From e0800133dc1c2cf90cef08e5bcf7e64a4b71c443 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Mon, 6 Mar 2023 15:14:00 +0800
Subject: [PATCH 01/53] Update hacking-on-gitea-zh_cn documentation (#23315)

This PR fix outdated hacking-on-gitea-zh_cn documentation.

---------

Co-authored-by: Jason Song <i@wolfogre.com>
---
 .../doc/developers/hacking-on-gitea.zh-cn.md  | 334 +++++++++++++++++-
 1 file changed, 320 insertions(+), 14 deletions(-)

diff --git a/docs/content/doc/developers/hacking-on-gitea.zh-cn.md b/docs/content/doc/developers/hacking-on-gitea.zh-cn.md
index 3e8cd3ec573a7..9c9141bf50cd4 100644
--- a/docs/content/doc/developers/hacking-on-gitea.zh-cn.md
+++ b/docs/content/doc/developers/hacking-on-gitea.zh-cn.md
@@ -1,6 +1,6 @@
 ---
 date: "2016-12-01T16:00:00+02:00"
-title: "加入 Gitea 开源"
+title: "玩转 Gitea"
 slug: "hacking-on-gitea"
 weight: 10
 toc: false
@@ -8,36 +8,342 @@ draft: false
 menu:
   sidebar:
     parent: "developers"
-    name: "加入 Gitea 开源"
+    name: "玩转 Gitea"
     weight: 10
     identifier: "hacking-on-gitea"
 ---
 
 # Hacking on Gitea
 
-首先你需要一些运行环境，这和 [从源代码安装]({{< relref "doc/installation/from-source.zh-cn.md" >}}) 相同，如果你还没有设置好，可以先阅读那个章节。
+**目录**
 
-如果你想为 Gitea 贡献代码，你需要 Fork 这个项目并且以 `master` 为开发分支。Gitea 使用 Govendor
-来管理依赖，因此所有依赖项都被工具自动 copy 在 vendor 子目录下。用下面的命令来下载源码：
+{{< toc >}}
 
-```
-go get -d code.gitea.io/gitea
-```
+## 快速入门
+
+要获得快速工作的开发环境，您可以使用 Gitpod。
+
+[![在 Gitpod 中打开](/open-in-gitpod.svg)](https://gitpod.io/#https://github.com/go-gitea/gitea)
+
+## 安装 Golang
+
+您需要 [安装 go]( https://golang.org/doc/install ) 并设置您的 go 环境。
+
+接下来，[使用 npm 安装 Node.js](https://nodejs.org/en/download/) ，这是构建
+JavaScript 和 CSS 文件的必要工具。最低支持的 Node.js 版本是 {{< min-node-version >}}
+并且推荐使用最新的 LTS 版本。
+
+**注意** ：当执行需要外部工具的 make 任务时，比如
+`make watch-backend`，Gitea 会自动下载并构建这些必要的组件。为了能够使用这些，你必须
+将 `"$GOPATH"/bin` 目录加入到可执行路径上。如果你不把go bin目录添加到可执行路径你必须手动
+指定可执行程序路径。
 
-然后你可以在 Github 上 fork [Gitea 项目](https://github.com/go-gitea/gitea)，之后可以通过下面的命令进入源码目录：
+**注意2** ：Go版本 {{< min-go-version >}} 或更高版本是必须的。Gitea 使用 `gofmt` 来
+格式化源代码。然而，`gofmt` 的结果可能因 `go` 的版本而有差异。因此推荐安装我们持续集成使用
+的 Go版本。截至上次更新，Go 版本应该是 {{< go-version >}}。
 
+## 安装 Make
+
+Gitea 大量使用 `Make` 来自动化任务和改进开发。本指南涵盖了如何安装 Make。
+
+### 在 Linux 上
+
+使用包管理器安装。
+
+在 Ubuntu/Debian 上：
+
+```bash
+sudo apt-get install make
 ```
-cd $GOPATH/src/code.gitea.io/gitea
+
+在 Fedora/RHEL/CentOS 上：
+
+```bash
+sudo yum install make
 ```
 
-要创建 pull requests 你还需要在源码中新增一个 remote 指向你 Fork 的地址，直接推送到 origin 的话会告诉你没有写权限：
+### 在 Windows 上
+
+Make 的这三个发行版都可以在 Windows 上运行：
 
+- [单个二进制构建]( http://www.equation.com/servlet/equation.cmd?fa=make )。复制到某处并添加到 `PATH`。
+  - [32 位版本](http://www.equation.com/ftpdir/make/32/make.exe)
+  - [64 位版本](http://www.equation.com/ftpdir/make/64/make.exe)
+- [MinGW-w64](https://www.mingw-w64.org) / [MSYS2](https://www.msys2.org/)。
+  - MSYS2 是一个工具和库的集合，为您提供一个易于使用的环境来构建、安装和运行本机 Windows 软件，它包括 MinGW-w64。
+  - 在 MingGW-w64 中，二进制文件称为 `mingw32-make.exe` 而不是 `make.exe`。将 `bin` 文件夹添加到 `PATH`。
+  - 在 MSYS2 中，您可以直接使用 `make`。请参阅 [MSYS2 移植](https://www.msys2.org/wiki/Porting/)。
+  - 要使用 CGO_ENABLED（例如：SQLite3）编译 Gitea，您可能需要使用 [tdm-gcc](https://jmeubank.github.io/tdm-gcc/) 而不是 MSYS2 gcc，因为 MSYS2 gcc 标头缺少一些 Windows -只有 CRT 函数像 _beginthread 一样。
+- [Chocolatey包管理器]( https://chocolatey.org/packages/make )。运行`choco install make`
+
+**注意** ：如果您尝试在 Windows 命令提示符下使用 make 进行构建，您可能会遇到问题。建议使用上述提示（Git bash 或 MinGW），但是如果您只有命令提示符（或可能是 PowerShell），则可以使用 [set](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/set_1) 命令，例如 `set TAGS=bindata`。
+
+## 下载并克隆 Gitea 源代码
+
+获取源代码的推荐方法是使用 `git clone`。
+
+```bash
+git clone https://github.com/go-gitea/gitea
 ```
+
+（自从go modules出现后，不再需要构建 go 项目从 `$GOPATH` 中获取，因此不再推荐使用 `go get` 方法。）
+
+## 派生 Gitea
+
+如上所述下载主要的 Gitea 源代码。然后，派生 [Gitea 仓库](https://github.com/go-gitea/gitea)，
+并为您的本地仓库切换 git 远程源，或添加另一个远程源：
+
+```bash
+# 将原来的 Gitea origin 重命名为 upstream
 git remote rename origin upstream
-git remote add origin git@github.com:<USERNAME>/gitea.git
+git remote add origin "git@github.com:$GITHUB_USERNAME/gitea.git"
 git fetch --all --prune
 ```
 
-然后你就可以开始开发了。你可以看一下 `Makefile` 的内容。`make test` 可以运行测试程序， `make build` 将生成一个 `gitea` 可运行文件在根目录。如果你的提交比较复杂，尽量多写一些单元测试代码。
+或者：
+
+```bash
+# 为我们的 fork 添加新的远程
+git remote add "$FORK_NAME" "git@github.com:$GITHUB_USERNAME/gitea.git"
+git fetch --all --prune
+```
+
+为了能够创建合并请求，应将分叉存储库添加为 Gitea 本地仓库的远程，否则无法推送更改。
+
+## 构建 Gitea（基本）
+
+看看我们的
+<a href='{{ < relref "doc/installation/from-source.en-us.md" > }}'>说明</a>
+关于如何 <a href='{{ < relref "doc/installation/from-source.en-us.md" > }}'>从源代码构建</a> 。
+
+从源代码构建的最简单推荐方法是：
+
+```bash
+TAGS="bindata sqlite sqlite_unlock_notify" make build
+```
+
+`build` 目标将同时执行 `frontend` 和 `backend` 子目标。如果存在 `bindata` 标签，资源文件将被编译成二进制文件。建议在进行前端开发时省略 `bindata` 标签，以便实时反映更改。
+
+有关所有可用的 `make` 目标，请参阅 `make help`。另请参阅 [`.drone.yml`](https://github.com/go-gitea/gitea/blob/main/.drone.yml) 以了解我们的持续集成是如何工作的。
+
+## 持续构建
+
+要在源文件更改时运行并持续构建：
+
+```bash
+# 对于前端和后端
+make watch
+
+# 或者：只看前端文件（html/js/css）
+make watch-frontend
+
+# 或者：只看后端文件 (go)
+make watch-backend
+```
+
+在 macOS 上，监视所有后端源文件可能会达到默认的打开文件限制，这可以通过当前 shell 的 `ulimit -n 12288` 或所有未来 shell 的 shell 启动文件来增加。
+
+### 格式化、代码分析和拼写检查
+
+我们的持续集成将拒绝未通过代码检查（包括格式检查、代码分析和拼写检查）的 PR。
+
+你应该格式化你的代码：
+
+```bash
+make fmt
+```
+
+并检查源代码：
+
+```bash
+# lint 前端和后端代码
+make lint
+# 仅 lint 后端代码
+make lint-backend
+```
+
+**注意** ：`gofmt` 的结果取决于 `go` 的版本。您应该运行与持续集成相同的 go 版本。
+
+### 处理 JS 和 CSS
+
+前端开发应遵循 [Guidelines for Frontend Development]({{ < 相关参考 "doc/developers/guidelines-frontend.en-us.md" > }})
+
+要使用前端资源构建，请使用上面提到的“watch-frontend”目标或只构建一次：
+
+```bash
+make build && ./gitea
+```
+
+在提交之前，确保 linters 通过：
+
+```bash
+make lint-frontend
+```
+
+### 配置本地 ElasticSearch 实例
+
+使用 docker 启动本地 ElasticSearch 实例：
+
+```sh
+mkdir -p $(pwd) /data/elasticsearch
+sudo chown -R 1000:1000 $(pwd) /data/elasticsearch
+docker run --rm --memory= "4g" -p 127.0.0.1:9200:9200 -p 127.0.0.1:9300:9300 -e "discovery.type=single-node" -v "$(pwd)/data /elasticsearch:/usr/share/elasticsearch/data" docker.elastic.co/elasticsearch/elasticsearch:7.16.3
+```
+
+配置`app.ini`：
+
+```ini
+[indexer]
+ISSUE_INDEXER_TYPE = elasticsearch
+ISSUE_INDEXER_CONN_STR = http://elastic:changeme@localhost:9200
+REPO_INDEXER_ENABLED = true
+REPO_INDEXER_TYPE = elasticsearch
+REPO_INDEXER_CONN_STR = http://elastic:changeme@localhost:9200
+```
+
+### 构建和添加 SVGs
+
+SVG 图标是使用 `make svg` 目标构建的，该目标将 `build/generate-svg.js` 中定义的图标源编译到输出目录 `public/img/svg` 中。可以在 `web_src/svg` 目录中添加自定义图标。
+
+### 构建 Logo
+
+Gitea Logo的 PNG 和 SVG 版本是使用 `TAGS="gitea" make generate-images` 目标从单个 SVG 源文件 assets/logo.svg 构建的。要运行它，Node.js 和 npm 必须可用。
+
+通过更新 `assets/logo.svg` 并运行 `make generate-images`，同样的过程也可用于从 SVG 源文件生成自定义 Logo PNG。忽略 gitea 编译选项将仅更新用户指定的 LOGO 文件。
+
+### 更新 API
+
+创建新的 API 路由或修改现有的 API 路由时，您**必须**
+更新和/或创建 [Swagger](https://swagger.io/docs/specification/2-0/what-is-swagger/)
+这些使用 [go-swagger](https://goswagger.io/) 评论的文档。
+[规范]( https://goswagger.io/use/spec.html#annotation-syntax )中描述了这些注释的结构。
+如果您想了解更多有关 Swagger 结构的信息，可以查看
+[Swagger 2.0 文档](https://swagger.io/docs/specification/2-0/basic-structure/)
+或与添加新 API 端点的先前 PR 进行比较，例如 [PR #5483](https://github.com/go-gitea/gitea/pull/5843/files#diff-2e0a7b644cf31e1c8ef7d76b444fe3aaR20)
+
+您应该注意不要破坏下游用户依赖的 API。在稳定的 API 上，一般来说添加是可以接受的，但删除
+或对 API 进行根本性更改将会被拒绝。
+
+创建或更改 API 端点后，请用以下命令重新生成 Swagger 文档：
+
+```bash
+make generate-swagger
+```
+
+您应该验证生成的 Swagger 文件并使用以下命令对其进行拼写检查：
+
+```bash
+make swagger-validate misspell-check
+```
+
+您应该提交更改后的 swagger JSON 文件。持续集成服务器将使用以下方法检查是否已完成：
+
+```bash
+make swagger-check
+```
+
+**注意** ：请注意，您应该使用 Swagger 2.0 文档，而不是 OpenAPI 3 文档。
+
+### 创建新的配置选项
+
+创建新的配置选项时，将它们添加到 `modules/setting` 的对应文件。您应该将信息添加到 `custom/conf/app.ini`
+并到 <a href = '{{ < relref "doc/advanced/config-cheat-sheet.en-us.md" > }}'>配置备忘单</a>
+在 `docs/content/doc/advanced/config-cheat-sheet.en-us.md` 中找到
+
+### 更改Logo
+
+更改 Gitea Logo SVG 时，您将需要运行并提交结果的：
+
+```bash
+make generate-images
+```
+
+这将创建必要的 Gitea 图标和其他图标。
+
+### 数据库迁移
+
+如果您对数据库中的任何数据库持久结构进行重大更改
+`models/` 目录，您将需要进行新的迁移。可以找到这些
+在 `models/migrations/` 中。您可以确保您的迁移适用于主要
+数据库类型使用：
+
+```bash
+make test-sqlite-migration # 将 SQLite 切换为适当的数据库
+```
+
+## 测试
+
+Gitea 运行两种类型的测试：单元测试和集成测试。
+
+### 单元测试
+
+`go test` 系统中的`*_test.go` 涵盖了单元测试。
+您可以设置环境变量 `GITEA_UNIT_TESTS_LOG_SQL=1` 以在详细模式下运行测试时显示所有 SQL 语句（即设置`GOTESTFLAGS=-v` 时）。
+
+```bash
+TAGS="bindata sqlite sqlite_unlock_notify" make test # Runs the unit tests
+```
+
+### 集成测试
+
+单元测试不会也不能完全单独测试 Gitea。因此，我们编写了集成测试；但是，这些依赖于数据库。
+
+```bash
+TAGS="bindata sqlite sqlite_unlock_notify" make build test-sqlite
+```
+
+将在 SQLite 环境中运行集成测试。集成测试需要安装 `git lfs`。其他数据库测试可用，但
+可能需要适应当地环境。
+
+看看 [`tests/integration/README.md`](https://github.com/go-gitea/gitea/blob/main/tests/integration/README.md) 有关更多信息以及如何运行单个测试。
+
+### 测试 PR
+
+我们的持续集成将测试代码是否通过了单元测试，并且所有支持的数据库都将在 Docker 环境中通过集成测试。
+还将测试从几个最新版本的 Gitea 迁移。
+
+请在PR中附带提交适当的单元测试和集成测试。
+
+## 网站文档
+
+该网站的文档位于 `docs/` 中。如果你改变了文档内容，你可以使用以下测试方法进行持续集成：
+
+```bash
+# 来自 Gitea 中的 docs 目录
+make trans-copy clean build
+```
+
+运行此任务依赖于 [Hugo](https://gohugo.io/)。请注意：这可能会生成一些未跟踪的 Git 对象，
+需要被清理干净。
+
+## Visual Studio Code
+
+`contrib/ide/vscode` 中为 Visual Studio Code 提供了 `launch.json` 和 `tasks.json`。查看
+[`contrib/ide/README.md`](https://github.com/go-gitea/gitea/blob/main/contrib/ide/README.md) 了解更多信息。
+
+## Goland
+
+单击 `/main.go` 中函数 `func main()` 上的 `Run Application` 箭头
+可以快速启动一个可调试的 Gitea 实例。
+
+`Run/Debug Configuration` 中的 `Output Directory` 必须设置为
+gitea 项目目录（包含 `main.go` 和 `go.mod`），
+否则，启动实例的工作目录是 GoLand 的临时目录
+并防止 Gitea 在开发环境中加载动态资源（例如：模板）。
+
+要在 GoLand 中使用 SQLite 运行单元测试，请设置 `-tags sqlite,sqlite_unlock_notify`
+在 `运行/调试配置` 的 `Go 工具参数` 中。
+
+## 提交 PR
+
+对更改感到满意后，将它们推送并打开拉取请求。它建议您允许 Gitea Managers 和 Owners 修改您的 PR
+分支，因为我们需要在合并之前将其更新为 main 和/或可能是能够直接帮助解决问题。
+
+任何 PR 都需要 Gitea 维护者的两次批准，并且需要通过持续集成。看看我们的
+[CONTRIBUTING.md](https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md)
+文档。
+
+如果您需要更多帮助，请访问 [Discord](https://discord.gg/gitea) #Develop 频道
+并在那里聊天。
 
-好了，到这里你已经设置好了所有的开发 Gitea 所需的环境。欢迎成为 Gitea 的 Contributor。
+现在，您已准备好 Hacking Gitea。

From 68d7d772eb24dea258db01fe19d6042e07b223f9 Mon Sep 17 00:00:00 2001
From: Brecht Van Lommel <brecht@blender.org>
Date: Mon, 6 Mar 2023 11:20:29 +0100
Subject: [PATCH 02/53] Scoped labels: don't require holding alt key to remove
 (#23303)

Alt doesn't work on all browsers, the simplest solution for v1.19 is to
just not require it and toggle the label by just clicking.

Part of #22974

Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 web_src/js/features/repo-legacy.js | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/web_src/js/features/repo-legacy.js b/web_src/js/features/repo-legacy.js
index 22113af169e37..5173a5b59907c 100644
--- a/web_src/js/features/repo-legacy.js
+++ b/web_src/js/features/repo-legacy.js
@@ -145,7 +145,6 @@ export function initRepoCommentForm() {
 
       const clickedItem = $(this);
       const scope = $(this).attr('data-scope');
-      const canRemoveScope = e.altKey;
 
       $(this).parent().find('.item').each(function () {
         if (scope) {
@@ -153,11 +152,7 @@ export function initRepoCommentForm() {
           if ($(this).attr('data-scope') !== scope) {
             return true;
           }
-          if ($(this).is(clickedItem)) {
-            if (!canRemoveScope && $(this).hasClass('checked')) {
-              return true;
-            }
-          } else if (!$(this).hasClass('checked')) {
+          if (!$(this).is(clickedItem) && !$(this).hasClass('checked')) {
             return true;
           }
         } else if (!$(this).is(clickedItem)) {

From f0b0f22aeda60c77e377f8869f262217c1895ab8 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Mon, 6 Mar 2023 23:35:24 +0900
Subject: [PATCH 03/53] Add ActionRunStatus component (#23259)

Related to:
https://github.com/go-gitea/gitea/pull/23212#discussion_r1122856231

Decrease duplication of SvgIcon when display a run status svg.

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 web_src/js/components/ActionRunStatus.vue | 30 +++++++++++++++++++++++
 web_src/js/components/RepoActionView.vue  | 21 ++++------------
 2 files changed, 35 insertions(+), 16 deletions(-)
 create mode 100644 web_src/js/components/ActionRunStatus.vue

diff --git a/web_src/js/components/ActionRunStatus.vue b/web_src/js/components/ActionRunStatus.vue
new file mode 100644
index 0000000000000..3717b64956617
--- /dev/null
+++ b/web_src/js/components/ActionRunStatus.vue
@@ -0,0 +1,30 @@
+<template>
+  <SvgIcon name="octicon-check-circle-fill" class="green" :size="size" :class-name="className" v-if="status === 'success'"/>
+  <SvgIcon name="octicon-skip" class="ui text grey" :size="size" :class-name="className" v-else-if="status === 'skipped'"/>
+  <SvgIcon name="octicon-clock" class="ui text yellow" :size="size" :class-name="className" v-else-if="status === 'waiting'"/>
+  <SvgIcon name="octicon-blocked" class="ui text yellow" :size="size" :class-name="className" v-else-if="status === 'blocked'"/>
+  <SvgIcon name="octicon-meter" class="ui text yellow" :size="size" :class-name="'job-status-rotate ' + className" v-else-if="status === 'running'"/>
+  <SvgIcon name="octicon-x-circle-fill" class="red" :size="size" v-else/>
+</template>
+
+<script>
+import {SvgIcon} from '../svg.js';
+
+export default {
+  components: {SvgIcon},
+  props: {
+    status: {
+      type: String,
+      required: true
+    },
+    size: {
+      type: Number,
+      default: 16
+    },
+    className: {
+      type: String,
+      default: ''
+    }
+  },
+};
+</script>
diff --git a/web_src/js/components/RepoActionView.vue b/web_src/js/components/RepoActionView.vue
index a5c12c754ece8..aadc8369b75e6 100644
--- a/web_src/js/components/RepoActionView.vue
+++ b/web_src/js/components/RepoActionView.vue
@@ -2,10 +2,7 @@
   <div class="action-view-container">
     <div class="action-view-header">
       <div class="action-info-summary">
-        <SvgIcon name="octicon-check-circle-fill" size="20" class="green" v-if="run.status === 'success'"/>
-        <SvgIcon name="octicon-clock" size="20" class="ui text yellow" v-else-if="run.status === 'waiting'"/>
-        <SvgIcon name="octicon-meter" size="20" class="ui text yellow" class-name="job-status-rotate" v-else-if="run.status === 'running'"/>
-        <SvgIcon name="octicon-x-circle-fill" size="20" class="red" v-else/>
+        <ActionRunStatus :status="run.status" :size="20"/>
         <div class="action-title">
           {{ run.title }}
         </div>
@@ -23,12 +20,7 @@
           <div class="job-brief-list">
             <div class="job-brief-item" v-for="(job, index) in run.jobs" :key="job.id">
               <a class="job-brief-link" :href="run.link+'/jobs/'+index">
-                <SvgIcon name="octicon-check-circle-fill" class="green" v-if="job.status === 'success'"/>
-                <SvgIcon name="octicon-skip" class="ui text grey" v-else-if="job.status === 'skipped'"/>
-                <SvgIcon name="octicon-clock" class="ui text yellow" v-else-if="job.status === 'waiting'"/>
-                <SvgIcon name="octicon-blocked" class="ui text yellow" v-else-if="job.status === 'blocked'"/>
-                <SvgIcon name="octicon-meter" class="ui text yellow" class-name="job-status-rotate" v-else-if="job.status === 'running'"/>
-                <SvgIcon name="octicon-x-circle-fill" class="red" v-else/>
+                <ActionRunStatus :status="job.status"/>
                 <span class="ui text">{{ job.name }}</span>
               </a>
               <button class="job-brief-rerun" @click="rerunJob(index)" v-if="job.canRerun">
@@ -54,12 +46,7 @@
               <SvgIcon name="octicon-chevron-down" class="gt-mr-3" v-show="currentJobStepsStates[i].expanded"/>
               <SvgIcon name="octicon-chevron-right" class="gt-mr-3" v-show="!currentJobStepsStates[i].expanded"/>
 
-              <SvgIcon name="octicon-check-circle-fill" class="green gt-mr-3" v-if="jobStep.status === 'success'"/>
-              <SvgIcon name="octicon-skip" class="ui text grey gt-mr-3" v-else-if="jobStep.status === 'skipped'"/>
-              <SvgIcon name="octicon-clock" class="ui text yellow gt-mr-3" v-else-if="jobStep.status === 'waiting'"/>
-              <SvgIcon name="octicon-blocked" class="ui text yellow gt-mr-3" v-else-if="jobStep.status === 'blocked'"/>
-              <SvgIcon name="octicon-meter" class="ui text yellow gt-mr-3" class-name="job-status-rotate" v-else-if="jobStep.status === 'running'"/>
-              <SvgIcon name="octicon-x-circle-fill" class="red gt-mr-3 " v-else/>
+              <ActionRunStatus :status="jobStep.status" class="gt-mr-3"/>
 
               <span class="step-summary-msg">{{ jobStep.summary }}</span>
               <span class="step-summary-dur">{{ jobStep.duration }}</span>
@@ -76,6 +63,7 @@
 
 <script>
 import {SvgIcon} from '../svg.js';
+import ActionRunStatus from './ActionRunStatus.vue';
 import {createApp} from 'vue';
 import AnsiToHTML from 'ansi-to-html';
 
@@ -85,6 +73,7 @@ const sfc = {
   name: 'RepoActionView',
   components: {
     SvgIcon,
+    ActionRunStatus,
   },
   props: {
     runIndex: String,

From 471b6d24b49ca749a93dcb1f292774aaa8935369 Mon Sep 17 00:00:00 2001
From: Hester Gong <hestergong@gmail.com>
Date: Mon, 6 Mar 2023 23:44:04 +0800
Subject: [PATCH 04/53] Fix PR view misalignment caused by long name file
 (#23321)

Close #23248

The UI after this PR:


https://user-images.githubusercontent.com/17645053/223009758-7f0c9f12-d346-4cb2-a605-729fddce732f.mov
---
 templates/repo/diff/box.tmpl  |  4 ++--
 web_src/less/_repository.less | 19 +++++++++++++++++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/templates/repo/diff/box.tmpl b/templates/repo/diff/box.tmpl
index 4e6879650ddcc..afd471368fa89 100644
--- a/templates/repo/diff/box.tmpl
+++ b/templates/repo/diff/box.tmpl
@@ -79,7 +79,7 @@
 						{{$isExpandable := or (gt $file.Addition 0) (gt $file.Deletion 0) $file.IsBin}}
 						<div class="diff-file-box diff-box file-content {{TabSizeClass $.Editorconfig $file.Name}} gt-mt-3" id="diff-{{$file.NameHash}}" data-old-filename="{{$file.OldName}}" data-new-filename="{{$file.Name}}" {{if or ($file.ShouldBeHidden) (not $isExpandable)}}data-folded="true"{{end}}>
 							<h4 class="diff-file-header sticky-2nd-row ui top attached normal header gt-df gt-ac gt-sb">
-								<div class="gt-df gt-ac">
+								<div class="diff-file-name gt-df gt-ac gt-mr-3">
 									<a role="button" class="fold-file muted gt-mr-2" {{if not $isExpandable}}style="visibility: hidden"{{end}}>
 										{{if $file.ShouldBeHidden}}
 											{{svg "octicon-chevron-right" 18}}
@@ -96,7 +96,7 @@
 											{{template "repo/diff/stats" dict "file" . "root" $}}
 										{{end}}
 									</div>
-									<span class="file gt-mono"><a class="muted" href="#diff-{{$file.NameHash}}">{{if $file.IsRenamed}}{{$file.OldName}} &rarr; {{end}}{{$file.Name}}</a>{{if .IsLFSFile}} ({{$.locale.Tr "repo.stored_lfs"}}){{end}}</span>
+									<span class="file gt-mono"><a class="muted file-link" title="{{if $file.IsRenamed}}{{$file.OldName}} &rarr; {{end}}{{$file.Name}}" href="#diff-{{$file.NameHash}}">{{if $file.IsRenamed}}{{$file.OldName}} &rarr; {{end}}{{$file.Name}}</a>{{if .IsLFSFile}} ({{$.locale.Tr "repo.stored_lfs"}}){{end}}</span>
 									{{if $file.IsGenerated}}
 										<span class="ui label gt-ml-3">{{$.locale.Tr "repo.diff.generated"}}</span>
 									{{end}}
diff --git a/web_src/less/_repository.less b/web_src/less/_repository.less
index 9eaa8644f1413..3b93a76a16ebc 100644
--- a/web_src/less/_repository.less
+++ b/web_src/less/_repository.less
@@ -1670,8 +1670,14 @@
     align-items: center;
 
     .file {
-      flex: 1;
-      word-break: break-all;
+      min-width: 0;
+      .file-link {
+        max-width: fit-content;
+        display: -webkit-box;
+        -webkit-box-orient: vertical;
+        -webkit-line-clamp: 2;
+        overflow: hidden;
+      }
     }
 
     .button {
@@ -3283,6 +3289,15 @@ td.blob-excerpt {
       position: static;
     }
   }
+
+  .diff-file-header-actions {
+    flex-shrink: 0;
+  }
+
+  .diff-file-name {
+    flex: auto;
+    min-width: 100px;
+  }
 }
 
 .diff-file-body {

From 3f547c7afb8135cadd2253acece45de1e0703e76 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Tue, 7 Mar 2023 01:32:56 +0900
Subject: [PATCH 05/53] Fix incorrect project links and use symlink icon for
 org-wide projects (#23325)

Fix displaying same projects icons between user/repo projects.
And fix incorrect projects links.
A part of https://github.com/go-gitea/gitea/pull/22865.


![image](https://user-images.githubusercontent.com/18380374/223044279-7b620ff1-d88a-4146-97e6-531bbf269761.png)

![image](https://user-images.githubusercontent.com/18380374/223044390-42911e3f-1f6b-439f-8441-4f3ebf99ea13.png)

![image](https://user-images.githubusercontent.com/18380374/223044437-5cad5391-0f95-4c8b-b0a3-32e263e2854f.png)
---
 templates/org/menu.tmpl             |  2 +-
 templates/projects/list.tmpl        |  4 ++--
 templates/repo/issue/new_form.tmpl  | 12 ++++++------
 templates/repo/projects/list.tmpl   |  2 +-
 templates/shared/issuelist.tmpl     |  4 ++--
 templates/user/overview/header.tmpl |  2 +-
 templates/user/profile.tmpl         |  2 +-
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/templates/org/menu.tmpl b/templates/org/menu.tmpl
index 7ca47cd32c56e..25f459c09c56a 100644
--- a/templates/org/menu.tmpl
+++ b/templates/org/menu.tmpl
@@ -4,7 +4,7 @@
 			{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
 		</a>
 		<a class="{{if .PageIsViewProjects}}active {{end}}item" href="{{$.Org.HomeLink}}/-/projects">
-			{{svg "octicon-project"}} {{.locale.Tr "user.projects"}}
+			{{svg "octicon-project-symlink"}} {{.locale.Tr "user.projects"}}
 		</a>
 		{{if .IsPackageEnabled}}
 		<a class="item" href="{{$.Org.HomeLink}}/-/packages">
diff --git a/templates/projects/list.tmpl b/templates/projects/list.tmpl
index 8d9594e2b4773..489189ec45a1c 100644
--- a/templates/projects/list.tmpl
+++ b/templates/projects/list.tmpl
@@ -12,7 +12,7 @@
 		{{template "base/alert" .}}
 		<div class="ui compact tiny menu">
 			<a class="item{{if not .IsShowClosed}} active{{end}}" href="{{$.Link}}?state=open">
-				{{svg "octicon-project" 16 "gt-mr-3"}}
+				{{svg "octicon-project-symlink" 16 "gt-mr-3"}}
 				{{JsPrettyNumber .OpenCount}}&nbsp;{{.locale.Tr "repo.issues.open_title"}}
 			</a>
 			<a class="item{{if .IsShowClosed}} active{{end}}" href="{{$.Link}}?state=closed">
@@ -38,7 +38,7 @@
 		<div class="milestone list">
 			{{range .Projects}}
 				<li class="item">
-					{{svg "octicon-project"}} <a href="{{$.Link}}/{{.ID}}">{{.Title}}</a>
+					{{svg "octicon-project-symlink"}} <a href="{{.Link}}">{{.Title}}</a>
 					<div class="meta">
 						{{$closedDate:= TimeSinceUnix .ClosedDateUnix $.locale}}
 						{{if .IsClosed}}
diff --git a/templates/repo/issue/new_form.tmpl b/templates/repo/issue/new_form.tmpl
index 24c7ac7e4ed4e..9fd6c99a5b3f0 100644
--- a/templates/repo/issue/new_form.tmpl
+++ b/templates/repo/issue/new_form.tmpl
@@ -176,8 +176,8 @@
 								{{.locale.Tr "repo.issues.new.open_projects"}}
 							</div>
 							{{range .OpenProjects}}
-								<a class="item muted sidebar-item-link" data-id="{{.ID}}" data-href="{{$.RepoLink}}/projects/{{.ID}}">
-									{{svg "octicon-project" 18 "gt-mr-3"}}
+								<a class="item muted sidebar-item-link" data-id="{{.ID}}" data-href="{{.Link}}">
+									{{if .IsOrganizationProject}}{{svg "octicon-project-symlink" 18 "gt-mr-3"}}{{else}}{{svg "octicon-project" 18 "gt-mr-3"}}{{end}}
 									{{.Title}}
 								</a>
 							{{end}}
@@ -188,8 +188,8 @@
 								{{.locale.Tr "repo.issues.new.closed_projects"}}
 							</div>
 							{{range .ClosedProjects}}
-								<a class="item muted sidebar-item-link" data-id="{{.ID}}" data-href="{{$.RepoLink}}/projects/{{.ID}}">
-									{{svg "octicon-project" 18 "gt-mr-3"}}
+								<a class="item muted sidebar-item-link" data-id="{{.ID}}" data-href="{{.Link}}">
+									{{if .IsOrganizationProject}}{{svg "octicon-project-symlink" 18 "gt-mr-3"}}{{else}}{{svg "octicon-project" 18 "gt-mr-3"}}{{end}}
 									{{.Title}}
 								</a>
 							{{end}}
@@ -201,8 +201,8 @@
 				<span class="no-select item {{if .Project}}gt-hidden{{end}}">{{.locale.Tr "repo.issues.new.no_projects"}}</span>
 				<div class="selected">
 					{{if .Project}}
-						<a class="item muted sidebar-item-link" href="{{.RepoLink}}/projects/{{.Project.ID}}">
-							{{svg "octicon-project" 18 "gt-mr-3"}}
+						<a class="item muted sidebar-item-link" href="{{.Project.Link}}">
+							{{if .IsOrganizationProject}}{{svg "octicon-project-symlink" 18 "gt-mr-3"}}{{else}}{{svg "octicon-project" 18 "gt-mr-3"}}{{end}}
 							{{.Project.Title}}
 						</a>
 					{{end}}
diff --git a/templates/repo/projects/list.tmpl b/templates/repo/projects/list.tmpl
index fc4770e5d8d42..929a1b4c6fb80 100644
--- a/templates/repo/projects/list.tmpl
+++ b/templates/repo/projects/list.tmpl
@@ -40,7 +40,7 @@
 		<div class="milestone list">
 			{{range .Projects}}
 				<li class="item">
-					{{svg "octicon-project"}} <a href="{{$.RepoLink}}/projects/{{.ID}}">{{.Title}}</a>
+					{{svg "octicon-project"}} <a href="{{.Link}}">{{.Title}}</a>
 					<div class="meta">
 						{{$closedDate:= TimeSinceUnix .ClosedDateUnix $.locale}}
 						{{if .IsClosed}}
diff --git a/templates/shared/issuelist.tmpl b/templates/shared/issuelist.tmpl
index 6f3fd0f9167d0..16bb3c1ec7fea 100644
--- a/templates/shared/issuelist.tmpl
+++ b/templates/shared/issuelist.tmpl
@@ -87,8 +87,8 @@
 						</a>
 					{{end}}
 					{{if .Project}}
-						<a class="project" {{if $.RepoLink}}href="{{$.RepoLink}}/projects/{{.Project.ID}}"{{else}}href="{{.Repo.Link}}/projects/{{.Project.ID}}"{{end}}>
-							{{svg "octicon-project" 14 "gt-mr-2"}}{{.Project.Title}}
+						<a class="project" href="{{.Project.Link}}">
+							{{if .Project.IsOrganizationProject}}{{svg "octicon-project-symlink" 14 "gt-mr-2"}}{{else}}{{svg "octicon-project" 14 "gt-mr-2"}}{{end}}{{.Project.Title}}
 						</a>
 					{{end}}
 					{{if .Ref}}
diff --git a/templates/user/overview/header.tmpl b/templates/user/overview/header.tmpl
index 2449f5fc323e8..ce9ecb46adbc8 100644
--- a/templates/user/overview/header.tmpl
+++ b/templates/user/overview/header.tmpl
@@ -23,7 +23,7 @@
 				{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
 			</a>
 			<a href="{{.ContextUser.HomeLink}}/-/projects" class="{{if .PageIsViewProjects}}active {{end}}item">
-				{{svg "octicon-project"}} {{.locale.Tr "user.projects"}}
+				{{svg "octicon-project-symlink"}} {{.locale.Tr "user.projects"}}
 			</a>
 			{{if (not .UnitPackagesGlobalDisabled)}}
 				<a href="{{.ContextUser.HomeLink}}/-/packages" class="{{if .IsPackagesPage}}active {{end}}item">
diff --git a/templates/user/profile.tmpl b/templates/user/profile.tmpl
index fcaec60eaec4d..5b445bdb00780 100644
--- a/templates/user/profile.tmpl
+++ b/templates/user/profile.tmpl
@@ -107,7 +107,7 @@
 						{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
 					</a>
 					<a href="{{.Owner.HomeLink}}/-/projects" class="{{if eq .TabName "projects"}}active {{end}}item">
-						{{svg "octicon-project"}} {{.locale.Tr "user.projects"}}
+						{{svg "octicon-project-symlink"}} {{.locale.Tr "user.projects"}}
 					</a>
 					{{if .IsPackageEnabled}}
 					<a class='{{if eq .TabName "packages"}}active {{end}}item' href="{{.Owner.HomeLink}}/-/packages">

From e7b89888e158b76a27c101bbfa1775ccd6b55ce9 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Tue, 7 Mar 2023 03:05:26 +0900
Subject: [PATCH 06/53] Fix incorrect redirect link of delete org project
 (#23327)

A part of https://github.com/go-gitea/gitea/pull/22865/commits

The old code will cause 500 error.
---
 routers/web/org/projects.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index 6449d12de105a..046100c72e2f5 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -205,7 +205,7 @@ func DeleteProject(ctx *context.Context) {
 	}
 
 	ctx.JSON(http.StatusOK, map[string]interface{}{
-		"redirect": ctx.Repo.RepoLink + "/projects",
+		"redirect": ctx.ContextUser.HomeLink() + "/-/projects",
 	})
 }
 

From 27ba7fff6d2159a01df4af302813dceaa15c9592 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Tue, 7 Mar 2023 03:12:10 +0800
Subject: [PATCH 07/53] Remove unnecessary space on link (#23334)

The action run title has a blank. This PR removes it.
---
 templates/repo/actions/runs_list.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/repo/actions/runs_list.tmpl b/templates/repo/actions/runs_list.tmpl
index a01d2165795b0..ffabe534c8bb4 100644
--- a/templates/repo/actions/runs_list.tmpl
+++ b/templates/repo/actions/runs_list.tmpl
@@ -7,7 +7,7 @@
 			<div class="issue-item-main gt-f1 gt-fc gt-df">
 				<div class="issue-item-top-row">
 					<a class="index gt-ml-0 gt-mr-2" href="{{if .Link}}{{.Link}}{{else}}{{$.Link}}/{{.Index}}{{end}}">
-						{{.Title}}
+						{{- .Title -}}
 					</a>
 					<span class="ui label">
 						{{if .RefLink}}

From 84a299310d9a8f6387f18a1711485b7f33e6f6b5 Mon Sep 17 00:00:00 2001
From: JonRB <4564448+eeyrjmr@users.noreply.github.com>
Date: Mon, 6 Mar 2023 23:39:07 +0000
Subject: [PATCH 08/53] Update documentation for the new YAML label file format
  (#23020)

update documentation to include an overview of the yaml label template that is part of PR #22976

Signed-off-by: Jon Roadley-Battin <jon.roadleybattin@gmail.com>

---------

Co-authored-by: Yarden Shoham <hrsi88@gmail.com>
Co-authored-by: Lauris BH <lauris@nix.lv>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
Co-authored-by: delvh <dev.lh@web.de>
---
 .../doc/advanced/customizing-gitea.en-us.md       | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/docs/content/doc/advanced/customizing-gitea.en-us.md b/docs/content/doc/advanced/customizing-gitea.en-us.md
index 18fc1b3e73d16..bad6342aad44d 100644
--- a/docs/content/doc/advanced/customizing-gitea.en-us.md
+++ b/docs/content/doc/advanced/customizing-gitea.en-us.md
@@ -282,9 +282,22 @@ To add custom .gitignore, add a file with existing [.gitignore rules](https://gi
 
