), p.Command, err)
 	}
+	args := commands[1:]
+
 	if p.IsInputFile {
 		// write to temp file
-		tmpFile, cleanup, err := setting.AppDataTempDir("git-repo-content").CreateTempFileRandom("gitea_input")
+		f, cleanup, err := setting.AppDataTempDir("git-repo-content").CreateTempFileRandom("gitea_input")
 		if err != nil {
 			return fmt.Errorf("%s create temp file when rendering %s failed: %w", p.Name(), p.Command, err)
 		}
 		defer cleanup()

-		_, err = io.Copy(tmpFile, input)
+		_, err = io.Copy(f, input)
 		if err != nil {
-			_ = tmpFile.Close()
+			_ = f.Close()
 			return fmt.Errorf("%s write data to temp file when rendering %s failed: %w", p.Name(), p.Command, err)
 		}

-		err = tmpFile.Close()
+		err = f.Close()
 		if err != nil {
 			return fmt.Errorf("%s close temp file when rendering %s failed: %w", p.Name(), p.Command, err)
 		}
-		cmdArgs = append(cmdArgs, tmpFile.Name())
+		args = append(args, f.Name())
 	}

-	processCtx, _, finished := process.GetManager().AddContext(ctx, fmt.Sprintf("Render [%s] for %s", cmdProg, baseLinkSrc))
+	processCtx, _, finished := process.GetManager().AddContext(ctx, fmt.Sprintf("Render [%s] for %s", commands[0], baseLinkSrc))
 	defer finished()

-	cmd := exec.CommandContext(processCtx, cmdProg, cmdArgs...)
+	cmd := exec.CommandContext(processCtx, commands[0], args...)
 	cmd.Env = append(
 		os.Environ(),
 		"GITEA_PREFIX_SRC="+baseLinkSrc,
@@ -162,7 +151,7 @@ func (p *Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.
 	process.SetSysProcAttribute(cmd)

 	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("%s render run command %s %v failed: %w\nStderr: %s", p.Name(), cmdProg, shellquote.Join(cmdArgs...), err, stderr.String())
+		return fmt.Errorf("%s render run command %s %v failed: %w\nStderr: %s", p.Name(), commands[0], args, err, stderr.String())
 	}
 	return nil
 }
@@ -1,24 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package external
-
-import (
-	"testing"
-
-	"gitea.dev/modules/setting"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestPrepareExternalCommand(t *testing.T) {
-	r := &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: ""}}
-	_, _, err := r.prepareExternalCommand(map[string]string{"KEY": "val"})
-	assert.ErrorContains(t, err, "no command")
-
-	r = &Renderer{MarkupRenderer: &setting.MarkupRenderer{Command: `"/foo bar/bin" --opt $KEY "$KEY" %KEY% other`}}
-	prog, args, err := r.prepareExternalCommand(map[string]string{"KEY": `a"b`})
-	assert.NoError(t, err)
-	assert.Equal(t, "/foo bar/bin", prog)
-	assert.Equal(t, []string{"--opt", `a"b`, `a"b`, `a"b`, "other"}, args)
-}
@@ -21,12 +21,19 @@ type frontendRenderer struct {
 	patterns []string
 }

-var _ markup.ExternalRenderer = (*frontendRenderer)(nil)
+var (
+	_ markup.PostProcessRenderer = (*frontendRenderer)(nil)
+	_ markup.ExternalRenderer    = (*frontendRenderer)(nil)
+)

 func (p *frontendRenderer) Name() string {
 	return p.name
 }

+func (p *frontendRenderer) NeedPostProcess() bool {
+	return false
+}
+
 func (p *frontendRenderer) FileNamePatterns() []string {
 	// TODO: the file extensions are ambiguous, even if the file name matches, it doesn't mean that the file is a 3D model
 	// There are some approaches to make it more accurate, but they are all complicated:
@@ -51,7 +51,7 @@ var globalVars = sync.OnceValue(func() *globalVarsType {
 	v := &globalVarsType{}
 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and lead to false positives.
+	// While fast, this is also incorrect and leads to false positives.
 	// TODO: fix invalid linking issue (update: stale TODO, what issues? maybe no TODO anymore)

