mirror of https://github.com/go-gitea/gitea.git
Support actions and reusable workflows from private repos (#32562)
Resolve https://gitea.com/gitea/act_runner/issues/102 This PR allows administrators of a private repository to specify some collaborative owners. The repositories of collaborative owners will be allowed to access this repository's actions and workflows. Settings for private repos:  --- This PR also moves "Enable Actions" setting to `Actions > General` page <img width="960" alt="image" src="https://github.com/user-attachments/assets/49337ec2-afb1-4a67-8516-5c9ef0ce05d4" /> <img width="960" alt="image" src="https://github.com/user-attachments/assets/f58ee6d5-17f9-4180-8760-a78e859f1c37" /> --------- Signed-off-by: Zettat123 <zettat123@gmail.com> Co-authored-by: ChristopherHX <christopher.homberger@web.de>pull/35748/head
Zettat123
GitHub
parent
5454fdacd4
commit
c9beb0b01f
@ -0,0 +1,121 @@
|
||||
// Copyright 2025 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package setting
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
repo_model "code.gitea.io/gitea/models/repo"
|
||||
unit_model "code.gitea.io/gitea/models/unit"
|
||||
user_model "code.gitea.io/gitea/models/user"
|
||||
"code.gitea.io/gitea/modules/templates"
|
||||
"code.gitea.io/gitea/modules/util"
|
||||
"code.gitea.io/gitea/services/context"
|
||||
repo_service "code.gitea.io/gitea/services/repository"
|
||||
)
|
||||
|
||||
const tplRepoActionsGeneralSettings templates.TplName = "repo/settings/actions"
|
||||
|
||||
func ActionsGeneralSettings(ctx *context.Context) {
|
||||
ctx.Data["Title"] = ctx.Tr("actions.general")
|
||||
ctx.Data["PageType"] = "general"
|
||||
ctx.Data["PageIsActionsSettingsGeneral"] = true
|
||||
|
||||
actionsUnit, err := ctx.Repo.Repository.GetUnit(ctx, unit_model.TypeActions)
|
||||
if err != nil && !repo_model.IsErrUnitTypeNotExist(err) {
|
||||
ctx.ServerError("GetUnit", err)
|
||||
return
|
||||
}
|
||||
if actionsUnit == nil { // no actions unit
|
||||
ctx.HTML(http.StatusOK, tplRepoActionsGeneralSettings)
|
||||
return
|
||||
}
|
||||
|
||||
if ctx.Repo.Repository.IsPrivate {
|
||||
collaborativeOwnerIDs := actionsUnit.ActionsConfig().CollaborativeOwnerIDs
|
||||
collaborativeOwners, err := user_model.GetUsersByIDs(ctx, collaborativeOwnerIDs)
|
||||
if err != nil {
|
||||
ctx.ServerError("GetUsersByIDs", err)
|
||||
return
|
||||
}
|
||||
ctx.Data["CollaborativeOwners"] = collaborativeOwners
|
||||
}
|
||||
|
||||
ctx.HTML(http.StatusOK, tplRepoActionsGeneralSettings)
|
||||
}
|
||||
|
||||
func ActionsUnitPost(ctx *context.Context) {
|
||||
redirectURL := ctx.Repo.RepoLink + "/settings/actions/general"
|
||||
enableActionsUnit := ctx.FormBool("enable_actions")
|
||||
repo := ctx.Repo.Repository
|
||||
|
||||
var err error
|
||||
if enableActionsUnit && !unit_model.TypeActions.UnitGlobalDisabled() {
|
||||
err = repo_service.UpdateRepositoryUnits(ctx, repo, []repo_model.RepoUnit{newRepoUnit(repo, unit_model.TypeActions, nil)}, nil)
|
||||
} else if !unit_model.TypeActions.UnitGlobalDisabled() {
|
||||
err = repo_service.UpdateRepositoryUnits(ctx, repo, nil, []unit_model.Type{unit_model.TypeActions})
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
ctx.ServerError("UpdateRepositoryUnits", err)
|
||||
return
|
||||
}
|
||||
|
||||
ctx.Flash.Success(ctx.Tr("repo.settings.update_settings_success"))
|
||||
ctx.Redirect(redirectURL)
|
||||
}
|
||||
|
||||
func AddCollaborativeOwner(ctx *context.Context) {
|
||||
name := strings.ToLower(ctx.FormString("collaborative_owner"))
|
||||
|
||||
ownerID, err := user_model.GetUserOrOrgIDByName(ctx, name)