 ### Labels
 
-To add a custom label set, add a file that follows the [label format](https://github.com/go-gitea/gitea/blob/main/options/label/Default) to `$GITEA_CUSTOM/options/label`
+Starting with Gitea 1.19, you can add a file that follows the [YAML label format](https://github.com/go-gitea/gitea/blob/main/options/label/Advanced.yaml) to `$GITEA_CUSTOM/options/label`:
+
+```yaml
+labels:
+  - name: "foo/bar"  # name of the label that will appear in the dropdown
+    exclusive: true # whether to use the exclusive namespace for scoped labels. scoped delimiter is /
+    color: aabbcc # hex colour coding
+    description: Some label # long description of label intent
+ ```
+
+The [legacy file format](https://github.com/go-gitea/gitea/blob/main/options/label/Default) can still be used following the format below, however we strongly recommend using the newer YAML format instead.
+
 `#hex-color label name ; label description`
 
+For more information, see the [labels documentation]({{< relref "doc/usage/labels.en-us.md" >}}).
+
 ### Licenses
 
 To add a custom license, add a file with the license text to `$GITEA_CUSTOM/options/license`

From c84238800bb743181582f043ece9b44fef233c95 Mon Sep 17 00:00:00 2001
From: Jason Song <i@wolfogre.com>
Date: Tue, 7 Mar 2023 18:51:06 +0800
Subject: [PATCH 09/53] Refactor `setting.Database.UseXXX` to methods (#23354)

Replace #23350.

Refactor `setting.Database.UseMySQL` to
`setting.Database.Type.IsMySQL()`.

To avoid mismatching between `Type` and `UseXXX`.

This refactor can fix the bug mentioned in #23350, so it should be
backported.
---
 cmd/convert.go                                |  2 +-
 cmd/dump.go                                   |  2 +-
 models/activities/action.go                   |  6 +--
 models/activities/action_test.go              |  2 +-
 models/activities/user_heatmap.go             |  4 +-
 models/db/common.go                           |  2 +-
 models/db/engine.go                           |  4 +-
 models/db/index.go                            |  2 +-
 models/db/sequence.go                         |  4 +-
 models/git/commit_status.go                   |  2 +-
 models/migrations/base/db.go                  | 28 +++++------
 models/migrations/v1_12/v139.go               |  4 +-
 models/migrations/v1_13/v140.go               |  2 +-
 models/migrations/v1_13/v145.go               |  8 +--
 models/migrations/v1_13/v151.go               |  8 +--
 models/migrations/v1_14/v158.go               | 10 ++--
 models/migrations/v1_14/v175.go               |  2 +-
 models/migrations/v1_15/v184.go               |  4 +-
 models/migrations/v1_16/v191.go               |  2 +-
 models/migrations/v1_17/v217.go               |  2 +-
 models/migrations/v1_17/v218.go               |  2 +-
 models/migrations/v1_17/v223.go               |  4 +-
 models/migrations/v1_18/v225.go               |  2 +-
 models/migrations/v1_19/v232.go               |  2 +-
 models/migrations/v1_19/v242.go               |  2 +-
 models/project/project.go                     |  4 +-
 models/repo/repo_list.go                      |  2 +-
 models/unittest/testdb.go                     |  2 +-
 modules/doctor/dbconsistency.go               |  2 +-
 modules/setting/database.go                   | 49 +++++++++++--------
 routers/init.go                               |  2 +-
 routers/install/install.go                    |  6 +--
 routers/web/healthcheck/check.go              |  2 +-
 tests/integration/markup_external_test.go     |  2 +-
 .../migration-test/migration_test.go          | 10 ++--
 tests/test_utils.go                           |  6 +--
 36 files changed, 103 insertions(+), 96 deletions(-)

diff --git a/cmd/convert.go b/cmd/convert.go
index 30e7d01e11a91..d9b89495c1bf0 100644
--- a/cmd/convert.go
+++ b/cmd/convert.go
@@ -35,7 +35,7 @@ func runConvert(ctx *cli.Context) error {
 	log.Info("Log path: %s", setting.Log.RootPath)
 	log.Info("Configuration file: %s", setting.CustomConf)
 
-	if !setting.Database.UseMySQL {
+	if !setting.Database.Type.IsMySQL() {
 		fmt.Println("This command can only be used with a MySQL database")
 		return nil
 	}
diff --git a/cmd/dump.go b/cmd/dump.go
index 600ec4f32eb08..c802849f8e50f 100644
--- a/cmd/dump.go
+++ b/cmd/dump.go
@@ -279,7 +279,7 @@ func runDump(ctx *cli.Context) error {
 	}()
 
 	targetDBType := ctx.String("database")
-	if len(targetDBType) > 0 && targetDBType != setting.Database.Type {
+	if len(targetDBType) > 0 && targetDBType != setting.Database.Type.String() {
 		log.Info("Dumping database %s => %s...", setting.Database.Type, targetDBType)
 	} else {
 		log.Info("Dumping database...")
diff --git a/models/activities/action.go b/models/activities/action.go
index 1412d2c051d60..c1d17517baf08 100644
--- a/models/activities/action.go
+++ b/models/activities/action.go
@@ -99,7 +99,7 @@ func (a *Action) TableIndices() []*schemas.Index {
 	actUserIndex.AddColumn("act_user_id", "repo_id", "created_unix", "user_id", "is_deleted")
 
 	indices := []*schemas.Index{actUserIndex, repoIndex}
-	if setting.Database.UsePostgreSQL {
+	if setting.Database.Type.IsPostgreSQL() {
 		cudIndex := schemas.NewIndex("c_u_d", schemas.IndexType)
 		cudIndex.AddColumn("created_unix", "user_id", "is_deleted")
 		indices = append(indices, cudIndex)
@@ -640,7 +640,7 @@ func DeleteIssueActions(ctx context.Context, repoID, issueID int64) error {
 
 // CountActionCreatedUnixString count actions where created_unix is an empty string
 func CountActionCreatedUnixString(ctx context.Context) (int64, error) {
-	if setting.Database.UseSQLite3 {
+	if setting.Database.Type.IsSQLite3() {
 		return db.GetEngine(ctx).Where(`created_unix = ""`).Count(new(Action))
 	}
 	return 0, nil
@@ -648,7 +648,7 @@ func CountActionCreatedUnixString(ctx context.Context) (int64, error) {
 
 // FixActionCreatedUnixString set created_unix to zero if it is an empty string
 func FixActionCreatedUnixString(ctx context.Context) (int64, error) {
-	if setting.Database.UseSQLite3 {
+	if setting.Database.Type.IsSQLite3() {
 		res, err := db.GetEngine(ctx).Exec(`UPDATE action SET created_unix = 0 WHERE created_unix = ""`)
 		if err != nil {
 			return 0, err
diff --git a/models/activities/action_test.go b/models/activities/action_test.go
index 2fd86bb8f6e76..7044bcc004abb 100644
--- a/models/activities/action_test.go
+++ b/models/activities/action_test.go
@@ -243,7 +243,7 @@ func TestGetFeedsCorrupted(t *testing.T) {
 }
 
 func TestConsistencyUpdateAction(t *testing.T) {
-	if !setting.Database.UseSQLite3 {
+	if !setting.Database.Type.IsSQLite3() {
 		t.Skip("Test is only for SQLite database.")
 	}
 	assert.NoError(t, unittest.PrepareTestDatabase())
diff --git a/models/activities/user_heatmap.go b/models/activities/user_heatmap.go
index 3370103a556f2..d3f0f0db73b27 100644
--- a/models/activities/user_heatmap.go
+++ b/models/activities/user_heatmap.go
@@ -39,9 +39,9 @@ func getUserHeatmapData(user *user_model.User, team *organization.Team, doer *us
 	groupBy := "created_unix / 900 * 900"
 	groupByName := "timestamp" // We need this extra case because mssql doesn't allow grouping by alias
 	switch {
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		groupBy = "created_unix DIV 900 * 900"
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		groupByName = groupBy
 	}
 
diff --git a/models/db/common.go b/models/db/common.go
index 76c7c119f4130..af6130c9f255b 100644
--- a/models/db/common.go
+++ b/models/db/common.go
@@ -15,7 +15,7 @@ import (
 // BuildCaseInsensitiveLike returns a condition to check if the given value is like the given key case-insensitively.
 // Handles especially SQLite correctly as UPPER there only transforms ASCII letters.
 func BuildCaseInsensitiveLike(key, value string) builder.Cond {
-	if setting.Database.UseSQLite3 {
+	if setting.Database.Type.IsSQLite3() {
 		return builder.Like{"UPPER(" + key + ")", util.ToUpperASCII(value)}
 	}
 	return builder.Like{"UPPER(" + key + ")", strings.ToUpper(value)}
diff --git a/models/db/engine.go b/models/db/engine.go
index 5020101d490a2..56dd209fd78ff 100755
--- a/models/db/engine.go
+++ b/models/db/engine.go
@@ -101,12 +101,12 @@ func newXORMEngine() (*xorm.Engine, error) {
 
 	var engine *xorm.Engine
 
-	if setting.Database.UsePostgreSQL && len(setting.Database.Schema) > 0 {
+	if setting.Database.Type.IsPostgreSQL() && len(setting.Database.Schema) > 0 {
 		// OK whilst we sort out our schema issues - create a schema aware postgres
 		registerPostgresSchemaDriver()
 		engine, err = xorm.NewEngine("postgresschema", connStr)
 	} else {
-		engine, err = xorm.NewEngine(setting.Database.Type, connStr)
+		engine, err = xorm.NewEngine(setting.Database.Type.String(), connStr)
 	}
 
 	if err != nil {
diff --git a/models/db/index.go b/models/db/index.go
index f840a62c8913f..7609d8fb6e6c2 100644
--- a/models/db/index.go
+++ b/models/db/index.go
@@ -73,7 +73,7 @@ func postgresGetNextResourceIndex(ctx context.Context, tableName string, groupID
 
 // GetNextResourceIndex generates a resource index, it must run in the same transaction where the resource is created
 func GetNextResourceIndex(ctx context.Context, tableName string, groupID int64) (int64, error) {
-	if setting.Database.UsePostgreSQL {
+	if setting.Database.Type.IsPostgreSQL() {
 		return postgresGetNextResourceIndex(ctx, tableName, groupID)
 	}
 
diff --git a/models/db/sequence.go b/models/db/sequence.go
index 6d801d022fbc0..f49ad935de099 100644
--- a/models/db/sequence.go
+++ b/models/db/sequence.go
@@ -13,7 +13,7 @@ import (
 
 // CountBadSequences looks for broken sequences from recreate-table mistakes
 func CountBadSequences(_ context.Context) (int64, error) {
-	if !setting.Database.UsePostgreSQL {
+	if !setting.Database.Type.IsPostgreSQL() {
 		return 0, nil
 	}
 
@@ -34,7 +34,7 @@ func CountBadSequences(_ context.Context) (int64, error) {
 
 // FixBadSequences fixes for broken sequences from recreate-table mistakes
 func FixBadSequences(_ context.Context) error {
-	if !setting.Database.UsePostgreSQL {
+	if !setting.Database.Type.IsPostgreSQL() {
 		return nil
 	}
 
diff --git a/models/git/commit_status.go b/models/git/commit_status.go
index 489507f710503..82cbb2363739f 100644
--- a/models/git/commit_status.go
+++ b/models/git/commit_status.go
@@ -65,7 +65,7 @@ func postgresGetCommitStatusIndex(ctx context.Context, repoID int64, sha string)
 
 // GetNextCommitStatusIndex retried 3 times to generate a resource index
 func GetNextCommitStatusIndex(ctx context.Context, repoID int64, sha string) (int64, error) {
-	if setting.Database.UsePostgreSQL {
+	if setting.Database.Type.IsPostgreSQL() {
 		return postgresGetCommitStatusIndex(ctx, repoID, sha)
 	}
 
diff --git a/models/migrations/base/db.go b/models/migrations/base/db.go
index dcf99c96ae81f..b038ad73372e4 100644
--- a/models/migrations/base/db.go
+++ b/models/migrations/base/db.go
@@ -89,7 +89,7 @@ func RecreateTable(sess *xorm.Session, bean interface{}) error {
 		hasID = hasID || (column.IsPrimaryKey && column.IsAutoIncrement)
 	}
 
-	if hasID && setting.Database.UseMSSQL {
+	if hasID && setting.Database.Type.IsMSSQL() {
 		if _, err := sess.Exec(fmt.Sprintf("SET IDENTITY_INSERT `%s` ON", tempTableName)); err != nil {
 			log.Error("Unable to set identity insert for table %s. Error: %v", tempTableName, err)
 			return err
@@ -143,7 +143,7 @@ func RecreateTable(sess *xorm.Session, bean interface{}) error {
 		return err
 	}
 
-	if hasID && setting.Database.UseMSSQL {
+	if hasID && setting.Database.Type.IsMSSQL() {
 		if _, err := sess.Exec(fmt.Sprintf("SET IDENTITY_INSERT `%s` OFF", tempTableName)); err != nil {
 			log.Error("Unable to switch off identity insert for table %s. Error: %v", tempTableName, err)
 			return err
@@ -151,7 +151,7 @@ func RecreateTable(sess *xorm.Session, bean interface{}) error {
 	}
 
 	switch {
-	case setting.Database.UseSQLite3:
+	case setting.Database.Type.IsSQLite3():
 		// SQLite will drop all the constraints on the old table
 		if _, err := sess.Exec(fmt.Sprintf("DROP TABLE `%s`", tableName)); err != nil {
 			log.Error("Unable to drop old table %s. Error: %v", tableName, err)
@@ -178,7 +178,7 @@ func RecreateTable(sess *xorm.Session, bean interface{}) error {
 			return err
 		}
 
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		// MySQL will drop all the constraints on the old table
 		if _, err := sess.Exec(fmt.Sprintf("DROP TABLE `%s`", tableName)); err != nil {
 			log.Error("Unable to drop old table %s. Error: %v", tableName, err)
@@ -205,7 +205,7 @@ func RecreateTable(sess *xorm.Session, bean interface{}) error {
 			log.Error("Unable to recreate uniques on table %s. Error: %v", tableName, err)
 			return err
 		}
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		var originalSequences []string
 		type sequenceData struct {
 			LastValue int  `xorm:"'last_value'"`
@@ -296,7 +296,7 @@ func RecreateTable(sess *xorm.Session, bean interface{}) error {
 
 		}
 
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		// MSSQL will drop all the constraints on the old table
 		if _, err := sess.Exec(fmt.Sprintf("DROP TABLE `%s`", tableName)); err != nil {
 			log.Error("Unable to drop old table %s. Error: %v", tableName, err)
@@ -323,7 +323,7 @@ func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...strin
 	// TODO: This will not work if there are foreign keys
 
 	switch {
-	case setting.Database.UseSQLite3:
+	case setting.Database.Type.IsSQLite3():
 		// First drop the indexes on the columns
 		res, errIndex := sess.Query(fmt.Sprintf("PRAGMA index_list(`%s`)", tableName))
 		if errIndex != nil {
@@ -405,7 +405,7 @@ func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...strin
 			return err
 		}
 
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		cols := ""
 		for _, col := range columnNames {
 			if cols != "" {
@@ -416,7 +416,7 @@ func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...strin
 		if _, err := sess.Exec(fmt.Sprintf("ALTER TABLE `%s` %s", tableName, cols)); err != nil {
 			return fmt.Errorf("Drop table `%s` columns %v: %v", tableName, columnNames, err)
 		}
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		// Drop indexes on columns first
 		sql := fmt.Sprintf("SHOW INDEX FROM %s WHERE column_name IN ('%s')", tableName, strings.Join(columnNames, "','"))
 		res, err := sess.Query(sql)
@@ -444,7 +444,7 @@ func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...strin
 		if _, err := sess.Exec(fmt.Sprintf("ALTER TABLE `%s` %s", tableName, cols)); err != nil {
 			return fmt.Errorf("Drop table `%s` columns %v: %v", tableName, columnNames, err)
 		}
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		cols := ""
 		for _, col := range columnNames {
 			if cols != "" {
@@ -543,13 +543,13 @@ func newXORMEngine() (*xorm.Engine, error) {
 
 func deleteDB() error {
 	switch {
-	case setting.Database.UseSQLite3:
+	case setting.Database.Type.IsSQLite3():
 		if err := util.Remove(setting.Database.Path); err != nil {
 			return err
 		}
 		return os.MkdirAll(path.Dir(setting.Database.Path), os.ModePerm)
 
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		db, err := sql.Open("mysql", fmt.Sprintf("%s:%s@tcp(%s)/",
 			setting.Database.User, setting.Database.Passwd, setting.Database.Host))
 		if err != nil {
@@ -565,7 +565,7 @@ func deleteDB() error {
 			return err
 		}
 		return nil
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		db, err := sql.Open("postgres", fmt.Sprintf("postgres://%s:%s@%s/?sslmode=%s",
 			setting.Database.User, setting.Database.Passwd, setting.Database.Host, setting.Database.SSLMode))
 		if err != nil {
@@ -612,7 +612,7 @@ func deleteDB() error {
 			}
 			return nil
 		}
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		host, port := setting.ParseMSSQLHostPort(setting.Database.Host)
 		db, err := sql.Open("mssql", fmt.Sprintf("server=%s; port=%s; database=%s; user id=%s; password=%s;",
 			host, port, "master", setting.Database.User, setting.Database.Passwd))
diff --git a/models/migrations/v1_12/v139.go b/models/migrations/v1_12/v139.go
index 725b8fa30597f..279aa7df87dc4 100644
--- a/models/migrations/v1_12/v139.go
+++ b/models/migrations/v1_12/v139.go
@@ -13,9 +13,9 @@ func PrependRefsHeadsToIssueRefs(x *xorm.Engine) error {
 	var query string
 
 	switch {
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		query = "UPDATE `issue` SET `ref` = 'refs/heads/' + `ref` WHERE `ref` IS NOT NULL AND `ref` <> '' AND `ref` NOT LIKE 'refs/%'"
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		query = "UPDATE `issue` SET `ref` = CONCAT('refs/heads/', `ref`) WHERE `ref` IS NOT NULL AND `ref` <> '' AND `ref` NOT LIKE 'refs/%';"
 	default:
 		query = "UPDATE `issue` SET `ref` = 'refs/heads/' || `ref` WHERE `ref` IS NOT NULL AND `ref` <> '' AND `ref` NOT LIKE 'refs/%'"
diff --git a/models/migrations/v1_13/v140.go b/models/migrations/v1_13/v140.go
index 3de9eaaf7cdaf..4d87b955fdff7 100644
--- a/models/migrations/v1_13/v140.go
+++ b/models/migrations/v1_13/v140.go
@@ -41,7 +41,7 @@ func FixLanguageStatsToSaveSize(x *xorm.Engine) error {
 
 	// Delete language stat statuses
 	truncExpr := "TRUNCATE TABLE"
-	if setting.Database.UseSQLite3 {
+	if setting.Database.Type.IsSQLite3() {
 		truncExpr = "DELETE FROM"
 	}
 
diff --git a/models/migrations/v1_13/v145.go b/models/migrations/v1_13/v145.go
index c96e79f8a0ee3..ee40bfc77f862 100644
--- a/models/migrations/v1_13/v145.go
+++ b/models/migrations/v1_13/v145.go
@@ -21,7 +21,7 @@ func IncreaseLanguageField(x *xorm.Engine) error {
 		return err
 	}
 
-	if setting.Database.UseSQLite3 {
+	if setting.Database.Type.IsSQLite3() {
 		// SQLite maps VARCHAR to TEXT without size so we're done
 		return nil
 	}
@@ -41,11 +41,11 @@ func IncreaseLanguageField(x *xorm.Engine) error {
 	}
 
 	switch {
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		if _, err := sess.Exec(fmt.Sprintf("ALTER TABLE language_stat MODIFY COLUMN language %s", sqlType)); err != nil {
 			return err
 		}
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		// Yet again MSSQL just has to be awkward.
 		// Here we have to drop the constraints first and then rebuild them
 		constraints := make([]string, 0)
@@ -71,7 +71,7 @@ func IncreaseLanguageField(x *xorm.Engine) error {
 		if err := sess.CreateUniques(new(LanguageStat)); err != nil {
 			return err
 		}
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		if _, err := sess.Exec(fmt.Sprintf("ALTER TABLE language_stat ALTER COLUMN language TYPE %s", sqlType)); err != nil {
 			return err
 		}
diff --git a/models/migrations/v1_13/v151.go b/models/migrations/v1_13/v151.go
index 9490c1778c6a7..9aa71ec29f13f 100644
--- a/models/migrations/v1_13/v151.go
+++ b/models/migrations/v1_13/v151.go
@@ -17,13 +17,13 @@ import (
 
 func SetDefaultPasswordToArgon2(x *xorm.Engine) error {
 	switch {
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		_, err := x.Exec("ALTER TABLE `user` ALTER passwd_hash_algo SET DEFAULT 'argon2';")
 		return err
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		_, err := x.Exec("ALTER TABLE `user` ALTER COLUMN passwd_hash_algo SET DEFAULT 'argon2';")
 		return err
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		// need to find the constraint and drop it, then recreate it.
 		sess := x.NewSession()
 		defer sess.Close()
@@ -53,7 +53,7 @@ func SetDefaultPasswordToArgon2(x *xorm.Engine) error {
 		}
 		return sess.Commit()
 
-	case setting.Database.UseSQLite3:
+	case setting.Database.Type.IsSQLite3():
 		// drop through
 	default:
 		log.Fatal("Unrecognized DB")
diff --git a/models/migrations/v1_14/v158.go b/models/migrations/v1_14/v158.go
index 7ea80a659ed29..2029829ff9901 100644
--- a/models/migrations/v1_14/v158.go
+++ b/models/migrations/v1_14/v158.go
@@ -62,7 +62,7 @@ func UpdateCodeCommentReplies(x *xorm.Engine) error {
 			return err
 		}
 
-		if setting.Database.UseMSSQL {
+		if setting.Database.Type.IsMSSQL() {
 			if _, err := sess.Exec(sqlSelect + " INTO #temp_comments" + sqlTail); err != nil {
 				log.Error("unable to create temporary table")
 				return err
@@ -72,13 +72,13 @@ func UpdateCodeCommentReplies(x *xorm.Engine) error {
 		comments := make([]*Comment, 0, batchSize)
 
 		switch {
-		case setting.Database.UseMySQL:
+		case setting.Database.Type.IsMySQL():
 			sqlCmd = sqlSelect + sqlTail + " LIMIT " + strconv.Itoa(batchSize) + ", " + strconv.Itoa(start)
-		case setting.Database.UsePostgreSQL:
+		case setting.Database.Type.IsPostgreSQL():
 			fallthrough
-		case setting.Database.UseSQLite3:
+		case setting.Database.Type.IsSQLite3():
 			sqlCmd = sqlSelect + sqlTail + " LIMIT " + strconv.Itoa(batchSize) + " OFFSET " + strconv.Itoa(start)
-		case setting.Database.UseMSSQL:
+		case setting.Database.Type.IsMSSQL():
 			sqlCmd = "SELECT TOP " + strconv.Itoa(batchSize) + " * FROM #temp_comments WHERE " +
 				"(id NOT IN ( SELECT TOP " + strconv.Itoa(start) + " id FROM #temp_comments ORDER BY id )) ORDER BY id"
 		default:
diff --git a/models/migrations/v1_14/v175.go b/models/migrations/v1_14/v175.go
index f1b9b974c6aa5..70d72b2600337 100644
--- a/models/migrations/v1_14/v175.go
+++ b/models/migrations/v1_14/v175.go
@@ -14,7 +14,7 @@ import (
 )
 
 func FixPostgresIDSequences(x *xorm.Engine) error {
-	if !setting.Database.UsePostgreSQL {
+	if !setting.Database.Type.IsPostgreSQL() {
 		return nil
 	}
 
diff --git a/models/migrations/v1_15/v184.go b/models/migrations/v1_15/v184.go
index 48f8b62165cc5..caf41b6048ed4 100644
--- a/models/migrations/v1_15/v184.go
+++ b/models/migrations/v1_15/v184.go
@@ -54,11 +54,11 @@ func RenameTaskErrorsToMessage(x *xorm.Engine) error {
 	}
 
 	switch {
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		if _, err := sess.Exec("ALTER TABLE `task` CHANGE errors message text"); err != nil {
 			return err
 		}
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		if _, err := sess.Exec("sp_rename 'task.errors', 'message', 'COLUMN'"); err != nil {
 			return err
 		}
diff --git a/models/migrations/v1_16/v191.go b/models/migrations/v1_16/v191.go
index 2d2c3d1a587a5..c618783c08e86 100644
--- a/models/migrations/v1_16/v191.go
+++ b/models/migrations/v1_16/v191.go
@@ -16,7 +16,7 @@ func AlterIssueAndCommentTextFieldsToLongText(x *xorm.Engine) error {
 		return err
 	}
 
-	if setting.Database.UseMySQL {
+	if setting.Database.Type.IsMySQL() {
 		if _, err := sess.Exec("ALTER TABLE `issue` CHANGE `content` `content` LONGTEXT"); err != nil {
 			return err
 		}
diff --git a/models/migrations/v1_17/v217.go b/models/migrations/v1_17/v217.go
index 3ca9215f09378..3f970b68a540d 100644
--- a/models/migrations/v1_17/v217.go
+++ b/models/migrations/v1_17/v217.go
@@ -16,7 +16,7 @@ func AlterHookTaskTextFieldsToLongText(x *xorm.Engine) error {
 		return err
 	}
 
-	if setting.Database.UseMySQL {
+	if setting.Database.Type.IsMySQL() {
 		if _, err := sess.Exec("ALTER TABLE `hook_task` CHANGE `payload_content` `payload_content` LONGTEXT, CHANGE `request_content` `request_content` LONGTEXT, change `response_content` `response_content` LONGTEXT"); err != nil {
 			return err
 		}
diff --git a/models/migrations/v1_17/v218.go b/models/migrations/v1_17/v218.go
index 675fd1df94fb3..ae91ba0c494bc 100644
--- a/models/migrations/v1_17/v218.go
+++ b/models/migrations/v1_17/v218.go
@@ -38,7 +38,7 @@ func (*improveActionTableIndicesAction) TableIndices() []*schemas.Index {
 	actUserIndex := schemas.NewIndex("au_r_c_u_d", schemas.IndexType)
 	actUserIndex.AddColumn("act_user_id", "repo_id", "created_unix", "user_id", "is_deleted")
 	indices := []*schemas.Index{actUserIndex, repoIndex}
-	if setting.Database.UsePostgreSQL {
+	if setting.Database.Type.IsPostgreSQL() {
 		cudIndex := schemas.NewIndex("c_u_d", schemas.IndexType)
 		cudIndex.AddColumn("created_unix", "user_id", "is_deleted")
 		indices = append(indices, cudIndex)
diff --git a/models/migrations/v1_17/v223.go b/models/migrations/v1_17/v223.go
index a23d9916b383a..6c61dbc53ae48 100644
--- a/models/migrations/v1_17/v223.go
+++ b/models/migrations/v1_17/v223.go
@@ -65,11 +65,11 @@ func RenameCredentialIDBytes(x *xorm.Engine) error {
 		}
 
 		switch {
-		case setting.Database.UseMySQL:
+		case setting.Database.Type.IsMySQL():
 			if _, err := sess.Exec("ALTER TABLE `webauthn_credential` CHANGE credential_id_bytes credential_id VARBINARY(1024)"); err != nil {
 				return err
 			}
-		case setting.Database.UseMSSQL:
+		case setting.Database.Type.IsMSSQL():
 			if _, err := sess.Exec("sp_rename 'webauthn_credential.credential_id_bytes', 'credential_id', 'COLUMN'"); err != nil {
 				return err
 			}
diff --git a/models/migrations/v1_18/v225.go b/models/migrations/v1_18/v225.go
index 786772c143bd0..b0ac3777fc248 100644
--- a/models/migrations/v1_18/v225.go
+++ b/models/migrations/v1_18/v225.go
@@ -16,7 +16,7 @@ func AlterPublicGPGKeyContentFieldsToMediumText(x *xorm.Engine) error {
 		return err
 	}
 
-	if setting.Database.UseMySQL {
+	if setting.Database.Type.IsMySQL() {
 		if _, err := sess.Exec("ALTER TABLE `gpg_key` CHANGE `content` `content` MEDIUMTEXT"); err != nil {
 			return err
 		}
diff --git a/models/migrations/v1_19/v232.go b/models/migrations/v1_19/v232.go
index 89b595c54375f..9caf587c1e9ca 100644
--- a/models/migrations/v1_19/v232.go
+++ b/models/migrations/v1_19/v232.go
@@ -16,7 +16,7 @@ func AlterPackageVersionMetadataToLongText(x *xorm.Engine) error {
 		return err
 	}
 
-	if setting.Database.UseMySQL {
+	if setting.Database.Type.IsMySQL() {
 		if _, err := sess.Exec("ALTER TABLE `package_version` MODIFY COLUMN `metadata_json` LONGTEXT"); err != nil {
 			return err
 		}
diff --git a/models/migrations/v1_19/v242.go b/models/migrations/v1_19/v242.go
index 517c7767b874c..4470835214f34 100644
--- a/models/migrations/v1_19/v242.go
+++ b/models/migrations/v1_19/v242.go
@@ -17,7 +17,7 @@ func AlterPublicGPGKeyImportContentFieldToMediumText(x *xorm.Engine) error {
 		return err
 	}
 
-	if setting.Database.UseMySQL {
+	if setting.Database.Type.IsMySQL() {
 		if _, err := sess.Exec("ALTER TABLE `gpg_key_import` CHANGE `content` `content` MEDIUMTEXT"); err != nil {
 			return err
 		}
diff --git a/models/project/project.go b/models/project/project.go
index 46b5c07c424f1..f3ed723030cdb 100644
--- a/models/project/project.go
+++ b/models/project/project.go
@@ -409,7 +409,7 @@ func DeleteProjectByID(ctx context.Context, id int64) error {
 
 func DeleteProjectByRepoID(ctx context.Context, repoID int64) error {
 	switch {
-	case setting.Database.UseSQLite3:
+	case setting.Database.Type.IsSQLite3():
 		if _, err := db.GetEngine(ctx).Exec("DELETE FROM project_issue WHERE project_issue.id IN (SELECT project_issue.id FROM project_issue INNER JOIN project WHERE project.id = project_issue.project_id AND project.repo_id = ?)", repoID); err != nil {
 			return err
 		}
@@ -419,7 +419,7 @@ func DeleteProjectByRepoID(ctx context.Context, repoID int64) error {
 		if _, err := db.GetEngine(ctx).Table("project").Where("repo_id = ? ", repoID).Delete(&Project{}); err != nil {
 			return err
 		}
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		if _, err := db.GetEngine(ctx).Exec("DELETE FROM project_issue USING project WHERE project.id = project_issue.project_id AND project.repo_id = ? ", repoID); err != nil {
 			return err
 		}
diff --git a/models/repo/repo_list.go b/models/repo/repo_list.go
index d64368daa6b28..d9cd905a1936a 100644
--- a/models/repo/repo_list.go
+++ b/models/repo/repo_list.go
@@ -498,7 +498,7 @@ func SearchRepositoryCondition(opts *SearchRepoOptions) builder.Cond {
 		subQueryCond := builder.NewCond()
 
 		// Topic checking. Topics are present.
-		if setting.Database.UsePostgreSQL { // postgres stores the topics as json and not as text
+		if setting.Database.Type.IsPostgreSQL() { // postgres stores the topics as json and not as text
 			subQueryCond = subQueryCond.Or(builder.And(builder.NotNull{"topics"}, builder.Neq{"(topics)::text": "[]"}))
 		} else {
 			subQueryCond = subQueryCond.Or(builder.And(builder.Neq{"topics": "null"}, builder.Neq{"topics": "[]"}))
diff --git a/models/unittest/testdb.go b/models/unittest/testdb.go
index 2bc41084ba872..cff1489a7c7bc 100644
--- a/models/unittest/testdb.go
+++ b/models/unittest/testdb.go
@@ -76,7 +76,7 @@ func MainTest(m *testing.M, testOpts *TestOptions) {
 	setting.SSH.BuiltinServerUser = "builtinuser"
 	setting.SSH.Port = 3000
 	setting.SSH.Domain = "try.gitea.io"
-	setting.Database.UseSQLite3 = true
+	setting.Database.Type = "sqlite3"
 	setting.Repository.DefaultBranch = "master" // many test code still assume that default branch is called "master"
 	repoRootPath, err := os.MkdirTemp(os.TempDir(), "repos")
 	if err != nil {
diff --git a/modules/doctor/dbconsistency.go b/modules/doctor/dbconsistency.go
index bb560ac6a350b..541fc736f44b6 100644
--- a/modules/doctor/dbconsistency.go
+++ b/modules/doctor/dbconsistency.go
@@ -155,7 +155,7 @@ func checkDBConsistency(ctx context.Context, logger log.Logger, autofix bool) er
 
 	// TODO: function to recalc all counters
 
-	if setting.Database.UsePostgreSQL {
+	if setting.Database.Type.IsPostgreSQL() {
 		consistencyChecks = append(consistencyChecks, consistencyCheck{
 			Name:         "Sequence values",
 			Counter:      db.CountBadSequences,
diff --git a/modules/setting/database.go b/modules/setting/database.go
index 49865a38a2840..d7a5078fe914e 100644
--- a/modules/setting/database.go
+++ b/modules/setting/database.go
@@ -27,7 +27,7 @@ var (
 
 	// Database holds the database settings
 	Database = struct {
-		Type              string
+		Type              DatabaseType
 		Host              string
 		Name              string
 		User              string
@@ -39,10 +39,6 @@ var (
 		Charset           string
 		Timeout           int // seconds
 		SQLiteJournalMode string
-		UseSQLite3        bool
-		UseMySQL          bool
-		UseMSSQL          bool
-		UsePostgreSQL     bool
 		DBConnectRetries  int
 		DBConnectBackoff  time.Duration
 		MaxIdleConns      int
@@ -59,24 +55,13 @@ var (
 // LoadDBSetting loads the database settings
 func LoadDBSetting() {
 	sec := CfgProvider.Section("database")
-	Database.Type = sec.Key("DB_TYPE").String()
+	Database.Type = DatabaseType(sec.Key("DB_TYPE").String())
 	defaultCharset := "utf8"
-	Database.UseMySQL = false
-	Database.UseSQLite3 = false
-	Database.UsePostgreSQL = false
-	Database.UseMSSQL = false
 
-	switch Database.Type {
-	case "sqlite3":
-		Database.UseSQLite3 = true
-	case "mysql":
-		Database.UseMySQL = true
+	if Database.Type.IsMySQL() {
 		defaultCharset = "utf8mb4"
-	case "postgres":
-		Database.UsePostgreSQL = true
-	case "mssql":
-		Database.UseMSSQL = true
 	}
+
 	Database.Host = sec.Key("HOST").String()
 	Database.Name = sec.Key("NAME").String()
 	Database.User = sec.Key("USER").String()
@@ -86,7 +71,7 @@ func LoadDBSetting() {
 	Database.Schema = sec.Key("SCHEMA").String()
 	Database.SSLMode = sec.Key("SSL_MODE").MustString("disable")
 	Database.Charset = sec.Key("CHARSET").In(defaultCharset, []string{"utf8", "utf8mb4"})
-	if Database.UseMySQL && defaultCharset != "utf8mb4" {
+	if Database.Type.IsMySQL() && defaultCharset != "utf8mb4" {
 		log.Error("Deprecated database mysql charset utf8 support, please use utf8mb4 or convert utf8 to utf8mb4.")
 	}
 
@@ -95,7 +80,7 @@ func LoadDBSetting() {
 	Database.SQLiteJournalMode = sec.Key("SQLITE_JOURNAL_MODE").MustString("")
 
 	Database.MaxIdleConns = sec.Key("MAX_IDLE_CONNS").MustInt(2)
-	if Database.UseMySQL {
+	if Database.Type.IsMySQL() {
 		Database.ConnMaxLifetime = sec.Key("CONN_MAX_LIFETIME").MustDuration(3 * time.Second)
 	} else {
 		Database.ConnMaxLifetime = sec.Key("CONN_MAX_LIFETIME").MustDuration(0)
@@ -207,3 +192,25 @@ func ParseMSSQLHostPort(info string) (string, string) {
 	}
 	return host, port
 }
+
+type DatabaseType string
+
+func (t DatabaseType) String() string {
+	return string(t)
+}
+
+func (t DatabaseType) IsSQLite3() bool {
+	return t == "sqlite3"
+}
+
+func (t DatabaseType) IsMySQL() bool {
+	return t == "mysql"
+}
+
+func (t DatabaseType) IsMSSQL() bool {
+	return t == "mssql"
+}
+
+func (t DatabaseType) IsPostgreSQL() bool {
+	return t == "postgres"
+}
diff --git a/routers/init.go b/routers/init.go
index d3f822dc8345a..8cf53fc108de0 100644
--- a/routers/init.go
+++ b/routers/init.go
@@ -141,7 +141,7 @@ func GlobalInitInstalled(ctx context.Context) {
 
 	if setting.EnableSQLite3 {
 		log.Info("SQLite3 support is enabled")
-	} else if setting.Database.UseSQLite3 {
+	} else if setting.Database.Type.IsSQLite3() {
 		log.Fatal("SQLite3 support is disabled, but it is used for database setting. Please get or build a Gitea release with SQLite3 support.")
 	}
 
diff --git a/routers/install/install.go b/routers/install/install.go
index a377c2950ba31..8e2d19c73271e 100644
--- a/routers/install/install.go
+++ b/routers/install/install.go
@@ -104,7 +104,7 @@ func Install(ctx *context.Context) {
 	form.DbSchema = setting.Database.Schema
 	form.Charset = setting.Database.Charset
 
-	curDBType := setting.Database.Type
+	curDBType := setting.Database.Type.String()
 	var isCurDBTypeSupported bool
 	for _, dbType := range setting.SupportedDatabaseTypes {
 		if dbType == curDBType {
@@ -272,7 +272,7 @@ func SubmitInstall(ctx *context.Context) {
 	// ---- Basic checks are passed, now test configuration.
 
 	// Test database setting.
-	setting.Database.Type = form.DbType
+	setting.Database.Type = setting.DatabaseType(form.DbType)
 	setting.Database.Host = form.DbHost
 	setting.Database.User = form.DbUser
 	setting.Database.Passwd = form.DbPasswd
@@ -392,7 +392,7 @@ func SubmitInstall(ctx *context.Context) {
 			log.Error("Failed to load custom conf '%s': %v", setting.CustomConf, err)
 		}
 	}
-	cfg.Section("database").Key("DB_TYPE").SetValue(setting.Database.Type)
+	cfg.Section("database").Key("DB_TYPE").SetValue(setting.Database.Type.String())
 	cfg.Section("database").Key("HOST").SetValue(setting.Database.Host)
 	cfg.Section("database").Key("NAME").SetValue(setting.Database.Name)
 	cfg.Section("database").Key("USER").SetValue(setting.Database.User)
diff --git a/routers/web/healthcheck/check.go b/routers/web/healthcheck/check.go
index 1142a0aec5d55..e11dd2aca2e80 100644
--- a/routers/web/healthcheck/check.go
+++ b/routers/web/healthcheck/check.go
@@ -100,7 +100,7 @@ func checkDatabase(checks checks) status {
 		st.Time = getCheckTime()
 	}
 
-	if setting.Database.UseSQLite3 && st.Status == pass {
+	if setting.Database.Type.IsSQLite3() && st.Status == pass {
 		if !setting.EnableSQLite3 {
 			st.Status = fail
 			st.Time = getCheckTime()
diff --git a/tests/integration/markup_external_test.go b/tests/integration/markup_external_test.go
index 6ea0226ec6203..c0e08a4f4f1f2 100644
--- a/tests/integration/markup_external_test.go
+++ b/tests/integration/markup_external_test.go
@@ -19,7 +19,7 @@ import (
 
 func TestExternalMarkupRenderer(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-	if !setting.Database.UseSQLite3 {