 	// valid chars in encoded path and parameter: [-+~_%.a-zA-Z0-9/]
@@ -29,8 +29,9 @@ func init() {
 type renderer struct{}

 var (
-	_ markup.Renderer         = (*renderer)(nil)
-	_ markup.ExternalRenderer = (*renderer)(nil) // FIXME: this is not an external render, need to refactor the framework in the future
+	_ markup.Renderer            = (*renderer)(nil)
+	_ markup.PostProcessRenderer = (*renderer)(nil)
+	_ markup.ExternalRenderer    = (*renderer)(nil) // FIXME: this is not an external render, need to refactor the framework in the future
 )

 type mimeHandler struct {
@@ -95,6 +96,8 @@ func (renderer) Name() string {
 	return "jupyter-render"
 }

+func (renderer) NeedPostProcess() bool { return true }
+
 func (renderer) GetExternalRendererOptions() markup.ExternalRendererOptions {
 	return markup.ExternalRendererOptions{
 		// HINT: no need to let markup render sanitize the output because there are many special CSS class names, inline attributes.
@@ -212,7 +215,7 @@ func renderCellCode(output htmlutil.HTMLWriter, cell Cell, language string) erro

 		// Highlight code
 		lexer := highlight.DetectChromaLexerByFileName("", language)
-		output.WriteFormat(`<div class="cell-right cell-input"><pre><code class="chroma language-%s">`, strings.ToLower(lexer.Config().Name))
+		output.WriteFormat(`<div class="cell-right cell-input"><pre><code class="chroma language-%s">`, strings.ToLower(language))
 		output.WriteHTML(highlight.RenderCodeByLexer(lexer, source))
 		output.WriteHTML("</code></pre></div>")
 	}
@@ -261,7 +261,7 @@ func TestIntegrationAndSanitization(t *testing.T) {
 	maliciousNotebook := `{
 		"nbformat": 4,
 		"nbformat_minor": 2,
-		"metadata": {"language_info":{"name":"any lang"}},
+		"metadata": {},
 		"cells": [
 			{
 				"cell_type": "code",
@@ -274,7 +274,7 @@ func TestIntegrationAndSanitization(t *testing.T) {
 						"execution_count": 1,
 						"data": {
 							"text/html": [
-								"<div><script>foo</script><table class=other><tr><td>[[name=no-post-process|link=/link]]</td></tr></table></div>"
+								"<div><script>alert('XSS Vector')</script><table class=\"dataframe\"><tr><td>Safe Content</td></tr></table></div>"
 							]
 						},
 						"metadata": {}
@@ -295,8 +295,8 @@ func TestIntegrationAndSanitization(t *testing.T) {
 		<div class="cell-line">
 			<div class="cell-left cell-prompt">In [1]:</div>
 			<div class="cell-right cell-input">
-				<pre><code class="chroma language-fallback">
-					a=1
+				<pre><code class="chroma language-python">
+					<span class="n">a</span><span class="o">=</span><span class="mi">1</span>
 				</code></pre>
 			</div>
 		</div>
@@ -304,7 +304,7 @@ func TestIntegrationAndSanitization(t *testing.T) {
 			<div class="cell-left cell-prompt">Out [1]:</div>
 			<div class="cell-right cell-output">
 				<div class="cell-output-html">
-					<div><table><tr><td>[[name=no-post-process|link=/link]]</td></tr></table></div>
+					<div><table><tbody><tr><td>Safe Content</td></tr></tbody></table></div>
 				</div>
 			</div>
 		</div>
@@ -14,6 +14,7 @@ import (
 func TestMain(m *testing.M) {
 	setting.IsInTesting = true
 	markup.RenderBehaviorForTesting.DisableAdditionalAttributes = true
+	setting.Markdown.FileNamePatterns = []string{"*.md"}
 	markup.RefreshFileNamePatterns()
 	os.Exit(m.Run())
 }
@@ -70,15 +70,7 @@ func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error
 	w := &orgWriter{rctx: ctx, HTMLWriter: htmlWriter}
 	htmlWriter.ExtendingWriter = w