|
||||
if err != nil {
|
||||
if errors.Is(err, util.ErrNotExist) {
|
||||
ctx.Flash.Error(ctx.Tr("form.user_not_exist"))
|
||||
ctx.JSONErrorNotFound()
|
||||
} else {
|
||||
ctx.ServerError("GetUserOrOrgIDByName", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
actionsUnit, err := ctx.Repo.Repository.GetUnit(ctx, unit_model.TypeActions)
|
||||
if err != nil {
|
||||
ctx.ServerError("GetUnit", err)
|
||||
return
|
||||
}
|
||||
actionsCfg := actionsUnit.ActionsConfig()
|
||||
actionsCfg.AddCollaborativeOwner(ownerID)
|
||||
if err := repo_model.UpdateRepoUnit(ctx, actionsUnit); err != nil {
|
||||
ctx.ServerError("UpdateRepoUnit", err)
|
||||
return
|
||||
}
|
||||
|
||||
ctx.JSONOK()
|
||||
}
|
||||
|
||||
func DeleteCollaborativeOwner(ctx *context.Context) {
|
||||
ownerID := ctx.FormInt64("id")
|
||||
|
||||
actionsUnit, err := ctx.Repo.Repository.GetUnit(ctx, unit_model.TypeActions)
|
||||
if err != nil {
|
||||
ctx.ServerError("GetUnit", err)
|
||||
return
|
||||
}
|
||||
actionsCfg := actionsUnit.ActionsConfig()
|
||||
if !actionsCfg.IsCollaborativeOwner(ownerID) {
|
||||
ctx.Flash.Error(ctx.Tr("actions.general.collaborative_owner_not_exist"))
|
||||
ctx.JSONErrorNotFound()
|
||||
return
|
||||
}
|
||||
actionsCfg.RemoveCollaborativeOwner(ownerID)
|
||||
if err := repo_model.UpdateRepoUnit(ctx, actionsUnit); err != nil {
|
||||
ctx.ServerError("UpdateRepoUnit", err)
|
||||
return
|
||||
}
|
||||
|
||||
ctx.JSONOK()
|
||||
}
|
||||
@ -0,0 +1,69 @@
|
||||
<div class="repo-setting-content">
|
||||
<h4 class="ui top attached header">
|
||||
{{ctx.Locale.Tr "actions.general.enable_actions"}}
|
||||
</h4>
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form" action="{{.Link}}/actions_unit" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
{{$isActionsEnabled := .Repository.UnitEnabled ctx ctx.Consts.RepoUnitTypeActions}}
|
||||
{{$isActionsGlobalDisabled := ctx.Consts.RepoUnitTypeActions.UnitGlobalDisabled}}
|
||||
<div class="inline field">
|
||||
<label>{{ctx.Locale.Tr "actions.actions"}}</label>
|
||||
<div class="ui checkbox{{if $isActionsGlobalDisabled}} disabled{{end}}"{{if $isActionsGlobalDisabled}} data-tooltip-content="{{ctx.Locale.Tr "repo.unit_disabled"}}"{{end}}>
|
||||
<input class="enable-system" name="enable_actions" type="checkbox" {{if $isActionsGlobalDisabled}}disabled{{end}} {{if $isActionsEnabled}}checked{{end}}>
|
||||
<label>{{ctx.Locale.Tr "repo.settings.actions_desc"}}</label>
|
||||
</div>
|
||||
</div>
|
||||
{{if not $isActionsGlobalDisabled}}
|
||||
<div class="divider"></div>
|
||||
<div class="field">
|
||||
<button class="ui primary button">{{ctx.Locale.Tr "repo.settings.update_settings"}}</button>
|
||||
</div>
|
||||
{{end}}
|
||||
</form>
|
||||
</div>
|
||||
|
||||
{{if and .EnableActions (.Permission.CanRead ctx.Consts.RepoUnitTypeActions)}}
|
||||
{{if .Repository.IsPrivate}}
|
||||
<h4 class="ui top attached header">
|
||||
{{ctx.Locale.Tr "actions.general.collaborative_owners_management"}}
|
||||
</h4>
|
||||
{{if len .CollaborativeOwners}}
|
||||
<div class="ui attached segment">
|
||||
<div class="flex-list">
|
||||
{{range .CollaborativeOwners}}
|
||||
<div class="flex-item tw-items-center">
|
||||
<div class="flex-item-leading">
|
||||
<a href="{{.HomeLink}}">{{ctx.AvatarUtils.Avatar . 32}}</a>
|
||||
</div>
|
||||
<div class="flex-item-main">
|
||||
<div class="flex-item-title">
|
||||
{{template "shared/user/name" .}}
|
||||
</div>
|
||||
</div>
|
||||
<div class="flex-item-trailing">
|
||||
<button class="ui red tiny button inline link-action"
|
||||