+	if !setting.Database.Type.IsSQLite3() {
 		t.Skip()
 		return
 	}
diff --git a/tests/integration/migration-test/migration_test.go b/tests/integration/migration-test/migration_test.go
index f030f566ce44f..4152379a9b80a 100644
--- a/tests/integration/migration-test/migration_test.go
+++ b/tests/integration/migration-test/migration_test.go
@@ -94,7 +94,7 @@ func availableVersions() ([]string, error) {
 		return nil, err
 	}
 	defer migrationsDir.Close()
-	versionRE, err := regexp.Compile("gitea-v(?P<version>.+)\\." + regexp.QuoteMeta(setting.Database.Type) + "\\.sql.gz")
+	versionRE, err := regexp.Compile("gitea-v(?P<version>.+)\\." + regexp.QuoteMeta(setting.Database.Type.String()) + "\\.sql.gz")
 	if err != nil {
 		return nil, err
 	}
@@ -149,7 +149,7 @@ func restoreOldDB(t *testing.T, version string) bool {
 	}
 
 	switch {
-	case setting.Database.UseSQLite3:
+	case setting.Database.Type.IsSQLite3():
 		util.Remove(setting.Database.Path)
 		err := os.MkdirAll(path.Dir(setting.Database.Path), os.ModePerm)
 		assert.NoError(t, err)
@@ -162,7 +162,7 @@ func restoreOldDB(t *testing.T, version string) bool {
 		assert.NoError(t, err)
 		db.Close()
 
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		db, err := sql.Open("mysql", fmt.Sprintf("%s:%s@tcp(%s)/",
 			setting.Database.User, setting.Database.Passwd, setting.Database.Host))
 		assert.NoError(t, err)
@@ -184,7 +184,7 @@ func restoreOldDB(t *testing.T, version string) bool {
 		assert.NoError(t, err)
 		db.Close()
 
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		var db *sql.DB
 		var err error
 		if setting.Database.Host[0] == '/' {
@@ -252,7 +252,7 @@ func restoreOldDB(t *testing.T, version string) bool {
 		assert.NoError(t, err)
 		db.Close()
 
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		host, port := setting.ParseMSSQLHostPort(setting.Database.Host)
 		db, err := sql.Open("mssql", fmt.Sprintf("server=%s; port=%s; database=%s; user id=%s; password=%s;",
 			host, port, "master", setting.Database.User, setting.Database.Passwd))
diff --git a/tests/test_utils.go b/tests/test_utils.go
index 5cc31b814ed4e..e3e5becfbedf3 100644
--- a/tests/test_utils.go
+++ b/tests/test_utils.go
@@ -74,7 +74,7 @@ func InitTest(requireGitea bool) {
 	}
 
 	switch {
-	case setting.Database.UseMySQL:
+	case setting.Database.Type.IsMySQL():
 		connType := "tcp"
 		if len(setting.Database.Host) > 0 && setting.Database.Host[0] == '/' { // looks like a unix socket
 			connType = "unix"
@@ -89,7 +89,7 @@ func InitTest(requireGitea bool) {
 		if _, err = db.Exec(fmt.Sprintf("CREATE DATABASE IF NOT EXISTS %s", setting.Database.Name)); err != nil {
 			log.Fatal("db.Exec: %v", err)
 		}
-	case setting.Database.UsePostgreSQL:
+	case setting.Database.Type.IsPostgreSQL():
 		var db *sql.DB
 		var err error
 		if setting.Database.Host[0] == '/' {
@@ -146,7 +146,7 @@ func InitTest(requireGitea bool) {
 			}
 		}
 
-	case setting.Database.UseMSSQL:
+	case setting.Database.Type.IsMSSQL():
 		host, port := setting.ParseMSSQLHostPort(setting.Database.Host)
 		db, err := sql.Open("mssql", fmt.Sprintf("server=%s; port=%s; database=%s; user id=%s; password=%s;",
 			host, port, "master", setting.Database.User, setting.Database.Passwd))

From 4c59c8c7682da31410decba3bd868fde5116e073 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Tue, 7 Mar 2023 20:11:24 +0800
Subject: [PATCH 10/53] Fix various ImageDiff/SVG bugs (#23312)

Replace #23310, Close #19733

And fix various UI problems, including regressions from #22959 #22950
and more.

## SVG Detection

The old regexp may mismatch non-SVG files. This PR adds new tests for
those cases.

## UI Changes

### Before

![image](https://user-images.githubusercontent.com/2114189/222967716-f6ad8721-f46a-4a3f-9eb0-a89e488d3436.png)

![image](https://user-images.githubusercontent.com/2114189/222967780-8af8981a-e69d-4304-9dc4-0235582fa4f4.png)

### After

![image](https://user-images.githubusercontent.com/2114189/222967575-c21c23d4-0200-4e09-aac3-57895e853000.png)

![image](https://user-images.githubusercontent.com/2114189/222967585-8b8da262-bc96-441a-9851-8d3845f2659d.png)

![image](https://user-images.githubusercontent.com/2114189/222967595-58d9bea5-6df4-41fa-bf8a-86704117959d.png)

![image](https://user-images.githubusercontent.com/2114189/222967608-38757c1a-b8bd-4ebf-b7a8-3b30edb7f303.png)

![image](https://user-images.githubusercontent.com/2114189/222967623-9849a339-6fae-4484-8fa5-939e2fdacbf5.png)

![image](https://user-images.githubusercontent.com/2114189/222967633-4383d7dd-62ba-47a3-8c10-86f7ca7757ae.png)

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 modules/typesniffer/typesniffer.go      | 21 +++++++++++++++------
 modules/typesniffer/typesniffer_test.go | 25 ++++++++++++++++++++++++-
 web_src/js/features/imagediff.js        | 15 +++++++--------
 web_src/less/features/imagediff.less    |  5 +++--
 4 files changed, 49 insertions(+), 17 deletions(-)

diff --git a/modules/typesniffer/typesniffer.go b/modules/typesniffer/typesniffer.go
index c9fef953ce703..5b215496b80c8 100644
--- a/modules/typesniffer/typesniffer.go
+++ b/modules/typesniffer/typesniffer.go
@@ -4,6 +4,7 @@
 package typesniffer
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"net/http"
@@ -24,8 +25,9 @@ const (
 )
 
 var (
-	svgTagRegex      = regexp.MustCompile(`(?si)\A\s*(?:(<!--.*?-->|<!DOCTYPE\s+svg([\s:]+.*?>|>))\s*)*<svg[\s>\/]`)
-	svgTagInXMLRegex = regexp.MustCompile(`(?si)\A<\?xml\b.*?\?>\s*(?:(<!--.*?-->|<!DOCTYPE\s+svg([\s:]+.*?>|>))\s*)*<svg[\s>\/]`)
+	svgComment       = regexp.MustCompile(`(?s)<!--.*?-->`)
+	svgTagRegex      = regexp.MustCompile(`(?si)\A\s*(?:(<!DOCTYPE\s+svg([\s:]+.*?>|>))\s*)*<svg\b`)
+	svgTagInXMLRegex = regexp.MustCompile(`(?si)\A<\?xml\b.*?\?>\s*(?:(<!DOCTYPE\s+svg([\s:]+.*?>|>))\s*)*<svg\b`)
 )
 
 // SniffedType contains information about a blobs type.
@@ -91,10 +93,17 @@ func DetectContentType(data []byte) SniffedType {
 		data = data[:sniffLen]
 	}
 
-	if (strings.Contains(ct, "text/plain") || strings.Contains(ct, "text/html")) && svgTagRegex.Match(data) ||
-		strings.Contains(ct, "text/xml") && svgTagInXMLRegex.Match(data) {
-		// SVG is unsupported. https://github.com/golang/go/issues/15888
-		ct = SvgMimeType
+	// SVG is unsupported by http.DetectContentType, https://github.com/golang/go/issues/15888
+
+	detectByHTML := strings.Contains(ct, "text/plain") || strings.Contains(ct, "text/html")
+	detectByXML := strings.Contains(ct, "text/xml")
+	if detectByHTML || detectByXML {
+		dataProcessed := svgComment.ReplaceAll(data, nil)
+		dataProcessed = bytes.TrimSpace(dataProcessed)
+		if detectByHTML && svgTagRegex.Match(dataProcessed) ||
+			detectByXML && svgTagInXMLRegex.Match(dataProcessed) {
+			ct = SvgMimeType
+		}
 	}
 
 	return SniffedType{ct}
diff --git a/modules/typesniffer/typesniffer_test.go b/modules/typesniffer/typesniffer_test.go
index dbce94fc3bdd9..2bafdffd141c3 100644
--- a/modules/typesniffer/typesniffer_test.go
+++ b/modules/typesniffer/typesniffer_test.go
@@ -28,7 +28,6 @@ func TestIsSvgImage(t *testing.T) {
 	assert.True(t, DetectContentType([]byte("<svg></svg>")).IsSvgImage())
 	assert.True(t, DetectContentType([]byte("    <svg></svg>")).IsSvgImage())
 	assert.True(t, DetectContentType([]byte(`<svg width="100"></svg>`)).IsSvgImage())
-	assert.True(t, DetectContentType([]byte("<svg/>")).IsSvgImage())
 	assert.True(t, DetectContentType([]byte(`<?xml version="1.0" encoding="UTF-8"?><svg></svg>`)).IsSvgImage())
 	assert.True(t, DetectContentType([]byte(`<!-- Comment -->
 	<svg></svg>`)).IsSvgImage())
@@ -57,6 +56,10 @@ func TestIsSvgImage(t *testing.T) {
 	<!-- Multline
 	Comment -->
 	<svg></svg>`)).IsSvgImage())
+
+	// the DetectContentType should work for incomplete data, because only beginning bytes are used for detection
+	assert.True(t, DetectContentType([]byte(`<svg>....`)).IsSvgImage())
+
 	assert.False(t, DetectContentType([]byte{}).IsSvgImage())
 	assert.False(t, DetectContentType([]byte("svg")).IsSvgImage())
 	assert.False(t, DetectContentType([]byte("<svgfoo></svgfoo>")).IsSvgImage())
@@ -68,6 +71,26 @@ func TestIsSvgImage(t *testing.T) {
 	assert.False(t, DetectContentType([]byte(`<?xml version="1.0" encoding="UTF-8"?>
 	<!-- <svg></svg> inside comment -->
 	<foo></foo>`)).IsSvgImage())
+
+	assert.False(t, DetectContentType([]byte(`
+<!-- comment1 -->
+<div>
+	<!-- comment2 -->
+	<svg></svg>
+</div>
+`)).IsSvgImage())
+
+	assert.False(t, DetectContentType([]byte(`
+<!-- comment1
+-->
+<div>
+	<!-- comment2
+-->
+	<svg></svg>
+</div>
+`)).IsSvgImage())
+	assert.False(t, DetectContentType([]byte(`<html><body><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg></svg></body></html>`)).IsSvgImage())
+	assert.False(t, DetectContentType([]byte(`<html><body><?xml version="1.0" encoding="UTF-8"?><svg></svg></body></html>`)).IsSvgImage())
 }
 
 func TestIsPDF(t *testing.T) {
diff --git a/web_src/js/features/imagediff.js b/web_src/js/features/imagediff.js
index 7a285f1f8dbcf..a26b927c33de6 100644
--- a/web_src/js/features/imagediff.js
+++ b/web_src/js/features/imagediff.js
@@ -129,8 +129,8 @@ export function initImageDiff() {
         initOverlay(createContext($imageAfter[2], $imageBefore[2]));
       }
 
-      hideElem($container.find('> .loader'));
       $container.find('> .gt-hidden').removeClass('gt-hidden');
+      hideElem($container.find('.ui.loader'));
     }
 
     function initSideBySide(sizes) {
@@ -155,7 +155,7 @@ export function initImageDiff() {
         height: sizes.size1.height * factor
       });
       sizes.image1.parent().css({
-        margin: `${sizes.ratio[1] * factor + 15}px ${sizes.ratio[0] * factor}px ${sizes.ratio[1] * factor}px`,
+        margin: `10px auto`,
         width: sizes.size1.width * factor + 2,
         height: sizes.size1.height * factor + 2
       });
@@ -164,7 +164,7 @@ export function initImageDiff() {
         height: sizes.size2.height * factor
       });
       sizes.image2.parent().css({
-        margin: `${sizes.ratio[3] * factor}px ${sizes.ratio[2] * factor}px`,
+        margin: `10px auto`,
         width: sizes.size2.width * factor + 2,
         height: sizes.size2.height * factor + 2
       });
@@ -255,13 +255,12 @@ export function initImageDiff() {
         width: sizes.size2.width * factor + 2,
         height: sizes.size2.height * factor + 2
       });
+
+      // some inner elements are `position: absolute`, so the container's height must be large enough
+      // the "css(width, height)" is somewhat hacky and not easy to understand, it could be improved in the future
       sizes.image2.parent().parent().css({
         width: sizes.max.width * factor + 2,
-        height: sizes.max.height * factor + 2
-      });
-      $container.find('.onion-skin').css({
-        width: sizes.max.width * factor + 2,
-        height: sizes.max.height * factor + 4
+        height: sizes.max.height * factor + 2 + 20 /* extra height for inner "position: absolute" elements */,
       });
 
       const $range = $container.find("input[type='range']");
diff --git a/web_src/less/features/imagediff.less b/web_src/less/features/imagediff.less
index a9ba7f8c8f362..07763c15e1261 100644
--- a/web_src/less/features/imagediff.less
+++ b/web_src/less/features/imagediff.less
@@ -1,6 +1,6 @@
 .image-diff-container {
   text-align: center;
-  padding: 30px 0;
+  padding: 1em 0;
 
   img {
     border: 1px solid var(--color-primary-light-7);
@@ -22,6 +22,7 @@
       display: inline-block;
       line-height: 0;
       vertical-align: top;
+      margin: 0 1em;
 
       .side-header {
         font-weight: bold;
@@ -98,7 +99,7 @@
     }
 
     input {
-      width: 300px;
+      max-width: 300px;
     }
   }
 }

From a2f44463f07cc184b0d6ca1655d1f26d75491896 Mon Sep 17 00:00:00 2001
From: Hester Gong <hestergong@gmail.com>
Date: Tue, 7 Mar 2023 23:08:22 +0800
Subject: [PATCH 11/53] Fix adding of empty class name (#23352)

This PR is to fix the error shown below. The reason is because
[`class-name`
prop](https://github.com/go-gitea/gitea/blob/main/web_src/js/components/ActionRunStatus.vue#L6)
given to `svg` component has a space, and classList cannot add empty
string.

https://user-images.githubusercontent.com/17645053/223346720-c7f9de43-5e69-4ecf-93c0-90bf04090693.mov

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 web_src/js/svg.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/web_src/js/svg.js b/web_src/js/svg.js
index 2132ad312037c..6476f16bfb3eb 100644
--- a/web_src/js/svg.js
+++ b/web_src/js/svg.js
@@ -80,7 +80,8 @@ export function svg(name, size = 16, className = '') {
   const svgNode = document.firstChild;
   if (size !== 16) svgNode.setAttribute('width', String(size));
   if (size !== 16) svgNode.setAttribute('height', String(size));
-  if (className) svgNode.classList.add(...className.split(/\s+/));
+  // filter array to remove empty string
+  if (className) svgNode.classList.add(...className.split(/\s+/).filter(Boolean));
   return serializer.serializeToString(svgNode);
 }
 

From 8598356df1eb21b6e33ecb9f9268ba36c5488e7c Mon Sep 17 00:00:00 2001
From: zeripath <art27@cantab.net>
Date: Tue, 7 Mar 2023 20:07:35 +0000
Subject: [PATCH 12/53] Refactor and tidy-up the merge/update branch code
 (#22568)

The merge and update branch code was previously a little tangled and had
some very long functions. The functions were not very clear in their
reasoning and there were deficiencies in their logging and at least one
bug in the handling of LFS for update by rebase.

This PR substantially refactors this code and splits things out to into
separate functions. It also attempts to tidy up the calls by wrapping
things in "context"s. There are also attempts to improve logging when
there are errors.

Signed-off-by: Andrew Thornton <art27@cantab.net>

---------

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: delvh <dev.lh@web.de>
---
 modules/git/pipeline/revlist.go |   5 +-
 services/pull/lfs.go            |   2 +-
 services/pull/merge.go          | 495 +++++---------------------------
 services/pull/merge_merge.go    |  25 ++
 services/pull/merge_prepare.go  | 297 +++++++++++++++++++
 services/pull/merge_rebase.go   |  50 ++++
 services/pull/merge_squash.go   |  53 ++++
 services/pull/patch.go          |  17 +-
 services/pull/pull.go           |  14 +-
 services/pull/temp_repo.go      | 194 ++++++-------
 services/pull/update.go         | 105 ++++---
 services/pull/update_rebase.go  | 107 +++++++
 12 files changed, 757 insertions(+), 607 deletions(-)
 create mode 100644 services/pull/merge_merge.go
 create mode 100644 services/pull/merge_prepare.go
 create mode 100644 services/pull/merge_rebase.go
 create mode 100644 services/pull/merge_squash.go
 create mode 100644 services/pull/update_rebase.go

diff --git a/modules/git/pipeline/revlist.go b/modules/git/pipeline/revlist.go
index 09bb2c8b3c844..d88ebe78ef200 100644
--- a/modules/git/pipeline/revlist.go
+++ b/modules/git/pipeline/revlist.go
@@ -42,7 +42,10 @@ func RevListObjects(ctx context.Context, revListWriter *io.PipeWriter, wg *sync.
 	defer revListWriter.Close()
 	stderr := new(bytes.Buffer)
 	var errbuf strings.Builder
-	cmd := git.NewCommand(ctx, "rev-list", "--objects").AddDynamicArguments(headSHA).AddArguments("--not").AddDynamicArguments(baseSHA)
+	cmd := git.NewCommand(ctx, "rev-list", "--objects").AddDynamicArguments(headSHA)
+	if baseSHA != "" {
+		cmd = cmd.AddArguments("--not").AddDynamicArguments(baseSHA)
+	}
 	if err := cmd.Run(&git.RunOpts{
 		Dir:    tmpBasePath,
 		Stdout: revListWriter,
diff --git a/services/pull/lfs.go b/services/pull/lfs.go
index dc4ca006e4915..39433724684e1 100644
--- a/services/pull/lfs.go
+++ b/services/pull/lfs.go
@@ -116,7 +116,7 @@ func createLFSMetaObjectsFromCatFileBatch(catFileBatchReader *io.PipeReader, wg
 		}
 
 		// Then we need to check that this pointer is in the db
-		if _, err := git_model.GetLFSMetaObjectByOid(db.DefaultContext, pr.HeadRepo.ID, pointer.Oid); err != nil {
+		if _, err := git_model.GetLFSMetaObjectByOid(db.DefaultContext, pr.HeadRepoID, pointer.Oid); err != nil {
 			if err == git_model.ErrLFSObjectNotExist {
 				log.Warn("During merge of: %d in %-v, there is a pointer to LFS Oid: %s which although present in the LFS store is not associated with the head repo %-v", pr.Index, pr.BaseRepo, pointer.Oid, pr.HeadRepo)
 				continue
diff --git a/services/pull/merge.go b/services/pull/merge.go
index ad428427cc187..afa924fc109ac 100644
--- a/services/pull/merge.go
+++ b/services/pull/merge.go
@@ -5,8 +5,6 @@
 package pull
 
 import (
-	"bufio"
-	"bytes"
 	"context"
 	"fmt"
 	"os"
@@ -14,7 +12,6 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
-	"time"
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
@@ -34,22 +31,17 @@ import (
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
 	issue_service "code.gitea.io/gitea/services/issue"
 )
 
 // GetDefaultMergeMessage returns default message used when merging pull request
 func GetDefaultMergeMessage(ctx context.Context, baseGitRepo *git.Repository, pr *issues_model.PullRequest, mergeStyle repo_model.MergeStyle) (message, body string, err error) {
-	if err := pr.LoadHeadRepo(ctx); err != nil {
-		return "", "", err
-	}
 	if err := pr.LoadBaseRepo(ctx); err != nil {
 		return "", "", err
 	}
-	if pr.BaseRepo == nil {
-		return "", "", repo_model.ErrRepoNotExist{ID: pr.BaseRepoID}
+	if err := pr.LoadHeadRepo(ctx); err != nil {
+		return "", "", err
 	}
-
 	if err := pr.LoadIssue(ctx); err != nil {
 		return "", "", err
 	}
@@ -144,18 +136,19 @@ func expandDefaultMergeMessage(template string, vars map[string]string) (message
 // Merge merges pull request to base repository.
 // Caller should check PR is ready to be merged (review and status checks)
 func Merge(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, baseGitRepo *git.Repository, mergeStyle repo_model.MergeStyle, expectedHeadCommitID, message string, wasAutoMerged bool) error {
-	if err := pr.LoadHeadRepo(ctx); err != nil {
-		log.Error("LoadHeadRepo: %v", err)
-		return fmt.Errorf("LoadHeadRepo: %w", err)
-	} else if err := pr.LoadBaseRepo(ctx); err != nil {
-		log.Error("LoadBaseRepo: %v", err)
-		return fmt.Errorf("LoadBaseRepo: %w", err)
+	if err := pr.LoadBaseRepo(ctx); err != nil {
+		log.Error("Unable to load base repo: %v", err)
+		return fmt.Errorf("unable to load base repo: %w", err)
+	} else if err := pr.LoadHeadRepo(ctx); err != nil {
+		log.Error("Unable to load head repo: %v", err)
+		return fmt.Errorf("unable to load head repo: %w", err)
 	}
 
 	pullWorkingPool.CheckIn(fmt.Sprint(pr.ID))
 	defer pullWorkingPool.CheckOut(fmt.Sprint(pr.ID))
 
 	// Removing an auto merge pull and ignore if not exist
+	// FIXME: is this the correct point to do this? Shouldn't this be after IsMergeStyleAllowed?
 	if err := pull_model.DeleteScheduledAutoMerge(ctx, pr.ID); err != nil && !db.IsErrNotExist(err) {
 		return err
 	}
@@ -179,7 +172,7 @@ func Merge(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.U
 	// Run the merge in the hammer context to prevent cancellation
 	hammerCtx := graceful.GetManager().HammerContext()
 
-	pr.MergedCommitID, err = rawMerge(hammerCtx, pr, doer, mergeStyle, expectedHeadCommitID, message)
+	pr.MergedCommitID, err = doMergeAndPush(hammerCtx, pr, doer, mergeStyle, expectedHeadCommitID, message)
 	if err != nil {
 		return err
 	}
@@ -189,18 +182,18 @@ func Merge(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.U
 	pr.MergerID = doer.ID
 
 	if _, err := pr.SetMerged(hammerCtx); err != nil {
-		log.Error("SetMerged [%d]: %v", pr.ID, err)
+		log.Error("SetMerged %-v: %v", pr, err)
 	}
 
 	if err := pr.LoadIssue(hammerCtx); err != nil {
-		log.Error("LoadIssue [%d]: %v", pr.ID, err)
+		log.Error("LoadIssue %-v: %v", pr, err)
 	}
 
 	if err := pr.Issue.LoadRepo(hammerCtx); err != nil {
-		log.Error("LoadRepo for issue [%d]: %v", pr.ID, err)
+		log.Error("pr.Issue.LoadRepo %-v: %v", pr, err)
 	}
 	if err := pr.Issue.Repo.LoadOwner(hammerCtx); err != nil {
-		log.Error("LoadOwner for PR [%d]: %v", pr.ID, err)
+		log.Error("LoadOwner for %-v: %v", pr, err)
 	}
 
 	if wasAutoMerged {
@@ -239,326 +232,43 @@ func Merge(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.U
 	return nil
 }
 
-// rawMerge perform the merge operation without changing any pull information in database
-func rawMerge(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, mergeStyle repo_model.MergeStyle, expectedHeadCommitID, message string) (string, error) {
+// doMergeAndPush performs the merge operation without changing any pull information in database and pushes it up to the base repository
+func doMergeAndPush(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, mergeStyle repo_model.MergeStyle, expectedHeadCommitID, message string) (string, error) {
 	// Clone base repo.
-	tmpBasePath, err := createTemporaryRepo(ctx, pr)
+	mergeCtx, cancel, err := createTemporaryRepoForMerge(ctx, pr, doer, expectedHeadCommitID)
 	if err != nil {
-		log.Error("CreateTemporaryPath: %v", err)
 		return "", err
 	}
-	defer func() {
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("Merge: RemoveTemporaryPath: %s", err)
-		}
-	}()
-
-	baseBranch := "base"
-	trackingBranch := "tracking"
-	stagingBranch := "staging"
-
-	if expectedHeadCommitID != "" {
-		trackingCommitID, _, err := git.NewCommand(ctx, "show-ref", "--hash").AddDynamicArguments(git.BranchPrefix + trackingBranch).RunStdString(&git.RunOpts{Dir: tmpBasePath})
-		if err != nil {
-			log.Error("show-ref[%s] --hash refs/heads/trackingn: %v", tmpBasePath, git.BranchPrefix+trackingBranch, err)
-			return "", fmt.Errorf("getDiffTree: %w", err)
-		}
-		if strings.TrimSpace(trackingCommitID) != expectedHeadCommitID {
-			return "", models.ErrSHADoesNotMatch{
-				GivenSHA:   expectedHeadCommitID,
-				CurrentSHA: trackingCommitID,
-			}
-		}
-	}
-
-	var outbuf, errbuf strings.Builder
-
-	// Enable sparse-checkout
-	sparseCheckoutList, err := getDiffTree(ctx, tmpBasePath, baseBranch, trackingBranch)
-	if err != nil {
-		log.Error("getDiffTree(%s, %s, %s): %v", tmpBasePath, baseBranch, trackingBranch, err)
-		return "", fmt.Errorf("getDiffTree: %w", err)
-	}
-
-	infoPath := filepath.Join(tmpBasePath, ".git", "info")
-	if err := os.MkdirAll(infoPath, 0o700); err != nil {
-		log.Error("Unable to create .git/info in %s: %v", tmpBasePath, err)
-		return "", fmt.Errorf("Unable to create .git/info in tmpBasePath: %w", err)
-	}
-
-	sparseCheckoutListPath := filepath.Join(infoPath, "sparse-checkout")
-	if err := os.WriteFile(sparseCheckoutListPath, []byte(sparseCheckoutList), 0o600); err != nil {
-		log.Error("Unable to write .git/info/sparse-checkout file in %s: %v", tmpBasePath, err)
-		return "", fmt.Errorf("Unable to write .git/info/sparse-checkout file in tmpBasePath: %w", err)
-	}
-
-	gitConfigCommand := func() *git.Command {
-		return git.NewCommand(ctx, "config", "--local")
-	}
-
-	// Switch off LFS process (set required, clean and smudge here also)
-	if err := gitConfigCommand().AddArguments("filter.lfs.process", "").
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git config [filter.lfs.process -> <> ]: %v\n%s\n%s", err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("git config [filter.lfs.process -> <> ]: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
-	}
-	outbuf.Reset()
-	errbuf.Reset()
-
-	if err := gitConfigCommand().AddArguments("filter.lfs.required", "false").
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git config [filter.lfs.required -> <false> ]: %v\n%s\n%s", err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("git config [filter.lfs.required -> <false> ]: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
-	}
-	outbuf.Reset()
-	errbuf.Reset()
-
-	if err := gitConfigCommand().AddArguments("filter.lfs.clean", "").
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git config [filter.lfs.clean -> <> ]: %v\n%s\n%s", err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("git config [filter.lfs.clean -> <> ]: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
-	}
-	outbuf.Reset()
-	errbuf.Reset()
-
-	if err := gitConfigCommand().AddArguments("filter.lfs.smudge", "").
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git config [filter.lfs.smudge -> <> ]: %v\n%s\n%s", err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("git config [filter.lfs.smudge -> <> ]: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
-	}
-	outbuf.Reset()
-	errbuf.Reset()
-
-	if err := gitConfigCommand().AddArguments("core.sparseCheckout", "true").
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git config [core.sparseCheckout -> true ]: %v\n%s\n%s", err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("git config [core.sparsecheckout -> true]: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
-	}
-	outbuf.Reset()
-	errbuf.Reset()
-
-	// Read base branch index
-	if err := git.NewCommand(ctx, "read-tree", "HEAD").
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git read-tree HEAD: %v\n%s\n%s", err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("Unable to read base branch in to the index: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
-	}
-	outbuf.Reset()
-	errbuf.Reset()
-
-	sig := doer.NewGitSig()
-	committer := sig
-
-	// Determine if we should sign. If no signKeyID, use --no-gpg-sign to countermand the sign config (from gitconfig)
-	var signArgs git.TrustedCmdArgs
-	sign, signKeyID, signer, _ := asymkey_service.SignMerge(ctx, pr, doer, tmpBasePath, "HEAD", trackingBranch)
-	if sign {
-		if pr.BaseRepo.GetTrustModel() == repo_model.CommitterTrustModel || pr.BaseRepo.GetTrustModel() == repo_model.CollaboratorCommitterTrustModel {
-			committer = signer
-		}
-		signArgs = git.ToTrustedCmdArgs([]string{"-S" + signKeyID})
-	} else {
-		signArgs = append(signArgs, "--no-gpg-sign")
-	}
-
-	commitTimeStr := time.Now().Format(time.RFC3339)
-
-	// Because this may call hooks we should pass in the environment
-	env := append(os.Environ(),
-		"GIT_AUTHOR_NAME="+sig.Name,
-		"GIT_AUTHOR_EMAIL="+sig.Email,
-		"GIT_AUTHOR_DATE="+commitTimeStr,
-		"GIT_COMMITTER_NAME="+committer.Name,
-		"GIT_COMMITTER_EMAIL="+committer.Email,
-		"GIT_COMMITTER_DATE="+commitTimeStr,
-	)
+	defer cancel()
 
 	// Merge commits.
 	switch mergeStyle {
 	case repo_model.MergeStyleMerge:
-		cmd := git.NewCommand(ctx, "merge", "--no-ff", "--no-commit").AddDynamicArguments(trackingBranch)
-		if err := runMergeCommand(pr, mergeStyle, cmd, tmpBasePath); err != nil {
-			log.Error("Unable to merge tracking into base: %v", err)
+		if err := doMergeStyleMerge(mergeCtx, message); err != nil {
 			return "", err
 		}
-
-		if err := commitAndSignNoAuthor(ctx, pr, message, signArgs, tmpBasePath, env); err != nil {
-			log.Error("Unable to make final commit: %v", err)
+	case repo_model.MergeStyleRebase, repo_model.MergeStyleRebaseMerge:
+		if err := doMergeStyleRebase(mergeCtx, mergeStyle, message); err != nil {
 			return "", err
 		}
-	case repo_model.MergeStyleRebase:
-		fallthrough
-	case repo_model.MergeStyleRebaseUpdate:
-		fallthrough
-	case repo_model.MergeStyleRebaseMerge:
-		// Checkout head branch
-		if err := git.NewCommand(ctx, "checkout", "-b").AddDynamicArguments(stagingBranch, trackingBranch).
-			Run(&git.RunOpts{
-				Dir:    tmpBasePath,
-				Stdout: &outbuf,
-				Stderr: &errbuf,
-			}); err != nil {
-			log.Error("git checkout base prior to merge post staging rebase [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-			return "", fmt.Errorf("git checkout base prior to merge post staging rebase  [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-		}
-		outbuf.Reset()
-		errbuf.Reset()
-
-		// Rebase before merging
-		if err := git.NewCommand(ctx, "rebase").AddDynamicArguments(baseBranch).
-			Run(&git.RunOpts{
-				Dir:    tmpBasePath,
-				Stdout: &outbuf,
-				Stderr: &errbuf,
-			}); err != nil {
-			// Rebase will leave a REBASE_HEAD file in .git if there is a conflict
-			if _, statErr := os.Stat(filepath.Join(tmpBasePath, ".git", "REBASE_HEAD")); statErr == nil {
-				var commitSha string
-				ok := false
-				failingCommitPaths := []string{
-					filepath.Join(tmpBasePath, ".git", "rebase-apply", "original-commit"), // Git < 2.26
-					filepath.Join(tmpBasePath, ".git", "rebase-merge", "stopped-sha"),     // Git >= 2.26
-				}
-				for _, failingCommitPath := range failingCommitPaths {
-					if _, statErr := os.Stat(failingCommitPath); statErr == nil {
-						commitShaBytes, readErr := os.ReadFile(failingCommitPath)
-						if readErr != nil {
-							// Abandon this attempt to handle the error
-							log.Error("git rebase staging on to base [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-							return "", fmt.Errorf("git rebase staging on to base [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-						}
-						commitSha = strings.TrimSpace(string(commitShaBytes))
-						ok = true
-						break
-					}
-				}
-				if !ok {
-					log.Error("Unable to determine failing commit sha for this rebase message. Cannot cast as models.ErrRebaseConflicts.")
-					log.Error("git rebase staging on to base [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-					return "", fmt.Errorf("git rebase staging on to base [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-				}
-				log.Debug("RebaseConflict at %s [%s:%s -> %s:%s]: %v\n%s\n%s", commitSha, pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-				return "", models.ErrRebaseConflicts{
-					Style:     mergeStyle,
-					CommitSHA: commitSha,
-					StdOut:    outbuf.String(),
-					StdErr:    errbuf.String(),
-					Err:       err,
-				}
-			}
-			log.Error("git rebase staging on to base [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-			return "", fmt.Errorf("git rebase staging on to base [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-		}
-		outbuf.Reset()
-		errbuf.Reset()
-
-		// not need merge, just update by rebase. so skip
-		if mergeStyle == repo_model.MergeStyleRebaseUpdate {
-			break
-		}
-
-		// Checkout base branch again
-		if err := git.NewCommand(ctx, "checkout").AddDynamicArguments(baseBranch).
-			Run(&git.RunOpts{
-				Dir:    tmpBasePath,
-				Stdout: &outbuf,
-				Stderr: &errbuf,
-			}); err != nil {
-			log.Error("git checkout base prior to merge post staging rebase [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-			return "", fmt.Errorf("git checkout base prior to merge post staging rebase  [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-		}
-		outbuf.Reset()
-		errbuf.Reset()
-
-		cmd := git.NewCommand(ctx, "merge")
-		if mergeStyle == repo_model.MergeStyleRebase {
-			cmd.AddArguments("--ff-only")
-		} else {
-			cmd.AddArguments("--no-ff", "--no-commit")
-		}
-		cmd.AddDynamicArguments(stagingBranch)
-
-		// Prepare merge with commit
-		if err := runMergeCommand(pr, mergeStyle, cmd, tmpBasePath); err != nil {
-			log.Error("Unable to merge staging into base: %v", err)
-			return "", err
-		}
-		if mergeStyle == repo_model.MergeStyleRebaseMerge {
-			if err := commitAndSignNoAuthor(ctx, pr, message, signArgs, tmpBasePath, env); err != nil {
-				log.Error("Unable to make final commit: %v", err)
-				return "", err
-			}
-		}
 	case repo_model.MergeStyleSquash:
-		// Merge with squash
-		cmd := git.NewCommand(ctx, "merge", "--squash").AddDynamicArguments(trackingBranch)
-		if err := runMergeCommand(pr, mergeStyle, cmd, tmpBasePath); err != nil {
-			log.Error("Unable to merge --squash tracking into base: %v", err)
+		if err := doMergeStyleSquash(mergeCtx, message); err != nil {
 			return "", err
 		}
-
-		if err = pr.Issue.LoadPoster(ctx); err != nil {
-			log.Error("LoadPoster: %v", err)
-			return "", fmt.Errorf("LoadPoster: %w", err)
-		}
-		sig := pr.Issue.Poster.NewGitSig()
-		if setting.Repository.PullRequest.AddCoCommitterTrailers && committer.String() != sig.String() {
-			// add trailer
-			message += fmt.Sprintf("\nCo-authored-by: %s\nCo-committed-by: %s\n", sig.String(), sig.String())
-		}
-		if err := git.NewCommand(ctx, "commit").
-			AddArguments(signArgs...).
-			AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
-			AddOptionFormat("--message=%s", message).
-			Run(&git.RunOpts{
-				Env:    env,
-				Dir:    tmpBasePath,
-				Stdout: &outbuf,
-				Stderr: &errbuf,
-			}); err != nil {
-			log.Error("git commit [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-			return "", fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-		}
-		outbuf.Reset()
-		errbuf.Reset()
 	default:
 		return "", models.ErrInvalidMergeStyle{ID: pr.BaseRepo.ID, Style: mergeStyle}
 	}
 
 	// OK we should cache our current head and origin/headbranch
-	mergeHeadSHA, err := git.GetFullCommitID(ctx, tmpBasePath, "HEAD")
+	mergeHeadSHA, err := git.GetFullCommitID(ctx, mergeCtx.tmpBasePath, "HEAD")
 	if err != nil {
 		return "", fmt.Errorf("Failed to get full commit id for HEAD: %w", err)
 	}
-	mergeBaseSHA, err := git.GetFullCommitID(ctx, tmpBasePath, "original_"+baseBranch)
+	mergeBaseSHA, err := git.GetFullCommitID(ctx, mergeCtx.tmpBasePath, "original_"+baseBranch)
 	if err != nil {
 		return "", fmt.Errorf("Failed to get full commit id for origin/%s: %w", pr.BaseBranch, err)
 	}
-	mergeCommitID, err := git.GetFullCommitID(ctx, tmpBasePath, baseBranch)
+	mergeCommitID, err := git.GetFullCommitID(ctx, mergeCtx.tmpBasePath, baseBranch)
 	if err != nil {
 		return "", fmt.Errorf("Failed to get full commit id for the new merge: %w", err)
 	}
@@ -567,7 +277,7 @@ func rawMerge(ctx context.Context, pr *issues_model.PullRequest, doer *user_mode
 	// I think in the interests of data safety - failures to push to the lfs should prevent
 	// the merge as you can always remerge.
 	if setting.LFS.StartServer {
-		if err := LFSPush(ctx, tmpBasePath, mergeHeadSHA, mergeBaseSHA, pr); err != nil {
+		if err := LFSPush(ctx, mergeCtx.tmpBasePath, mergeHeadSHA, mergeBaseSHA, pr); err != nil {
 			return "", err
 		}
 	}
@@ -576,167 +286,92 @@ func rawMerge(ctx context.Context, pr *issues_model.PullRequest, doer *user_mode
 	err = pr.HeadRepo.LoadOwner(ctx)
 	if err != nil {
 		if !user_model.IsErrUserNotExist(err) {
-			log.Error("Can't find user: %d for head repository - %v", pr.HeadRepo.OwnerID, err)
+			log.Error("Can't find user: %d for head repository in %-v: %v", pr.HeadRepo.OwnerID, pr, err)
 			return "", err
 		}
-		log.Error("Can't find user: %d for head repository - defaulting to doer: %s - %v", pr.HeadRepo.OwnerID, doer.Name, err)
+		log.Warn("Can't find user: %d for head repository in %-v - defaulting to doer: %s - %v", pr.HeadRepo.OwnerID, pr, doer.Name, err)
 		headUser = doer
 	} else {
 		headUser = pr.HeadRepo.Owner
 	}
 
-	var pushCmd *git.Command
-	if mergeStyle == repo_model.MergeStyleRebaseUpdate {
-		// force push the rebase result to head branch
-		env = repo_module.FullPushingEnvironment(
-			headUser,
-			doer,
-			pr.HeadRepo,
-			pr.HeadRepo.Name,
-			pr.ID,