-	cfg := org.New()
-	cfg.ReadFile = func(path string) ([]byte, error) {
-		// actually the orgmode render doesn't support rendering the content from the content again,
-		// so just leave the plain text to end users
-		content := fmt.Sprintf("#+INCLUDE: [[%s]]", path)
-		return []byte(content), nil
-	}
-	doc := cfg.Silent().Parse(input, "")
-	res, err := doc.Write(w)
+	res, err := org.New().Silent().Parse(input, "").Write(w)
 	if err != nil {
 		return fmt.Errorf("orgmode.Render failed: %w", err)
 	}
@@ -21,74 +21,86 @@ func TestMain(m *testing.M) {
 	os.Exit(m.Run())
 }

-func testRender(t *testing.T, input, expected string) {
-	buffer, err := orgmode.RenderString(markup.NewTestRenderContext(), input)
-	assert.NoError(t, err)
-	assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
-}
-
 func TestRender_StandardLinks(t *testing.T) {
-	testRender(t, "[[https://google.com/]]",
+	test := func(input, expected string) {
+		buffer, err := orgmode.RenderString(markup.NewTestRenderContext(), input)
+		assert.NoError(t, err)
+		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
+	}
+
+	test("[[https://google.com/]]",
 		`<p><a href="https://google.com/">https://google.com/</a></p>`)
-	testRender(t, "[[ImageLink.svg][The Image Desc]]",
+	test("[[ImageLink.svg][The Image Desc]]",
 		`<p><a href="ImageLink.svg">The Image Desc</a></p>`)
 }

 func TestRender_InternalLinks(t *testing.T) {
-	testRender(t, "[[file:test.org][Test]]",
+	test := func(input, expected string) {
+		buffer, err := orgmode.RenderString(markup.NewTestRenderContext(), input)
+		assert.NoError(t, err)
+		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
+	}
+
+	test("[[file:test.org][Test]]",
 		`<p><a href="test.org">Test</a></p>`)
-	testRender(t, "[[./test.org][Test]]",
+	test("[[./test.org][Test]]",
 		`<p><a href="./test.org">Test</a></p>`)
-	testRender(t, "[[test.org][Test]]",
+	test("[[test.org][Test]]",
 		`<p><a href="test.org">Test</a></p>`)
-	testRender(t, "[[path/to/test.org][Test]]",
+	test("[[path/to/test.org][Test]]",
 		`<p><a href="path/to/test.org">Test</a></p>`)
 }

 func TestRender_Media(t *testing.T) {
-	testRender(t, "[[file:../../.images/src/02/train.jpg]]",
+	test := func(input, expected string) {
+		buffer, err := orgmode.RenderString(markup.NewTestRenderContext(), input)
+		assert.NoError(t, err)
+		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
+	}
+
+	test("[[file:../../.images/src/02/train.jpg]]",
 		`<p><img src="../../.images/src/02/train.jpg" alt="../../.images/src/02/train.jpg"></p>`)
-	testRender(t, "[[file:train.jpg]]",
+	test("[[file:train.jpg]]",
 		`<p><img src="train.jpg" alt="train.jpg"></p>`)

 	// With description.
-	testRender(t, "[[https://example.com][https://example.com/example.svg]]",
+	test("[[https://example.com][https://example.com/example.svg]]",
 		`<p><a href="https://example.com"><img src="https://example.com/example.svg" alt="https://example.com/example.svg"></a></p>`)
-	testRender(t, "[[https://example.com][pre https://example.com/example.svg post]]",
+	test("[[https://example.com][pre https://example.com/example.svg post]]",
 		`<p><a href="https://example.com">pre <img src="https://example.com/example.svg" alt="https://example.com/example.svg"> post</a></p>`)
-	testRender(t, "[[https://example.com][https://example.com/example.mp4]]",
+	test("[[https://example.com][https://example.com/example.mp4]]",
 		`<p><a href="https://example.com"><video src="https://example.com/example.mp4">https://example.com/example.mp4</video></a></p>`)
-	testRender(t, "[[https://example.com][pre https://example.com/example.mp4 post]]",
+	test("[[https://example.com][pre https://example.com/example.mp4 post]]",
 		`<p><a href="https://example.com">pre <video src="https://example.com/example.mp4">https://example.com/example.mp4</video> post</a></p>`)