data-url="{{$.Link}}/collaborative_owner/delete?id={{.ID}}"
|
||||
data-modal-confirm-header="{{ctx.Locale.Tr "actions.general.remove_collaborative_owner"}}"
|
||||
data-modal-confirm-content="{{ctx.Locale.Tr "actions.general.remove_collaborative_owner_desc"}}"
|
||||
>{{ctx.Locale.Tr "remove"}}</button>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
<div class="ui bottom attached segment">
|
||||
<form class="ui form form-fetch-action" action="{{.Link}}/collaborative_owner/add" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
<div id="search-user-box" class="ui search input tw-align-middle" data-include-orgs="true">
|
||||
<input class="prompt" name="collaborative_owner" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" autofocus required>
|
||||
</div>
|
||||
<button class="ui primary button">{{ctx.Locale.Tr "actions.general.add_collaborative_owner"}}</button>
|
||||
</form>
|
||||
<br>
|
||||
{{ctx.Locale.Tr "actions.general.collaborative_owners_management_help"}}
|
||||
</div>
|
||||
{{end}}
|
||||
{{end}}
|
||||
</div>
|
||||
@ -0,0 +1,62 @@
|
||||
// Copyright 2025 The Gitea Authors. All rights reserved.
|
||||
// SPDX-License-Identifier: MIT
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
actions_model "code.gitea.io/gitea/models/actions"
|
||||
auth_model "code.gitea.io/gitea/models/auth"
|
||||
"code.gitea.io/gitea/models/unittest"
|
||||
user_model "code.gitea.io/gitea/models/user"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
func TestActionsCollaborativeOwner(t *testing.T) {
|
||||
onGiteaRun(t, func(t *testing.T, u *url.URL) {
|
||||
// user2 is the owner of "reusable_workflow" repo
|
||||
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
||||
user2Session := loginUser(t, user2.Name)
|
||||
user2Token := getTokenForLoggedInUser(t, user2Session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
|
||||
repo := createActionsTestRepo(t, user2Token, "reusable_workflow", true)
|
||||
|
||||
// a private repo(id=6) of user10 will try to clone "reusable_workflow" repo
|
||||
user10 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 10})
|
||||
// task id is 55 and its repo_id=6
|
||||
task := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: 55, RepoID: 6})
|
||||
taskToken := "674f727a81ed2f195bccab036cccf86a182199eb"
|
||||
tokenHash := auth_model.HashToken(taskToken, task.TokenSalt)
|
||||
assert.Equal(t, task.TokenHash, tokenHash)
|
||||
|
||||
dstPath := t.TempDir()
|
||||
u.Path = fmt.Sprintf("%s/%s.git", repo.Owner.UserName, repo.Name)
|
||||
u.User = url.UserPassword("gitea-actions", taskToken)
|
||||
|
||||
// the git clone will fail
|
||||
doGitCloneFail(u)(t)
|
||||
|
||||
// add user10 to the list of collaborative owners
|
||||
req := NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/settings/actions/general/collaborative_owner/add", repo.Owner.UserName, repo.Name), map[string]string{
|
||||
"_csrf": GetUserCSRFToken(t, user2Session),
|
||||
"collaborative_owner": user10.Name,
|
||||
})
|
||||
user2Session.MakeRequest(t, req, http.StatusOK)
|
||||
|
||||
// the git clone will be successful
|
||||
doGitClone(dstPath, u)(t)
|
||||
|
||||
// remove user10 from the list of collaborative owners
|
||||
req = NewRequestWithValues(t, "POST", fmt.Sprintf("/%s/%s/settings/actions/general/collaborative_owner/delete?id=%d", repo.Owner.UserName, repo.Name, user10.ID), map[string]string{
|
||||
"_csrf": GetUserCSRFToken(t, user2Session),
|
||||
})
|
||||
user2Session.MakeRequest(t, req, http.StatusOK)
|
||||
|
||||
// the git clone will fail
|
||||
doGitCloneFail(u)(t)
|
||||
})
|
||||
}
|
||||
Loading…
Reference in New Issue