-		)
-		pushCmd = git.NewCommand(ctx, "push", "-f", "head_repo").AddDynamicArguments(stagingBranch + ":" + git.BranchPrefix + pr.HeadBranch)
-	} else {
-		env = repo_module.FullPushingEnvironment(
-			headUser,
-			doer,
-			pr.BaseRepo,
-			pr.BaseRepo.Name,
-			pr.ID,
-		)
-		pushCmd = git.NewCommand(ctx, "push", "origin").AddDynamicArguments(baseBranch + ":" + git.BranchPrefix + pr.BaseBranch)
-	}
+	mergeCtx.env = repo_module.FullPushingEnvironment(
+		headUser,
+		doer,
+		pr.BaseRepo,
+		pr.BaseRepo.Name,
+		pr.ID,
+	)
+	pushCmd := git.NewCommand(ctx, "push", "origin").AddDynamicArguments(baseBranch + ":" + git.BranchPrefix + pr.BaseBranch)
 
 	// Push back to upstream.
 	// TODO: this cause an api call to "/api/internal/hook/post-receive/...",
 	//       that prevents us from doint the whole merge in one db transaction
-	if err := pushCmd.Run(&git.RunOpts{
-		Env:    env,
-		Dir:    tmpBasePath,
-		Stdout: &outbuf,
-		Stderr: &errbuf,
-	}); err != nil {
-		if strings.Contains(errbuf.String(), "non-fast-forward") {
+	if err := pushCmd.Run(mergeCtx.RunOpts()); err != nil {
+		if strings.Contains(mergeCtx.errbuf.String(), "non-fast-forward") {
 			return "", &git.ErrPushOutOfDate{
-				StdOut: outbuf.String(),
-				StdErr: errbuf.String(),
+				StdOut: mergeCtx.outbuf.String(),
+				StdErr: mergeCtx.errbuf.String(),
 				Err:    err,
 			}
-		} else if strings.Contains(errbuf.String(), "! [remote rejected]") {
+		} else if strings.Contains(mergeCtx.errbuf.String(), "! [remote rejected]") {
 			err := &git.ErrPushRejected{
-				StdOut: outbuf.String(),
-				StdErr: errbuf.String(),
+				StdOut: mergeCtx.outbuf.String(),
+				StdErr: mergeCtx.errbuf.String(),
 				Err:    err,
 			}
 			err.GenerateMessage()
 			return "", err
 		}
-		return "", fmt.Errorf("git push: %s", errbuf.String())
+		return "", fmt.Errorf("git push: %s", mergeCtx.errbuf.String())
 	}
-	outbuf.Reset()
-	errbuf.Reset()
+	mergeCtx.outbuf.Reset()
+	mergeCtx.errbuf.Reset()
 
 	return mergeCommitID, nil
 }
 
-func commitAndSignNoAuthor(ctx context.Context, pr *issues_model.PullRequest, message string, signArgs git.TrustedCmdArgs, tmpBasePath string, env []string) error {
-	var outbuf, errbuf strings.Builder
-	if err := git.NewCommand(ctx, "commit").AddArguments(signArgs...).AddOptionFormat("--message=%s", message).
-		Run(&git.RunOpts{
-			Env:    env,
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("git commit [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-		return fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
+func commitAndSignNoAuthor(ctx *mergeContext, message string) error {
+	if err := git.NewCommand(ctx, "commit").AddArguments(ctx.signArg...).AddOptionFormat("--message=%s", message).
+		Run(ctx.RunOpts()); err != nil {
+		log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+		return fmt.Errorf("git commit %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
 	}
 	return nil
 }
 
-func runMergeCommand(pr *issues_model.PullRequest, mergeStyle repo_model.MergeStyle, cmd *git.Command, tmpBasePath string) error {
-	var outbuf, errbuf strings.Builder
-	if err := cmd.Run(&git.RunOpts{
-		Dir:    tmpBasePath,
-		Stdout: &outbuf,
-		Stderr: &errbuf,
-	}); err != nil {
+func runMergeCommand(ctx *mergeContext, mergeStyle repo_model.MergeStyle, cmd *git.Command) error {
+	if err := cmd.Run(ctx.RunOpts()); err != nil {
 		// Merge will leave a MERGE_HEAD file in the .git folder if there is a conflict
-		if _, statErr := os.Stat(filepath.Join(tmpBasePath, ".git", "MERGE_HEAD")); statErr == nil {
+		if _, statErr := os.Stat(filepath.Join(ctx.tmpBasePath, ".git", "MERGE_HEAD")); statErr == nil {
 			// We have a merge conflict error
-			log.Debug("MergeConflict [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
+			log.Debug("MergeConflict %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
 			return models.ErrMergeConflicts{
 				Style:  mergeStyle,
-				StdOut: outbuf.String(),
-				StdErr: errbuf.String(),
+				StdOut: ctx.outbuf.String(),
+				StdErr: ctx.errbuf.String(),
 				Err:    err,
 			}
-		} else if strings.Contains(errbuf.String(), "refusing to merge unrelated histories") {
-			log.Debug("MergeUnrelatedHistories [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
+		} else if strings.Contains(ctx.errbuf.String(), "refusing to merge unrelated histories") {
+			log.Debug("MergeUnrelatedHistories %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
 			return models.ErrMergeUnrelatedHistories{
 				Style:  mergeStyle,
-				StdOut: outbuf.String(),
-				StdErr: errbuf.String(),
+				StdOut: ctx.outbuf.String(),
+				StdErr: ctx.errbuf.String(),
 				Err:    err,
 			}
 		}
-		log.Error("git merge [%s:%s -> %s:%s]: %v\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
-		return fmt.Errorf("git merge [%s:%s -> %s:%s]: %w\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
+		log.Error("git merge %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+		return fmt.Errorf("git merge %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
 	}
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
 
 	return nil
 }
 
 var escapedSymbols = regexp.MustCompile(`([*[?! \\])`)
 
-func getDiffTree(ctx context.Context, repoPath, baseBranch, headBranch string) (string, error) {
-	getDiffTreeFromBranch := func(repoPath, baseBranch, headBranch string) (string, error) {
-		var outbuf, errbuf strings.Builder
-		// Compute the diff-tree for sparse-checkout
-		if err := git.NewCommand(ctx, "diff-tree", "--no-commit-id", "--name-only", "-r", "-z", "--root").AddDynamicArguments(baseBranch, headBranch).
-			Run(&git.RunOpts{
-				Dir:    repoPath,
-				Stdout: &outbuf,
-				Stderr: &errbuf,
-			}); err != nil {
-			return "", fmt.Errorf("git diff-tree [%s base:%s head:%s]: %s", repoPath, baseBranch, headBranch, errbuf.String())
-		}
-		return outbuf.String(), nil
-	}
-
-	scanNullTerminatedStrings := func(data []byte, atEOF bool) (advance int, token []byte, err error) {
-		if atEOF && len(data) == 0 {
-			return 0, nil, nil
-		}
-		if i := bytes.IndexByte(data, '\x00'); i >= 0 {
-			return i + 1, data[0:i], nil
-		}
-		if atEOF {
-			return len(data), data, nil
-		}
-		return 0, nil, nil
-	}
-
-	list, err := getDiffTreeFromBranch(repoPath, baseBranch, headBranch)
-	if err != nil {
-		return "", err
-	}
-
-	// Prefixing '/' for each entry, otherwise all files with the same name in subdirectories would be matched.
-	out := bytes.Buffer{}
-	scanner := bufio.NewScanner(strings.NewReader(list))
-	scanner.Split(scanNullTerminatedStrings)
-	for scanner.Scan() {
-		filepath := scanner.Text()
-		// escape '*', '?', '[', spaces and '!' prefix
-		filepath = escapedSymbols.ReplaceAllString(filepath, `\$1`)
-		// no necessary to escape the first '#' symbol because the first symbol is '/'
-		fmt.Fprintf(&out, "/%s\n", filepath)
-	}
-
-	return out.String(), nil
-}
-
 // IsUserAllowedToMerge check if user is allowed to merge PR with given permissions and branch protections
 func IsUserAllowedToMerge(ctx context.Context, pr *issues_model.PullRequest, p access_model.Permission, user *user_model.User) (bool, error) {
 	if user == nil {
diff --git a/services/pull/merge_merge.go b/services/pull/merge_merge.go
new file mode 100644
index 0000000000000..0f7664297aa81
--- /dev/null
+++ b/services/pull/merge_merge.go
@@ -0,0 +1,25 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pull
+
+import (
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
+)
+
+// doMergeStyleMerge merges the tracking into the current HEAD - which is assumed to tbe staging branch (equal to the pr.BaseBranch)
+func doMergeStyleMerge(ctx *mergeContext, message string) error {
+	cmd := git.NewCommand(ctx, "merge", "--no-ff", "--no-commit").AddDynamicArguments(trackingBranch)
+	if err := runMergeCommand(ctx, repo_model.MergeStyleMerge, cmd); err != nil {
+		log.Error("%-v Unable to merge tracking into base: %v", ctx.pr, err)
+		return err
+	}
+
+	if err := commitAndSignNoAuthor(ctx, message); err != nil {
+		log.Error("%-v Unable to make final commit: %v", ctx.pr, err)
+		return err
+	}
+	return nil
+}
diff --git a/services/pull/merge_prepare.go b/services/pull/merge_prepare.go
new file mode 100644
index 0000000000000..2ba821961a2be
--- /dev/null
+++ b/services/pull/merge_prepare.go
@@ -0,0 +1,297 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pull
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"code.gitea.io/gitea/models"
+	issues_model "code.gitea.io/gitea/models/issues"
+	repo_model "code.gitea.io/gitea/models/repo"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
+	asymkey_service "code.gitea.io/gitea/services/asymkey"
+)
+
+type mergeContext struct {
+	*prContext
+	doer      *user_model.User
+	sig       *git.Signature
+	committer *git.Signature
+	signArg   git.TrustedCmdArgs
+	env       []string
+}
+
+func (ctx *mergeContext) RunOpts() *git.RunOpts {
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+	return &git.RunOpts{
+		Env:    ctx.env,
+		Dir:    ctx.tmpBasePath,
+		Stdout: ctx.outbuf,
+		Stderr: ctx.errbuf,
+	}
+}
+
+func createTemporaryRepoForMerge(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, expectedHeadCommitID string) (mergeCtx *mergeContext, cancel context.CancelFunc, err error) {
+	// Clone base repo.
+	prCtx, cancel, err := createTemporaryRepoForPR(ctx, pr)
+	if err != nil {
+		log.Error("createTemporaryRepoForPR: %v", err)
+		return nil, cancel, err
+	}
+
+	mergeCtx = &mergeContext{
+		prContext: prCtx,
+		doer:      doer,
+	}
+
+	if expectedHeadCommitID != "" {
+		trackingCommitID, _, err := git.NewCommand(ctx, "show-ref", "--hash").AddDynamicArguments(git.BranchPrefix + trackingBranch).RunStdString(&git.RunOpts{Dir: mergeCtx.tmpBasePath})
+		if err != nil {
+			defer cancel()
+			log.Error("failed to get sha of head branch in %-v: show-ref[%s] --hash refs/heads/tracking: %v", mergeCtx.pr, mergeCtx.tmpBasePath, err)
+			return nil, nil, fmt.Errorf("unable to get sha of head branch in %v %w", pr, err)
+		}
+		if strings.TrimSpace(trackingCommitID) != expectedHeadCommitID {
+			defer cancel()
+			return nil, nil, models.ErrSHADoesNotMatch{
+				GivenSHA:   expectedHeadCommitID,
+				CurrentSHA: trackingCommitID,
+			}
+		}
+	}
+
+	mergeCtx.outbuf.Reset()
+	mergeCtx.errbuf.Reset()
+	if err := prepareTemporaryRepoForMerge(mergeCtx); err != nil {
+		defer cancel()
+		return nil, nil, err
+	}
+
+	mergeCtx.sig = doer.NewGitSig()
+	mergeCtx.committer = mergeCtx.sig
+
+	// Determine if we should sign
+	sign, keyID, signer, _ := asymkey_service.SignMerge(ctx, mergeCtx.pr, mergeCtx.doer, mergeCtx.tmpBasePath, "HEAD", trackingBranch)
+	if sign {
+		mergeCtx.signArg = git.ToTrustedCmdArgs([]string{"-S" + keyID})
+		if pr.BaseRepo.GetTrustModel() == repo_model.CommitterTrustModel || pr.BaseRepo.GetTrustModel() == repo_model.CollaboratorCommitterTrustModel {
+			mergeCtx.committer = signer
+		}
+	} else {
+		mergeCtx.signArg = git.ToTrustedCmdArgs([]string{"--no-gpg-sign"})
+	}
+
+	commitTimeStr := time.Now().Format(time.RFC3339)
+
+	// Because this may call hooks we should pass in the environment
+	mergeCtx.env = append(os.Environ(),
+		"GIT_AUTHOR_NAME="+mergeCtx.sig.Name,
+		"GIT_AUTHOR_EMAIL="+mergeCtx.sig.Email,
+		"GIT_AUTHOR_DATE="+commitTimeStr,
+		"GIT_COMMITTER_NAME="+mergeCtx.committer.Name,
+		"GIT_COMMITTER_EMAIL="+mergeCtx.committer.Email,
+		"GIT_COMMITTER_DATE="+commitTimeStr,
+	)
+
+	return mergeCtx, cancel, nil
+}
+
+// prepareTemporaryRepoForMerge takes a repository that has been created using createTemporaryRepo
+// it then sets up the sparse-checkout and other things
+func prepareTemporaryRepoForMerge(ctx *mergeContext) error {
+	infoPath := filepath.Join(ctx.tmpBasePath, ".git", "info")
+	if err := os.MkdirAll(infoPath, 0o700); err != nil {
+		log.Error("%-v Unable to create .git/info in %s: %v", ctx.pr, ctx.tmpBasePath, err)
+		return fmt.Errorf("Unable to create .git/info in tmpBasePath: %w", err)
+	}
+
+	// Enable sparse-checkout
+	// Here we use the .git/info/sparse-checkout file as described in the git documentation
+	sparseCheckoutListFile, err := os.OpenFile(filepath.Join(infoPath, "sparse-checkout"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	if err != nil {
+		log.Error("%-v Unable to write .git/info/sparse-checkout file in %s: %v", ctx.pr, ctx.tmpBasePath, err)
+		return fmt.Errorf("Unable to write .git/info/sparse-checkout file in tmpBasePath: %w", err)
+	}
+	defer sparseCheckoutListFile.Close() // we will close it earlier but we need to ensure it is closed if there is an error
+
+	if err := getDiffTree(ctx, ctx.tmpBasePath, baseBranch, trackingBranch, sparseCheckoutListFile); err != nil {
+		log.Error("%-v getDiffTree(%s, %s, %s): %v", ctx.pr, ctx.tmpBasePath, baseBranch, trackingBranch, err)
+		return fmt.Errorf("getDiffTree: %w", err)
+	}
+
+	if err := sparseCheckoutListFile.Close(); err != nil {
+		log.Error("%-v Unable to close .git/info/sparse-checkout file in %s: %v", ctx.pr, ctx.tmpBasePath, err)
+		return fmt.Errorf("Unable to close .git/info/sparse-checkout file in tmpBasePath: %w", err)
+	}
+
+	gitConfigCommand := func() *git.Command {
+		return git.NewCommand(ctx, "config", "--local")
+	}
+
+	setConfig := func(key, value string) error {
+		if err := gitConfigCommand().AddArguments(git.ToTrustedCmdArgs([]string{key, value})...).
+			Run(ctx.RunOpts()); err != nil {
+			if value == "" {
+				value = "<>"
+			}
+			log.Error("git config [%s -> %s ]: %v\n%s\n%s", key, value, err, ctx.outbuf.String(), ctx.errbuf.String())
+			return fmt.Errorf("git config [%s -> %s ]: %w\n%s\n%s", key, value, err, ctx.outbuf.String(), ctx.errbuf.String())
+		}
+		ctx.outbuf.Reset()
+		ctx.errbuf.Reset()
+
+		return nil
+	}
+
+	// Switch off LFS process (set required, clean and smudge here also)
+	if err := setConfig("filter.lfs.process", ""); err != nil {
+		return err
+	}
+
+	if err := setConfig("filter.lfs.required", "false"); err != nil {
+		return err
+	}
+
+	if err := setConfig("filter.lfs.clean", ""); err != nil {
+		return err
+	}
+
+	if err := setConfig("filter.lfs.smudge", ""); err != nil {
+		return err
+	}
+
+	if err := setConfig("core.sparseCheckout", "true"); err != nil {
+		return err
+	}
+
+	// Read base branch index
+	if err := git.NewCommand(ctx, "read-tree", "HEAD").
+		Run(ctx.RunOpts()); err != nil {
+		log.Error("git read-tree HEAD: %v\n%s\n%s", err, ctx.outbuf.String(), ctx.errbuf.String())
+		return fmt.Errorf("Unable to read base branch in to the index: %w\n%s\n%s", err, ctx.outbuf.String(), ctx.errbuf.String())
+	}
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+
+	return nil
+}
+
+// getDiffTree returns a string containing all the files that were changed between headBranch and baseBranch
+// the filenames are escaped so as to fit the format required for .git/info/sparse-checkout
+func getDiffTree(ctx context.Context, repoPath, baseBranch, headBranch string, out io.Writer) error {
+	diffOutReader, diffOutWriter, err := os.Pipe()
+	if err != nil {
+		log.Error("Unable to create os.Pipe for %s", repoPath)
+		return err
+	}
+	defer func() {
+		_ = diffOutReader.Close()
+		_ = diffOutWriter.Close()
+	}()
+
+	scanNullTerminatedStrings := func(data []byte, atEOF bool) (advance int, token []byte, err error) {
+		if atEOF && len(data) == 0 {
+			return 0, nil, nil
+		}
+		if i := bytes.IndexByte(data, '\x00'); i >= 0 {
+			return i + 1, data[0:i], nil
+		}
+		if atEOF {
+			return len(data), data, nil
+		}
+		return 0, nil, nil
+	}
+
+	err = git.NewCommand(ctx, "diff-tree", "--no-commit-id", "--name-only", "-r", "-r", "-z", "--root").AddDynamicArguments(baseBranch, headBranch).
+		Run(&git.RunOpts{
+			Dir:    repoPath,
+			Stdout: diffOutWriter,
+			PipelineFunc: func(ctx context.Context, cancel context.CancelFunc) error {
+				// Close the writer end of the pipe to begin processing
+				_ = diffOutWriter.Close()
+				defer func() {
+					// Close the reader on return to terminate the git command if necessary
+					_ = diffOutReader.Close()
+				}()
+
+				// Now scan the output from the command
+				scanner := bufio.NewScanner(diffOutReader)
+				scanner.Split(scanNullTerminatedStrings)
+				for scanner.Scan() {
+					filepath := scanner.Text()
+					// escape '*', '?', '[', spaces and '!' prefix
+					filepath = escapedSymbols.ReplaceAllString(filepath, `\$1`)
+					// no necessary to escape the first '#' symbol because the first symbol is '/'
+					fmt.Fprintf(out, "/%s\n", filepath)
+				}
+				return scanner.Err()
+			},
+		})
+	return err
+}
+
+// rebaseTrackingOnToBase checks out the tracking branch as staging and rebases it on to the base branch
+// if there is a conflict it will return a models.ErrRebaseConflicts
+func rebaseTrackingOnToBase(ctx *mergeContext, mergeStyle repo_model.MergeStyle) error {
+	// Checkout head branch
+	if err := git.NewCommand(ctx, "checkout", "-b").AddDynamicArguments(stagingBranch, trackingBranch).
+		Run(ctx.RunOpts()); err != nil {
+		return fmt.Errorf("unable to git checkout tracking as staging in temp repo for %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+	}
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+
+	// Rebase before merging
+	if err := git.NewCommand(ctx, "rebase").AddDynamicArguments(baseBranch).
+		Run(ctx.RunOpts()); err != nil {
+		// Rebase will leave a REBASE_HEAD file in .git if there is a conflict
+		if _, statErr := os.Stat(filepath.Join(ctx.tmpBasePath, ".git", "REBASE_HEAD")); statErr == nil {
+			var commitSha string
+			ok := false
+			failingCommitPaths := []string{
+				filepath.Join(ctx.tmpBasePath, ".git", "rebase-apply", "original-commit"), // Git < 2.26
+				filepath.Join(ctx.tmpBasePath, ".git", "rebase-merge", "stopped-sha"),     // Git >= 2.26
+			}
+			for _, failingCommitPath := range failingCommitPaths {
+				if _, statErr := os.Stat(failingCommitPath); statErr == nil {
+					commitShaBytes, readErr := os.ReadFile(failingCommitPath)
+					if readErr != nil {
+						// Abandon this attempt to handle the error
+						return fmt.Errorf("unable to git rebase staging on to base in temp repo for %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+					}
+					commitSha = strings.TrimSpace(string(commitShaBytes))
+					ok = true
+					break
+				}
+			}
+			if !ok {
+				log.Error("Unable to determine failing commit sha for failing rebase in temp repo for %-v. Cannot cast as models.ErrRebaseConflicts.", ctx.pr)
+				return fmt.Errorf("unable to git rebase staging on to base in temp repo for %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+			}
+			log.Debug("Conflict when rebasing staging on to base in %-v at %s: %v\n%s\n%s", ctx.pr, commitSha, err, ctx.outbuf.String(), ctx.errbuf.String())
+			return models.ErrRebaseConflicts{
+				CommitSHA: commitSha,
+				Style:     mergeStyle,
+				StdOut:    ctx.outbuf.String(),
+				StdErr:    ctx.errbuf.String(),
+				Err:       err,
+			}
+		}
+		return fmt.Errorf("unable to git rebase staging on to base in temp repo for %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+	}
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+	return nil
+}
diff --git a/services/pull/merge_rebase.go b/services/pull/merge_rebase.go
new file mode 100644
index 0000000000000..d3bb86d4aa081
--- /dev/null
+++ b/services/pull/merge_rebase.go
@@ -0,0 +1,50 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pull
+
+import (
+	"fmt"
+
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
+)
+
+// doMergeStyleRebase rebaases the tracking branch on the base branch as the current HEAD with or with a merge commit to the original pr branch
+func doMergeStyleRebase(ctx *mergeContext, mergeStyle repo_model.MergeStyle, message string) error {
+	if err := rebaseTrackingOnToBase(ctx, mergeStyle); err != nil {
+		return err
+	}
+
+	// Checkout base branch again
+	if err := git.NewCommand(ctx, "checkout").AddDynamicArguments(baseBranch).
+		Run(ctx.RunOpts()); err != nil {
+		log.Error("git checkout base prior to merge post staging rebase %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+		return fmt.Errorf("git checkout base prior to merge post staging rebase  %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+	}
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+
+	cmd := git.NewCommand(ctx, "merge")
+	if mergeStyle == repo_model.MergeStyleRebase {
+		cmd.AddArguments("--ff-only")
+	} else {
+		cmd.AddArguments("--no-ff", "--no-commit")
+	}
+	cmd.AddDynamicArguments(stagingBranch)
+
+	// Prepare merge with commit
+	if err := runMergeCommand(ctx, mergeStyle, cmd); err != nil {
+		log.Error("Unable to merge staging into base: %v", err)
+		return err
+	}
+	if mergeStyle == repo_model.MergeStyleRebaseMerge {
+		if err := commitAndSignNoAuthor(ctx, message); err != nil {
+			log.Error("Unable to make final commit: %v", err)
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/services/pull/merge_squash.go b/services/pull/merge_squash.go
new file mode 100644
index 0000000000000..0a8cc0167e400
--- /dev/null
+++ b/services/pull/merge_squash.go
@@ -0,0 +1,53 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pull
+
+import (
+	"fmt"
+
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
+)
+
+// doMergeStyleSquash squashes the tracking branch on the current HEAD (=base)
+func doMergeStyleSquash(ctx *mergeContext, message string) error {
+	cmd := git.NewCommand(ctx, "merge", "--squash").AddDynamicArguments(trackingBranch)
+	if err := runMergeCommand(ctx, repo_model.MergeStyleSquash, cmd); err != nil {
+		log.Error("%-v Unable to merge --squash tracking into base: %v", ctx.pr, err)
+		return err
+	}
+
+	if err := ctx.pr.Issue.LoadPoster(ctx); err != nil {
+		log.Error("%-v Issue[%d].LoadPoster: %v", ctx.pr, ctx.pr.Issue.ID, err)
+		return fmt.Errorf("LoadPoster: %w", err)
+	}
+	sig := ctx.pr.Issue.Poster.NewGitSig()
+	if len(ctx.signArg) == 0 {
+		if err := git.NewCommand(ctx, "commit").
+			AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
+			AddOptionFormat("--message=%s", message).
+			Run(ctx.RunOpts()); err != nil {
+			log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+			return fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", ctx.pr.HeadRepo.FullName(), ctx.pr.HeadBranch, ctx.pr.BaseRepo.FullName(), ctx.pr.BaseBranch, err, ctx.outbuf.String(), ctx.errbuf.String())
+		}
+	} else {
+		if setting.Repository.PullRequest.AddCoCommitterTrailers && ctx.committer.String() != sig.String() {
+			// add trailer
+			message += fmt.Sprintf("\nCo-authored-by: %s\nCo-committed-by: %s\n", sig.String(), sig.String())
+		}
+		if err := git.NewCommand(ctx, "commit").
+			AddArguments(ctx.signArg...).
+			AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
+			AddOptionFormat("--message=%s", message).
+			Run(ctx.RunOpts()); err != nil {
+			log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+			return fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", ctx.pr.HeadRepo.FullName(), ctx.pr.HeadBranch, ctx.pr.BaseRepo.FullName(), ctx.pr.BaseBranch, err, ctx.outbuf.String(), ctx.errbuf.String())
+		}
+	}
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+	return nil
+}
diff --git a/services/pull/patch.go b/services/pull/patch.go
index c2ccc75bdccdd..9277355720dc5 100644
--- a/services/pull/patch.go
+++ b/services/pull/patch.go
@@ -22,7 +22,6 @@ import (
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
-	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 
@@ -64,25 +63,21 @@ func TestPatch(pr *issues_model.PullRequest) error {
 	defer finished()
 
 	// Clone base repo.
-	tmpBasePath, err := createTemporaryRepo(ctx, pr)
+	prCtx, cancel, err := createTemporaryRepoForPR(ctx, pr)
 	if err != nil {
-		log.Error("CreateTemporaryPath: %v", err)
+		log.Error("createTemporaryRepoForPR %-v: %v", pr, err)
 		return err
 	}
-	defer func() {
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("Merge: RemoveTemporaryPath: %s", err)
-		}
-	}()
+	defer cancel()
 
-	gitRepo, err := git.OpenRepository(ctx, tmpBasePath)
+	gitRepo, err := git.OpenRepository(ctx, prCtx.tmpBasePath)
 	if err != nil {
 		return fmt.Errorf("OpenRepository: %w", err)
 	}
 	defer gitRepo.Close()
 
 	// 1. update merge base
-	pr.MergeBase, _, err = git.NewCommand(ctx, "merge-base", "--", "base", "tracking").RunStdString(&git.RunOpts{Dir: tmpBasePath})
+	pr.MergeBase, _, err = git.NewCommand(ctx, "merge-base", "--", "base", "tracking").RunStdString(&git.RunOpts{Dir: prCtx.tmpBasePath})
 	if err != nil {
 		var err2 error
 		pr.MergeBase, err2 = gitRepo.GetRefCommitID(git.BranchPrefix + "base")
@@ -101,7 +96,7 @@ func TestPatch(pr *issues_model.PullRequest) error {
 	}
 
 	// 2. Check for conflicts
-	if conflicts, err := checkConflicts(ctx, pr, gitRepo, tmpBasePath); err != nil || conflicts || pr.Status == issues_model.PullRequestStatusEmpty {
+	if conflicts, err := checkConflicts(ctx, pr, gitRepo, prCtx.tmpBasePath); err != nil || conflicts || pr.Status == issues_model.PullRequestStatusEmpty {
 		return err
 	}
 
diff --git a/services/pull/pull.go b/services/pull/pull.go
index a19e88b33b657..d8923d0d57251 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -349,18 +349,14 @@ func AddTestPullRequestTask(doer *user_model.User, repoID int64, branch string,
 // checkIfPRContentChanged checks if diff to target branch has changed by push
 // A commit can be considered to leave the PR untouched if the patch/diff with its merge base is unchanged
 func checkIfPRContentChanged(ctx context.Context, pr *issues_model.PullRequest, oldCommitID, newCommitID string) (hasChanged bool, err error) {
-	tmpBasePath, err := createTemporaryRepo(ctx, pr)
+	prCtx, cancel, err := createTemporaryRepoForPR(ctx, pr)
 	if err != nil {
-		log.Error("CreateTemporaryRepo: %v", err)
+		log.Error("CreateTemporaryRepoForPR %-v: %v", pr, err)
 		return false, err
 	}
-	defer func() {
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("checkIfPRContentChanged: RemoveTemporaryPath: %s", err)
-		}
-	}()
+	defer cancel()
 
-	tmpRepo, err := git.OpenRepository(ctx, tmpBasePath)
+	tmpRepo, err := git.OpenRepository(ctx, prCtx.tmpBasePath)
 	if err != nil {
 		return false, fmt.Errorf("OpenRepository: %w", err)
 	}
@@ -379,7 +375,7 @@ func checkIfPRContentChanged(ctx context.Context, pr *issues_model.PullRequest,
 	}
 
 	if err := cmd.Run(&git.RunOpts{
-		Dir:    tmpBasePath,
+		Dir:    prCtx.tmpBasePath,
 		Stdout: stdoutWriter,
 		PipelineFunc: func(ctx context.Context, cancel context.CancelFunc) error {
 			_ = stdoutWriter.Close()
diff --git a/services/pull/temp_repo.go b/services/pull/temp_repo.go
index 2bef671555e00..146470780671e 100644
--- a/services/pull/temp_repo.go
+++ b/services/pull/temp_repo.go
@@ -19,49 +19,85 @@ import (
 	repo_module "code.gitea.io/gitea/modules/repository"
 )
 
-// createTemporaryRepo creates a temporary repo with "base" for pr.BaseBranch and "tracking" for  pr.HeadBranch
+// Temporary repos created here use standard branch names to help simplify
+// merging code
+const (
+	baseBranch     = "base"     // equivalent to pr.BaseBranch
+	trackingBranch = "tracking" // equivalent to pr.HeadBranch
+	stagingBranch  = "staging"  // this is used for a working branch
+)
+
+type prContext struct {
+	context.Context
+	tmpBasePath string
+	pr          *issues_model.PullRequest
+	outbuf      *strings.Builder // we keep these around to help reduce needless buffer recreation,
+	errbuf      *strings.Builder // any use should be preceded by a Reset and preferably after use
+}
+
+func (ctx *prContext) RunOpts() *git.RunOpts {
+	ctx.outbuf.Reset()
+	ctx.errbuf.Reset()
+	return &git.RunOpts{
+		Dir:    ctx.tmpBasePath,
+		Stdout: ctx.outbuf,
+		Stderr: ctx.errbuf,
+	}
+}
+
+// createTemporaryRepoForPR creates a temporary repo with "base" for pr.BaseBranch and "tracking" for  pr.HeadBranch
 // it also create a second base branch called "original_base"
-func createTemporaryRepo(ctx context.Context, pr *issues_model.PullRequest) (string, error) {
+func createTemporaryRepoForPR(ctx context.Context, pr *issues_model.PullRequest) (prCtx *prContext, cancel context.CancelFunc, err error) {
 	if err := pr.LoadHeadRepo(ctx); err != nil {
-		log.Error("LoadHeadRepo: %v", err)
-		return "", fmt.Errorf("LoadHeadRepo: %w", err)
+		log.Error("%-v LoadHeadRepo: %v", pr, err)
+		return nil, nil, fmt.Errorf("%v LoadHeadRepo: %w", pr, err)
 	} else if pr.HeadRepo == nil {
-		log.Error("Pr %d HeadRepo %d does not exist", pr.ID, pr.HeadRepoID)
-		return "", &repo_model.ErrRepoNotExist{
+		log.Error("%-v HeadRepo %d does not exist", pr, pr.HeadRepoID)
+		return nil, nil, &repo_model.ErrRepoNotExist{
 			ID: pr.HeadRepoID,
 		}
 	} else if err := pr.LoadBaseRepo(ctx); err != nil {
-		log.Error("LoadBaseRepo: %v", err)
-		return "", fmt.Errorf("LoadBaseRepo: %w", err)
+		log.Error("%-v LoadBaseRepo: %v", pr, err)
+		return nil, nil, fmt.Errorf("%v LoadBaseRepo: %w", pr, err)
 	} else if pr.BaseRepo == nil {
-		log.Error("Pr %d BaseRepo %d does not exist", pr.ID, pr.BaseRepoID)
-		return "", &repo_model.ErrRepoNotExist{
+		log.Error("%-v BaseRepo %d does not exist", pr, pr.BaseRepoID)
+		return nil, nil, &repo_model.ErrRepoNotExist{
 			ID: pr.BaseRepoID,
 		}
 	} else if err := pr.HeadRepo.LoadOwner(ctx); err != nil {
-		log.Error("HeadRepo.LoadOwner: %v", err)
-		return "", fmt.Errorf("HeadRepo.LoadOwner: %w", err)
+		log.Error("%-v HeadRepo.LoadOwner: %v", pr, err)
+		return nil, nil, fmt.Errorf("%v HeadRepo.LoadOwner: %w", pr, err)
 	} else if err := pr.BaseRepo.LoadOwner(ctx); err != nil {
-		log.Error("BaseRepo.LoadOwner: %v", err)
-		return "", fmt.Errorf("BaseRepo.LoadOwner: %w", err)
+		log.Error("%-v BaseRepo.LoadOwner: %v", pr, err)
+		return nil, nil, fmt.Errorf("%v BaseRepo.LoadOwner: %w", pr, err)
 	}
 
 	// Clone base repo.
 	tmpBasePath, err := repo_module.CreateTemporaryPath("pull")
 	if err != nil {
-		log.Error("CreateTemporaryPath: %v", err)
-		return "", err
+		log.Error("CreateTemporaryPath[%-v]: %v", pr, err)
+		return nil, nil, err
+	}
+	prCtx = &prContext{
+		Context:     ctx,
+		tmpBasePath: tmpBasePath,
+		pr:          pr,
+		outbuf:      &strings.Builder{},
+		errbuf:      &strings.Builder{},
+	}
+	cancel = func() {
+		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
+			log.Error("Error whilst removing removing temporary repo for %-v: %v", pr, err)
+		}
 	}
 
 	baseRepoPath := pr.BaseRepo.RepoPath()
 	headRepoPath := pr.HeadRepo.RepoPath()
 
 	if err := git.InitRepository(ctx, tmpBasePath, false); err != nil {
-		log.Error("git init tmpBasePath: %v", err)
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", err
+		log.Error("Unable to init tmpBasePath for %-v: %v", pr, err)
+		cancel()
+		return nil, nil, err
 	}
 
 	remoteRepoName := "head_repo"
@@ -73,99 +109,63 @@ func createTemporaryRepo(ctx context.Context, pr *issues_model.PullRequest) (str
 		fetchArgs = append(fetchArgs, "--no-write-commit-graph")
 	}
 
-	// Add head repo remote.
-	addCacheRepo := func(staging, cache string) error {
-		p := filepath.Join(staging, ".git", "objects", "info", "alternates")
+	// addCacheRepo adds git alternatives for the cacheRepoPath in the repoPath
+	addCacheRepo := func(repoPath, cacheRepoPath string) error {
+		p := filepath.Join(repoPath, ".git", "objects", "info", "alternates")
 		f, err := os.OpenFile(p, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
 		if err != nil {
-			log.Error("Could not create .git/objects/info/alternates file in %s: %v", staging, err)
+			log.Error("Could not create .git/objects/info/alternates file in %s: %v", repoPath, err)
 			return err
 		}
 		defer f.Close()
-		data := filepath.Join(cache, "objects")
+		data := filepath.Join(cacheRepoPath, "objects")
 		if _, err := fmt.Fprintln(f, data); err != nil {
-			log.Error("Could not write to .git/objects/info/alternates file in %s: %v", staging, err)
+			log.Error("Could not write to .git/objects/info/alternates file in %s: %v", repoPath, err)
 			return err
 		}
 		return nil
 	}
 
+	// Add head repo remote.
 	if err := addCacheRepo(tmpBasePath, baseRepoPath); err != nil {
-		log.Error("Unable to add base repository to temporary repo [%s -> %s]: %v", pr.BaseRepo.FullName(), tmpBasePath, err)
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", fmt.Errorf("Unable to add base repository to temporary repo [%s -> tmpBasePath]: %w", pr.BaseRepo.FullName(), err)
+		log.Error("%-v Unable to add base repository to temporary repo [%s -> %s]: %v", pr, pr.BaseRepo.FullName(), tmpBasePath, err)
+		cancel()
+		return nil, nil, fmt.Errorf("Unable to add base repository to temporary repo [%s -> tmpBasePath]: %w", pr.BaseRepo.FullName(), err)
 	}
 
-	var outbuf, errbuf strings.Builder
 	if err := git.NewCommand(ctx, "remote", "add", "-t").AddDynamicArguments(pr.BaseBranch).AddArguments("-m").AddDynamicArguments(pr.BaseBranch).AddDynamicArguments("origin", baseRepoPath).
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("Unable to add base repository as origin [%s -> %s]: %v\n%s\n%s", pr.BaseRepo.FullName(), tmpBasePath, err, outbuf.String(), errbuf.String())
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", fmt.Errorf("Unable to add base repository as origin [%s -> tmpBasePath]: %w\n%s\n%s", pr.BaseRepo.FullName(), err, outbuf.String(), errbuf.String())
+		Run(prCtx.RunOpts()); err != nil {
+		log.Error("%-v Unable to add base repository as origin [%s -> %s]: %v\n%s\n%s", pr, pr.BaseRepo.FullName(), tmpBasePath, err, prCtx.outbuf.String(), prCtx.errbuf.String())
+		cancel()
+		return nil, nil, fmt.Errorf("Unable to add base repository as origin [%s -> tmpBasePath]: %w\n%s\n%s", pr.BaseRepo.FullName(), err, prCtx.outbuf.String(), prCtx.errbuf.String())
 	}
-	outbuf.Reset()
-	errbuf.Reset()
 
 	if err := git.NewCommand(ctx, "fetch", "origin").AddArguments(fetchArgs...).AddDashesAndList(pr.BaseBranch+":"+baseBranch, pr.BaseBranch+":original_"+baseBranch).
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("Unable to fetch origin base branch [%s:%s -> base, original_base in %s]: %v:\n%s\n%s", pr.BaseRepo.FullName(), pr.BaseBranch, tmpBasePath, err, outbuf.String(), errbuf.String())
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", fmt.Errorf("Unable to fetch origin base branch [%s:%s -> base, original_base in tmpBasePath]: %w\n%s\n%s", pr.BaseRepo.FullName(), pr.BaseBranch, err, outbuf.String(), errbuf.String())
+		Run(prCtx.RunOpts()); err != nil {
+		log.Error("%-v Unable to fetch origin base branch [%s:%s -> base, original_base in %s]: %v:\n%s\n%s", pr, pr.BaseRepo.FullName(), pr.BaseBranch, tmpBasePath, err, prCtx.outbuf.String(), prCtx.errbuf.String())
+		cancel()
+		return nil, nil, fmt.Errorf("Unable to fetch origin base branch [%s:%s -> base, original_base in tmpBasePath]: %w\n%s\n%s", pr.BaseRepo.FullName(), pr.BaseBranch, err, prCtx.outbuf.String(), prCtx.errbuf.String())
 	}
-	outbuf.Reset()
-	errbuf.Reset()
 