 	// Without description.
-	testRender(t, "[[https://example.com/example.svg]]",
+	test("[[https://example.com/example.svg]]",
 		`<p><img src="https://example.com/example.svg" alt="https://example.com/example.svg"></p>`)
-	testRender(t, "[[https://example.com/example.mp4]]",
+	test("[[https://example.com/example.mp4]]",
 		`<p><video src="https://example.com/example.mp4">https://example.com/example.mp4</video></p>`)

 	// test [[LINK][DESCRIPTION]] syntax with "file:" prefix
-	testRender(t, `[[https://example.com/][file:https://example.com/foo%20bar.svg]]`,
+	test(`[[https://example.com/][file:https://example.com/foo%20bar.svg]]`,
 		`<p><a href="https://example.com/"><img src="https://example.com/foo%20bar.svg" alt="https://example.com/foo%20bar.svg"></a></p>`)
-	testRender(t, `[[file:https://example.com/foo%20bar.svg][Goto Image]]`,
+	test(`[[file:https://example.com/foo%20bar.svg][Goto Image]]`,
 		`<p><a href="https://example.com/foo%20bar.svg">Goto Image</a></p>`)
-	testRender(t, `[[file:https://example.com/link][https://example.com/image.jpg]]`,
+	test(`[[file:https://example.com/link][https://example.com/image.jpg]]`,
 		`<p><a href="https://example.com/link"><img src="https://example.com/image.jpg" alt="https://example.com/image.jpg"></a></p>`)
-	testRender(t, `[[file:https://example.com/link][file:https://example.com/image.jpg]]`,
+	test(`[[file:https://example.com/link][file:https://example.com/image.jpg]]`,
 		`<p><a href="https://example.com/link"><img src="https://example.com/image.jpg" alt="https://example.com/image.jpg"></a></p>`)
 }

 func TestRender_Source(t *testing.T) {
-	testRender(t, `#+begin_src c
+	test := func(input, expected string) {
+		buffer, err := orgmode.RenderString(markup.NewTestRenderContext(), input)
+		assert.NoError(t, err)
+		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
+	}
+
+	test(`#+begin_src c
 int a;
 #+end_src
 `, `<div class="src src-c">
 <pre><code class="chroma language-c"><span class="kt">int</span> <span class="n">a</span><span class="p">;</span></code></pre>
 </div>`)
 }
-
-func TestRender_IncludeLink(t *testing.T) {
-	testRender(t, `#+INCLUDE: "./other.org" src text`, `<div class="src src-text">
-<pre><code class="chroma language-plaintext">#+INCLUDE: [[other.org]]</code></pre>
-</div>`)
-}
@@ -54,7 +54,7 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 	// Allow 'color' and 'background-color' properties for the style attribute on text elements.
 	policy.AllowStyles("color", "background-color").OnElements("div", "span", "p", "tr", "th", "td")

-	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
+	policy.AllowAttrs("src", "autoplay", "controls", "muted", "loop", "playsinline").OnElements("video")

 	// Native support of "<picture><source media=... srcset=...><img src=...></picture>"
 	// ATTENTION: it only works with "auto" theme, because "media" query doesn't work with the theme chosen by end user manually.
@@ -153,9 +153,6 @@ func ParsePackage(r io.Reader) (*Package, error) {
 				return nil, err
 			}
 		} else if !strings.HasPrefix(filename, ".") {
-			if strings.ContainsAny(hd.Name, "\n\r") {
-				continue // a newline would forge extra lines in the pacman index
-			}
 			if err := files.Add(hd.Name); err != nil {
 				return nil, err
 			}
@@ -104,7 +104,6 @@ func TestParsePackage(t *testing.T) {
 				data := createPackage(c, map[string][]byte{
 					".PKGINFO":        createPKGINFOContent(packageName, packageVersion),
 					"/test/dummy.txt": {},
-					"usr/lib/legit\n\n%FILES%\n/etc/cron.d/x": {}, // must not reach the file list
 				})

 				p, err := ParsePackage(data)
@@ -123,26 +123,11 @@ func ParsePackage(sr io.ReaderAt, size int64, mr io.Reader) (*Package, error) {
 		},
 	}