 	if err := git.NewCommand(ctx, "symbolic-ref").AddDynamicArguments("HEAD", git.BranchPrefix+baseBranch).
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("Unable to set HEAD as base branch [%s]: %v\n%s\n%s", tmpBasePath, err, outbuf.String(), errbuf.String())
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", fmt.Errorf("Unable to set HEAD as base branch [tmpBasePath]: %w\n%s\n%s", err, outbuf.String(), errbuf.String())
+		Run(prCtx.RunOpts()); err != nil {
+		log.Error("%-v Unable to set HEAD as base branch in [%s]: %v\n%s\n%s", pr, tmpBasePath, err, prCtx.outbuf.String(), prCtx.errbuf.String())
+		cancel()
+		return nil, nil, fmt.Errorf("Unable to set HEAD as base branch in tmpBasePath: %w\n%s\n%s", err, prCtx.outbuf.String(), prCtx.errbuf.String())
 	}
-	outbuf.Reset()
-	errbuf.Reset()
 
 	if err := addCacheRepo(tmpBasePath, headRepoPath); err != nil {
-		log.Error("Unable to add head repository to temporary repo [%s -> %s]: %v", pr.HeadRepo.FullName(), tmpBasePath, err)
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", fmt.Errorf("Unable to head base repository to temporary repo [%s -> tmpBasePath]: %w", pr.HeadRepo.FullName(), err)
+		log.Error("%-v Unable to add head repository to temporary repo [%s -> %s]: %v", pr, pr.HeadRepo.FullName(), tmpBasePath, err)
+		cancel()
+		return nil, nil, fmt.Errorf("Unable to add head base repository to temporary repo [%s -> tmpBasePath]: %w", pr.HeadRepo.FullName(), err)
 	}
 
 	if err := git.NewCommand(ctx, "remote", "add").AddDynamicArguments(remoteRepoName, headRepoPath).
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		log.Error("Unable to add head repository as head_repo [%s -> %s]: %v\n%s\n%s", pr.HeadRepo.FullName(), tmpBasePath, err, outbuf.String(), errbuf.String())
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
-		return "", fmt.Errorf("Unable to add head repository as head_repo [%s -> tmpBasePath]: %w\n%s\n%s", pr.HeadRepo.FullName(), err, outbuf.String(), errbuf.String())
+		Run(prCtx.RunOpts()); err != nil {
+		log.Error("%-v Unable to add head repository as head_repo [%s -> %s]: %v\n%s\n%s", pr, pr.HeadRepo.FullName(), tmpBasePath, err, prCtx.outbuf.String(), prCtx.errbuf.String())
+		cancel()
+		return nil, nil, fmt.Errorf("Unable to add head repository as head_repo [%s -> tmpBasePath]: %w\n%s\n%s", pr.HeadRepo.FullName(), err, prCtx.outbuf.String(), prCtx.errbuf.String())
 	}
-	outbuf.Reset()
-	errbuf.Reset()
 
 	trackingBranch := "tracking"
 	// Fetch head branch
@@ -178,24 +178,18 @@ func createTemporaryRepo(ctx context.Context, pr *issues_model.PullRequest) (str
 		headBranch = pr.GetGitRefName()
 	}
 	if err := git.NewCommand(ctx, "fetch").AddArguments(fetchArgs...).AddDynamicArguments(remoteRepoName, headBranch+":"+trackingBranch).
-		Run(&git.RunOpts{
-			Dir:    tmpBasePath,
-			Stdout: &outbuf,
-			Stderr: &errbuf,
-		}); err != nil {
-		if err := repo_module.RemoveTemporaryPath(tmpBasePath); err != nil {
-			log.Error("CreateTempRepo: RemoveTemporaryPath: %s", err)
-		}
+		Run(prCtx.RunOpts()); err != nil {
+		cancel()
 		if !git.IsBranchExist(ctx, pr.HeadRepo.RepoPath(), pr.HeadBranch) {
-			return "", models.ErrBranchDoesNotExist{
+			return nil, nil, models.ErrBranchDoesNotExist{
 				BranchName: pr.HeadBranch,
 			}
 		}
-		log.Error("Unable to fetch head_repo head branch [%s:%s -> tracking in %s]: %v:\n%s\n%s", pr.HeadRepo.FullName(), pr.HeadBranch, tmpBasePath, err, outbuf.String(), errbuf.String())
-		return "", fmt.Errorf("Unable to fetch head_repo head branch [%s:%s -> tracking in tmpBasePath]: %w\n%s\n%s", pr.HeadRepo.FullName(), headBranch, err, outbuf.String(), errbuf.String())
+		log.Error("%-v Unable to fetch head_repo head branch [%s:%s -> tracking in %s]: %v:\n%s\n%s", pr, pr.HeadRepo.FullName(), pr.HeadBranch, tmpBasePath, err, prCtx.outbuf.String(), prCtx.errbuf.String())
+		return nil, nil, fmt.Errorf("Unable to fetch head_repo head branch [%s:%s -> tracking in tmpBasePath]: %w\n%s\n%s", pr.HeadRepo.FullName(), headBranch, err, prCtx.outbuf.String(), prCtx.errbuf.String())
 	}
-	outbuf.Reset()
-	errbuf.Reset()
+	prCtx.outbuf.Reset()
+	prCtx.errbuf.Reset()
 
-	return tmpBasePath, nil
+	return prCtx, cancel, nil
 }
diff --git a/services/pull/update.go b/services/pull/update.go
index b9525cf0c980f..b977dbdba9fe2 100644
--- a/services/pull/update.go
+++ b/services/pull/update.go
@@ -16,61 +16,67 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
 )
 
 // Update updates pull request with base branch.
-func Update(ctx context.Context, pull *issues_model.PullRequest, doer *user_model.User, message string, rebase bool) error {
-	var (
-		pr    *issues_model.PullRequest
-		style repo_model.MergeStyle
-	)
+func Update(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, message string, rebase bool) error {
+	if pr.Flow == issues_model.PullRequestFlowAGit {
+		// TODO: update of agit flow pull request's head branch is unsupported
+		return fmt.Errorf("update of agit flow pull request's head branch is unsupported")
+	}
 
-	pullWorkingPool.CheckIn(fmt.Sprint(pull.ID))
-	defer pullWorkingPool.CheckOut(fmt.Sprint(pull.ID))
+	pullWorkingPool.CheckIn(fmt.Sprint(pr.ID))
+	defer pullWorkingPool.CheckOut(fmt.Sprint(pr.ID))
 
-	if rebase {
-		pr = pull
-		style = repo_model.MergeStyleRebaseUpdate
-	} else {
-		// use merge functions but switch repo's and branch's
-		pr = &issues_model.PullRequest{
-			HeadRepoID: pull.BaseRepoID,
-			BaseRepoID: pull.HeadRepoID,
-			HeadBranch: pull.BaseBranch,
-			BaseBranch: pull.HeadBranch,
-		}
-		style = repo_model.MergeStyleMerge
+	diffCount, err := GetDiverging(ctx, pr)
+	if err != nil {
+		return err
+	} else if diffCount.Behind == 0 {
+		return fmt.Errorf("HeadBranch of PR %d is up to date", pr.Index)
 	}
 
-	if pull.Flow == issues_model.PullRequestFlowAGit {
-		// TODO: Not support update agit flow pull request's head branch
-		return fmt.Errorf("Not support update agit flow pull request's head branch")
+	if rebase {
+		defer func() {
+			go AddTestPullRequestTask(doer, pr.BaseRepo.ID, pr.BaseBranch, false, "", "")
+		}()
+
+		return updateHeadByRebaseOnToBase(ctx, pr, doer, message)
 	}
 
+	if err := pr.LoadBaseRepo(ctx); err != nil {
+		log.Error("unable to load BaseRepo for %-v during update-by-merge: %v", pr, err)
+		return fmt.Errorf("unable to load BaseRepo for PR[%d] during update-by-merge: %w", pr.ID, err)
+	}
 	if err := pr.LoadHeadRepo(ctx); err != nil {
-		log.Error("LoadHeadRepo: %v", err)
-		return fmt.Errorf("LoadHeadRepo: %w", err)
-	} else if err = pr.LoadBaseRepo(ctx); err != nil {
-		log.Error("LoadBaseRepo: %v", err)
-		return fmt.Errorf("LoadBaseRepo: %w", err)
+		log.Error("unable to load HeadRepo for PR %-v during update-by-merge: %v", pr, err)
+		return fmt.Errorf("unable to load HeadRepo for PR[%d] during update-by-merge: %w", pr.ID, err)
+	}
+	if pr.HeadRepo == nil {
+		// LoadHeadRepo will swallow ErrRepoNotExist so if pr.HeadRepo is still nil recreate the error
+		err := repo_model.ErrRepoNotExist{
+			ID: pr.HeadRepoID,
+		}
+		log.Error("unable to load HeadRepo for PR %-v during update-by-merge: %v", pr, err)
+		return fmt.Errorf("unable to load HeadRepo for PR[%d] during update-by-merge: %w", pr.ID, err)
 	}
 
-	diffCount, err := GetDiverging(ctx, pull)
-	if err != nil {
-		return err
-	} else if diffCount.Behind == 0 {
-		return fmt.Errorf("HeadBranch of PR %d is up to date", pull.Index)
+	// use merge functions but switch repos and branches
+	reversePR := &issues_model.PullRequest{
+		ID: pr.ID,
+
+		HeadRepoID: pr.BaseRepoID,
+		HeadRepo:   pr.BaseRepo,
+		HeadBranch: pr.BaseBranch,
+
+		BaseRepoID: pr.HeadRepoID,
+		BaseRepo:   pr.HeadRepo,
+		BaseBranch: pr.HeadBranch,
 	}
 
-	_, err = rawMerge(ctx, pr, doer, style, "", message)
+	_, err = doMergeAndPush(ctx, reversePR, doer, repo_model.MergeStyleMerge, "", message)
 
 	defer func() {
-		if rebase {
-			go AddTestPullRequestTask(doer, pr.BaseRepo.ID, pr.BaseBranch, false, "", "")
-			return
-		}
-		go AddTestPullRequestTask(doer, pr.HeadRepo.ID, pr.HeadBranch, false, "", "")
+		go AddTestPullRequestTask(doer, reversePR.HeadRepo.ID, reversePR.HeadBranch, false, "", "")
 	}()
 
 	return err
@@ -159,27 +165,16 @@ func IsUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest,
 
 // GetDiverging determines how many commits a PR is ahead or behind the PR base branch
 func GetDiverging(ctx context.Context, pr *issues_model.PullRequest) (*git.DivergeObject, error) {
-	log.Trace("GetDiverging[%d]: compare commits", pr.ID)
-	if err := pr.LoadBaseRepo(ctx); err != nil {
-		return nil, err
-	}
-	if err := pr.LoadHeadRepo(ctx); err != nil {
-		return nil, err
-	}
-
-	tmpRepo, err := createTemporaryRepo(ctx, pr)
+	log.Trace("GetDiverging[%-v]: compare commits", pr)
+	prCtx, cancel, err := createTemporaryRepoForPR(ctx, pr)
 	if err != nil {
 		if !models.IsErrBranchDoesNotExist(err) {
-			log.Error("CreateTemporaryRepo: %v", err)
+			log.Error("CreateTemporaryRepoForPR %-v: %v", pr, err)
 		}
 		return nil, err
 	}
-	defer func() {
-		if err := repo_module.RemoveTemporaryPath(tmpRepo); err != nil {
-			log.Error("Merge: RemoveTemporaryPath: %s", err)
-		}
-	}()
+	defer cancel()
 
-	diff, err := git.GetDivergingCommits(ctx, tmpRepo, "base", "tracking")
+	diff, err := git.GetDivergingCommits(ctx, prCtx.tmpBasePath, baseBranch, trackingBranch)
 	return &diff, err
 }
diff --git a/services/pull/update_rebase.go b/services/pull/update_rebase.go
new file mode 100644
index 0000000000000..8e7bfa0ffd4c2
--- /dev/null
+++ b/services/pull/update_rebase.go
@@ -0,0 +1,107 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pull
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	issues_model "code.gitea.io/gitea/models/issues"
+	repo_model "code.gitea.io/gitea/models/repo"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/git"
+	"code.gitea.io/gitea/modules/log"
+	repo_module "code.gitea.io/gitea/modules/repository"
+	"code.gitea.io/gitea/modules/setting"
+)
+
+// updateHeadByRebaseOnToBase handles updating a PR's head branch by rebasing it on the PR current base branch
+func updateHeadByRebaseOnToBase(ctx context.Context, pr *issues_model.PullRequest, doer *user_model.User, message string) error {
+	// "Clone" base repo and add the cache headers for the head repo and branch
+	mergeCtx, cancel, err := createTemporaryRepoForMerge(ctx, pr, doer, "")
+	if err != nil {
+		return err
+	}
+	defer cancel()
+
+	// Determine the old merge-base before the rebase - we use this for LFS push later on
+	oldMergeBase, _, _ := git.NewCommand(ctx, "merge-base").AddDashesAndList(baseBranch, trackingBranch).RunStdString(&git.RunOpts{Dir: mergeCtx.tmpBasePath})
+	oldMergeBase = strings.TrimSpace(oldMergeBase)
+
+	// Rebase the tracking branch on to the base as the staging branch
+	if err := rebaseTrackingOnToBase(mergeCtx, repo_model.MergeStyleRebaseUpdate); err != nil {
+		return err
+	}
+
+	if setting.LFS.StartServer {
+		// Now we need to ensure that the head repository contains any LFS objects between the new base and the old mergebase
+		// It's questionable about where this should go - either after or before the push
+		// I think in the interests of data safety - failures to push to the lfs should prevent
+		// the push as you can always re-rebase.
+		if err := LFSPush(ctx, mergeCtx.tmpBasePath, baseBranch, oldMergeBase, &issues_model.PullRequest{
+			HeadRepoID: pr.BaseRepoID,
+			BaseRepoID: pr.HeadRepoID,
+		}); err != nil {
+			log.Error("Unable to push lfs objects between %s and %s up to head branch in %-v: %v", baseBranch, oldMergeBase, pr, err)
+			return err
+		}
+	}
+
+	// Now determine who the pushing author should be
+	var headUser *user_model.User
+	if err := pr.HeadRepo.LoadOwner(ctx); err != nil {
+		if !user_model.IsErrUserNotExist(err) {
+			log.Error("Can't find user: %d for head repository in %-v - %v", pr.HeadRepo.OwnerID, pr, err)
+			return err
+		}
+		log.Error("Can't find user: %d for head repository in %-v - defaulting to doer: %-v - %v", pr.HeadRepo.OwnerID, pr, doer, err)
+		headUser = doer
+	} else {
+		headUser = pr.HeadRepo.Owner
+	}
+
+	pushCmd := git.NewCommand(ctx, "push", "-f", "head_repo").
+		AddDynamicArguments(stagingBranch + ":" + git.BranchPrefix + pr.HeadBranch)
+
+	// Push back to the head repository.
+	// TODO: this cause an api call to "/api/internal/hook/post-receive/...",
+	//       that prevents us from doint the whole merge in one db transaction
+	mergeCtx.outbuf.Reset()
+	mergeCtx.errbuf.Reset()
+
+	if err := pushCmd.Run(&git.RunOpts{
+		Env: repo_module.FullPushingEnvironment(
+			headUser,
+			doer,
+			pr.HeadRepo,
+			pr.HeadRepo.Name,
+			pr.ID,
+		),
+		Dir:    mergeCtx.tmpBasePath,
+		Stdout: mergeCtx.outbuf,
+		Stderr: mergeCtx.errbuf,
+	}); err != nil {
+		if strings.Contains(mergeCtx.errbuf.String(), "non-fast-forward") {
+			return &git.ErrPushOutOfDate{
+				StdOut: mergeCtx.outbuf.String(),
+				StdErr: mergeCtx.errbuf.String(),
+				Err:    err,
+			}
+		} else if strings.Contains(mergeCtx.errbuf.String(), "! [remote rejected]") {
+			err := &git.ErrPushRejected{
+				StdOut: mergeCtx.outbuf.String(),
+				StdErr: mergeCtx.errbuf.String(),
+				Err:    err,
+			}
+			err.GenerateMessage()
+			return err
+		}
+		return fmt.Errorf("git push: %s", mergeCtx.errbuf.String())
+	}
+	mergeCtx.outbuf.Reset()
+	mergeCtx.errbuf.Reset()
+
+	return nil
+}

From 608a3eeb592a311ea44f7d739458bcf4fa4ba9bd Mon Sep 17 00:00:00 2001
From: delvh <leon@kske.dev>
Date: Wed, 8 Mar 2023 00:17:35 +0100
Subject: [PATCH 13/53] Pass context to avatar for projects view (#23359)

Previously, a 500 response was returned when
- an issue had assignees
- the issue was assigned to a project
- you tried to view this project

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 templates/projects/view.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 074c5315ab2a3..14a876d8fd943 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -238,7 +238,7 @@
 							{{end}}
 							<div class="right floated">
 								{{range .Assignees}}
-									<a class="tooltip" target="_blank" href="{{.HomeLink}}" data-content="{{$.locale.Tr "repo.projects.column.assigned_to"}} {{.Name}}">{{avatar . 28 "mini gt-mr-3"}}</a>
+									<a class="tooltip" target="_blank" href="{{.HomeLink}}" data-content="{{$.locale.Tr "repo.projects.column.assigned_to"}} {{.Name}}">{{avatar $.Context . 28 "mini gt-mr-3"}}</a>
 								{{end}}
 							</div>
 						</div>

From 2dc4f80af0d9ee865711e5394295cc431f73f8c9 Mon Sep 17 00:00:00 2001
From: GiteaBot <teabot@gitea.io>
Date: Wed, 8 Mar 2023 00:15:50 +0000
Subject: [PATCH 14/53] [skip ci] Updated translations via Crowdin

---
 options/locale/locale_ja-JP.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index 5ad66a510166b..12d9423628bdc 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -247,6 +247,7 @@ default_enable_timetracking_popup=新しいリポジトリのタイムトラッ
 no_reply_address=メールを隠すときのドメイン
 no_reply_address_helper=メールアドレスを隠しているユーザーに使用するドメイン名。 例えば 'noreply.example.org' と設定した場合、ユーザー名 'joe' はGitに 'joe@noreply.example.org' としてログインすることになります。
 password_algorithm=パスワードハッシュアルゴリズム
+invalid_password_algorithm=無効なパスワードハッシュアルゴリズム
 password_algorithm_helper=パスワードハッシュアルゴリズムを設定します。 アルゴリズムにより動作要件と強度が異なります。 `argon2`は良い特性を備えていますが、多くのメモリを使用するため小さなシステムには適さない場合があります。
 enable_update_checker=アップデートチェッカーを有効にする
 enable_update_checker_helper=gitea.ioに接続して定期的に新しいバージョンのリリースを確認します。

From b70c7f86604185ed18a9d5e3b25327805e2b6a52 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Wed, 8 Mar 2023 11:26:37 +0800
Subject: [PATCH 15/53] Fix incorrect display for comment context menu 
 (#23343)

Replace #23342

Fix a regression of #23014: the `a` couldn't be used here because
Fomantic UI has style conflicts: `.ui.comments .comment .actions a {
display: inline-block; }`


And complete one more of my TODOs: "in the future there could be a
special CSS class for it"
---
 templates/repo/issue/view_content/context_menu.tmpl | 10 +++++-----
 web_src/js/features/aria.js                         |  5 +++--
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/templates/repo/issue/view_content/context_menu.tmpl b/templates/repo/issue/view_content/context_menu.tmpl
index f836271b65b56..c073c74ea32f0 100644
--- a/templates/repo/issue/view_content/context_menu.tmpl
+++ b/templates/repo/issue/view_content/context_menu.tmpl
@@ -10,16 +10,16 @@
 		{{else}}
 			{{$referenceUrl = Printf "%s/files#%s" .ctxData.Issue.Link .item.HashTag}}
 		{{end}}
-		<a class="item context" data-clipboard-text-type="url" data-clipboard-text="{{AppSubUrl}}{{$referenceUrl}}">{{.ctxData.locale.Tr "repo.issues.context.copy_link"}}</a>
-		<a class="item context quote-reply {{if .diff}}quote-reply-diff{{end}}" data-target="{{.item.HashTag}}-raw">{{.ctxData.locale.Tr "repo.issues.context.quote_reply"}}</a>
+		<div class="item context js-aria-clickable" data-clipboard-text-type="url" data-clipboard-text="{{AppSubUrl}}{{$referenceUrl}}">{{.ctxData.locale.Tr "repo.issues.context.copy_link"}}</div>
+		<div class="item context js-aria-clickable quote-reply {{if .diff}}quote-reply-diff{{end}}" data-target="{{.item.HashTag}}-raw">{{.ctxData.locale.Tr "repo.issues.context.quote_reply"}}</div>
 		{{if not .ctxData.UnitIssuesGlobalDisabled}}
-			<a class="item context reference-issue" data-target="{{.item.HashTag}}-raw" data-modal="#reference-issue-modal" data-poster="{{.item.Poster.GetDisplayName}}" data-poster-username="{{.item.Poster.Name}}" data-reference="{{$referenceUrl}}">{{.ctxData.locale.Tr "repo.issues.context.reference_issue"}}</a>
+			<div class="item context js-aria-clickable reference-issue" data-target="{{.item.HashTag}}-raw" data-modal="#reference-issue-modal" data-poster="{{.item.Poster.GetDisplayName}}" data-poster-username="{{.item.Poster.Name}}" data-reference="{{$referenceUrl}}">{{.ctxData.locale.Tr "repo.issues.context.reference_issue"}}</div>
 		{{end}}
 		{{if or .ctxData.Permission.IsAdmin .IsCommentPoster .ctxData.HasIssuesOrPullsWritePermission}}
 			<div class="divider"></div>
-			<a class="item context edit-content">{{.ctxData.locale.Tr "repo.issues.context.edit"}}</a>
+			<div class="item context js-aria-clickable edit-content">{{.ctxData.locale.Tr "repo.issues.context.edit"}}</div>
 			{{if .delete}}
-				<a class="item context delete-comment" data-comment-id={{.item.HashTag}} data-url="{{.ctxData.RepoLink}}/comments/{{.item.ID}}/delete" data-locale="{{.ctxData.locale.Tr "repo.issues.delete_comment_confirm"}}">{{.ctxData.locale.Tr "repo.issues.context.delete"}}</a>
+				<div class="item context js-aria-clickable delete-comment" data-comment-id={{.item.HashTag}} data-url="{{.ctxData.RepoLink}}/comments/{{.item.ID}}/delete" data-locale="{{.ctxData.locale.Tr "repo.issues.delete_comment_confirm"}}">{{.ctxData.locale.Tr "repo.issues.context.delete"}}</div>
 			{{end}}
 		{{end}}
 	</div>
diff --git a/web_src/js/features/aria.js b/web_src/js/features/aria.js
index 373d667c5f73c..46944336adc10 100644
--- a/web_src/js/features/aria.js
+++ b/web_src/js/features/aria.js
@@ -83,8 +83,9 @@ function attachOneDropdownAria($dropdown) {
     if (e.key === 'Enter') {
       let $item = $dropdown.dropdown('get item', $dropdown.dropdown('get value'));
       if (!$item) $item = $menu.find('> .item.selected'); // when dropdown filters items by input, there is no "value", so query the "selected" item
-      // if the selected item is clickable, then trigger the click event. in the future there could be a special CSS class for it.
-      if ($item && $item.is('a')) $item[0].click();
+      // if the selected item is clickable, then trigger the click event.
+      // we can not click any item without check, because Fomantic code might also handle the Enter event. that would result in double click.
+      if ($item && ($item.is('a') || $item.is('.js-aria-clickable'))) $item[0].click();
     }
   });
 

From 7e3b7c23463bf71c4e2ab93f184a675f1e30df0e Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Wed, 8 Mar 2023 11:40:41 +0800
Subject: [PATCH 16/53] Do not recognize text files as audio (#23355)

Close #17108

This PR uses a trick (removing the ID3 tag) to detect the content again
to to see whether the content is text type.

---------

Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 modules/typesniffer/typesniffer.go      | 10 ++++++++++
 modules/typesniffer/typesniffer_test.go |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/modules/typesniffer/typesniffer.go b/modules/typesniffer/typesniffer.go
index 5b215496b80c8..7887fd42b72ef 100644
--- a/modules/typesniffer/typesniffer.go
+++ b/modules/typesniffer/typesniffer.go
@@ -106,6 +106,16 @@ func DetectContentType(data []byte) SniffedType {
 		}
 	}
 
+	if strings.HasPrefix(ct, "audio/") && bytes.HasPrefix(data, []byte("ID3")) {
+		// The MP3 detection is quite inaccurate, any content with "ID3" prefix will result in "audio/mpeg".
+		// So remove the "ID3" prefix and detect again, if result is text, then it must be text content.
+		// This works especially because audio files contain many unprintable/invalid characters like `0x00`
+		ct2 := http.DetectContentType(data[3:])
+		if strings.HasPrefix(ct2, "text/") {
+			ct = ct2
+		}
+	}
+
 	return SniffedType{ct}
 }
 
diff --git a/modules/typesniffer/typesniffer_test.go b/modules/typesniffer/typesniffer_test.go
index 2bafdffd141c3..6c6da34aa006a 100644
--- a/modules/typesniffer/typesniffer_test.go
+++ b/modules/typesniffer/typesniffer_test.go
@@ -109,6 +109,10 @@ func TestIsAudio(t *testing.T) {
 	mp3, _ := base64.StdEncoding.DecodeString("SUQzBAAAAAABAFRYWFgAAAASAAADbWFqb3JfYnJhbmQAbXA0MgBUWFhYAAAAEQAAA21pbm9yX3Zl")
 	assert.True(t, DetectContentType(mp3).IsAudio())
 	assert.False(t, DetectContentType([]byte("plain text")).IsAudio())
+
+	assert.True(t, DetectContentType([]byte("ID3Toy\000")).IsAudio())
+	assert.True(t, DetectContentType([]byte("ID3Toy\n====\t* hi 🌞, ...")).IsText())          // test ID3 tag for plain text
+	assert.True(t, DetectContentType([]byte("ID3Toy\n====\t* hi 🌞, ..."+"🌛"[0:2])).IsText()) // test ID3 tag with incomplete UTF8 char
 }
 
 func TestDetectContentTypeFromReader(t *testing.T) {

From a12f5757372f751d25f9e5ca1f168f6920ded894 Mon Sep 17 00:00:00 2001
From: JakobDev <jakobdev@gmx.de>
Date: Wed, 8 Mar 2023 08:07:58 +0100
Subject: [PATCH 17/53] Clean Path in Options (#23006)

At the Moment it is possible to read files in another Directory as
supposed using the Options functions. e.g.
`options.Gitignore("../label/Default) `. This was discovered while
working on #22783, which exposes `options.Gitignore()` through the
public API. At the moment, this is not a security problem, as this
function is only used internal, but I thought it would be a good idea to
make a PR to fix this for all types of Options files, not only
Gitignore, to make it safe for the further. This PR should be merged
before the linked PR.

---------

Co-authored-by: Jason Song <i@wolfogre.com>
---
 modules/options/dynamic.go | 8 ++++----
 modules/options/static.go  | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/modules/options/dynamic.go b/modules/options/dynamic.go
index a20253676e671..f9b3714b8fb90 100644
--- a/modules/options/dynamic.go
+++ b/modules/options/dynamic.go
@@ -79,22 +79,22 @@ func WalkLocales(callback func(path, name string, d fs.DirEntry, err error) erro
 
 // Readme reads the content of a specific readme from static or custom path.
 func Readme(name string) ([]byte, error) {
-	return fileFromDir(path.Join("readme", name))
+	return fileFromDir(path.Join("readme", path.Clean("/"+name)))
 }
 
 // Gitignore reads the content of a specific gitignore from static or custom path.
 func Gitignore(name string) ([]byte, error) {
-	return fileFromDir(path.Join("gitignore", name))
+	return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
 }
 
 // License reads the content of a specific license from static or custom path.
 func License(name string) ([]byte, error) {
-	return fileFromDir(path.Join("license", name))
+	return fileFromDir(path.Join("license", path.Clean("/"+name)))
 }
 
 // Labels reads the content of a specific labels from static or custom path.
 func Labels(name string) ([]byte, error) {
-	return fileFromDir(path.Join("label", name))
+	return fileFromDir(path.Join("label", path.Clean("/"+name)))
 }
 
 // fileFromDir is a helper to read files from static or custom path.
diff --git a/modules/options/static.go b/modules/options/static.go
index ff3c86d3f84f6..2405d658bfb17 100644
--- a/modules/options/static.go
+++ b/modules/options/static.go
@@ -84,22 +84,22 @@ func WalkLocales(callback func(path, name string, d fs.DirEntry, err error) erro
 
 // Readme reads the content of a specific readme from bindata or custom path.
 func Readme(name string) ([]byte, error) {
-	return fileFromDir(path.Join("readme", name))
+	return fileFromDir(path.Join("readme", path.Clean("/"+name)))
 }
 
 // Gitignore reads the content of a gitignore locale from bindata or custom path.
 func Gitignore(name string) ([]byte, error) {
-	return fileFromDir(path.Join("gitignore", name))
+	return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
 }
 
 // License reads the content of a specific license from bindata or custom path.
 func License(name string) ([]byte, error) {
-	return fileFromDir(path.Join("license", name))
+	return fileFromDir(path.Join("license", path.Clean("/"+name)))
 }
 
 // Labels reads the content of a specific labels from static or custom path.
 func Labels(name string) ([]byte, error) {
-	return fileFromDir(path.Join("label", name))
+	return fileFromDir(path.Join("label", path.Clean("/"+name)))
 }
 
 // fileFromDir is a helper to read files from bindata or custom path.

From 090e75392385041b3abb30d02564962a3ff687f6 Mon Sep 17 00:00:00 2001
From: Jason Song <i@wolfogre.com>
Date: Wed, 8 Mar 2023 17:31:27 +0800
Subject: [PATCH 18/53] Reduce duplicate and useless code in options (#23369)

Avoid maintaining two copies of code, some functions can be used with
both `bindata` and `no bindata`.

And removed `GetRepoInitFile`, it's useless now.
`Readme`/`Gitignore`/`License`/`Labels` will clean the name and use
custom files when available.
---
 modules/label/parser.go    |  6 ++--
 modules/options/base.go    | 56 ++++++++++++++++++++++++++++++
 modules/options/dynamic.go | 70 ++++----------------------------------
 modules/options/repo.go    | 44 ------------------------
 modules/options/static.go  | 50 ++++-----------------------
 modules/repository/init.go |  6 ++--
 6 files changed, 74 insertions(+), 158 deletions(-)
 delete mode 100644 modules/options/repo.go

diff --git a/modules/label/parser.go b/modules/label/parser.go
index 768c72a61b014..55bf570de6b95 100644
--- a/modules/label/parser.go
+++ b/modules/label/parser.go
@@ -36,17 +36,17 @@ func (err ErrTemplateLoad) Error() string {
 // GetTemplateFile loads the label template file by given name,
 // then parses and returns a list of name-color pairs and optionally description.
 func GetTemplateFile(name string) ([]*Label, error) {
-	data, err := options.GetRepoInitFile("label", name+".yaml")
+	data, err := options.Labels(name + ".yaml")
 	if err == nil && len(data) > 0 {
 		return parseYamlFormat(name+".yaml", data)
 	}
 
-	data, err = options.GetRepoInitFile("label", name+".yml")
+	data, err = options.Labels(name + ".yml")
 	if err == nil && len(data) > 0 {
 		return parseYamlFormat(name+".yml", data)
 	}
 
-	data, err = options.GetRepoInitFile("label", name)
+	data, err = options.Labels(name)
 	if err != nil {
 		return nil, ErrTemplateLoad{name, fmt.Errorf("GetRepoInitFile: %w", err)}
 	}
diff --git a/modules/options/base.go b/modules/options/base.go
index 039e934b3a4d9..3c140f64326be 100644
--- a/modules/options/base.go
+++ b/modules/options/base.go
@@ -7,11 +7,52 @@ import (
 	"fmt"
 	"io/fs"
 	"os"
+	"path"
 	"path/filepath"
 
+	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 )
 
+// Locale reads the content of a specific locale from static/bindata or custom path.
+func Locale(name string) ([]byte, error) {
+	return fileFromDir(path.Join("locale", path.Clean("/"+name)))
+}
+
+// Readme reads the content of a specific readme from static/bindata or custom path.
+func Readme(name string) ([]byte, error) {
+	return fileFromDir(path.Join("readme", path.Clean("/"+name)))
+}
+
+// Gitignore reads the content of a gitignore locale from static/bindata or custom path.
+func Gitignore(name string) ([]byte, error) {
+	return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
+}
+
+// License reads the content of a specific license from static/bindata or custom path.
+func License(name string) ([]byte, error) {
+	return fileFromDir(path.Join("license", path.Clean("/"+name)))
+}
+
+// Labels reads the content of a specific labels from static/bindata or custom path.
+func Labels(name string) ([]byte, error) {
+	return fileFromDir(path.Join("label", path.Clean("/"+name)))
+}
+
+// WalkLocales reads the content of a specific locale
+func WalkLocales(callback func(path, name string, d fs.DirEntry, err error) error) error {
+	if IsDynamic() {
+		if err := walkAssetDir(filepath.Join(setting.StaticRootPath, "options", "locale"), callback); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("failed to walk locales. Error: %w", err)
+		}
+	}
+
+	if err := walkAssetDir(filepath.Join(setting.CustomPath, "options", "locale"), callback); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("failed to walk locales. Error: %w", err)
+	}
+	return nil
+}
+
 func walkAssetDir(root string, callback func(path, name string, d fs.DirEntry, err error) error) error {
 	if err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 		// name is the path relative to the root
@@ -37,3 +78,18 @@ func walkAssetDir(root string, callback func(path, name string, d fs.DirEntry, e
 	}
 	return nil
 }
+
+func statDirIfExist(dir string) ([]string, error) {
+	isDir, err := util.IsDir(dir)
+	if err != nil {
+		return nil, fmt.Errorf("unable to check if static directory %s is a directory. %w", dir, err)
+	}
+	if !isDir {
+		return nil, nil
+	}
+	files, err := util.StatDir(dir, true)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read directory %q. %w", dir, err)
+	}
+	return files, nil
+}
diff --git a/modules/options/dynamic.go b/modules/options/dynamic.go
index f9b3714b8fb90..8c954492ae51f 100644
--- a/modules/options/dynamic.go
+++ b/modules/options/dynamic.go
@@ -7,10 +7,8 @@ package options
 
 import (
 	"fmt"
-	"io/fs"
 	"os"
 	"path"
-	"path/filepath"
 
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -27,76 +25,20 @@ func Dir(name string) ([]string, error) {
 
 	var result []string
 
-	customDir := path.Join(setting.CustomPath, "options", name)
-
-	isDir, err := util.IsDir(customDir)
-	if err != nil {
-		return []string{}, fmt.Errorf("Unabe to check if custom directory %s is a directory. %w", customDir, err)
-	}
-	if isDir {
-		files, err := util.StatDir(customDir, true)
-		if err != nil {
-			return []string{}, fmt.Errorf("Failed to read custom directory. %w", err)
-		}
-
-		result = append(result, files...)
-	}
-
-	staticDir := path.Join(setting.StaticRootPath, "options", name)
-
-	isDir, err = util.IsDir(staticDir)
-	if err != nil {
-		return []string{}, fmt.Errorf("unable to check if static directory %s is a directory. %w", staticDir, err)
-	}
-	if isDir {
-		files, err := util.StatDir(staticDir, true)
+	for _, dir := range []string{
+		path.Join(setting.CustomPath, "options", name),     // custom dir
+		path.Join(setting.StaticRootPath, "options", name), // static dir
+	} {
+		files, err := statDirIfExist(dir)
 		if err != nil {
-			return []string{}, fmt.Errorf("Failed to read static directory. %w", err)
+			return nil, err
 		}
-
 		result = append(result, files...)
 	}
 
 	return directories.AddAndGet(name, result), nil
 }
 
-// Locale reads the content of a specific locale from static or custom path.
-func Locale(name string) ([]byte, error) {
-	return fileFromDir(path.Join("locale", name))
-}
-
-// WalkLocales reads the content of a specific locale from static or custom path.
-func WalkLocales(callback func(path, name string, d fs.DirEntry, err error) error) error {
-	if err := walkAssetDir(filepath.Join(setting.StaticRootPath, "options", "locale"), callback); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to walk locales. Error: %w", err)
-	}
-
-	if err := walkAssetDir(filepath.Join(setting.CustomPath, "options", "locale"), callback); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to walk locales. Error: %w", err)
-	}
-	return nil
-}
-
-// Readme reads the content of a specific readme from static or custom path.
-func Readme(name string) ([]byte, error) {
-	return fileFromDir(path.Join("readme", path.Clean("/"+name)))
-}
-
-// Gitignore reads the content of a specific gitignore from static or custom path.
-func Gitignore(name string) ([]byte, error) {
-	return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
-}
-
-// License reads the content of a specific license from static or custom path.
-func License(name string) ([]byte, error) {
-	return fileFromDir(path.Join("license", path.Clean("/"+name)))
-}
-
-// Labels reads the content of a specific labels from static or custom path.
-func Labels(name string) ([]byte, error) {
-	return fileFromDir(path.Join("label", path.Clean("/"+name)))
-}
-
 // fileFromDir is a helper to read files from static or custom path.
 func fileFromDir(name string) ([]byte, error) {
 	customPath := path.Join(setting.CustomPath, "options", name)
diff --git a/modules/options/repo.go b/modules/options/repo.go
deleted file mode 100644
index 1480f7808176c..0000000000000
--- a/modules/options/repo.go
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package options
-
-import (
-	"fmt"
-	"os"
-	"path"
-	"strings"
-
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-)
-
-// GetRepoInitFile returns repository init files
-func GetRepoInitFile(tp, name string) ([]byte, error) {
-	cleanedName := strings.TrimLeft(path.Clean("/"+name), "/")
-	relPath := path.Join("options", tp, cleanedName)
-
-	// Use custom file when available.
-	customPath := path.Join(setting.CustomPath, relPath)
-	isFile, err := util.IsFile(customPath)
-	if err != nil {
-		log.Error("Unable to check if %s is a file. Error: %v", customPath, err)
-	}
-	if isFile {
-		return os.ReadFile(customPath)
-	}
-
-	switch tp {
-	case "readme":
-		return Readme(cleanedName)
-	case "gitignore":
-		return Gitignore(cleanedName)
-	case "license":
-		return License(cleanedName)
-	case "label":
-		return Labels(cleanedName)
-	default:
-		return []byte{}, fmt.Errorf("Invalid init file type")
-	}
-}
diff --git a/modules/options/static.go b/modules/options/static.go
index 2405d658bfb17..549f4e25b11a3 100644
--- a/modules/options/static.go
+++ b/modules/options/static.go
@@ -8,10 +8,8 @@ package options
 import (
 	"fmt"
 	"io"
-	"io/fs"
 	"os"
 	"path"
-	"path/filepath"
 
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -28,17 +26,14 @@ func Dir(name string) ([]string, error) {
 
 	var result []string
 
-	customDir := path.Join(setting.CustomPath, "options", name)
-	isDir, err := util.IsDir(customDir)
-	if err != nil {
-		return []string{}, fmt.Errorf("unable to check if custom directory %q is a directory. %w", customDir, err)
-	}
-	if isDir {
-		files, err := util.StatDir(customDir, true)
+	for _, dir := range []string{
+		path.Join(setting.CustomPath, "options", name), // custom dir
+		// no static dir
+	} {
+		files, err := statDirIfExist(dir)
 		if err != nil {
-			return []string{}, fmt.Errorf("unable to read custom directory %q. %w", customDir, err)
+			return nil, err
 		}
-
 		result = append(result, files...)
 	}
 
@@ -69,39 +64,6 @@ func AssetDir(dirName string) ([]string, error) {
 	return results, nil
 }
 
-// Locale reads the content of a specific locale from bindata or custom path.
-func Locale(name string) ([]byte, error) {
-	return fileFromDir(path.Join("locale", name))
-}
-
-// WalkLocales reads the content of a specific locale from static or custom path.
-func WalkLocales(callback func(path, name string, d fs.DirEntry, err error) error) error {
-	if err := walkAssetDir(filepath.Join(setting.CustomPath, "options", "locale"), callback); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("failed to walk locales. Error: %w", err)
-	}
-	return nil
-}
-
-// Readme reads the content of a specific readme from bindata or custom path.
-func Readme(name string) ([]byte, error) {
-	return fileFromDir(path.Join("readme", path.Clean("/"+name)))
-}
-
-// Gitignore reads the content of a gitignore locale from bindata or custom path.
-func Gitignore(name string) ([]byte, error) {
-	return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
-}
-
-// License reads the content of a specific license from bindata or custom path.
-func License(name string) ([]byte, error) {
-	return fileFromDir(path.Join("license", path.Clean("/"+name)))
-}
-
-// Labels reads the content of a specific labels from static or custom path.
-func Labels(name string) ([]byte, error) {
-	return fileFromDir(path.Join("label", path.Clean("/"+name)))
-}
-
 // fileFromDir is a helper to read files from bindata or custom path.
 func fileFromDir(name string) ([]byte, error) {
 	customPath := path.Join(setting.CustomPath, "options", name)
diff --git a/modules/repository/init.go b/modules/repository/init.go
index 49c8d2a904d1a..f9a33cd4f68c9 100644
--- a/modules/repository/init.go
+++ b/modules/repository/init.go
@@ -136,7 +136,7 @@ func prepareRepoCommit(ctx context.Context, repo *repo_model.Repository, tmpDir,
 	}
 
 	// README
-	data, err := options.GetRepoInitFile("readme", opts.Readme)
+	data, err := options.Readme(opts.Readme)
 	if err != nil {
 		return fmt.Errorf("GetRepoInitFile[%s]: %w", opts.Readme, err)
 	}
@@ -164,7 +164,7 @@ func prepareRepoCommit(ctx context.Context, repo *repo_model.Repository, tmpDir,
 		var buf bytes.Buffer
 		names := strings.Split(opts.Gitignores, ",")
 		for _, name := range names {
-			data, err = options.GetRepoInitFile("gitignore", name)
+			data, err = options.Gitignore(name)
 			if err != nil {
 				return fmt.Errorf("GetRepoInitFile[%s]: %w", name, err)
 			}
@@ -182,7 +182,7 @@ func prepareRepoCommit(ctx context.Context, repo *repo_model.Repository, tmpDir,
 
 	// LICENSE
 	if len(opts.License) > 0 {
-		data, err = options.GetRepoInitFile("license", opts.License)
+		data, err = options.License(opts.License)
 		if err != nil {
 			return fmt.Errorf("GetRepoInitFile[%s]: %w", opts.License, err)
 		}

From b116418f05b822481bba3613873eef876da73814 Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Wed, 8 Mar 2023 20:17:39 +0800
Subject: [PATCH 19/53] Use CleanPath instead of path.Clean (#23371)

As title.
---
 models/git/lfs_lock.go                       | 12 ++++--------
 modules/options/base.go                      | 10 +++++-----
 modules/public/public.go                     |  4 ++--
 modules/storage/local.go                     |  3 +--
 modules/storage/minio.go                     |  3 ++-
 modules/util/path.go                         |  8 ++++++++
 modules/util/path_test.go                    | 12 ++++++++++++
 routers/web/base.go                          |  5 +++--
 routers/web/repo/editor.go                   |  2 +-
 routers/web/repo/lfs.go                      |  2 +-
 services/migrations/gitea_uploader.go        |  4 ++--
 services/packages/container/blob_uploader.go |  4 ++--
 services/repository/files/file.go            |  4 ++--
 13 files changed, 45 insertions(+), 28 deletions(-)

diff --git a/models/git/lfs_lock.go b/models/git/lfs_lock.go
index 25480f3f96541..178fa72f09bf6 100644
--- a/models/git/lfs_lock.go
+++ b/models/git/lfs_lock.go
@@ -6,7 +6,6 @@ package git
 import (
 	"context"
 	"fmt"
-	"path"
 	"strings"
 	"time"
 
@@ -17,6 +16,7 @@ import (
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
 )
 
 // LFSLock represents a git lfs lock of repository.
@@ -34,11 +34,7 @@ func init() {
 
 // BeforeInsert is invoked from XORM before inserting an object of this type.
 func (l *LFSLock) BeforeInsert() {
-	l.Path = cleanPath(l.Path)
-}
-
-func cleanPath(p string) string {
-	return path.Clean("/" + p)[1:]
+	l.Path = util.CleanPath(l.Path)
 }
 
 // CreateLFSLock creates a new lock.
@@ -53,7 +49,7 @@ func CreateLFSLock(ctx context.Context, repo *repo_model.Repository, lock *LFSLo
 		return nil, err
 	}
 
-	lock.Path = cleanPath(lock.Path)
+	lock.Path = util.CleanPath(lock.Path)
 	lock.RepoID = repo.ID
 
 	l, err := GetLFSLock(dbCtx, repo, lock.Path)
@@ -73,7 +69,7 @@ func CreateLFSLock(ctx context.Context, repo *repo_model.Repository, lock *LFSLo
 
 // GetLFSLock returns release by given path.
 func GetLFSLock(ctx context.Context, repo *repo_model.Repository, path string) (*LFSLock, error) {
-	path = cleanPath(path)
+	path = util.CleanPath(path)
 	rel := &LFSLock{RepoID: repo.ID}
 	has, err := db.GetEngine(ctx).Where("lower(path) = ?", strings.ToLower(path)).Get(rel)
 	if err != nil {
diff --git a/modules/options/base.go b/modules/options/base.go
index 3c140f64326be..e83e8df5d0945 100644
--- a/modules/options/base.go
+++ b/modules/options/base.go
@@ -16,27 +16,27 @@ import (
 
 // Locale reads the content of a specific locale from static/bindata or custom path.
 func Locale(name string) ([]byte, error) {
-	return fileFromDir(path.Join("locale", path.Clean("/"+name)))
+	return fileFromDir(path.Join("locale", util.CleanPath(name)))
 }
 
 // Readme reads the content of a specific readme from static/bindata or custom path.
 func Readme(name string) ([]byte, error) {
-	return fileFromDir(path.Join("readme", path.Clean("/"+name)))
+	return fileFromDir(path.Join("readme", util.CleanPath(name)))
 }
 
 // Gitignore reads the content of a gitignore locale from static/bindata or custom path.
 func Gitignore(name string) ([]byte, error) {
-	return fileFromDir(path.Join("gitignore", path.Clean("/"+name)))
+	return fileFromDir(path.Join("gitignore", util.CleanPath(name)))
 }
 
 // License reads the content of a specific license from static/bindata or custom path.
 func License(name string) ([]byte, error) {
-	return fileFromDir(path.Join("license", path.Clean("/"+name)))
+	return fileFromDir(path.Join("license", util.CleanPath(name)))
 }
 
 // Labels reads the content of a specific labels from static/bindata or custom path.
 func Labels(name string) ([]byte, error) {
-	return fileFromDir(path.Join("label", path.Clean("/"+name)))
+	return fileFromDir(path.Join("label", util.CleanPath(name)))
 }
 
 // WalkLocales reads the content of a specific locale
diff --git a/modules/public/public.go b/modules/public/public.go
index 42026f9b10549..e1d60d89eb9f9 100644
--- a/modules/public/public.go
+++ b/modules/public/public.go
@@ -6,7 +6,6 @@ package public
 import (
 	"net/http"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 
@@ -14,6 +13,7 @@ import (
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
 )
 
 // Options represents the available options to configure the handler.
@@ -103,7 +103,7 @@ func setWellKnownContentType(w http.ResponseWriter, file string) {
 
 func (opts *Options) handle(w http.ResponseWriter, req *http.Request, fs http.FileSystem, file string) bool {
 	// use clean to keep the file is a valid path with no . or ..
-	f, err := fs.Open(path.Clean(file))
+	f, err := fs.Open(util.CleanPath(file))
 	if err != nil {
 		if os.IsNotExist(err) {
 			return false
diff --git a/modules/storage/local.go b/modules/storage/local.go
index a6a9d54a8ca30..05bf1fb28a56c 100644
--- a/modules/storage/local.go
+++ b/modules/storage/local.go
@@ -8,7 +8,6 @@ import (
 	"io"
 	"net/url"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 
@@ -59,7 +58,7 @@ func NewLocalStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
 }
 
 func (l *LocalStorage) buildLocalPath(p string) string {
-	return filepath.Join(l.dir, path.Clean("/" + strings.ReplaceAll(p, "\\", "/"))[1:])
+	return filepath.Join(l.dir, util.CleanPath(strings.ReplaceAll(p, "\\", "/")))
 }
 
 // Open a file
diff --git a/modules/storage/minio.go b/modules/storage/minio.go
index c427d8d7e3122..24da14b634631 100644
--- a/modules/storage/minio.go
+++ b/modules/storage/minio.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/util"
 
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
@@ -120,7 +121,7 @@ func NewMinioStorage(ctx context.Context, cfg interface{}) (ObjectStorage, error
 }
 
 func (m *MinioStorage) buildMinioPath(p string) string {
-	return strings.TrimPrefix(path.Join(m.basePath, path.Clean("/" + strings.ReplaceAll(p, "\\", "/"))[1:]), "/")
+	return strings.TrimPrefix(path.Join(m.basePath, util.CleanPath(strings.ReplaceAll(p, "\\", "/"))), "/")
 }
 
 // Open open a file
diff --git a/modules/util/path.go b/modules/util/path.go
index 74acb7a85fd87..5aa9e15f5c3e9 100644
--- a/modules/util/path.go
+++ b/modules/util/path.go
@@ -14,6 +14,14 @@ import (
 	"strings"
 )
 
+// CleanPath ensure to clean the path
+func CleanPath(p string) string {
+	if strings.HasPrefix(p, "/") {
+		return path.Clean(p)
+	}
+	return path.Clean("/" + p)[1:]
+}
+
 // EnsureAbsolutePath ensure that a path is absolute, making it
 // relative to absoluteBase if necessary
 func EnsureAbsolutePath(path, absoluteBase string) string {
diff --git a/modules/util/path_test.go b/modules/util/path_test.go
index 93f4f67cf6486..2f020f924dd2a 100644
--- a/modules/util/path_test.go
+++ b/modules/util/path_test.go
@@ -136,3 +136,15 @@ func TestMisc_IsReadmeFileName(t *testing.T) {
 		assert.Equal(t, testCase.idx, idx)
 	}
 }
+
+func TestCleanPath(t *testing.T) {
+	cases := map[string]string{
+		"../../test": "test",
+		"/test":      "/test",
+		"/../test":   "/test",
+	}
+
+	for k, v := range cases {
+		assert.Equal(t, v, CleanPath(k))
+	}
+}
diff --git a/routers/web/base.go b/routers/web/base.go
index b0d8a7c3f1e6d..d0135eac7a968 100644
--- a/routers/web/base.go
+++ b/routers/web/base.go
@@ -19,6 +19,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/storage"
 	"code.gitea.io/gitea/modules/templates"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/modules/web/middleware"
 	"code.gitea.io/gitea/modules/web/routing"
 	"code.gitea.io/gitea/services/auth"
@@ -44,7 +45,7 @@ func storageHandler(storageSetting setting.Storage, prefix string, objStore stor
 				routing.UpdateFuncInfo(req.Context(), funcInfo)
 
 				rPath := strings.TrimPrefix(req.URL.Path, "/"+prefix+"/")
-				rPath = path.Clean("/" + strings.ReplaceAll(rPath, "\\", "/"))[1:]
+				rPath = util.CleanPath(strings.ReplaceAll(rPath, "\\", "/"))
 
 				u, err := objStore.URL(rPath, path.Base(rPath))
 				if err != nil {
@@ -80,7 +81,7 @@ func storageHandler(storageSetting setting.Storage, prefix string, objStore stor
 			routing.UpdateFuncInfo(req.Context(), funcInfo)
 
 			rPath := strings.TrimPrefix(req.URL.Path, "/"+prefix+"/")
-			rPath = path.Clean("/" + strings.ReplaceAll(rPath, "\\", "/"))[1:]
+			rPath = util.CleanPath(strings.ReplaceAll(rPath, "\\", "/"))
 			if rPath == "" {
 				http.Error(w, "file not found", http.StatusNotFound)
 				return
diff --git a/routers/web/repo/editor.go b/routers/web/repo/editor.go
index e5ba4ad2c1398..4f208098e4766 100644
--- a/routers/web/repo/editor.go
+++ b/routers/web/repo/editor.go
@@ -726,7 +726,7 @@ func UploadFilePost(ctx *context.Context) {
 
 func cleanUploadFileName(name string) string {
 	// Rebase the filename
-	name = strings.Trim(path.Clean("/"+name), "/")
+	name = strings.Trim(util.CleanPath(name), "/")
 	// Git disallows any filenames to have a .git directory in them.
 	for _, part := range strings.Split(name, "/") {
 		if strings.ToLower(part) == ".git" {
diff --git a/routers/web/repo/lfs.go b/routers/web/repo/lfs.go
index 869a69c377219..43f5527986b9b 100644
--- a/routers/web/repo/lfs.go
+++ b/routers/web/repo/lfs.go
@@ -207,7 +207,7 @@ func LFSLockFile(ctx *context.Context) {
 		ctx.Redirect(ctx.Repo.RepoLink + "/settings/lfs/locks")
 		return
 	}
-	lockPath = path.Clean("/" + lockPath)[1:]
+	lockPath = util.CleanPath(lockPath)
 	if len(lockPath) == 0 {
 		ctx.Flash.Error(ctx.Tr("repo.settings.lfs_invalid_locking_path", originalPath))
 		ctx.Redirect(ctx.Repo.RepoLink + "/settings/lfs/locks")
diff --git a/services/migrations/gitea_uploader.go b/services/migrations/gitea_uploader.go
index 8b259a362b1eb..ca961524d12c2 100644
--- a/services/migrations/gitea_uploader.go
+++ b/services/migrations/gitea_uploader.go
@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -30,6 +29,7 @@ import (
 	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/uri"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/pull"
 
 	"github.com/google/uuid"
@@ -866,7 +866,7 @@ func (g *GiteaLocalUploader) CreateReviews(reviews ...*base.Review) error {
 			}
 
 			// SECURITY: The TreePath must be cleaned!
-			comment.TreePath = path.Clean("/" + comment.TreePath)[1:]
+			comment.TreePath = util.CleanPath(comment.TreePath)
 
 			var patch string
 			reader, writer := io.Pipe()
diff --git a/services/packages/container/blob_uploader.go b/services/packages/container/blob_uploader.go
index ba92b0507343a..860672587d2b4 100644
--- a/services/packages/container/blob_uploader.go
+++ b/services/packages/container/blob_uploader.go
@@ -8,13 +8,13 @@ import (
 	"errors"
 	"io"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 
 	packages_model "code.gitea.io/gitea/models/packages"
 	packages_module "code.gitea.io/gitea/modules/packages"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
 )
 
 var (
@@ -33,7 +33,7 @@ type BlobUploader struct {
 }
 
 func buildFilePath(id string) string {
-	return filepath.Join(setting.Packages.ChunkedUploadPath, path.Clean("/" + strings.ReplaceAll(id, "\\", "/"))[1:])
+	return filepath.Join(setting.Packages.ChunkedUploadPath, util.CleanPath(strings.ReplaceAll(id, "\\", "/")))
 }
 
 // NewBlobUploader creates a new blob uploader for the given id
diff --git a/services/repository/files/file.go b/services/repository/files/file.go
index 2bac4372d378c..7939491aec624 100644
--- a/services/repository/files/file.go
+++ b/services/repository/files/file.go
@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"net/url"
-	"path"
 	"strings"
 	"time"
 
@@ -15,6 +14,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
 	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/util"
 )
 
 // GetFileResponseFromCommit Constructs a FileResponse from a Commit object
@@ -129,7 +129,7 @@ func GetAuthorAndCommitterUsers(author, committer *IdentityOptions, doer *user_m
 // CleanUploadFileName Trims a filename and returns empty string if it is a .git directory
 func CleanUploadFileName(name string) string {
 	// Rebase the filename
-	name = strings.Trim(path.Clean("/"+name), "/")
+	name = strings.Trim(util.CleanPath(name), "/")
 	// Git disallows any filenames to have a .git directory in them.
 	for _, part := range strings.Split(name, "/") {
 		if strings.ToLower(part) == ".git" {

From 15a1c2d7efa2c835fb9bcff439446579f08c5e32 Mon Sep 17 00:00:00 2001
From: Zettat123 <zettat123@gmail.com>
Date: Wed, 8 Mar 2023 20:21:23 +0800
Subject: [PATCH 20/53] Fix panic when getting notes by ref (#23372)

Fix #23357 .

Now the `/repos/{owner}/{repo}/git/notes/{sha}` API supports getting
notes by a ref or sha
(https://try.gitea.io/api/swagger#/repository/repoGetNote). But the
`GetNote` func can only accept commit ID.

https://github.com/go-gitea/gitea/blob/a12f5757372f751d25f9e5ca1f168f6920ded894/modules/git/notes_nogogit.go#L18

So we need to convert the query parameter to commit ID before calling
`GetNote`.
---
 routers/api/v1/repo/notes.go | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/routers/api/v1/repo/notes.go b/routers/api/v1/repo/notes.go
index 2d1f3291f8b9c..74969f2cad7c8 100644
--- a/routers/api/v1/repo/notes.go
+++ b/routers/api/v1/repo/notes.go
@@ -58,8 +58,18 @@ func getNote(ctx *context.APIContext, identifier string) {
 		return
 	}
 
+	commitSHA, err := ctx.Repo.GitRepo.ConvertToSHA1(identifier)
+	if err != nil {
+		if git.IsErrNotExist(err) {
+			ctx.NotFound(err)
+		} else {
+			ctx.Error(http.StatusInternalServerError, "ConvertToSHA1", err)
+		}
+		return
+	}
+
 	var note git.Note
-	if err := git.GetNote(ctx, ctx.Repo.GitRepo, identifier, &note); err != nil {
+	if err := git.GetNote(ctx, ctx.Repo.GitRepo, commitSHA.String(), &note); err != nil {
 		if git.IsErrNotExist(err) {
 			ctx.NotFound(identifier)
 			return

From d949d8e074407a96dbcfa98a71ccd80527b5ad78 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Thu, 9 Mar 2023 00:18:10 +0900
Subject: [PATCH 21/53] add user visibility in dashboard navbar (#22747)

Add private/limited tag to dashboard user/org list dropdown menu

![image](https://user-images.githubusercontent.com/18380374/216752207-5beb5281-1b0b-4e2b-adfc-b39c192c5032.png)

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 templates/user/dashboard/navbar.tmpl | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/templates/user/dashboard/navbar.tmpl b/templates/user/dashboard/navbar.tmpl
index 719d5b06b9f55..ab6f1bc5841b9 100644
--- a/templates/user/dashboard/navbar.tmpl
+++ b/templates/user/dashboard/navbar.tmpl
@@ -5,12 +5,10 @@
 				<span class="text truncated-item-container">
 					{{avatar $.Context .ContextUser}}
 					<span class="truncated-item-name">{{.ContextUser.ShortName 40}}</span>
-					{{if .ContextUser.IsOrganization}}
-						<span class="org-visibility">
-							{{if .ContextUser.Visibility.IsLimited}}<div class="ui basic tiny horizontal label">{{.locale.Tr "org.settings.visibility.limited_shortname"}}</div>{{end}}
-							{{if .ContextUser.Visibility.IsPrivate}}<div class="ui basic tiny horizontal label">{{.locale.Tr "org.settings.visibility.private_shortname"}}</div>{{end}}
-						</span>
-					{{end}}
+					<span class="org-visibility">
+						{{if .ContextUser.Visibility.IsLimited}}<div class="ui basic tiny horizontal label">{{.locale.Tr "org.settings.visibility.limited_shortname"}}</div>{{end}}
+						{{if .ContextUser.Visibility.IsPrivate}}<div class="ui basic tiny horizontal label">{{.locale.Tr "org.settings.visibility.private_shortname"}}</div>{{end}}
+					</span>
 					{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 				</span>
 				<div class="context user overflow menu" tabindex="-1">
@@ -21,6 +19,10 @@
 						<a class="{{if eq .ContextUser.ID .SignedUser.ID}}active selected{{end}} item truncated-item-container" href="{{AppSubUrl}}/{{if .PageIsIssues}}issues{{else if .PageIsPulls}}pulls{{else if .PageIsMilestonesDashboard}}milestones{{end}}">
 							{{avatar $.Context .SignedUser}}
 							<span class="truncated-item-name">{{.SignedUser.ShortName 40}}</span>
+							<span class="org-visibility">
+								{{if .ContextUser.Visibility.IsLimited}}<div class="ui basic tiny horizontal label">{{$.locale.Tr "org.settings.visibility.limited_shortname"}}</div>{{end}}
+								{{if .ContextUser.Visibility.IsPrivate}}<div class="ui basic tiny horizontal label">{{$.locale.Tr "org.settings.visibility.private_shortname"}}</div>{{end}}
+							</span>
 						</a>
 						{{range .Orgs}}
 							<a class="{{if eq $.ContextUser.ID .ID}}active selected{{end}} item truncated-item-container" title="{{.Name}}" href="{{.OrganisationLink}}/{{if $.PageIsIssues}}issues{{else if $.PageIsPulls}}pulls{{else if $.PageIsMilestonesDashboard}}milestones{{else}}dashboard{{end}}">

From 1960ad5c90df65100488b64e7047d1ba3096c11c Mon Sep 17 00:00:00 2001
From: Jason Song <i@wolfogre.com>
Date: Thu, 9 Mar 2023 01:57:05 +0800
Subject: [PATCH 22/53] Improve cache context (#23330)

Related to: #22294 #23186 #23054

Replace: #23218

Some discussion is in the comments of #23218.

Highlights:
- Add Expiration for cache context. If a cache context has been used for
more than 10s, the cache data will be ignored, and warning logs will be
printed.
- Add `discard` field to `cacheContext`, a `cacheContext` with `discard`
true will drop all cached data and won't store any new one.
- Introduce `WithNoCacheContext`, if one wants to run long-life tasks,
but the parent context is a cache context,
`WithNoCacheContext(perentCtx)` will discard the cache data, so it will
be safe to keep the context for a long time.
- It will be fine to treat an original context as a cache context, like
`GetContextData(context.Backgraud())`, no warning logs will be printed.

Some cases about nesting:

When:
- *A*, *B* or *C* means a cache context.
- ~*A*~, ~*B*~ or ~*C*~ means a discard cache context.
- `ctx` means `context.Backgrand()`
- *A(ctx)* means a cache context with `ctx` as the parent context.
- *B(A(ctx))* means a cache context with `A(ctx)` as the parent context.
- `With` means `WithCacheContext`
- `WithNo` means `WithNoCacheContext`

So:
- `With(ctx)` -> *A(ctx)*
- `With(With(ctx))` -> *A(ctx)*, not *B(A(ctx))*
- `With(With(With(ctx)))` -> *A(ctx)*, not *C(B(A(ctx)))*
- `WithNo(ctx)` -> *ctx*, not *~A~(ctx)*
- `WithNo(With(ctx))` -> *~A~(ctx)*
- `WithNo(WithNo(With(ctx)))` -> *~A~(ctx)*, not *~B~(~A~(ctx))*
- `With(WithNo(With(ctx)))` -> *B(~A~(ctx))*
- `WithNo(With(WithNo(With(ctx))))` -> *~B~(~A~(ctx))*
- `With(WithNo(With(WithNo(With(ctx)))))` -> *C(~B~(~A~(ctx)))*
---
 modules/cache/context.go      | 119 +++++++++++++++++++++++++++++-----
 modules/cache/context_test.go |  39 ++++++++++-
 services/repository/push.go   |   1 -
 3 files changed, 141 insertions(+), 18 deletions(-)

diff --git a/modules/cache/context.go b/modules/cache/context.go
index f741a87445383..62bbf5dcba84a 100644
--- a/modules/cache/context.go
+++ b/modules/cache/context.go
@@ -6,6 +6,7 @@ package cache
 import (
 	"context"
 	"sync"
+	"time"
 
 	"code.gitea.io/gitea/modules/log"
 )
@@ -14,65 +15,151 @@ import (
 // This is useful for caching data that is expensive to calculate and is likely to be
 // used multiple times in a request.
 type cacheContext struct {
-	ctx  context.Context
-	data map[any]map[any]any
-	lock sync.RWMutex
+	data    map[any]map[any]any
+	lock    sync.RWMutex
+	created time.Time
+	discard bool
 }
 
 func (cc *cacheContext) Get(tp, key any) any {
 	cc.lock.RLock()
 	defer cc.lock.RUnlock()
-	if cc.data[tp] == nil {
-		return nil
-	}
 	return cc.data[tp][key]
 }
 
 func (cc *cacheContext) Put(tp, key, value any) {
 	cc.lock.Lock()
 	defer cc.lock.Unlock()
-	if cc.data[tp] == nil {
-		cc.data[tp] = make(map[any]any)
+
+	if cc.discard {
+		return
+	}
+
+	d := cc.data[tp]
+	if d == nil {
+		d = make(map[any]any)
+		cc.data[tp] = d
 	}
-	cc.data[tp][key] = value
+	d[key] = value
 }
 
 func (cc *cacheContext) Delete(tp, key any) {
 	cc.lock.Lock()
 	defer cc.lock.Unlock()
-	if cc.data[tp] == nil {
-		return
-	}
 	delete(cc.data[tp], key)
 }
 
+func (cc *cacheContext) Discard() {
+	cc.lock.Lock()
+	defer cc.lock.Unlock()
+	cc.data = nil
+	cc.discard = true
+}
+
+func (cc *cacheContext) isDiscard() bool {
+	cc.lock.RLock()
+	defer cc.lock.RUnlock()
+	return cc.discard
+}
+
+// cacheContextLifetime is the max lifetime of cacheContext.
+// Since cacheContext is used to cache data in a request level context, 10s is enough.
+// If a cacheContext is used more than 10s, it's probably misuse.
+const cacheContextLifetime = 10 * time.Second
+
+var timeNow = time.Now
+
+func (cc *cacheContext) Expired() bool {
+	return timeNow().Sub(cc.created) > cacheContextLifetime
+}
+
 var cacheContextKey = struct{}{}
 
+/*
+Since there are both WithCacheContext and WithNoCacheContext,
+it may be confusing when there is nesting.
+
+Some cases to explain the design:
+
+When:
+- A, B or C means a cache context.
+- A', B' or C' means a discard cache context.
+- ctx means context.Backgrand().
+- A(ctx) means a cache context with ctx as the parent context.
+- B(A(ctx)) means a cache context with A(ctx) as the parent context.
+- With is alias of WithCacheContext.
+- WithNo is alias of WithNoCacheContext.
+
+So:
+- With(ctx) -> A(ctx)
+- With(With(ctx)) -> A(ctx), not B(A(ctx)), always reuse parent cache context if possible.
+- With(With(With(ctx))) -> A(ctx), not C(B(A(ctx))), ditto.
+- WithNo(ctx) -> ctx, not A'(ctx), don't create new cache context if we don't have to.
+- WithNo(With(ctx)) -> A'(ctx)
+- WithNo(WithNo(With(ctx))) -> A'(ctx), not B'(A'(ctx)), don't create new cache context if we don't have to.
+- With(WithNo(With(ctx))) -> B(A'(ctx)), not A(ctx), never reuse a discard cache context.
+- WithNo(With(WithNo(With(ctx)))) -> B'(A'(ctx))
+- With(WithNo(With(WithNo(With(ctx))))) -> C(B'(A'(ctx))), so there's always only one not-discard cache context.
+*/
+
 func WithCacheContext(ctx context.Context) context.Context {
+	if c, ok := ctx.Value(cacheContextKey).(*cacheContext); ok {
+		if !c.isDiscard() {
+			// reuse parent context
+			return ctx
+		}
+	}
 	return context.WithValue(ctx, cacheContextKey, &cacheContext{
-		ctx:  ctx,
-		data: make(map[any]map[any]any),
+		data:    make(map[any]map[any]any),
+		created: timeNow(),
 	})
 }
 
+func WithNoCacheContext(ctx context.Context) context.Context {
+	if c, ok := ctx.Value(cacheContextKey).(*cacheContext); ok {
+		// The caller want to run long-life tasks, but the parent context is a cache context.
+		// So we should disable and clean the cache data, or it will be kept in memory for a long time.
+		c.Discard()
+		return ctx
+	}
+
+	return ctx
+}
+
 func GetContextData(ctx context.Context, tp, key any) any {
 	if c, ok := ctx.Value(cacheContextKey).(*cacheContext); ok {
+		if c.Expired() {
+			// The warning means that the cache context is misused for long-life task,
+			// it can be resolved with WithNoCacheContext(ctx).
+			log.Warn("cache context is expired, may be misused for long-life tasks: %v", c)
+			return nil
+		}
 		return c.Get(tp, key)
 	}
-	log.Warn("cannot get cache context when getting data: %v", ctx)
 	return nil
 }
 
 func SetContextData(ctx context.Context, tp, key, value any) {
 	if c, ok := ctx.Value(cacheContextKey).(*cacheContext); ok {
+		if c.Expired() {
+			// The warning means that the cache context is misused for long-life task,
+			// it can be resolved with WithNoCacheContext(ctx).
+			log.Warn("cache context is expired, may be misused for long-life tasks: %v", c)
+			return
+		}
 		c.Put(tp, key, value)
 		return
 	}
-	log.Warn("cannot get cache context when setting data: %v", ctx)
 }
 
 func RemoveContextData(ctx context.Context, tp, key any) {
 	if c, ok := ctx.Value(cacheContextKey).(*cacheContext); ok {
+		if c.Expired() {
+			// The warning means that the cache context is misused for long-life task,
+			// it can be resolved with WithNoCacheContext(ctx).
+			log.Warn("cache context is expired, may be misused for long-life tasks: %v", c)
+			return
+		}
 		c.Delete(tp, key)
 	}
 }
diff --git a/modules/cache/context_test.go b/modules/cache/context_test.go
index 77e3ecad2ca70..5315547865e19 100644
--- a/modules/cache/context_test.go
+++ b/modules/cache/context_test.go
@@ -6,6 +6,7 @@ package cache
 import (
 	"context"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -25,7 +26,7 @@ func TestWithCacheContext(t *testing.T) {
 	assert.EqualValues(t, 1, v.(int))
 
 	RemoveContextData(ctx, field, "my_config1")
-	RemoveContextData(ctx, field, "my_config2") // remove an non-exist key
+	RemoveContextData(ctx, field, "my_config2") // remove a non-exist key
 
 	v = GetContextData(ctx, field, "my_config1")
 	assert.Nil(t, v)
@@ -38,4 +39,40 @@ func TestWithCacheContext(t *testing.T) {
 
 	v = GetContextData(ctx, field, "my_config1")
 	assert.EqualValues(t, 1, v)
+
+	now := timeNow
+	defer func() {
+		timeNow = now
+	}()
+	timeNow = func() time.Time {
+		return now().Add(10 * time.Second)
+	}
+	v = GetContextData(ctx, field, "my_config1")
+	assert.Nil(t, v)
+}
+
+func TestWithNoCacheContext(t *testing.T) {
+	ctx := context.Background()
+
+	const field = "system_setting"
+
+	v := GetContextData(ctx, field, "my_config1")
+	assert.Nil(t, v)
+	SetContextData(ctx, field, "my_config1", 1)
+	v = GetContextData(ctx, field, "my_config1")
+	assert.Nil(t, v) // still no cache
+
+	ctx = WithCacheContext(ctx)
+	v = GetContextData(ctx, field, "my_config1")
+	assert.Nil(t, v)
+	SetContextData(ctx, field, "my_config1", 1)
+	v = GetContextData(ctx, field, "my_config1")
+	assert.NotNil(t, v)
+
+	ctx = WithNoCacheContext(ctx)
+	v = GetContextData(ctx, field, "my_config1")
+	assert.Nil(t, v)
+	SetContextData(ctx, field, "my_config1", 1)
+	v = GetContextData(ctx, field, "my_config1")
+	assert.Nil(t, v) // still no cache
 }
diff --git a/services/repository/push.go b/services/repository/push.go
index 355c2878113fd..cdf030396fcf6 100644
--- a/services/repository/push.go
+++ b/services/repository/push.go
@@ -80,7 +80,6 @@ func pushUpdates(optsList []*repo_module.PushUpdateOptions) error {
 
 	ctx, _, finished := process.GetManager().AddContext(graceful.GetManager().HammerContext(), fmt.Sprintf("PushUpdates: %s/%s", optsList[0].RepoUserName, optsList[0].RepoName))
 	defer finished()
-	ctx = cache.WithCacheContext(ctx)
 
 	repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, optsList[0].RepoUserName, optsList[0].RepoName)
 	if err != nil {

From af0468ed8dea62f373c51efaa679080a9cb69f5c Mon Sep 17 00:00:00 2001
From: Yarden Shoham <hrsi88@gmail.com>
Date: Wed, 8 Mar 2023 22:40:04 +0200
Subject: [PATCH 23/53] Set `X-Gitea-Debug` header once (#23361)

Instead of adding it

# Before
On the raw commit page:

![image](https://user-images.githubusercontent.com/20454870/223470744-cdf11898-e023-4198-8c8b-c294e5d78b73.png)

# After

![image](https://user-images.githubusercontent.com/20454870/223470596-af898d66-bd5b-4ddb-b220-ceb1f149bfec.png)

Fixes #23308

---------

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: John Olheiser <john.olheiser@gmail.com>
---
 modules/context/api.go         |  2 +-
 modules/context/context.go     |  4 ++--
 modules/httpcache/httpcache.go | 12 ++++++------
 routers/install/routes.go      |  2 +-
 routers/web/base.go            |  2 +-
 routers/web/user/avatar.go     |  2 +-
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/modules/context/api.go b/modules/context/api.go
index 3f938948aed66..f7a3384691246 100644
--- a/modules/context/api.go
+++ b/modules/context/api.go
@@ -244,7 +244,7 @@ func APIContexter() func(http.Handler) http.Handler {
 				}
 			}
 
-			httpcache.AddCacheControlToHeader(ctx.Resp.Header(), 0, "no-transform")
+			httpcache.SetCacheControlInHeader(ctx.Resp.Header(), 0, "no-transform")
 			ctx.Resp.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions)
 
 			ctx.Data["Context"] = &ctx
diff --git a/modules/context/context.go b/modules/context/context.go
index 0c8d7411ed5db..50c34edae2e53 100644
--- a/modules/context/context.go
+++ b/modules/context/context.go
@@ -388,7 +388,7 @@ func (ctx *Context) SetServeHeaders(opts *ServeHeaderOptions) {
 	if duration == 0 {
 		duration = 5 * time.Minute
 	}
-	httpcache.AddCacheControlToHeader(header, duration)
+	httpcache.SetCacheControlInHeader(header, duration)
 
 	if !opts.LastModified.IsZero() {
 		header.Set("Last-Modified", opts.LastModified.UTC().Format(http.TimeFormat))
@@ -753,7 +753,7 @@ func Contexter(ctx context.Context) func(next http.Handler) http.Handler {
 				}
 			}
 
-			httpcache.AddCacheControlToHeader(ctx.Resp.Header(), 0, "no-transform")
+			httpcache.SetCacheControlInHeader(ctx.Resp.Header(), 0, "no-transform")
 			ctx.Resp.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions)
 
 			ctx.Data["CsrfToken"] = ctx.csrf.GetToken()
diff --git a/modules/httpcache/httpcache.go b/modules/httpcache/httpcache.go
index f0caa30eb82b3..46e0152ef4553 100644
--- a/modules/httpcache/httpcache.go
+++ b/modules/httpcache/httpcache.go
@@ -15,8 +15,8 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 )
 
-// AddCacheControlToHeader adds suitable cache-control headers to response
-func AddCacheControlToHeader(h http.Header, maxAge time.Duration, additionalDirectives ...string) {
+// SetCacheControlInHeader sets suitable cache-control headers in the response
+func SetCacheControlInHeader(h http.Header, maxAge time.Duration, additionalDirectives ...string) {
 	directives := make([]string, 0, 2+len(additionalDirectives))
 
 	// "max-age=0 + must-revalidate" (aka "no-cache") is preferred instead of "no-store"
@@ -31,7 +31,7 @@ func AddCacheControlToHeader(h http.Header, maxAge time.Duration, additionalDire
 		directives = append(directives, "max-age=0", "private", "must-revalidate")
 
 		// to remind users they are using non-prod setting.
-		h.Add("X-Gitea-Debug", "RUN_MODE="+setting.RunMode)
+		h.Set("X-Gitea-Debug", "RUN_MODE="+setting.RunMode)
 	}
 
 	h.Set("Cache-Control", strings.Join(append(directives, additionalDirectives...), ", "))
@@ -50,7 +50,7 @@ func HandleTimeCache(req *http.Request, w http.ResponseWriter, fi os.FileInfo) (
 
 // HandleGenericTimeCache handles time-based caching for a HTTP request
 func HandleGenericTimeCache(req *http.Request, w http.ResponseWriter, lastModified time.Time) (handled bool) {
-	AddCacheControlToHeader(w.Header(), setting.StaticCacheTime)
+	SetCacheControlInHeader(w.Header(), setting.StaticCacheTime)
 
 	ifModifiedSince := req.Header.Get("If-Modified-Since")
 	if ifModifiedSince != "" {
@@ -81,7 +81,7 @@ func HandleGenericETagCache(req *http.Request, w http.ResponseWriter, etag strin
 			return true
 		}
 	}
-	AddCacheControlToHeader(w.Header(), setting.StaticCacheTime)
+	SetCacheControlInHeader(w.Header(), setting.StaticCacheTime)
 	return false
 }
 
@@ -125,6 +125,6 @@ func HandleGenericETagTimeCache(req *http.Request, w http.ResponseWriter, etag s
 			}
 		}
 	}
-	AddCacheControlToHeader(w.Header(), setting.StaticCacheTime)
+	SetCacheControlInHeader(w.Header(), setting.StaticCacheTime)
 	return false
 }
diff --git a/routers/install/routes.go b/routers/install/routes.go
index a8efc92fe17ca..82d9c34b41f18 100644
--- a/routers/install/routes.go
+++ b/routers/install/routes.go