-	// Nested packages (test fixtures, examples, benchmarks) ship their own manifests, which must not
-	// replace the package manifest. The package sits at the archive root or in a single top level
-	// directory, so keep only the shallowest manifest directory, breaking ties by name for stability.
-	var manifestFiles []*zip.File
-	manifestDir, manifestDepth := "", 0
 	for _, file := range zr.File {
-		if strings.HasSuffix(file.Name, "/") || !manifestPattern.MatchString(path.Base(file.Name)) {
+		manifestMatch := manifestPattern.FindStringSubmatch(path.Base(file.Name))
+		if len(manifestMatch) == 0 {
 			continue
 		}
-		dir, depth := path.Dir(file.Name), strings.Count(file.Name, "/")
-		switch {
-		case manifestFiles == nil || depth < manifestDepth || (depth == manifestDepth && dir < manifestDir):
-			manifestDir, manifestDepth, manifestFiles = dir, depth, []*zip.File{file}
-		case dir == manifestDir:
-			manifestFiles = append(manifestFiles, file)
-		}
-	}
-
-	for _, file := range manifestFiles {
-		manifestMatch := manifestPattern.FindStringSubmatch(path.Base(file.Name))

 		if file.UncompressedSize64 > maxManifestFileSize {
 			return nil, ErrManifestFileTooLarge
@@ -4,7 +4,6 @@
 package swift

 import (
-	"archive/zip"
 	"bytes"
 	"strings"
 	"testing"
@@ -25,18 +24,6 @@ const (
 	packageLicense       = "MIT"
 )

-// writeOrderedZipArchive writes name/content pairs in the given order, which map based test.WriteZipArchive cannot do
-func writeOrderedZipArchive(entries [][2]string) *bytes.Buffer {
-	buf := &bytes.Buffer{}
-	zw := zip.NewWriter(buf)
-	for _, entry := range entries {
-		w, _ := zw.Create(entry[0])
-		_, _ = w.Write([]byte(entry[1]))
-	}
-	_ = zw.Close()
-	return buf
-}
-
 func TestParsePackage(t *testing.T) {
 	t.Run("MissingManifestFile", func(t *testing.T) {
 		data := test.WriteZipArchive(map[string]string{"dummy.txt": ""})
@@ -78,77 +65,6 @@ func TestParsePackage(t *testing.T) {
 		assert.Equal(t, content2, m.Content)
 	})

-	t.Run("IgnoresNestedManifests", func(t *testing.T) {
-		rootManifest := "// swift-tools-version:5.7\n//\n//  Package.swift"
-		rootAltManifest := "// swift-tools-version:5.5\n//\n//  Package@swift-5.5.swift"
-		rootPatchAltManifest := "// swift-tools-version:5.7.1\n//\n//  Package@swift-5.7.1.swift"
-		nestedManifest := "// swift-tools-version:6.3\n//\n//  nested fixture package"
-
-		data := writeOrderedZipArchive([][2]string{
-			{"Package.swift", rootManifest},
-			{"Package@swift-5.5.swift", rootAltManifest},
-			{"Package@swift-5.7.1.swift", rootPatchAltManifest},
-			{"Benchmarks/Package.swift", nestedManifest},
-			{"Utils/Fixtures/PlainPackage/Package.swift", nestedManifest},
-		})
-
-		p, err := ParsePackage(bytes.NewReader(data.Bytes()), int64(data.Len()), nil)
-		assert.NotNil(t, p)
-		assert.NoError(t, err)
-
-		assert.Len(t, p.Metadata.Manifests, 3)
-		assert.Equal(t, rootManifest, p.Metadata.Manifests[""].Content)
-		assert.Equal(t, "5.7", p.Metadata.Manifests[""].ToolsVersion)
-		assert.Equal(t, rootAltManifest, p.Metadata.Manifests["5.5"].Content)
-		assert.Equal(t, rootPatchAltManifest, p.Metadata.Manifests["5.7.1"].Content)
-	})
-
-	t.Run("IgnoresNestedManifestsInPrefixedArchive", func(t *testing.T) {
-		rootManifest := "// swift-tools-version:5.7\n//\n//  Package.swift"
-
-		// `swift package archive-source` produces archives with a single top level directory
-		data := writeOrderedZipArchive([][2]string{
-			{"gitea-1.0.1/Package.swift", rootManifest},
-			{"gitea-1.0.1/Tests/Fixtures/Package.swift", "// swift-tools-version:6.3"},
-		})
-
-		p, err := ParsePackage(bytes.NewReader(data.Bytes()), int64(data.Len()), nil)
-		assert.NotNil(t, p)
-		assert.NoError(t, err)
-
-		assert.Len(t, p.Metadata.Manifests, 1)
-		assert.Equal(t, rootManifest, p.Metadata.Manifests[""].Content)
-	})
-
-	t.Run("AltManifestOnlyInRootDirectory", func(t *testing.T) {
-		// a deeper Package.swift belongs to a nested package and must not stand in for the missing root manifest
-		data := test.WriteZipArchive(map[string]string{
-			"Package@swift-5.5.swift": "// swift-tools-version:5.5",
-			"Sub/Package.swift":       "// swift-tools-version:5.7",
-		})
-
-		p, err := ParsePackage(bytes.NewReader(data.Bytes()), int64(data.Len()), nil)
-		assert.Nil(t, p)
-		assert.ErrorIs(t, err, ErrMissingManifestFile)
-	})
-
-	t.Run("ManifestDirectoryTieBreak", func(t *testing.T) {
-		contentA := "// swift-tools-version:5.7\n// A"
-		contentB := "// swift-tools-version:5.7\n// B"
-
-		// at equal depth the name decides, never the archive order
-		data := writeOrderedZipArchive([][2]string{
-			{"a/Package.swift", contentA},
-			{"b/Package.swift", contentB},
-		})
-
-		p, err := ParsePackage(bytes.NewReader(data.Bytes()), int64(data.Len()), nil)
-		assert.NotNil(t, p)
-		assert.NoError(t, err)
-		assert.Len(t, p.Metadata.Manifests, 1)
-		assert.Equal(t, contentA, p.Metadata.Manifests[""].Content)
-	})
-
 	t.Run("WithMetadata", func(t *testing.T) {
 		data := test.WriteZipArchive(map[string]string{
 			"Package.swift": "// swift-tools-version:5.7\n//\n//  Package.swift",
@@ -24,7 +24,7 @@ var (

 	// NOTE: All below regex matching do not perform any extra validation.
 	// Thus a link is produced even if the linked entity does not exist.
-	// While fast, this is also incorrect and lead to false positives.
+	// While fast, this is also incorrect and leads to false positives.
 	// TODO: fix invalid linking issue

 	// mentionPattern matches all mentions in the form of "@user" or "@org/team"
@@ -8,10 +8,4 @@ const (
 	KeyUname = "uname"

 	KeyUserHasTwoFactorAuth = "userHasTwoFactorAuth"
-
-	// KeySignInMethod records how the current session was authenticated so logout
-	// can decide whether RP-initiated OIDC logout is appropriate.
-	KeySignInMethod = "signInMethod"
-
-	SignInMethodOAuth2 = "oauth2"
 )
@@ -50,8 +50,7 @@ var Markdown = struct {
 	MathCodeBlockDetection []string
 	MathCodeBlockOptions   MarkdownMathCodeBlockOptions `ini:"-"`
 }{
-	EnableMath:       true,
-	FileNamePatterns: []string{"*.md"},
+	EnableMath: true,
 }

 // MarkupRenderer defines the external parser configured in ini
@@ -22,6 +22,7 @@ const (
 const (
 	RepoPRTitleSourceFirstCommit = "first-commit"
 	RepoPRTitleSourceAuto        = "auto"
+	RepoPRTitleSourceBranchName  = "branch-name"
 )

 // ItemsPerPage maximum items per page in forks, watchers and stars of a repo
@@ -304,10 +304,12 @@ func (a *AzureBlobStorage) ServeDirectURL(storePath, name, method string, reqPar