@@ -64,7 +64,7 @@ func installRecovery(ctx goctx.Context) func(next http.Handler) http.Handler {
 						"SignedUserName": "",
 					}
 
-					httpcache.AddCacheControlToHeader(w.Header(), 0, "no-transform")
+					httpcache.SetCacheControlInHeader(w.Header(), 0, "no-transform")
 					w.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions)
 
 					if !setting.IsProd {
diff --git a/routers/web/base.go b/routers/web/base.go
index d0135eac7a968..2eb0b6f39118a 100644
--- a/routers/web/base.go
+++ b/routers/web/base.go
@@ -159,7 +159,7 @@ func Recovery(ctx goctx.Context) func(next http.Handler) http.Handler {
 						store["SignedUserName"] = ""
 					}
 
-					httpcache.AddCacheControlToHeader(w.Header(), 0, "no-transform")
+					httpcache.SetCacheControlInHeader(w.Header(), 0, "no-transform")
 					w.Header().Set(`X-Frame-Options`, setting.CORSConfig.XFrameOptions)
 
 					if !setting.IsProd {
diff --git a/routers/web/user/avatar.go b/routers/web/user/avatar.go
index 2dba74822e531..7ad65cd51e39c 100644
--- a/routers/web/user/avatar.go
+++ b/routers/web/user/avatar.go
@@ -17,7 +17,7 @@ func cacheableRedirect(ctx *context.Context, location string) {
 	// here we should not use `setting.StaticCacheTime`, it is pretty long (default: 6 hours)
 	// we must make sure the redirection cache time is short enough, otherwise a user won't see the updated avatar in 6 hours
 	// it's OK to make the cache time short, it is only a redirection, and doesn't cost much to make a new request
-	httpcache.AddCacheControlToHeader(ctx.Resp.Header(), 5*time.Minute)
+	httpcache.SetCacheControlInHeader(ctx.Resp.Header(), 5*time.Minute)
 	ctx.Redirect(location)
 }
 

From c5573dbc0fe2937a363813971a443277ccd580c3 Mon Sep 17 00:00:00 2001
From: GiteaBot <teabot@gitea.io>
Date: Thu, 9 Mar 2023 00:15:57 +0000
Subject: [PATCH 24/53] [skip ci] Updated translations via Crowdin

---
 options/locale/locale_zh-TW.ini | 91 ++++++++++++++++++++++++++++++++-
 1 file changed, 90 insertions(+), 1 deletion(-)

diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index edf7376e7cc45..4f2e0ebb13c3e 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -57,6 +57,7 @@ new_mirror=新鏡像
 new_fork=新增儲存庫 fork
 new_org=新增組織
 new_project=新增專案
+new_project_column=新增欄位
 manage_org=管理組織
 admin_panel=網站管理
 account_settings=帳戶設定
@@ -90,9 +91,11 @@ disabled=已停用
 
 copy=複製
 copy_url=複製 URL
+copy_content=複製內容
 copy_branch=複製分支名稱
 copy_success=複製成功！
 copy_error=複製失敗
+copy_type_unsupported=無法複製此類型的檔案
 
 write=撰寫
 preview=預覽
@@ -109,8 +112,14 @@ never=從來沒有
 rss_feed=RSS 摘要
 
 [aria]
+navbar=導航列
+footer=頁尾
+footer.software=關於軟體
+footer.links=連結
 
 [filter]
+string.asc=A - Z
+string.desc=Z - A
 
 [error]
 occurred=發生錯誤
@@ -238,7 +247,10 @@ default_enable_timetracking_popup=預設情況下啟用新存儲庫的時間跟
 no_reply_address=隱藏電子信箱域名
 no_reply_address_helper=作為隱藏電子信箱使用者的域名。例如，如果隱藏的電子信箱域名設定為「noreply.example.org」，帳號「joe」將以「joe@noreply.example.org」的身分登錄到 Git 中。
 password_algorithm=密碼雜湊演算法
+invalid_password_algorithm=無效的密碼雜湊演算法
 password_algorithm_helper=設定密碼雜湊演算法。演算法有不同的需求和強度。「argon2」雖然有優秀的特性但會占用大量記憶體，所以可能不適用於小型系統。
+enable_update_checker=啟用更新檢查器
+enable_update_checker_helper=定期連線到 gitea.io 檢查更新。
 
 [home]
 uname_holder=帳號或電子信箱
@@ -285,6 +297,8 @@ org_no_results=沒有找到符合的組織。
 code_no_results=找不到符合您關鍵字的原始碼。
 code_search_results=「%s」的搜尋結果
 code_last_indexed_at=最後索引 %s
+relevant_repositories_tooltip=已隱藏缺少主題、圖示、說明、Fork 的儲存庫。
+relevant_repositories=只顯示相關的儲存庫，<a href="%s">顯示未篩選的結果</a>。
 
 
 [auth]
@@ -357,6 +371,7 @@ password_pwned_err=無法完成對 HaveIBeenPwned 的請求。
 
 [mail]
 view_it_on=在 %s 上查看
+reply=或是直接回覆此電子郵件
 link_not_working_do_paste=無法開啟？請複製超連結到瀏覽器貼上。
 hi_user_x=<b>%s</b> 您好，
 
@@ -491,6 +506,7 @@ user_not_exist=該用戶名不存在
 team_not_exist=團隊不存在
 last_org_owner=你不能從「Owners」團隊中刪除最後一個使用者。每個組織中至少要有一個擁有者。
 cannot_add_org_to_team=組織不能被新增為團隊成員。
+organization_leave_success=您已成功離開組織 %s。
 
 invalid_ssh_key=無法驗證您的 SSH 密鑰：%s
 invalid_gpg_key=無法驗證您的 GPG 密鑰：%s
@@ -1002,10 +1018,12 @@ unstar=移除星號
 star=加上星號
 fork=Fork
 download_archive=下載此儲存庫
+more_operations=更多操作
 
 no_desc=暫無描述
 quick_guide=快速幫助
 clone_this_repo=Clone 此儲存庫
+cite_this_repo=引用此儲存庫
 create_new_repo_command=從命令列建立新儲存庫。
 push_exist_repo=從命令列推送已存在的儲存庫
 empty_message=此儲存庫未包含任何內容。
@@ -1155,6 +1173,7 @@ commits.signed_by_untrusted_user_unmatched=由不受信任且與提交者不相
 commits.gpg_key_id=GPG 金鑰 ID
 commits.ssh_key_fingerprint=SSH 金鑰指紋
 
+commit.operations=操作
 commit.revert=還原
 commit.revert-header=還原: %s
 commit.revert-content=選擇還原的目標分支：
@@ -1187,11 +1206,22 @@ projects.type.bug_triage=Bug 檢傷分類
 projects.template.desc=專案範本
 projects.template.desc_helper=選擇專案範本以開始
 projects.type.uncategorized=未分類
+projects.column.edit=編輯欄位
 projects.column.edit_title=組織名稱
 projects.column.new_title=組織名稱
+projects.column.new_submit=建立欄位
+projects.column.new=新增欄位
+projects.column.set_default=設為預設
+projects.column.set_default_desc=將此欄位設定為未分類問題及合併請求的預設預設值
+projects.column.delete=刪除欄位
+projects.column.deletion_desc=刪除專案欄位會將所有相關的問題移動到「未分類」，是否繼續？
 projects.column.color=彩色
 projects.open=開啟
 projects.close=關閉
+projects.column.assigned_to=已指派給
+projects.card_type.desc=卡片預覽
+projects.card_type.images_and_text=圖片和文字
+projects.card_type.text_only=純文字
 
 issues.desc=管理錯誤報告、任務和里程碑。
 issues.filter_assignees=篩選負責人
@@ -1268,6 +1298,7 @@ issues.filter_label_no_select=所有標籤
 issues.filter_milestone=里程碑
 issues.filter_milestone_no_select=所有里程碑
 issues.filter_project=專案
+issues.filter_project_all=所有專案
 issues.filter_project_none=未選擇專案
 issues.filter_assignee=負責人
 issues.filter_assginee_no_select=所有負責人
@@ -1300,6 +1331,8 @@ issues.action_milestone=里程碑
 issues.action_milestone_no_select=無里程碑
 issues.action_assignee=負責人
 issues.action_assignee_no_select=沒有負責人
+issues.action_check=選取/取消選取
+issues.action_check_all=全選/取消全選
 issues.opened_by=建立於 %[1]s 由 <a href="%[2]s">%[3]s</a>
 pulls.merged_by=由 <a href="%[2]s">%[3]s</a> 建立，合併於 %[1]s
 pulls.merged_by_fake=由 %[2]s 建立，合併於 %[1]s
@@ -1798,6 +1831,7 @@ settings.mirror_sync_in_progress=鏡像同步正在進行中。 請稍後再回
 settings.site=網站
 settings.update_settings=更新設定
 settings.branches.update_default_branch=更新預設分支
+settings.branches.add_new_rule=加入新規則
 settings.advanced_settings=進階設定
 settings.wiki_desc=啟用儲存庫 Wiki
 settings.use_internal_wiki=使用內建 Wiki
@@ -1827,8 +1861,11 @@ settings.pulls.ignore_whitespace=衝突時忽略空白
 settings.pulls.enable_autodetect_manual_merge=啟用自動偵測手動合併 (注意: 在某些特殊情況下可能發生誤判)
 settings.pulls.allow_rebase_update=啟用透過 Rebase 更新合併請求分支
 settings.pulls.default_delete_branch_after_merge=預設在合併後刪除合併請求分支
+settings.pulls.default_allow_edits_from_maintainers=預設允許維護者進行編輯
+settings.releases_desc=啟用儲存庫版本發佈
 settings.packages_desc=啟用儲存庫套件註冊中心
 settings.projects_desc=啟用儲存庫專案
+settings.actions_desc=啟用儲存庫 Actions
 settings.admin_settings=管理員設定
 settings.admin_enable_health_check=啟用儲存庫的健康檢查 (git fsck)
 settings.admin_code_indexer=程式碼索引器
@@ -2038,6 +2075,8 @@ settings.deploy_key_deletion_desc=移除部署金鑰將拒絕它存取此儲存
 settings.deploy_key_deletion_success=部署金鑰已移除。
 settings.branches=分支
 settings.protected_branch=分支保護
+settings.protected_branch.save_rule=儲存規則
+settings.protected_branch.delete_rule=刪除規則
 settings.protected_branch_can_push=允許推送？
 settings.protected_branch_can_push_yes=你可以推送
 settings.protected_branch_can_push_no=你不能推送
@@ -2072,6 +2111,7 @@ settings.dismiss_stale_approvals=捨棄過時的核可
 settings.dismiss_stale_approvals_desc=當新的提交有修改到合併請求的內容，並被推送到此分支時，將捨棄舊的核可。
 settings.require_signed_commits=僅接受經簽署的提交
 settings.require_signed_commits_desc=拒絕未經簽署或未經驗證的提交推送到此分支。
+settings.protect_branch_name_pattern=受保護的分支名稱模式
 settings.protect_protected_file_patterns=受保護的檔案模式 (以分號區隔「\;」):
 settings.protect_protected_file_patterns_desc=即便使用者有權限新增、修改、刪除此分支的檔案，仍不允許直接修改受保護的檔案。可以用半形分號「\;」分隔多個模式。請於<a href="https://pkg.go.dev/github.com/gobwas/glob#Compile">github.com/gobwas/glob</a> 文件查看模式格式。範例：<code>.drone.yml</code>, <code>/docs/**/*.txt</code>。
 settings.protect_unprotected_file_patterns=未受保護的檔案模式 (以分號區隔「\;」):
@@ -2080,6 +2120,7 @@ settings.add_protected_branch=啟用保護
 settings.delete_protected_branch=停用保護
 settings.update_protect_branch_success=已更新「%s」的分支保護。
 settings.remove_protected_branch_success=已停用「%s」的分支保護。
+settings.remove_protected_branch_failed=刪除分支保護規則「%s」失敗。
 settings.protected_branch_deletion=停用分支保護
 settings.protected_branch_deletion_desc=停用分支保護將允許有寫入權限的使用者推送至該分支，是否繼續？
 settings.block_rejected_reviews=有退回的審核時阻擋合併
@@ -2089,9 +2130,13 @@ settings.block_on_official_review_requests_desc=如果有官方的審核請求
 settings.block_outdated_branch=如果合併請求已經過時則阻擋合併
 settings.block_outdated_branch_desc=當 head 分支落後於基礎分支時不得合併。
 settings.default_branch_desc=請選擇用來提交程式碼和合併請求的預設分支。
+settings.merge_style_desc=合併方式
+settings.default_merge_style_desc=預設合併方式
 settings.choose_branch=選擇一個分支...
 settings.no_protected_branch=沒有受保護的分支。
 settings.edit_protected_branch=編輯
+settings.protected_branch_required_rule_name=必須填寫規則名稱
+settings.protected_branch_duplicate_rule_name=規則名稱已存在
 settings.protected_branch_required_approvals_min=需要的核可數量不能為負數。
 settings.tags=標籤
 settings.tags.protection=標籤保護
@@ -2247,6 +2292,8 @@ release.downloads=下載附件
 release.download_count=下載次數：%s
 release.add_tag_msg=使用此版本的標題和內容作為標籤訊息。
 release.add_tag=只建立標籤
+release.releases_for=%s 的版本發佈
+release.tags_for=%s 的標籤
 
 branch.name=分支名稱
 branch.search=搜尋分支
@@ -2305,7 +2352,7 @@ org_full_name_holder=組織全名
 org_name_helper=組織名稱應該要簡短且方便記憶
 create_org=建立組織
 repo_updated=更新於
-members=成員數
+members=成員
 teams=團隊
 code=程式碼
 lower_members=名成員
@@ -2957,6 +3004,7 @@ monitor.queue.pool.cancel_desc=讓佇列沒有任何工作者群組可能造成
 
 notices.system_notice_list=系統提示
 notices.view_detail_header=查看提示細節
+notices.operations=操作
 notices.select_all=選取全部
 notices.deselect_all=取消所有選取
 notices.inverse_selection=反向選取
@@ -3081,6 +3129,8 @@ keywords=關鍵字
 details=詳情
 details.author=作者
 details.project_site=專案網站
+details.repository_site=儲存庫網站
+details.documentation_site=文件網站
 details.license=授權條款
 assets=檔案
 versions=版本
@@ -3088,7 +3138,14 @@ versions.on=於
 versions.view_all=檢視全部
 dependency.id=ID
 dependency.version=版本
+cargo.registry=在 Cargo 組態檔設定此註冊中心 (例如: <code>~/.cargo/config.toml</code>):
+cargo.install=執行下列命令以使用 Cargo 安裝此套件:
+cargo.documentation=關於 Cargo registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/cargo/">說明文件</a>。
+cargo.details.repository_site=儲存庫網站
+cargo.details.documentation_site=文件網站
+chef.registry=在您的 <code>~/.chef/config.rb</code> 檔設定此註冊中心:
 chef.install=執行下列命令安裝此套件:
+chef.documentation=關於 Chef registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/chef/">說明文件</a>。
 composer.registry=在您的 <code>~/.composer/config.json</code> 檔設定此註冊中心:
 composer.install=執行下列命令以使用 Composer 安裝此套件:
 composer.documentation=關於 Composer registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/composer/">說明文件</a>。
@@ -3098,6 +3155,11 @@ conan.details.repository=儲存庫
 conan.registry=透過下列命令設定此註冊中心:
 conan.install=執行下列命令以使用 Conan 安裝此套件:
 conan.documentation=關於 Conan registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/conan/">說明文件</a>。
+conda.registry=在您的 <code>.condarc</code> 檔設定此註冊中心為 Conda 存儲庫:
+conda.install=執行下列命令以使用 Conda 安裝此套件:
+conda.documentation=關於 Conda registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/conda/">說明文件</a>。
+conda.details.repository_site=儲存庫網站
+conda.details.documentation_site=文件網站
 container.details.type=映像檔類型
 container.details.platform=平台
 container.pull=透過下列命令拉取映像檔:
@@ -3156,7 +3218,27 @@ settings.delete.description=刪除套件是永久且不可還原的。
 settings.delete.notice=您正要刪除 %s (%s)，此動作是無法還原的，您確定嗎？
 settings.delete.success=已刪除該套件。
 settings.delete.error=刪除套件失敗。
+owner.settings.cargo.initialize=初始化索引
+owner.settings.cargo.rebuild=重建索引
+owner.settings.cleanuprules.title=管理清理規則
+owner.settings.cleanuprules.add=加入清理規則
+owner.settings.cleanuprules.edit=編輯清理規則
+owner.settings.cleanuprules.none=沒有可用的清理規則。閱讀文件以了解更多。
+owner.settings.cleanuprules.preview=清理規則預覽
+owner.settings.cleanuprules.preview.none=清理規則不符合任何套件。
 owner.settings.cleanuprules.enabled=已啟用
+owner.settings.cleanuprules.pattern_full_match=將比對規則套用到完整的套件名稱
+owner.settings.cleanuprules.keep.title=符合這些規則的版本即使符合下面的刪除規則也會被保留。
+owner.settings.cleanuprules.keep.count=保留最新的
+owner.settings.cleanuprules.keep.count.1=每個套件 1 個版本
+owner.settings.cleanuprules.keep.count.n=每個套件 %d 個版本
+owner.settings.cleanuprules.keep.pattern=保留版本的比對規則
+owner.settings.cleanuprules.keep.pattern.container=Container 套件的<code>最新</code>版本總是會保留。
+owner.settings.cleanuprules.remove.title=符合這些規則的版本將被移除，除非前述的規則要求保留它們。
+owner.settings.cleanuprules.remove.days=移除早於天數的版本
+owner.settings.cleanuprules.remove.pattern=移除版本的比對規則
+owner.settings.cleanuprules.success.update=已更新清理規則。
+owner.settings.cleanuprules.success.delete=已刪除清理規則。
 
 [secrets]
 value=值
@@ -3166,16 +3248,23 @@ name=組織名稱
 
 
 
+runners.status=狀態
 runners.id=ID
 runners.name=組織名稱
 runners.owner_type=認證類型
 runners.description=組織描述
 runners.labels=標籤
+runners.agent_labels=代理程式標籤
+runners.custom_labels=自訂標籤
 runners.task_list.run=執行
+runners.task_list.status=狀態
 runners.task_list.repository=儲存庫
 runners.task_list.commit=提交
+runners.task_list.done_at=完成於
 runners.status.active=啟用
 
+runs.open_tab=%d 開放中
+runs.closed_tab=%d 已關閉
 runs.commit=提交
 
 

From 52e24167e5ebe0297f7630e9daecd6ffc9570a99 Mon Sep 17 00:00:00 2001
From: Nick <nick.guenther@polymtl.ca>
Date: Wed, 8 Mar 2023 20:24:23 -0500
Subject: [PATCH 25/53] Test renderReadmeFile (#23185)

Add test coverage to the important features of
[`routers.web.repo.renderReadmeFile`](https://github.com/go-gitea/gitea/blob/067b0c2664d127c552ccdfd264257caca4907a77/routers/web/repo/view.go#L273);
namely that:

- it can handle looking in docs/, .gitea/, and .github/
- it can handle choosing between multiple competing READMEs
- it prefers the localized README to the markdown README to the
plaintext README
- it can handle broken symlinks when processing all the options
- it uses the name of the symlink, not the name of the target of the
symlink
---
 models/db/iterate_test.go                     |   2 +-
 models/db/list_test.go                        |   4 +-
 models/fixtures/repo_unit.yml                 |   6 +
 models/fixtures/repository.yml                |  13 +++
 models/fixtures/user.yml                      |   2 +-
 .../user2/readme-test.git/HEAD                |   1 +
 .../user2/readme-test.git/config              |   4 +
 .../user2/readme-test.git/info/exclude        |   6 +
 .../user2/readme-test.git/info/refs           |  21 ++++
 .../12/11481f7314efbfe4e44703170d96c8fac8172b | Bin 0 -> 169 bytes
 .../17/2343566bf11fc71ba4acf8d2ea70d12bc1d037 | Bin 0 -> 214 bytes
 .../1a/48cae3f18ccd9c929e6608f67087dbaac3cf9e | Bin 0 -> 167 bytes
 .../1e/1e08102cf1b1fc01c069c88ee75445974363ab | Bin 0 -> 83 bytes
 .../21/470f9b3e8ff24e0fa083d2dbc447f4c3401355 |   2 +
 .../23/65bfe0c5714e2e3f2d53bb302b10d8d5b4fc7d | Bin 0 -> 175 bytes
 .../38/9d08c6a71d024a91f14089007cd789cd977ca6 | Bin 0 -> 48 bytes
 .../3a/a8f4e0e1a535f0f9e0ae40e6ec1bce42642bc4 | Bin 0 -> 140 bytes
 .../3b/23d7f1a9cb904cb46f5f2272bfa5ed5f871fb9 |   1 +
 .../50/6ff7310f420e878595b4bc8f11688e3f0ae14e | Bin 0 -> 166 bytes
 .../58/3eb775c596858380273492759d39081d65d029 | Bin 0 -> 169 bytes
 .../60/ea618ae7d4ecbe9c1962591c7da1b05bb1a5c8 |   3 +
 .../6a/b05db4c52530726c1856eb558228e9d1949e7f | Bin 0 -> 169 bytes
 .../71/60a063b5544b5a78131b94f47bfd200046eda2 | Bin 0 -> 167 bytes
 .../75/6c70c97047d8aeb11ca3c71edd9fb76cefee9c | Bin 0 -> 28 bytes
 .../7f/2b9f991d99362eb827b67f4ae2f5fbc5fa2271 | Bin 0 -> 211 bytes
 .../7f/792e709143fb0f021da2371e5f40d1bcc284fd | Bin 0 -> 166 bytes
 .../82/817856dadc7f6b944633e1b77d5b6e302dde06 | Bin 0 -> 51 bytes
 .../8b/4149e7dede3cd53ba11c64c88b057c5fe2c200 | Bin 0 -> 169 bytes
 .../93/54813d81053c14afe878a9f056b937ec42bb48 | Bin 0 -> 28 bytes
 .../9c/72c10e55e7d6ea21f591aa424e2625e8ad8094 | Bin 0 -> 136 bytes
 .../a3/cd04bb110e17591ac04e156c7df2c2f5c96fa6 | Bin 0 -> 82 bytes
 .../b0/e851a5619e2d6cee1da25a15ab67305f0861ec | Bin 0 -> 76 bytes
 .../b4/4c8eb00bdaf0522de61e591fee5f66851ef4b5 | Bin 0 -> 112 bytes
 .../b8/eaa80ad86072e1f23d2638842154ce9aceff8d | Bin 0 -> 77 bytes
 .../d5/34f914944c3c943a6bdb677d869ac54934928d | Bin 0 -> 31 bytes
 .../e2/f9904cd97b4045feecfffef5a426e9461bee70 | Bin 0 -> 117 bytes
 .../e3/a6fd8fe49e323ee10017f72b777a53fbd8076f |   3 +
 .../e7/bf02fcfa7a86f7fe9e8158b55d58ddf9d877ec | Bin 0 -> 171 bytes
 .../ea/57c91ddb8b4ac705b5ac4c34c7a48f2d0fc180 | Bin 0 -> 77 bytes
 .../fe/495ea336f079ef2bed68648d0ba9a37cdbd4aa | Bin 0 -> 197 bytes
 .../readme-test.git/objects/info/commit-graph | Bin 0 -> 2612 bytes
 .../user2/readme-test.git/objects/info/packs  |   2 +
 ...d634b76f8154310cccb52537a0195e43166.bitmap | Bin 0 -> 1642 bytes
 ...33bd634b76f8154310cccb52537a0195e43166.idx | Bin 0 -> 4012 bytes
 ...3bd634b76f8154310cccb52537a0195e43166.pack | Bin 0 -> 7854 bytes
 .../user2/readme-test.git/packed-refs         |  22 ++++
 .../refs/heads/fallbacks-broken-symlinks      |   1 +
 tests/integration/repo_test.go                | 105 ++++++++++++++++++
 48 files changed, 194 insertions(+), 4 deletions(-)
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/HEAD
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/config
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/info/exclude
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/info/refs
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/12/11481f7314efbfe4e44703170d96c8fac8172b
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/17/2343566bf11fc71ba4acf8d2ea70d12bc1d037
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/1a/48cae3f18ccd9c929e6608f67087dbaac3cf9e
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/1e/1e08102cf1b1fc01c069c88ee75445974363ab
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/21/470f9b3e8ff24e0fa083d2dbc447f4c3401355
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/23/65bfe0c5714e2e3f2d53bb302b10d8d5b4fc7d
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/38/9d08c6a71d024a91f14089007cd789cd977ca6
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/3a/a8f4e0e1a535f0f9e0ae40e6ec1bce42642bc4
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/3b/23d7f1a9cb904cb46f5f2272bfa5ed5f871fb9
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/50/6ff7310f420e878595b4bc8f11688e3f0ae14e
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/58/3eb775c596858380273492759d39081d65d029
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/60/ea618ae7d4ecbe9c1962591c7da1b05bb1a5c8
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/6a/b05db4c52530726c1856eb558228e9d1949e7f
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/71/60a063b5544b5a78131b94f47bfd200046eda2
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/75/6c70c97047d8aeb11ca3c71edd9fb76cefee9c
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/7f/2b9f991d99362eb827b67f4ae2f5fbc5fa2271
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/7f/792e709143fb0f021da2371e5f40d1bcc284fd
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/82/817856dadc7f6b944633e1b77d5b6e302dde06
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/8b/4149e7dede3cd53ba11c64c88b057c5fe2c200
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/93/54813d81053c14afe878a9f056b937ec42bb48
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/9c/72c10e55e7d6ea21f591aa424e2625e8ad8094
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/a3/cd04bb110e17591ac04e156c7df2c2f5c96fa6
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/b0/e851a5619e2d6cee1da25a15ab67305f0861ec
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/b4/4c8eb00bdaf0522de61e591fee5f66851ef4b5
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/b8/eaa80ad86072e1f23d2638842154ce9aceff8d
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/d5/34f914944c3c943a6bdb677d869ac54934928d
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/e2/f9904cd97b4045feecfffef5a426e9461bee70
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/e3/a6fd8fe49e323ee10017f72b777a53fbd8076f
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/e7/bf02fcfa7a86f7fe9e8158b55d58ddf9d877ec
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/ea/57c91ddb8b4ac705b5ac4c34c7a48f2d0fc180
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/fe/495ea336f079ef2bed68648d0ba9a37cdbd4aa
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/info/commit-graph
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/info/packs
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.bitmap
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.idx
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.pack
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/packed-refs
 create mode 100644 tests/gitea-repositories-meta/user2/readme-test.git/refs/heads/fallbacks-broken-symlinks

diff --git a/models/db/iterate_test.go b/models/db/iterate_test.go
index a713fe0d8b85c..6bcf740c238b0 100644
--- a/models/db/iterate_test.go
+++ b/models/db/iterate_test.go
@@ -25,7 +25,7 @@ func TestIterate(t *testing.T) {
 		return nil
 	})
 	assert.NoError(t, err)
-	assert.EqualValues(t, 83, repoCnt)
+	assert.EqualValues(t, 84, repoCnt)
 
 	err = db.Iterate(db.DefaultContext, nil, func(ctx context.Context, repoUnit *repo_model.RepoUnit) error {
 		reopUnit2 := repo_model.RepoUnit{ID: repoUnit.ID}
diff --git a/models/db/list_test.go b/models/db/list_test.go
index ffef1e4948eea..1295692cec856 100644
--- a/models/db/list_test.go
+++ b/models/db/list_test.go
@@ -35,11 +35,11 @@ func TestFind(t *testing.T) {
 	var repoUnits []repo_model.RepoUnit
 	err := db.Find(db.DefaultContext, &opts, &repoUnits)
 	assert.NoError(t, err)
-	assert.EqualValues(t, 83, len(repoUnits))
+	assert.EqualValues(t, 84, len(repoUnits))
 
 	cnt, err := db.Count(db.DefaultContext, &opts, new(repo_model.RepoUnit))
 	assert.NoError(t, err)
-	assert.EqualValues(t, 83, cnt)
+	assert.EqualValues(t, 84, cnt)
 
 	repoUnits = make([]repo_model.RepoUnit, 0, 10)
 	newCnt, err := db.FindAndCount(db.DefaultContext, &opts, &repoUnits)
diff --git a/models/fixtures/repo_unit.yml b/models/fixtures/repo_unit.yml
index 503b8c9ddfa46..ef0b7c1a941e2 100644
--- a/models/fixtures/repo_unit.yml
+++ b/models/fixtures/repo_unit.yml
@@ -569,3 +569,9 @@
   type: 3
   config: "{\"IgnoreWhitespaceConflicts\":false,\"AllowMerge\":true,\"AllowRebase\":true,\"AllowRebaseMerge\":true,\"AllowSquash\":true}"
   created_unix: 946684810
+
+-
+  id: 84
+  repo_id: 56
+  type: 1
+  created_unix: 946684810
diff --git a/models/fixtures/repository.yml b/models/fixtures/repository.yml
index dd8facb7a3134..32ba8744d4522 100644
--- a/models/fixtures/repository.yml
+++ b/models/fixtures/repository.yml
@@ -1634,3 +1634,16 @@
   is_private: true
   num_issues: 1
   status: 0
+
+-
+  id: 56
+  owner_id: 2
+  owner_name: user2
+  lower_name: readme-test
+  name: readme-test
+  default_branch: master
+  is_empty: false
+  is_archived: false
+  is_private: true
+  status: 0
+  num_issues: 0
diff --git a/models/fixtures/user.yml b/models/fixtures/user.yml
index c6081f07d06b7..ce54defacdc67 100644
--- a/models/fixtures/user.yml
+++ b/models/fixtures/user.yml
@@ -66,7 +66,7 @@
   num_followers: 2
   num_following: 1
   num_stars: 2
-  num_repos: 11
+  num_repos: 12
   num_teams: 0
   num_members: 0
   visibility: 0
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/HEAD b/tests/gitea-repositories-meta/user2/readme-test.git/HEAD
new file mode 100644
index 0000000000000..cb089cd89a7d7
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/HEAD
@@ -0,0 +1 @@
+ref: refs/heads/master
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/config b/tests/gitea-repositories-meta/user2/readme-test.git/config
new file mode 100644
index 0000000000000..07d359d07cf1e
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/config
@@ -0,0 +1,4 @@
+[core]
+	repositoryformatversion = 0
+	filemode = true
+	bare = true
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/info/exclude b/tests/gitea-repositories-meta/user2/readme-test.git/info/exclude
new file mode 100644
index 0000000000000..a5196d1be8fb5
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/info/exclude
@@ -0,0 +1,6 @@
+# git ls-files --others --exclude-from=.git/info/exclude
+# Lines that start with '#' are comments.
+# For a project mostly in C, the following would be a good set of
+# exclude patterns (uncomment them if you want to use them):
+# *.[oa]
+# *~
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/info/refs b/tests/gitea-repositories-meta/user2/readme-test.git/info/refs
new file mode 100644
index 0000000000000..fd5f1b98ebd57
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/info/refs
@@ -0,0 +1,21 @@
+ea9ef877d1d88af76682d8798418081264f10cfc	refs/heads/fallbacks
+0d4c14db927c9ffba01fa7e126cc748b5c02c01e	refs/heads/fallbacks2
+c66d5b07c2063d3268707f22226c708b589574ef	refs/heads/fallbacks3
+89f8426e9eb5eff35c09b3565836c8f8e15d0ce9	refs/heads/fallbacks4
+b0e902496eae435ad03c92a5d479f916ef2d4893	refs/heads/fallbacks5
+84a5500b5cc040b11daf53fc42c542a99589dc76	refs/heads/fallbacks6
+cf406a96e416d7de5c4c1bbfffdd672300c822bf	refs/heads/fallbacks7
+0d6ac644b969e9199915a492da9dba08c179fd23	refs/heads/fallbacks8
+5038febc0c57215beb3748d7ae4091a25a4acc93	refs/heads/fallbacks9
+9134e1f178ca4cccf1a197142646f2d7627e8cd5	refs/heads/i18n
+744d2441e55bc0010d6b340d303f0106a627ad29	refs/heads/master
+3c492566170b057e962c025515ab38bbd7444077	refs/heads/plain
+3882d6373a0882a6739b3cd9b24d21c630621234	refs/heads/sp-ace
+bf5ed898252eaa50dcc01108ed4417c3ea98a294	refs/heads/special-subdir-.gitea
+c03543573ab088ce1cf7090a387d2be621426234	refs/heads/special-subdir-.github
+e75957ad9b7e6ed16dda183529ec283db0bbc5fe	refs/heads/special-subdir-docs
+46f5d5ab33d701642e08c713fab42af89fdd4fea	refs/heads/special-subdir-nested
+9c0f872256b839c2b97ec22fd348d87b14045513	refs/heads/subdir
+d7a854fff61e45b98234d7aa79ecbcb1619cd3dd	refs/heads/symlink
+30b9c0ed4b1039dbd99f3fb537b84ca507e0549d	refs/heads/symlink-loop
+41489b7be5c2244d2b7b524dcb31caf3bd1f9ccc	refs/heads/txt
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/12/11481f7314efbfe4e44703170d96c8fac8172b b/tests/gitea-repositories-meta/user2/readme-test.git/objects/12/11481f7314efbfe4e44703170d96c8fac8172b
new file mode 100644
index 0000000000000000000000000000000000000000..b9009e32444a4be9dd189dc611880aef4f0d8b02
GIT binary patch
literal 169
zcmV;a09OBa0iDh{4#F@Hg<)!+VlF^5cDzMGh>nhm3wW6!5zeCE6x^N&aRSP}_?}*x
z$8o5jv^vz42%^@>Q$&n8FdC&YSxKgoOk~(vZzQpfMl4~ase)tIDRS6J-Eu@mC38@%
z+YM{XGNz=w<}AWi`+0@ike+becG}Ylr)kgT@yp9Hm-kpplfoIKb<P;sY7a*=h$4NT
X)?NL-A@205z@d~F(o=i@i<M4nfA~|$

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/17/2343566bf11fc71ba4acf8d2ea70d12bc1d037 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/17/2343566bf11fc71ba4acf8d2ea70d12bc1d037
new file mode 100644
index 0000000000000000000000000000000000000000..c7a4deca9293a563181b8dadbe42a5f669681739
GIT binary patch
literal 214
zcmV;{04e`?0hNxiZp0uEL{s}Kwo8>07%!ZqC`y+u{{YMSK(^sz);i_ygQEL^6jO{e
zZ)T|OdloQidXa+}u3^&C%r0_dLlI5zT9cjVdJPI4;ld-0N)2~^a1pQ=J^Bfq!Z3~o
z?QE2G+S%wGd&01gUFN6;e@dzcd}mtW>+ERa1Kvxwm)p~R-s|?W%XT6E0opo;IHEQ1
zrmzpv-&5(-e><$1pB+PcWT6C7fy-^nEkR)NXJg0^Yk3t|OMO7<>Y3fI4E-nwH)(L3
Q1#$sOxp3p*7x&_1XWgo56#xJL

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/1a/48cae3f18ccd9c929e6608f67087dbaac3cf9e b/tests/gitea-repositories-meta/user2/readme-test.git/objects/1a/48cae3f18ccd9c929e6608f67087dbaac3cf9e
new file mode 100644
index 0000000000000000000000000000000000000000..d8522ae6d3319a48188c99be269b1622f89e7030
GIT binary patch
literal 167
zcmV;Y09gNc0iBLJ4#GeT1*!KGz5vMHFGvW{(NS>$uj3^V`6(;~w<kiJfO4caqbJia
zbQP?3o4TliW8N39sKmjAg5{vd>QSQ#Wl?XVw^_WIdC{=~CF{HkG3G*4BvEG1Qud8i
zPT0`8r3PIx{HpD=z_pVHTwbf%>H^1c#ohgf=XvViL+y9MC!m;82sTlGEe1p*-=}r8
V{%@F@J}VUN`^@rqnhyv1PZ>ILQ$7Fy

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/1e/1e08102cf1b1fc01c069c88ee75445974363ab b/tests/gitea-repositories-meta/user2/readme-test.git/objects/1e/1e08102cf1b1fc01c069c88ee75445974363ab
new file mode 100644
index 0000000000000000000000000000000000000000..d4152e535edee4dede53f2b78c5890f6010635bb
GIT binary patch
literal 83
zcmV-Z0IdIb0V^p=O;s>AWH2-^Ff%bx2y%6F@pWa`@t!|<rStv(_qzdwi6*BHu4Y%~
pFf=j%0;meT+!Th=oPv`D?l;zLlv#XS?(Y2UIq%=i0RRG$9p!&{B{Bd2

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/21/470f9b3e8ff24e0fa083d2dbc447f4c3401355 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/21/470f9b3e8ff24e0fa083d2dbc447f4c3401355
new file mode 100644
index 0000000000000..8aabb78c6838b
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/objects/21/470f9b3e8ff24e0fa083d2dbc447f4c3401355
@@ -0,0 +1,2 @@
+x
��;�0@�s
+_�*N��H��1q
�u(�?�t��T�0��==���Q��+�*4��d��h�S�η.z���͙Z3�c
t��0'�As�5h�zL�=D��B�\cx-ݴ��!O������q�����<�����	0�T�装���5�=-�����U s�7,O�
#�M�
\ No newline at end of file
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/23/65bfe0c5714e2e3f2d53bb302b10d8d5b4fc7d b/tests/gitea-repositories-meta/user2/readme-test.git/objects/23/65bfe0c5714e2e3f2d53bb302b10d8d5b4fc7d
new file mode 100644
index 0000000000000000000000000000000000000000..715977676d5041e2a56504189cb38b4d3b524cfb
GIT binary patch
literal 175
zcmV;g08syU0iBLJ4#F@HM5%p>y#UeLtnFArh>nhm3v8S<iO5fhDRO%(#0lu;Y4k=D
z=W*;a7>kFzih!6D0#a;)ZwSdIk(g4FWSNYUKu$Lz9@WCDOc?~pa~)axw&jwzZiIq1
zuJ+oU1dS;ror2<b?&cNleSE>~UDQriI8Ozu=MS&TJnUm0s>m16&U;JVSO-V6h$?=c
d=3@Q7p&qhjh#mKnw6N{t&`+;TeE>rzQOAB&RpI~u

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/38/9d08c6a71d024a91f14089007cd789cd977ca6 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/38/9d08c6a71d024a91f14089007cd789cd977ca6
new file mode 100644
index 0000000000000000000000000000000000000000..c5929ae89288aa30a1a891326bc8bb9f340640f8
GIT binary patch
literal 48
zcmV-00MGw;0V^p=O;s>9W-u`T0tLPF%#zeZ2HRsE+r`do2(@WGwr9=%yg1I;B`E+G
GZx5ikFcZ80

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/3a/a8f4e0e1a535f0f9e0ae40e6ec1bce42642bc4 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/3a/a8f4e0e1a535f0f9e0ae40e6ec1bce42642bc4
new file mode 100644
index 0000000000000000000000000000000000000000..106393d722517fe5c97ef75e78200b79654ea7ab
GIT binary patch
literal 140
zcmV;70CWF%0V^p=O;s>7Hf1m|00ITQ^vsgfL<ZYq9^1vvYzVb!KDKAg|GYTP*(E84
z1_ov(CJI5WjxN5g441E2x84pr@IRN~v|{A0KVp7v4r(YW^m0=e&Rwp&wwytJxyMf)
u-uwA856+yPrwXwrB|o{CVL=ApB%AZ+6fKVJFG^nY{Okp@nMwfU={Lu<i9rDX

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/3b/23d7f1a9cb904cb46f5f2272bfa5ed5f871fb9 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/3b/23d7f1a9cb904cb46f5f2272bfa5ed5f871fb9
new file mode 100644
index 0000000000000..c36705ba28dda
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/objects/3b/23d7f1a9cb904cb46f5f2272bfa5ed5f871fb9
@@ -0,0 +1 @@
+x
��M� �aל��0&Ƹs��ئ�'�.���x������4]���.)�D��Q�|@b6Xbd��}�2+b�%�T� �I>g�	2�7Q���. (c�����"o��n�M�<�[6�_^橼�Z��T�U�� ���n��
qO�*3��{���N\
\ No newline at end of file
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/50/6ff7310f420e878595b4bc8f11688e3f0ae14e b/tests/gitea-repositories-meta/user2/readme-test.git/objects/50/6ff7310f420e878595b4bc8f11688e3f0ae14e
new file mode 100644
index 0000000000000000000000000000000000000000..a7f4501ea2e8b7d2c984dcf2f926497f5b9597b3
GIT binary patch
literal 166
zcmV;X09pTd0iBLH4#F@H0IB_o{Q%M0@p{)1LUeRge84!%A#y1=1;58aynu3w8BLys
z;ZeYOw<(J%By>uA70(!0I5Gw7qT1ldv)C*w>PWMh)1qSml2$Lwlqm+OAn3UD(J{rY
zjVQJY)S-(et>r!~aC+n?9M`Jeb%EVjvAO;5Fi-t^D1DRD9&D&pvcw*?NQfqXPfNA_
UZ<w>b3S3j)Us8UW4?((1W7)${?*IS*

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/58/3eb775c596858380273492759d39081d65d029 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/58/3eb775c596858380273492759d39081d65d029
new file mode 100644
index 0000000000000000000000000000000000000000..a2dadacf8ac5c581336a8fec56846cc07f12f8ac
GIT binary patch
literal 169
zcmV;a09OBa0iBL9Zo@DP06Xgy{6Gv+kwgh7if-95^#c^eG(qe*aOEMtk5S|W8E?45
z={!xB4nFvgzL>#2mxfuBFg5f+3Y{omE{Lp+bJ13qRg$~QVz&+nO%i1>Zo#x#Q7XyD
zLds33Vyu-UYId^r^Sr?EqE|Sqn|ihdK5rWizc2j0&*Nk2<Dl{dl$c|r;1ldHB0Bv)
X?VI&}!~NJ_hm(wB6}`GA1W--qeJ4@w

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/60/ea618ae7d4ecbe9c1962591c7da1b05bb1a5c8 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/60/ea618ae7d4ecbe9c1962591c7da1b05bb1a5c8
new file mode 100644
index 0000000000000..4367c41e2858e
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/objects/60/ea618ae7d4ecbe9c1962591c7da1b05bb1a5c8
@@ -0,0 +1,3 @@
+x
��;�0@�s
+_�*N뤕bcc���Њ�Tҁ�S!N�����d�>���!���քLu�Ul�#q����l�Q�,�ꔡ��lCBn$6��X�Dɹ�bbҖR0���y�[/O�n���
+�i�����2�1��Ї@�e�p�d���iޭ�殯��!�<���N�
\ No newline at end of file
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/6a/b05db4c52530726c1856eb558228e9d1949e7f b/tests/gitea-repositories-meta/user2/readme-test.git/objects/6a/b05db4c52530726c1856eb558228e9d1949e7f
new file mode 100644
index 0000000000000000000000000000000000000000..3e4c8247d906f07f3985a58a76b08000a1d661f2
GIT binary patch
literal 169
zcmV;a09OBa0V^p=O;s>7H)Sv}00ITQ^vsgfL<ZYq9^1vvYzVb!KDKAg|GYTP*(E84
z1_ov(CJI5WjxN5g441E2x84pr@IRN~v|{A0KVp7v4r(YW^iuQma#I*MKHl3FemK04
zf9a#bto-)V?OCrAQPlwzox5ClZ8?Mda*v-py!Z2G9-KKnPZi>xl>Fpkh6NdXlWfkP
XQ?xj?zbJXp^RpMsW-0*yojgaTO}bCn

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/71/60a063b5544b5a78131b94f47bfd200046eda2 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/71/60a063b5544b5a78131b94f47bfd200046eda2
new file mode 100644
index 0000000000000000000000000000000000000000..477d5b1f1f4312265b57e9f6403dc133ddd83c81
GIT binary patch
literal 167
zcmV;Y09gNc0iBLJ4#F@H1*v_Cy#UcVvDZdIh>nhm3)tov5Y9)zDY!im;slga%xKcs
z_m4`gX*YES$XOR9!)OuX!4Zru$`1C59MBmbSfh<eO<~4R$+G0^I?dU%4DY<%*=S<&
zS!?kgUFHC7pu$q`<4osAdeUiG)jMX|4=XmeA0DT%y!%?36b_`tIcv4B(3UN;O5fAE
VTK_lH1+PjuloCUFst-`>P8}43Q9A$t

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/75/6c70c97047d8aeb11ca3c71edd9fb76cefee9c b/tests/gitea-repositories-meta/user2/readme-test.git/objects/75/6c70c97047d8aeb11ca3c71edd9fb76cefee9c
new file mode 100644
index 0000000000000000000000000000000000000000..3ef17969867f6a1e4c2138ae8d469601e3c1fb5f
GIT binary patch
literal 28
kcmb<m^geacKghr&^}^-L=TDx$=zr?`X|_a$pc3|K0L<|X(f|Me

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/7f/2b9f991d99362eb827b67f4ae2f5fbc5fa2271 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/7f/2b9f991d99362eb827b67f4ae2f5fbc5fa2271
new file mode 100644
index 0000000000000000000000000000000000000000..4e39c0306eaa5ba7dbcc8926ab9cf76da6c05cea
GIT binary patch
literal 211
zcmV;^04)D_0iBL9YQ!)QMN|6}(`}VSmOYXUOGvj}?jViED`8t&tT9V&9}#kb6u<cJ
z-{(=;_arc=@l6h9FwQFsek9a5D60+i6B_o2lhzZ@p`XW@?b1En!CAmyaOg&~3cc0?
znt4#Y?X3yUvLo~hnPm>DbEm{|z*nLb?q@?IA8^a9ULSw;^I5j<UA8N^59p1x*d)vV
z?+TUb=+{&l_5Y8qzLHP`DZu%$r5eFAxwA4P2qj+x)?8i?TiRxKD?<|n;VKo5GegQi
NF=ejY{Qw1TV~XWYWat0@

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/7f/792e709143fb0f021da2371e5f40d1bcc284fd b/tests/gitea-repositories-meta/user2/readme-test.git/objects/7f/792e709143fb0f021da2371e5f40d1bcc284fd
new file mode 100644
index 0000000000000000000000000000000000000000..90fae23886ca83c4be056c5dd3c8125047bcf0b9
GIT binary patch
literal 166
zcmV;X09pTd0iBLH4#F@H0IB_o{Q%MWSer-)(a}-yf%Rrh5IImV1-~akynu3w8I8>2