 // IterateObjects iterates across the objects in the azureblobstorage
 func (a *AzureBlobStorage) IterateObjects(dirName string, fn func(path string, obj Object) error) error {
-	basePrefix := buildObjectStorePathPrefix(a.cfg.BasePath, "")
-	dirPrefix := buildObjectStorePathPrefix(a.cfg.BasePath, dirName)
+	dirName = a.buildAzureBlobPath(dirName)
+	if dirName != "" {
+		dirName += "/"
+	}
 	pager := a.client.NewListBlobsFlatPager(a.cfg.Container, &container.ListBlobsFlatOptions{
-		Prefix: &dirPrefix,
+		Prefix: &dirName,
 	})
 	for pager.More() {
 		resp, err := pager.NextPage(a.ctx)
@@ -315,8 +317,7 @@ func (a *AzureBlobStorage) IterateObjects(dirName string, fn func(path string, o
 			return convertAzureBlobErr(err)
 		}
 		for _, object := range resp.Segment.BlobItems {
-			objPath := strings.TrimPrefix(*object.Name, basePrefix)
-			blobClient := a.getBlobClient(objPath)
+			blobClient := a.getBlobClient(*object.Name)
 			object := &azureBlobObject{
 				Context:    a.ctx,
 				blobClient: blobClient,
@@ -326,7 +327,7 @@ func (a *AzureBlobStorage) IterateObjects(dirName string, fn func(path string, o
 			}
 			if err := func(object *azureBlobObject, fn func(path string, obj Object) error) error {
 				defer object.Close()
-				return fn(objPath, object)
+				return fn(strings.TrimPrefix(object.Name, a.cfg.BasePath), object)
 			}(object, fn); err != nil {
 				return convertAzureBlobErr(err)
 			}
@@ -335,6 +336,7 @@ func (a *AzureBlobStorage) IterateObjects(dirName string, fn func(path string, o
 	return nil
 }

+// Delete delete a file
 func (a *AzureBlobStorage) getBlobClient(path string) *blob.Client {
 	return a.client.ServiceClient().NewContainerClient(a.cfg.Container).NewBlobClient(a.buildAzureBlobPath(path))
 }
@@ -27,16 +27,24 @@ func TestAzureBlobStorage(t *testing.T) {
 			Container:   "test",
 		},
 	}
-	t.Run("Iterator", func(t *testing.T) {
-		testStorageIterator(t, storageType, config)
-	})
-	t.Run("BlobStorageURLContentTypeAndDisposition", func(t *testing.T) {
-		testBlobStorageURLContentTypeAndDisposition(t, storageType, config)
-	})
-	t.Run("IteratorWithBasePath", func(t *testing.T) {
-		config.AzureBlobConfig.BasePath = "test-base-path"
-		testStorageIterator(t, storageType, config)
-	})
+	table := []struct {
+		name string
+		test func(t *testing.T, typStr Type, cfg *setting.Storage)
+	}{
+		{
+			name: "iterator",
+			test: testStorageIterator,
+		},
+		{
+			name: "testBlobStorageURLContentTypeAndDisposition",
+			test: testBlobStorageURLContentTypeAndDisposition,
+		},
+	}
+	for _, entry := range table {
+		t.Run(entry.name, func(t *testing.T) {
+			entry.test(t, storageType, config)
+		})
+	}
 }

 func TestAzureBlobStoragePath(t *testing.T) {
@@ -26,8 +26,6 @@ import (

 var _ ObjectStorage = &MinioStorage{}

-const unknownSizePartSize = 1024 * 1024 * 16 // same as minio-go's minPartSize
-
 type minioObject struct {
 	*minio.Object
 }
@@ -213,10 +211,6 @@ func (m *MinioStorage) Save(path string, r io.Reader, size int64) (int64, error)
 			// * https://www.backblaze.com/b2/docs/s3_compatible_api.html
 			// do not support "x-amz-checksum-algorithm" header, so use legacy MD5 checksum
 			SendContentMd5: m.cfg.ChecksumAlgorithm == "md5",
-
-			// with an unknown size (-1) minio-go assumes a 5TiB object and buffers a 528MiB part for it, even
-			// for a payload of a few KiB, so pin the part size there, a known size derives its own
-			PartSize: util.Iif[uint64](size < 0, unknownSizePartSize, 0),
 		},
 	)
 	if err != nil {
--- a/Show More
+++ b/Show More