zc&p%o+tfuBJoByuMYT+x3YJ!pHK0Znn?-|*!DR{N!HZ56B6Un0C?RF%JjK?dO*X}j
zld@1Q5=+~m;aBbF1<p6Q!|AoEy)LkyR&1_6JU-^(J=UQSK7frW5n1mDwn&IZzNdAy
U{%@FzJ}VR+hRkv|AA!wIRa@CkBme*a

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/82/817856dadc7f6b944633e1b77d5b6e302dde06 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/82/817856dadc7f6b944633e1b77d5b6e302dde06
new file mode 100644
index 0000000000000000000000000000000000000000..0428af472a486f6b2689fd113291540555a8374f
GIT binary patch
literal 51
zcmb<m)YkO!4K*-JG%ztRFg6U-@bdLJ>6`jPaYEJa*lGXHNtRod<n7tJvaYTyUY)`C
HlVA=2#pM&k

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/8b/4149e7dede3cd53ba11c64c88b057c5fe2c200 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/8b/4149e7dede3cd53ba11c64c88b057c5fe2c200
new file mode 100644
index 0000000000000000000000000000000000000000..64542d37589eb57bf563c0cbe7d8c305c26c8ecb
GIT binary patch
literal 169
zcmV;a09OBa0V^p=O;s>7H)Sv}00ITQ^vsgfL<ZYq9^1vvYzVb!KDKAg|GYTP*(E84
z1_ov(CJI5WjxN5g441E2x84pr@IRN~v|{A0KVp7v4r(YW^iuQma#I*K?z)n5cxkwB
zUXi5E4&_&;XDDi>qpAZcI(ND9+HwZ@<sLtIc<<-WJUDZDo+`vWDf!983=1;&CfS@n
Xr)Y6(e^K(H=VvdN%~S#aJ3dB3^BhgC

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/93/54813d81053c14afe878a9f056b937ec42bb48 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/93/54813d81053c14afe878a9f056b937ec42bb48
new file mode 100644
index 0000000000000000000000000000000000000000..8542b45c75ff86619f87b916e8ee3df903bd9e8e
GIT binary patch
literal 28
kcmb<m^geacKghr&$>WUXx$Eao>!0_~^<rgk+0XV90Iqrq{{R30

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/9c/72c10e55e7d6ea21f591aa424e2625e8ad8094 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/9c/72c10e55e7d6ea21f591aa424e2625e8ad8094
new file mode 100644
index 0000000000000000000000000000000000000000..b53d42aee9e633a49905c0bd76fb95bf9031145d
GIT binary patch
literal 136
zcmV;30C)d*0V^p=O;s>7Hf1m|00ITQ^vsgfL<X4)hIe;7JfhoTwBDaX@@Tka?4NQ&
zBe04fS4S6LSB9%5KSiea*i5m?zMWp%HtVRT$)sKs6?(ZT43k3|Z5vr_MApBkSotAr
qr}-PF-5wBoQu33F8RX<R1av-b{KI%4^F-hC5ZCF>$*TcJIW-;CK0dJk

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/a3/cd04bb110e17591ac04e156c7df2c2f5c96fa6 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/a3/cd04bb110e17591ac04e156c7df2c2f5c96fa6
new file mode 100644
index 0000000000000000000000000000000000000000..6d9bc2a7664fe2968b95869b01587b4eaa61a4fe
GIT binary patch
literal 82
zcmV-Y0ImOc0V^p=O;s?nWH2-`00M;|S4S6LSH0X6h6P%IvU?Y)CvG|R|7KUck;K%O
or+%1#)#R6Cq!uv*co<)>wEEN6zbbUcs*pz-KP}|_02Heo?n7)OQvd(}

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/b0/e851a5619e2d6cee1da25a15ab67305f0861ec b/tests/gitea-repositories-meta/user2/readme-test.git/objects/b0/e851a5619e2d6cee1da25a15ab67305f0861ec
new file mode 100644
index 0000000000000000000000000000000000000000..2f88dbd361ae06a6ca6202ea1441b965b36a145a
GIT binary patch
literal 76
zcmV-S0JHyi0V^p=O;s>6VK6ZO0tLPF%#zeZ2HRsE+r`do2(@WGwr9=%yg1I;B`FXE
iDf!9848easzi??;<(R6yt3=9gw&*v>c|QTPTpYU4?IQ>P

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/b4/4c8eb00bdaf0522de61e591fee5f66851ef4b5 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/b4/4c8eb00bdaf0522de61e591fee5f66851ef4b5
new file mode 100644
index 0000000000000000000000000000000000000000..55bb8491afef625eeeb1af14dd0b3cd87974c3f3
GIT binary patch
literal 112
zcmV-$0FVE80V^p=O;xb8U@$QN0tLPF%#zeZ2HRsE+r`do2(@WGwr9=%yg1I;B`Jmm
z24*HE3PG-pF21e|m#<m3-VQtPKbPUOV&twrVt#H8Y7iq*@{@}h7G&^EvN?ZF(c;+t
SqU1%-&t5Q_sRRHQqbY&h9y1C6

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/b8/eaa80ad86072e1f23d2638842154ce9aceff8d b/tests/gitea-repositories-meta/user2/readme-test.git/objects/b8/eaa80ad86072e1f23d2638842154ce9aceff8d
new file mode 100644
index 0000000000000000000000000000000000000000..84ab5684a0093099072185262a4a43517cb15030
GIT binary patch
literal 77
zcmV-T0J8sh0V^p=O;s>6VK6ZO0tLPF%#zeZ2HRsE+r`do2(@WGwr9=%yg1I;B`FXE
jDf!983=1;&CfS@nr)Y6(e^K(H=VvdN%~S#at56)Q)g~dT

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/d5/34f914944c3c943a6bdb677d869ac54934928d b/tests/gitea-repositories-meta/user2/readme-test.git/objects/d5/34f914944c3c943a6bdb677d869ac54934928d
new file mode 100644
index 0000000000000000000000000000000000000000..7bb434442f72d254b112e2740ebf900a8bcd1e73
GIT binary patch
literal 31
ncmb<m^geacKghr&Rl`H)<OThc*Uz8UKY8MeH#<YrWe#ot*oh5(

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/e2/f9904cd97b4045feecfffef5a426e9461bee70 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/e2/f9904cd97b4045feecfffef5a426e9461bee70
new file mode 100644
index 0000000000000000000000000000000000000000..9654f877b8c59f52226850f204f4323b224e85e2
GIT binary patch
literal 117
zcmV-*0E+*30V^p=O;s>7Fk>(@G5`XFAXi5hUst`{6b8%sw0Rmmf%9Jnzj)s0?^SW}
zGS5X5u$toh+*F3eXIXX&@`*=E9q<#)sr_{5>&g6OP%}!35_1dkb29T%8JyT;7#ALA
Xn11m|_<YT!Yrk;qeKQpRC{`>_kh3)c

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/e3/a6fd8fe49e323ee10017f72b777a53fbd8076f b/tests/gitea-repositories-meta/user2/readme-test.git/objects/e3/a6fd8fe49e323ee10017f72b777a53fbd8076f
new file mode 100644
index 0000000000000..2307ba82dca7c
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/objects/e3/a6fd8fe49e323ee10017f72b777a53fbd8076f
@@ -0,0 +1,3 @@
+x
��M
+1�a�=E.��m�� �Νwh����#�"��A<��g�~|eǾ�#�jU:����$%�9o��{�9F	�գQdsOU��H��rA�(�=�x��E���$nkҳ]�
+�����\ҫV�M7��yx�mؔ��1�-�1 ��}ږ��
3�/�%=�f>&L�
\ No newline at end of file
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/e7/bf02fcfa7a86f7fe9e8158b55d58ddf9d877ec b/tests/gitea-repositories-meta/user2/readme-test.git/objects/e7/bf02fcfa7a86f7fe9e8158b55d58ddf9d877ec
new file mode 100644
index 0000000000000000000000000000000000000000..9f898ef87387dc17cf15c794fd48d43921ddccbc
GIT binary patch
literal 171
zcmV;c095~Y0hNw94#F@H0IB_o{Q!~e_>>T$qod*j>&==(ITf6O-xHyHfO3i%4b9`&
z70^bX%E}DM7z&)EObupfwQkrcwozqfo1F_*aW=_{1y`O5C^UhP>#PD%6DjJ*&dHFS
zm%%p)k!s431#YFCS9o;P!+qP;mRGn;J65j)Z_7M<#xhidS5VG-YgKImoTZgg(C@VD
Z)}IaSwLco-$?pOghan;L;tL^5Pf1exQLg|1

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/ea/57c91ddb8b4ac705b5ac4c34c7a48f2d0fc180 b/tests/gitea-repositories-meta/user2/readme-test.git/objects/ea/57c91ddb8b4ac705b5ac4c34c7a48f2d0fc180
new file mode 100644
index 0000000000000000000000000000000000000000..d1eff52868d457865f396c829e7060972f4f3ac8
GIT binary patch
literal 77
zcmV-T0J8sh0V^p=O;s>6VK6ZO0tLPF%#zeZ2HRsE+r`do2(@WGwr9=%yg1I;B`FXE
jDf!9841Xgw?YVe?)2-mtT+c<4vwUKHHtqxfy8Rtw@<$_V

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/fe/495ea336f079ef2bed68648d0ba9a37cdbd4aa b/tests/gitea-repositories-meta/user2/readme-test.git/objects/fe/495ea336f079ef2bed68648d0ba9a37cdbd4aa
new file mode 100644
index 0000000000000000000000000000000000000000..48c0b5a4d621e0a9c34ca50ef4b53faef90a273a
GIT binary patch
literal 197
zcmV;$06PD80iBLJPQ@?~0I7Y7y#P<P@n<a|L`O%%3HI4*62<w*-W2clM2HhmPBEj&
z`?}5o7UPq2W=J{OY&3h%u>>Y-s!xW<S;sb5&qxJza_XSYn*dYdiZK>b5UIux&=!md
zok5Mp23L*FH7h!0+B<yCd4Z4fQYY^4x?Ont{=@fUZ;w^lEz=vA5To}m-g<b}UTc+q
zPvx@y-%wvHa2{~)`@$QH$J*v?86Z0d4}nUp-RU~)XX63$1~QRArork53iw_DU9Mm~

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/info/commit-graph b/tests/gitea-repositories-meta/user2/readme-test.git/objects/info/commit-graph
new file mode 100644
index 0000000000000000000000000000000000000000..9bb0976fdc30e99f66fae5f74525635980f9d928
GIT binary patch
literal 2612
zcmZ>E5Aa}QWMT04ba7*V02d(J2f}1=advSGfw0*u+~I7_Jy5kkic0~(CW*xaR80zI
z2CAnOW&xUw53>U0kue*PkB-@aV(6FyC`JtC1gfJp<^q~YF6IX6r3CW;^`m26pcp>P
z2b3ok^8?jV6AJ*%BNqz-^$Ov@!a#9CSOlmB9~K456T)IZHMp=iP!5JAfNV;!B+v{L
z%<Cg^ds5B(-wWiIKU6zY(jCKeK#n)-n9I)0my$C@mrS}fcNfRO%D>8zK1&YU-HHxe
zmCLN&ILp~k?&R0C20IVD^%k(aeRID3R`VS`OW7ZU%(ZB`W^TpNw5)ix&CN}|ipLC+
zgiLHaRnx?|S?i|hFolY)w%C2$#i88MV|Mk^Ln^-7)j__e4NraED?jIq+t;hBjjuDN
z=y4nu{<THx$NanguL3Oo?coVmjDBtIaebY`#6?kFXC|lKigGQ8Rx-^r5Esu~{_5!d
zV?QsH_^LQQjXuE0n{C2tV9&_5Ont3p%hCYum;(+QW!DG)aXRX>a%$(Dvd$k)dGofu
z{~W`)IV{5L#E*xuJTE7jJp5R3%ID0-h0{gU+&*1Ts_VHrhreAZY=`Bcopp!wFMHgm
z7GVh$-tdyiGjE-9)CHSKORrS^6nn4hF?oO7jTx$Xs{-yE5af94B7XSQj73upm^z1B
zZRj{B^PQ8+qE`EvqEnK|vD|3(Lu|H283px9N;w7H5mQUvpLfWb_C)OZy%-<q{r~T#
zD>Ix>+JAjT$p3G0t~;AduCJ<mvu9)CoXd9~xUV=Res}qb75hAeG76I)DD^C{d>$FT
zc6MFf#oSvGrkZawY&Yya`tQ}eALSQsbbU{2x>4C8!6B6Lk>}5E=X1$zK@pyxS4EkZ
zZ1^<&4@-&iF^6LpBYmgao?0X(%6VfV^TV$@Qb6gf07w9VK=R+5r3>`Jf4H+%RF)>(
ze3%qcA=BQc`UWT`3{|6%{5LnLeuja=E0Kx!N*@H3>B=0svPQS{B2bMOR1Ht^-{_SO
z|2}>0xO{VcN8^Xi``aG4$mCzP1FDfg*cGEYL*S{!*Mrg5-p&`wUjD!Ri}d8@u0S<h
zP&FLMe`Eh0xiwjNQGfqK&iRucc3zHH^T#wc6jhCniD>TgV~gZxzL{V>wLbF3s>=s+
zPiUj55n*(gcSdJv+={1fcv-49yg4VW)G{Bah6&-GMAg#j{3l{5ecTToZ<`nUew|4d
z<0DX=$p}@W1N3_#18?qy_WAQJ<TGEtk$BTsi!1Mv2C7}DkCY@6%Zgqtb$c}Bi%wnF
zwbfohwHY8Ypyse7|23I#(lz?(o!!khydGtht()aM_3eir$AC)sp=uO>cA4o%&GHpn
zyIWbSr!{U{z;+GSyUj^JH9}A|62SP{^X#|TiToP@*~J^H4Ug1MdH&7eQ9i1BykEvl
zZ;+RCHd*Y@wc3A$>xwU%ZIAv%RTF4ZzQj|VbIOFK^Nh>xR7^7ca_-9fM?f_^P`hM+
z?okO!7VD0Aw%4<F=H~ScAHv?3nr1EnszHkPpzZ6Fzsxz*w373<#Az!*p3hhAUcK%G
zR3iX22bji!`L{dr*lX;zJ*RVGN#)YxUS-?XaJU22z`{oa=&ub?_W!uqSPzwc-1|DA
zne{3EvSpo~KqcHzb5wxtaXD`F`!!EP#>H)$pS$WO&#KDIzrPl!1}Tjt_=wDK`ufVL
zbfQCZz^$WUu2v7OZYu?<K}usGl1s15<j&l1yW^Mp<kHPC!e)|pGoGTV37RikK1r_d
z%>A9sQ~94%E7h)ZW#<L8w>Y8h0jBw!$ramKP6<~!DQfQdH_4Y{>oIPwOMifBL=kGj
eWq^E|gV$BAMVrhm)^9AH!JzuP<h^G|_fG&<$XM6_

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/info/packs b/tests/gitea-repositories-meta/user2/readme-test.git/objects/info/packs
new file mode 100644
index 0000000000000..aad10862f1457
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/objects/info/packs
@@ -0,0 +1,2 @@
+P pack-8933bd634b76f8154310cccb52537a0195e43166.pack
+
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.bitmap b/tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.bitmap
new file mode 100644
index 0000000000000000000000000000000000000000..db39955a2535726c21da5f59d413fb4da9c2eb12
GIT binary patch
literal 1642
zcmZ{jO=uHA6vy9~#19k<X#FTEK>|G}Vl9XW+O1w%QfsjW(UKwxq6eWDbLb%*Otnc%
zQR~KHPdOB!rFT(K*IPk7h#m?emH2T`M7^~ljqm?9yGgdwfqftU`R$vxGqWc;&YmJg
z5hB`|Z+Uh(kzQ;#8GZfgOwWKSd}+P{ou4(8haHhBm&+0mU1J~OCycx|fBi!m0jcEU
zU%hW6B)ZDpXQtBQ@tiv`(;l5VRAJy$O^h%mxn}FXO@mlE!m9(ul#F#^HQPFJi6YAZ
z@|>BRrpUhldDuuUGr1Tb+l}NmCVvOWBPMeB5tE++WRHpb3(^UYYfa=+kUBtKGLRV|
zd7^GV_Zi56o5g84<~nlsO0rdRwJ6S*$rvZ@I4@4K_0P!RM1`WTq?{Mto!ZKRd$>Lc
zK~YRBk;7gFUJa0%1r@SjNiFDB4lp)~)olHmxHKvXsjg4lcw<e-=+m#+3q>xWUsJQ7
z@UMW>dKV%d-C{LcpOn>QUQwocle<<ScR*LvUnMWDLdu@-7gfpQD@iCS#)kJwSIO;A
zB=!4*pyc;gn`&w{LN|~WWOcBHJPO4?YRJl|ArC+?kRsQ8ktp_fH;u)^?}ieo`N`x*
zEh3xA!Jl(p44-|VYg37H{I_Q(M%qSa+@r}(q-o4@G4R6+Zd`aDxAQ%p{dexZoxOp?
z-g4RzZ=ud;7%}?|t{-W$?|dzCzP^$l8|vz7LhOy)wm+SSQ<b)d5`FuTGbbMXVc2$j
z0N>|k?zc@QOZR2Y!kYOd^oxFS4Mh**I;r_W=R*eq=2NAYGG|-jj0Ssv;q{a%WiEK2
uw}<w<?>0273(tKw<!)&?2hq`s#ro*xx#s>B>v_j;V$YM?vyFwlKmG$ksnc)(

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.idx b/tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.idx
new file mode 100644
index 0000000000000000000000000000000000000000..561e0f2e9d241a658eca432443f071acb88482ce
GIT binary patch
literal 4012
zcmb7{c{J7g*T)YTjw!^!$rP@cB1497%(Fy>GGq=JawAh_U9&PK3in(yAqtU9nTN<6
zGF&1<5i;}J*5X-~)$@DS^T%uL;q&?Iy}xIzv(|nexL&hFAP~3!&XGOzPjUugJOCdc
zI0X{o-$4X<Vu0inq!1rN2L9RKKn}V8FBI^G@;6XHj`|1`SQ>!#2s*H6;QR>~z-K%K
z6U3)shTJh1z(0ib2sW^PoPZttlW;)H32^-e9?0>YfDioB@I&sHi{SrnT!J%!BLu+;
z{RUyk9U^jsDA;4JfPWG(h{b<{1mup91pgQ*@J}KQ@kwMLJ_ZB6{BKZ%+)0!mK1Lb*
zLsX7X1*>)nb%+nq1hoDO+HiLL6gm(eas$viLLcmD3?OHCiklFh<QBw6{|Cl!ZgK)s
z@DI5Sm;)9^9R6Q_hZW@i8#Zu$j4k+w*!>S=j@=<?sol<J28Yatg?NaaK5^k-QakuE
zO><@z$?&|37rW?LgVP9B(_3oii9`3Vzp;~hZ=Ip~884LZvWzR?Wj@<7vE-0qgEMUo
z*so2<l`mxm4F)dcnNu$I&LQm~_6z1j(ayC-dAh7Jos^{iHsh9=;zwb~G^j^nAExc3
zGiOh7bht(s<JK~f**7V?wflyChRTTj{Gt+B=efs5Rl;8qMHefr_=#3A2{pg$V_H5+
zog}wDFXtA63DW-DsIMq7(O>3<a-40#GCx~<BAMWKb11L3&as6Tt&!0n{n_Yxp5qzL
zfMj_=rq=bB4Bdib6_X$MgD)3dL!uiE#7%bH8Qo)<Tsp?z1|^VBd$al!DiV@uu%gW$
z{5hYgG!?(b=NmqducqT;d+AoPCe6z#HlD~wre)gYT#92s76NZ;m((f5M~2g6-dw5B
z$RwP&@j?XMSQ_)o-`CAQM8sv?jCRn9Oh?38e#=-kh}uiQPsrn&9E%}SGr6drNwau!
z*8sh`y>WddZtHn%!G~gj16L%Ffm!!ct`3)IvNQ=;oD&xJvq|NOyq>n8J2x9}P0gdH
zm$XNMIA`o0?G^ptC$8)Ys-okyW?@2CRoQK5N$`CW`Ed16`C?Ur3K(~(CY5rUj$*y5
zK~3)p4xCJhQe3U1xh}Aip(eb9H1HBd5v!^iW_41sDk<JG^?zvcdh2Mm3%0FRGe7T;
z)y&?xro5DaKQ(zTGG!pI)y8c{j(`E@?`Fi)o@s+L?#!2K#MO%lO6&dkLW4L~7m>|W
z+pl>x)5fmNt82Q)284Ew1}Oi$796>E`?l7@hgt`VdpiiPpTXD?mgf5ecjK>$<7kWR
zzauqZF<Q8yGFXU-!QN8qh|^XP>K2#SjeeY`SCMyPifc=ZSxd)~Cc^k@wQAI}(jxz5
z{U2^3c39or)j5UWJXverO4svRDX3rQ)Gd8JWFcZXXT&A^{df-|TU*#*rT&)8J_!MS
zz1vFlf>{v$40%>on5vPLXH{x63p=yo?aAKEi&-1I``gA({h877!vA2x^RMM7=B$-U
zHSU@7v6J9seQhY;+AVXtO%nd8lWNp_HD1z<#pF%nXvR1Zv-EeN8+o=CXhutNFD$dD
zBF4q@Nyc9^E9c^@Ki^WkXT&OECqPT<m_6TE)3nuXuhcNtIv_2r{)LiD?Q37N1c!5#
zV+4Kc#QhDb+UfY$iOeMQX5j++u9|<y&KT9=klhs~6Oh3n$l`p-?dI(~O=A^JGVyO&
zs>zQ+;c%R(ckUUgoJ8?Y0zcwpje5k2tabIJO?e<A^2(;NS)<gv<#$YjCbw5DXgtdC
z+NeC`Sh(Nq$7&+qG?5U0+V!z^@EqbJZ~nzowIX6h@lxr9@maql0n9vg%on!_od^63
z^?e2Wk9q=RQ3q<doJzLkkF1@y7?Z-19dv^;wMmR?F|Qblba&+%<#H3kMjwPqYS9ck
zr>oKz8dTYKyI#h9qB|G1Dd&{>=EtfrQK`P6Xv^lL3F)_JlRcrt!JpXe;W-5c<P!f{
zxRO$g@Z^d|n?}dV-%qJIlzt9c_(t}}U%H5;xzBoENO6w4#?hBw^^@RwyjCavo`HLw
zZd_o0QpLt+;ju~kB#Ifa^*W=0rL=Q*vkyYn=;LM;pOc5M>Q{)@zxA!Z)T=V&O^v5V
zm1cCIyJ$t3AKPIru;_$c#HZiqPUpGKSdHa0f8BI29PW3SF5z3-X8J{gO=SWPPdBsS
zNsAjE3?b3%i|Mv!W3PVfVi9Yq`O^|R+u1Gpj5QOfaX^5eDRs*ITJ*8_W8_jnjecg|
zGZMSvk<e}BIJZ(`DpB;9?M!anM$2mn%2gJA%lwV-u#rxJ%Jc&N9T|+Xg*q{A+a%7E
z-t)CAjjlqrwdeJLxkSx$?Gluvt9@hrgKEX!a8;cO<!^Ogjm_-y+@krxuM+pFvd^I*
z(}2q9Pc&Zz+kATx3-_HjQ`K?!HFqOcbNqM9*JevTI4Ka6%aY1)RY`U6wPbi^Hmf}-
zD?lojPtA?(Kl<=u6Q%sO`Mb#pp`Es>iXY^bx$-sI%46Ct=ECiD`GlOv8q=X9_KSJi
zqqUUCB?a1s`6O(7O@wgSa&!VVtVW?umbgwb`7zn;S`m2ziQ>>Mh7BTOF(2NqEOHjY
zA3n#iVIM!9Bua~$4C^&4*cCC+Yr-`3+|+z3)rO@(5e>zhnOv{1YH~CptS6AVY<tg-
zmDS;1gkgf~k7kLT1yX<8p0d(e#Y>jSUUtsoFIyFj`bVpRhSa9)9~36bCoC;*Hg)xS
z4rC*kvsJc8$;O?Z)jfOa#QqUupEyl3_{CU*zUE-;4jZC{wWfDK^3jNX?SUhro#kfb
zE{&EFhGQ`2#=$Qp#kYaNgL$5d?_QZd?;RV;U6<uqD0%e7*UHVf(r+sEAH(<w<(xL!
zvFx0j_p0Y?T`VV9BQwM&_hx2gvrGL#1D3<a%O(^UoO`9GgSzO+3Q!IX?76`=kvNRA
zWQ6@+cSKv9hqUkBf8{Os!7qOH7iP+NmZPTK$MOzNhnGOU98<9&YF~YN_NKwh6kn$v
z$Io;k+>2aN#Z`^_bK^06@hcGz9>0%ba(LX|bKy>L%6#gkd(Tk#hE3p*XD}V|oYe~H
z?s9%Eo&&nv%fQKT=!L;Ue?5hj#7zq8k?;1G-X@J9`G%H;IX|XEhi&eSKQ6Kn)hkeW
zNM(uV)@j-Gz-ULl%knQBL)F#1TUT6*e?HyCb7kB4LUnTvEnO<nrj^*e!1Q&(TD)@4
zu;g7&H<8l4wil{cbh3u=R>0fySKBFPSBuWCmfLx`HSx`aEhTs4YVl&4wRnFCgshKn
zOn>6vm^S<p7l^$SZe#3TTZ!iwW%|QMDT9{7miNtdxr%?cG(&_x5~$PKJ#XA8O3l2p
zL2{jKp65xO$$l6%F6A4Z#Z(GL(zHa)3}c9CmAJOev@1GbxIn;@y)bXh)*6hSe6`Nm
z5)t+yY-DdS;C+q3fDLZi;Mt{qAsnQqr11x7(I|vmtW@DY6}bEz)g*S!!<$4lEcLi5
zJ~57$dPl9kb$n1LoL;*8J!t#el-tHurM0?!<k{PuRLz;YtQi#UWHPzMZ|u}`aog2m
z19#c_X$$}83hm`6YS>!86P#ax)sK#=i9yICDa<meqd5Wtv%ec|U+E=kq7-Y$x~uu~
zZD6`qdKHE_l&3(_GcUV$@q$*n8kTsX8&_5}vjnH}{ioN2$=b{<^S0ExuALLh>4F1h
z0pIyUI1hd)+$C5#_yBuFfQn@aitZ^2VeIi&6xN^Nm5pCw?*@lCE9T#s1;V*47xxe}
z?Tmu1H?56KMwk+}olR;^{r9;YU+OwWzOgw3f@%?gK!F}XgU&hM4sxggBu+m_x+vKF
zUV$8%K_KX1&t=R+Ac$bcBnRDa?r)Gh_8_V1K;G@b9d?jTuv^nPK^zJG9{AiK2XR2c
zwIL7;TOjKOpa<;mbfB*Y>7f_w%;-O%2PwP{g*&i^Q}{s580g^)_h2rDE`SB*O9on@
z9?ZiCbr0nn**{Pl4gMhXgL?FGaOMvdbQ|>w$W`ch4(2%ndHNS{AG8GBdzc$E3mU$S
z6ndTChu$#5*>vd3487nRQ4pVp+VoI^z6qpm8vI7^4z&zc0qz16c_3X|pgs{;F6gTZ
zXMWIY7G`mSa}kK+V1~my?Ei$F@XiG!FT6p+9R|3=ga`8^!W{71lS_eo2K_}H4d+!b
zQ!(6yZz6~9rVI)bs<u>ru!)kV=xEo`^}<P*7PPsm6Bm0Sdb`1%-;?2`YdLLqAA{U~
E06F%2IsgCw

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.pack b/tests/gitea-repositories-meta/user2/readme-test.git/objects/pack/pack-8933bd634b76f8154310cccb52537a0195e43166.pack
new file mode 100644
index 0000000000000000000000000000000000000000..6f5bf1f044bcfb2158b5ca9c6743c51c89a0dba0
GIT binary patch
literal 7854
zcmbVQcOcb$`~KSH9EU>os_Z?=9%YYXCVQPYp@UL{vbPY&J{>c%N7-AbjN{lLD|@7f
zB87ejJ*%hpeV^y|hrfKjpZmJ6`?|0D{v6#)ikbib;N$)rkmMfdgh)w9s}Kcnuep_l
z)s%BvikD4ERrLkQ>+KLFNjr4Fblh2%3`PgI#+m-9UB6W0KzlQPR#vFO>7?vy4v22+
zY>1u{+K!w4w5!q$0;bb+XGNm<hr_vvLN3zlSQIe4xVJJ=l&;A5`I`KI<+COMlB?^K
z>*G@1OCpA`E^jh+uylk&G&cdBk}a9|v%d25fE3FrdwQ01+LM-BSLAhTHL2rpAagLX
z5PUWYg_$&in|R^`_ypm??(SDDfsp5uHNG}ut>g8<;$?dgJEnGtr^L+ordTCD(e_Do
z_$Lg$&M=zqFR#*qMI|h8<kQ|1mblnuhe344XynHu%N4zeSxen`&VDGiD!32+l(@66
zcCTbpgk{ZAe(JT|o|e-Zmt~G?*y~k_NEv@3iVCg4KKk!l6gpEVzFUk2**hFf3&a{L
zM>IzLnMP?#&P0l=$B$<T-u0mVpb-r_q*2XH1OJo^>o{>-c&ZY)6B*ZuaGBkUH5nJX
zo>5IoT_z0c07J5bnb?acrMs8;g8iJ9Yd%J750sk7lQ83G9QuhyEpey&gRJz|8=G2g
z={8`ubR+gA%bwSlXIgG@OZAH>&+6?1*h?BWj!<G6$=X;CdE_=`Jwpt+txuJsnZyHP
zyxE@Ut9&!|{ah<38^@!gP2wqj1+^I1iK+80;gyfEr_PxKws04&J*H%!wk!Zg=s7%y
z4ll;j=u#RY>~v3l>V|fE#vGN=xP2qGmo0kpDT_m|vSm_W&$oGRv)py_T#f-~RmnTR
zbk59EFC#weoeX*9<}`U!1~$~=V{Vt$AQe~iEJ>85rtWdI|B6zAJ7OS5Gl6JhH;jLd
z#m3zBTTKTsck^tcX>!g^zv+-Ao9UHH2Kr8SWOx1EC_HO#e9>--c)Fo)*Fsg~9yx)R
zYwJhlPRvL+$Ccf}|0#l2S!T8D%r2t?^5L8oiNIzZ8Zjk5ReiyC5ycQ8J|?w}Cq~aN
zNE&~-0=s3*iz~O_RH2selE6U41HlC~jjq3S&6}d~cgmN;qN5|oiyp>=nUiWiUssPM
z7n-CJwd)y!X?nfp7%t)_ypwl2n2Utt1anSie7i78c|?YqA%&7?<CMRJYsc*K>YBFx
zKtiPGE=RRW^*~Rd_ot6e>*Hzeo|Q=sBdc!9PAQ@5#vweb!>`w5_1@F2ojlRf?#cK~
zAIBqA{G3hNt^uO3jY6!chukVaz5ck`vbfd;E6m8|b`a&E#lj6vvR%B$A@H^aQv9_L
z37JTPGy-!BO-2__rS{Ril^RdhpL}M#s0Lx!jEok_Rsi>BnmWYQ+S@ZRj68XHR$P)3
zKknp<(H4@hPEljxb2v@%Kl0g@S$^fyr+v{o^<mM}^{ElNJ#D+9Wal@8O6$<~SxtT<
zx(!+eRuOyqW&J^0N17az;F!I%4<t)z`W#j}0V92g((f4M8Zz`8Tl>qG?L?7teGyGp
z2K>j{021rHkng311qp8zE~})QYu`!_u6^Ohtp6ma%!uzm<#|f5QEGvqwkg-k$doWm
zu>Tt^;aEld){8X(tjb`Q%11``Ru*h}$2s5MsSI6dTRd2BNC_P=4psSLFWkQD&Coy2
z<N=)9lGv_X{Z1Y*-DdvT#A(K+=BZ5DBH5Ej4Xqf;Lz@(KZW974-%SrN%OylQMF{Is
zP1b#eh$yQDIB}QR6V`fPn8#;2*zns)XFh99&_86x*3FpcSw}{RQdU8IOAAOkMV2Du
zy0Z~#OBDM2F-t7?;xz?vvX@A98kz9xXd3r!Dy=1*s0F|2cHTYod-?^x-iZw_-?^Q~
zh*FDc-fx0s(I=j&inqMT5N1m9)+yNhPCU6hxx6aMt=fl=TsJE?1-J3N>Q9(CPab?B
ziL<?Gam|O?-cUE+bVfon8_Z~s$TP{3D`fp9jsoYWSSTsZ^oibjYYWrpa>x%}WSv!+
z@C;4X5*vMz!*t2T<;+w|PoT?3W}U0>FaaW$C^C45B0Os9x{C?9oC*D9O#f;2vz0*!
zg$nEDB3K8GI%TD({Cbnn&a57&#j+L)@*_{fym0AF{*Nb<j0)vEf)$-6rhR4jx4xv<
zPQ1EFIQdytQZ=lsEs+O1ctz<;I+>dfXrvh9Ht!T@t`ag~dD2CH)xsMuxnDPShS*QY
z1APPjwKLC5KOR+JZEYO`OGLt~ZJbl!DJYnABHS7cOM}_KlVJ`BM7({BeIg2GYb&fL
z9yL7F*D_%{3%<uLq<CqhWvIpP0k1@*Qf7q$8^16oC%3SqS?2l5njjExS&tzo>5!S<
z>YN%tqo!brbiz~aD>i##>6f*vlE+UMAv3@2=0BA&*mkewdt*L6vMu9mVA)Prxfiw8
z@)O#R7>!%BaGEpaw+9FO11Q~L#T?uHlv~MtkU=f~)Ji2Dn~!KP%f24NMEU);SGTlT
z-n=bFd+mQ6+-WQ+EiN^hVd#^9P6d0OugOpq)34^=DfzxDl>T*1*RhsQH8$<W40T$)
z#=*iV1Ls8&?jnOs)TzVS2z5U4blKcwkl5M9UNyrZi@PQZ_yph!5zjj!sTa0CXNfOw
znl-$VKBbf^L_#Wp9l);8BXs90Ql1$yGnu;F?n+jAl}fJ&F;#x%SOpg;-!@^Rzk*$1
z-I}+E)|Zy$_9qb>hwPkA-|$AST$a9H6_=DQ@AKKo+sIPzl*`RZEZzI!*Bfk6@n@YY
z&%nR-D$3XkMc%d0ya(~1w#;DWO=>#L=nYg6I^3(o%Xz*V7~K$NrNM17vq&5S@<0<k
z*CY)R0t31+CZDOs$OuR~M@QY44D}xgmFu?m;<Z!OY}GW~y{c;H@_;8>EpI|)&R-%)
zTT|q#yGeivc#%8zYGCu~G_P0oyASdw#}or2mnRxrSj(^?Tzj0xSGw}nsX6F|W!q$!
zG}nmy1wGJ@UVMtutIp=SV8}Ks#Lqq~HayWT)GyOHD$~>2+A7r3(kjBv-^n-J(%vpK
z#>f9+RKhLGS?WP>e(*v&9mJK@^fx8pl%tecBO=ZzDrm;WDc|e|0=~Xw5PozdBWMHx
z8->bFT9$y&C8t6|+ROMSO`vCP6IAjHA`cXuE<4LNCNp3bp9k)E7YhY?dyJ@`ljNGC
zeyW_9=TxemlieA_1W^yaK$XU@=C8`oq1r7Qw;CSc%H-IqULTzmDLfOXJo=`Ls%Gg^
z(0G*&iNJ>By4RQ8!NI!7_57$%s^|=_8~qZ2XXMUna1V$;YcCx1hSuD6+VGaOYAT6Y
zLWO5Gp2_3QWmL&C%Qi3gLPS7j@EL`3<J3s$Xq?X}-8<5M|1&PUOEJ#%#oPGt?d>Xi
zfyGp{`vn~*2YT8t4RwY1q3z4hMx!5}dq!o@bmP2{P`2DXEw11XV~A((^e^>44XRqw
z&t^ZVZc#B$U^dNtx^lp+zoQWH4$^$hr?t1xf@E^$nV5{coX7a<71@y$^aAN?(Vgi0
zotv%9{qt^VuS`FKRI?wp?XBpsk&6hJzV+xGtdSw#BIhH4<}4D0sUF!vN1nlvE!e{x
zY+&(l6v`fE>+I-Yk245_V+=AG;phm5IiiytV_+y-xSSqm;0w%9$IV$Vi8@7b#tmyn
z>y{UWNK^AHUGtPjaVbeXM8LiSP3GYM&H3|g{N>H);Z8S4{^;`}#eB>d)m|Fao}X)W
zN^DnAZ0foqhij+J#gr`QkY~kf-E~c_9EEVa;gAHHehYGQeQgNixd3jZ#ha8#6o~V^
z$&_`BR3Ai24COhzR=@dVpEL3{fgnOyrm8-FPFWbHu&i{t7StyNc#Bv^X1S$to;p~{
z44Te*WP`l5j$H)>(Q9(e5Cy_L(C^@0Z9i<$(H4%dhsWBY(2j}mFqlIu%pt`VoeZ~$
zfm=H!qTtSs2uFB|y_lYO>KLXEF?&b#6sujy4+3(M(oB%3yj~)p<RNw6I^lzJhunI-
zIOaCS9)-KmA;uP-VjF|BwTVr%hdDbSoKdz26v7^XfZL}aVenX~BX0ZJJ#gHz{myLy
zGTpogcX1#;HRlJy2ltOI{>{r#2nS~y>twjS0}O#c+9P1rvB}A{$V7V^7|K2tj<iLf
zkqA_x$RX&V2^bFaC04tPAD|P^$*EmLzzs`k>2;z=!y`5H{9wc0F%jvQhDfxxO@=$9
z;KEp=Z5<rb;EpLUTm%>zVV{UZ*u>-52pnt2z-Ga!?5sII?xl{2OHRqvMVjhm#Uxr0
z+EOLiF6P|E0~EIy?cWnQ96DAlnIF!v6fUK3V}MvKW)f2s^)i1BwYL%c15bI$?pp1*
zT@{2|BiHh^&cCCIb=~yT8hgloK81iY({D`;CF?~qUJn)scoAlgDOZ#%bTy3G!e20Z
zSeL>gB*iG4K#JQpx-XI93xgH<y>((iTuxeXkg(-}Ywg<Ym)~_zJfGwB!Z%`(ld<Xn
zgrVplBIpH52JJiSMKI;-uR#tfDYb;&U!6>5hRiOE`rfWcidL<5vUrJi`oX*f8&6rd
z<jalP$F<{DT<G<lNA6!%Hi%#E37^lz_dtsZ1NcOZpD@TFrI7azEhqLzylg*^>+J-G
z-(!{&I`DQB2iCMtQD+?<6%!H?71lf9>UQU&n_bP*&BDj8-$9FaR`oTmxev>uDkNZ}
zzyK10t;QWTxT>a!=~UOy!d~T4=NFinCGG6sy9%5=4z<r}q)KCDBmnF;fu(<fL7V~#
zxqDYeCTkp4F_o^kX<uWvmhK8PF@U>EiT@Fb2)1XWjT2NMG&`J@DVtC0i+rt0&9%P|
zKOkLUfIsFb=mPS;m3gsiM$c~-Y&1+T+-|!;f7wD#n*ew*Cjhdw^FVjsO@9jk2=?%z
z>;7pjxPSrxJ13dcPw9kA?*yH*QhVc6CAA>_zV$}!b#i_FyLdoX806Z&$!AFBFr^9S
zl{oT<W)O>qh+Vgsr}IjXK%j5ls$YcVM7oDv*Q*cD4!j#(CHIX4d9q!S$$;Cz{Ckc6
zIEAAa0)UPmL^^};uiE%!7Abzz+4Gz<qJ-af_gZu860Q|&mz?Hq9?P0OzqC&XD4b#N
z{JU^QKc>lh=4>4RJN0<M;T*Z-C2*r90I2H)?N<J0q*?KM^RVA#voH%P`d0||qDCv0
zW{I?`0}O7<(x_uM!*|DOC;^pf#&dr!!Y>gDDP7G>delnsr0r?+Ok2cwu*J6zR<_2>
z)~63XQWRtrfMe=ZRQtbM@(xdmR8>D&{2rg$FUiYE3z(2_h1uHvSyMItEX^ZDfzrT*
z|0>h9^^0TMnJ%kY*nI&Krdo(;@9I(%37|N}Ao6cAMdjj>?X!8$=`QN)pZlq9W0H<W
zBQlwTuvx*7<O<a<SpaD5xajKtVRApTCZ<7FREl%IKl{)xwMIuzo1Bu&MOZ6U_oYt6
zya_((CB4@2-8^J4BDVe@Y`0c2FEg)CvuCgyYBO5%P6IoWGt=s+jFgg&w@OXR%u9(b
zfaEPtEOg!IrkhW?w>Ll2m@dEd7PI16z+t^}B;)@;-MQ0BiS~ZD@o3hYEcV=Ume3P`
zWD;<c{g*_4v$q1jlS2-EmWQ8?VkOva!gA;UiYWrq^8fkmQSrNSNC&I__t76zzV8GL
z{X`}4_%-J77g)rJN(Z^B>pkBaB(P)b+#$roa1IXAOC`|)O(o!@Qj_W_i1dbh(o6+x
zzC<48;|y`+;`!uiK#R2~X{bV9@~M5L!#wqESCkx!PRorb$m1c%j-H!qbeaim1MMcs
z@nE`K<R{ZUOZ5}3r5*NZ2oc@=I0QD`phBXmnai_(tDFV{=fML8T9noPxf>OLk4VsY
z3(@!oB>Xu2fg3dUPbK){6R`ra`X@ixU5*jl^}2J-<i~Dr*Of(D8_~{sIvr>WX@q7R
zX~br^ew-$4mE0TY6gOY@oh52A-zs0vrWLg`5CgE3#*$QucP!}OBQn~14T?0WuT?WQ
zme0%OHcU#-#Te27PtSr;Ik?*XWvUM2#H)skhc1?yo_ASX)isv1QGYb5n%N0dID??a
zisRCNYIQ<~`TsOkGi8n<c?$rAC{l$Z%l&PvM-H41A&vfEIL^#(wEDTg{eWp?Z)0TX
zyfDz;1Bv@303oQ`0o~jvpT3>0i}}X^b>Yh&B;<kC7|`wG+Hna$dAPcIHK4eu&T}-?
zGiA=(cppx7Tr?aA#}4wQ+!KeXi2(S)$Gw0nC2{xH3Qu}j|1B$$W{;`mb;Da9MS7Jf
z%TTj>6IX~0Iv+pc^tqA8>trv^zlUP=kqs8_pn$2U>%p8a`Dnu}c>*aPf#+K1z=MKv
zC(}!7@4TleX>@sV8O+UZT{dfat6E_~rpWGcc)^3*v3-J*sV{+>o1!0^aHZhI_Ckky
z1v}OF2L#plI{S3^bfCOF>e?9XVcvW$JfLC$RDC3XKjTG4oDLx}^?!DcCZE$;a{D{n
zs4=#EC@I$`*^hc5$u|3pFrf#nRawQ?!I5U3JFg02RO#jU=l6k!{ETw49_YcrK|yW}
z41Y&&Cq|P9V5TB`^}8wp+L7Q87T@)qQXNr{#hl(bG)CX+;;y-g7|_@Q-YWP*6>5J$
zYC|!VU7v3RL#DoCzcoUaRVp|1(y5sM;KQf5d#w3iYvYjL{XJyl(AoXN(6R!6v>D{C
zqz4*ww94T`hX;Ur@k>ewe#kbveI7wv{&jRN@l~%y+%`5svf{x?_7y*ysFTK0?9DO{
z{oii|P?A{Qa@zw<pjIjb-NKjn6Cps~eLCsivy9){lnGgK{H8O)kt>>(FJk=ud^OwU
zPw6|9KuH$(?qAPwfAxCM9+40cWnpFip|^PObA#;{Y9IjvVmX%RUxXC09N#s$^_9wS
z!D5cZ(z2j>t$w@N3g|O|SU2Ff!%;s%@c1zN{wyZ`3I!+Ug<_><E>YRXgzdZ<(4J0c
z4~76>q9uFxI|lSn#c5*I>4oO~$!P%_?@whJ*S9MTIR`a-34q!xNJ91>CBadAbi=ic
zZ{HW!T|x?U_#a&4W)_5Zr@^juo&fOtAZt%?qTAxr6TGT+r2{&w*8%10!Yttf0#!tk
zkN<L$7Vdv`U)W;2zF8z5VCn8k-f?bd%=htex8ek5=Ex17;Z7S|{i&*IhH5zJ8sgSz
z-1VJW!*lpRQzdCq!O?R37oz@q$GJ>zsz)(hUl*(M-E>*mWnfu1GPrg^_;EIua5bwu
z?kA3f=i$(hTQj#pR%p_LdPmIbwm~CP;s$ueqCBhrkA5kV`Lf@BhWB}IL|tcL^If+o
zx$dePctGw=X2stNai~vX_jBJ)yPr#qbUIW1Mm$I~z02g&8Z8i>38Fo2jl&$<H-{<)
z(DUtUR~ipHb+@0C=C$vg5sNz<{coXDS>i<l-^K70Zk#$(hO5P)A_fP^kJWzE^33Ce
z20t(Azw~^(&NpOTc41K5Q}a3o6+;9N-NAdGeK;-tY!?5++(Md0n_mu=_?mutw+N!4
zi>|J-s+*VqtehCp8HaknnRW0{e}(|$bD+elzF)r@1%EK6-c*~*4Q^los;0s9e{=N<
zWX<oHHscy<leJ}S?^8)Fb&I6m20AFnUj5S5)rRyI;3nH^8{6r=RS7R|-?fn9y-xxR
zVj=M3ZR97F9lq8wWsaVP$F7d42dVu`8E4N@w&zIL;(T5SB7ELD-W%KPLk*OKlFt7U
zgK^i)R(jMW#O<lB>+gD9B&N6Adk%zv*PM_qzf}64FbpZ-21`o@Y42}51fwz8hvg@h
zCL=Pm>?bjNDaSX6p_RM$^*mz*5s=AFD)UPW9j?-Qv-20ErPuET&|CJFFjnh#Pm=-D
z!4RI~`HE{P4P1XM%(`|9^6PVTV0gK&cIX)3rk)Pp0It^xnn~~f{Z*3(?a6P*Z1dfF
z^!mfYCnxc5OfJ6Mzyqp=z@+s!1>WxB>(cHq=qSFzCD5sZ6}YOV12ydE5Y)+^#|It|
zpKN~ehc6sIun$L*&D*tZd5T6J<IaO3*50`}t?^modrZJcBRI4PcOGYEzi$Eq%7B2t
zv_|l3z}}urFa{Qk+`Au~jk$v}dj%mf_q@MdU)a@$TQ-ts?<RhB@z^bR+X*$gzV^kZ
zd;UWkA3z#Nv2nO_;c)<C-_NlwhZZb1mn|lS&evCwk}f}buvDI~m|Qwv<2PSZuv`|s
qoaaZ1wWH<xCE@?U-d2>z?}UpsUek2{Laj)F>DD*!!b_MJhW{VoRCZec

literal 0
HcmV?d00001

diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/packed-refs b/tests/gitea-repositories-meta/user2/readme-test.git/packed-refs
new file mode 100644
index 0000000000000..2399a8008dcb8
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/packed-refs
@@ -0,0 +1,22 @@
+# pack-refs with: peeled fully-peeled sorted 
+ea9ef877d1d88af76682d8798418081264f10cfc refs/heads/fallbacks
+0d4c14db927c9ffba01fa7e126cc748b5c02c01e refs/heads/fallbacks2
+c66d5b07c2063d3268707f22226c708b589574ef refs/heads/fallbacks3
+89f8426e9eb5eff35c09b3565836c8f8e15d0ce9 refs/heads/fallbacks4
+b0e902496eae435ad03c92a5d479f916ef2d4893 refs/heads/fallbacks5
+84a5500b5cc040b11daf53fc42c542a99589dc76 refs/heads/fallbacks6
+cf406a96e416d7de5c4c1bbfffdd672300c822bf refs/heads/fallbacks7
+0d6ac644b969e9199915a492da9dba08c179fd23 refs/heads/fallbacks8
+5038febc0c57215beb3748d7ae4091a25a4acc93 refs/heads/fallbacks9
+9134e1f178ca4cccf1a197142646f2d7627e8cd5 refs/heads/i18n
+744d2441e55bc0010d6b340d303f0106a627ad29 refs/heads/master
+3c492566170b057e962c025515ab38bbd7444077 refs/heads/plain
+3882d6373a0882a6739b3cd9b24d21c630621234 refs/heads/sp-ace
+bf5ed898252eaa50dcc01108ed4417c3ea98a294 refs/heads/special-subdir-.gitea
+c03543573ab088ce1cf7090a387d2be621426234 refs/heads/special-subdir-.github
+e75957ad9b7e6ed16dda183529ec283db0bbc5fe refs/heads/special-subdir-docs
+46f5d5ab33d701642e08c713fab42af89fdd4fea refs/heads/special-subdir-nested
+9c0f872256b839c2b97ec22fd348d87b14045513 refs/heads/subdir
+d7a854fff61e45b98234d7aa79ecbcb1619cd3dd refs/heads/symlink
+30b9c0ed4b1039dbd99f3fb537b84ca507e0549d refs/heads/symlink-loop
+41489b7be5c2244d2b7b524dcb31caf3bd1f9ccc refs/heads/txt
diff --git a/tests/gitea-repositories-meta/user2/readme-test.git/refs/heads/fallbacks-broken-symlinks b/tests/gitea-repositories-meta/user2/readme-test.git/refs/heads/fallbacks-broken-symlinks
new file mode 100644
index 0000000000000..cf36865a7126f
--- /dev/null
+++ b/tests/gitea-repositories-meta/user2/readme-test.git/refs/heads/fallbacks-broken-symlinks
@@ -0,0 +1 @@
+fe495ea336f079ef2bed68648d0ba9a37cdbd4aa
diff --git a/tests/integration/repo_test.go b/tests/integration/repo_test.go
index 7c3eac20cfac2..cef9dccf24f60 100644
--- a/tests/integration/repo_test.go
+++ b/tests/integration/repo_test.go
@@ -257,6 +257,111 @@ func TestViewRepoDirectory(t *testing.T) {
 	assert.Zero(t, repoSummary.Length())
 }
 
+// ensure that the all the different ways to find and render a README work
+func TestViewRepoDirectoryReadme(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	// there are many combinations:
+	// - READMEs can be .md, .txt, or have no extension
+	// - READMEs can be tagged with a language and even a country code
+	// - READMEs can be stored in docs/, .gitea/, or .github/
+	// - READMEs can be symlinks to other files
+	// - READMEs can be broken symlinks which should not render
+	//
+	// this doesn't cover all possible cases, just the major branches of the code
+
+	session := loginUser(t, "user2")
+
+	check := func(name, url, expectedFilename, expectedReadmeType, expectedContent string) {
+		t.Run(name, func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			req := NewRequest(t, "GET", url)
+			resp := session.MakeRequest(t, req, http.StatusOK)
+
+			htmlDoc := NewHTMLParser(t, resp.Body)
+			readmeName := htmlDoc.doc.Find("h4.file-header")
+			readmeContent := htmlDoc.doc.Find(".file-view") // TODO: add a id="readme" to the output to make this test more precise
+			readmeType, _ := readmeContent.Attr("class")
+
+			assert.Equal(t, expectedFilename, strings.TrimSpace(readmeName.Text()))
+			assert.Contains(t, readmeType, expectedReadmeType)
+			assert.Contains(t, readmeContent.Text(), expectedContent)
+		})
+	}
+
+	// viewing the top level
+	check("Home", "/user2/readme-test/", "README.md", "markdown", "The cake is a lie.")
+
+	// viewing different file extensions
+	check("md", "/user2/readme-test/src/branch/master/", "README.md", "markdown", "The cake is a lie.")
+	check("txt", "/user2/readme-test/src/branch/txt/", "README.txt", "plain-text", "My spoon is too big.")
+	check("plain", "/user2/readme-test/src/branch/plain/", "README", "plain-text", "Birken my stocks gee howdy")
+	check("i18n", "/user2/readme-test/src/branch/i18n/", "README.zh.md", "markdown", "蛋糕是一个谎言")
+
+	// viewing different subdirectories
+	check("subdir", "/user2/readme-test/src/branch/subdir/libcake", "README.md", "markdown", "Four pints of sugar.")
+	check("docs-direct", "/user2/readme-test/src/branch/special-subdir-docs/docs/", "README.md", "markdown", "This is in docs/")
+	check("docs", "/user2/readme-test/src/branch/special-subdir-docs/", "docs/README.md", "markdown", "This is in docs/")
+	check(".gitea", "/user2/readme-test/src/branch/special-subdir-.gitea/", ".gitea/README.md", "markdown", "This is in .gitea/")
+	check(".github", "/user2/readme-test/src/branch/special-subdir-.github/", ".github/README.md", "markdown", "This is in .github/")
+
+	// symlinks
+	// symlinks are subtle:
+	// - they should be able to handle going a reasonable number of times up and down in the tree
+	// - they shouldn't get stuck on link cycles
+	// - they should determine the filetype based on the name of the link, not the target
+	check("symlink", "/user2/readme-test/src/branch/symlink/", "README.md", "markdown", "This is in some/other/path")
+	check("symlink-multiple", "/user2/readme-test/src/branch/symlink/some/", "README.txt", "plain-text", "This is in some/other/path")
+	check("symlink-up-and-down", "/user2/readme-test/src/branch/symlink/up/back/down/down", "README.md", "markdown", "It's a me, mario")
+
+	// testing fallback rules
+	// READMEs are searched in this order:
+	// - [README.zh-cn.md, README.zh_cn.md, README.zh.md, README_zh.md, README.md, README.txt, README,
+	//     docs/README.zh-cn.md, docs/README.zh_cn.md, docs/README.zh.md, docs/README_zh.md, docs/README.md, docs/README.txt, docs/README,
+	//    .gitea/README.zh-cn.md, .gitea/README.zh_cn.md, .gitea/README.zh.md, .gitea/README_zh.md, .gitea/README.md, .gitea/README.txt, .gitea/README,
+
+	//     .github/README.zh-cn.md, .github/README.zh_cn.md, .github/README.zh.md, .github/README_zh.md, .github/README.md, .github/README.txt, .github/README]
+	// and a broken/looped symlink counts as not existing at all and should be skipped.
+	// again, this doesn't cover all cases, but it covers a few
+	check("fallback/top", "/user2/readme-test/src/branch/fallbacks/", "README.en.md", "markdown", "This is README.en.md")
+	check("fallback/2", "/user2/readme-test/src/branch/fallbacks2/", "README.md", "markdown", "This is README.md")
+	check("fallback/3", "/user2/readme-test/src/branch/fallbacks3/", "README", "plain-text", "This is README")
+	check("fallback/4", "/user2/readme-test/src/branch/fallbacks4/", "docs/README.en.md", "markdown", "This is docs/README.en.md")
+	check("fallback/5", "/user2/readme-test/src/branch/fallbacks5/", "docs/README.md", "markdown", "This is docs/README.md")
+	check("fallback/6", "/user2/readme-test/src/branch/fallbacks6/", "docs/README", "plain-text", "This is docs/README")
+	check("fallback/7", "/user2/readme-test/src/branch/fallbacks7/", ".gitea/README.en.md", "markdown", "This is .gitea/README.en.md")
+	check("fallback/8", "/user2/readme-test/src/branch/fallbacks8/", ".gitea/README.md", "markdown", "This is .gitea/README.md")
+	check("fallback/9", "/user2/readme-test/src/branch/fallbacks9/", ".gitea/README", "plain-text", "This is .gitea/README")
+
+	// this case tests that broken symlinks count as missing files, instead of rendering their contents
+	check("fallbacks-broken-symlinks", "/user2/readme-test/src/branch/fallbacks-broken-symlinks/", "docs/README", "plain-text", "This is docs/README")
+
+	// some cases that should NOT render a README
+	// - /readme
+	// - /.github/docs/README.md
+	// - a symlink loop
+
+	missing := func(name, url string) {
+		t.Run("missing/"+name, func(t *testing.T) {
+			defer tests.PrintCurrentTest(t)()
+
+			req := NewRequest(t, "GET", url)
+			resp := session.MakeRequest(t, req, http.StatusOK)
+
+			htmlDoc := NewHTMLParser(t, resp.Body)
+			_, exists := htmlDoc.doc.Find(".file-view").Attr("class")
+			fmt.Printf("%s", resp.Body)
+
+			assert.False(t, exists, "README should not have rendered")
+		})
+	}
+	missing("sp-ace", "/user2/readme-test/src/branch/sp-ace/")
+	missing("nested-special", "/user2/readme-test/src/branch/special-subdir-nested/subproject") // the special subdirs should only trigger on the repo root
+	// missing("special-subdir-nested", "/user2/readme-test/src/branch/special-subdir-nested/") // This is currently FAILING, due to a bug introduced in https://github.com/go-gitea/gitea/pull/22177
+	missing("symlink-loop", "/user2/readme-test/src/branch/symlink-loop/")
+}
+
 func TestMarkDownImage(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 

From 8cadd51bf295e6ff36ac36efed68cc5de34c9382 Mon Sep 17 00:00:00 2001
From: Jason Song <i@wolfogre.com>
Date: Thu, 9 Mar 2023 10:49:34 +0800
Subject: [PATCH 26/53] Add Gitea Community Code of Conduct (#23188)

The Gitea Community Code of Conduct.

Authored by lunny. Slightly modified from [Go
CoC](https://go.dev/conduct)

---

CC all TOCs:

@go-gitea/technical-oversight-committee

And we welcome suggestions from everyone.

---------

Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Nick <nick@kousu.ca>
Co-authored-by: Lauris BH <lauris@nix.lv>
---
 CODE_OF_CONDUCT.md | 96 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 CODE_OF_CONDUCT.md

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000000000..979831eb9b8b2
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,96 @@
+# Gitea Community Code of Conduct
+
+## About
+
+Online communities include people from many different backgrounds. The Gitea contributors are committed to providing a friendly, safe and welcoming environment for all, regardless of gender identity and expression, sexual orientation, disabilities, neurodiversity, physical appearance, body size, ethnicity, nationality, race, age, religion, or similar personal characteristics.
+
+The first goal of the Code of Conduct is to specify a baseline standard of behavior so that people with different social values and communication styles can talk about Gitea effectively, productively, and respectfully.
+
+The second goal is to provide a mechanism for resolving conflicts in the community when they arise.
+
+The third goal of the Code of Conduct is to make our community welcoming to people from different backgrounds. Diversity is critical to the project; for Gitea to be successful, it needs contributors and users from all backgrounds.
+
+We believe that healthy debate and disagreement are essential to a healthy project and community. However, it is never ok to be disrespectful. We value diverse opinions, but we value respectful behavior more.
+
+## Community values
+
+These are the values to which people in the Gitea community should aspire.
+
+- **Be friendly and welcoming.**
+- **Be patient.**
+  - Remember that people have varying communication styles and that not everyone is using their native language. (Meaning and tone can be lost in translation.)
+- **Be thoughtful.**
+  - Productive communication requires effort. Think about how your words will be interpreted.
+  - Remember that sometimes it is best to refrain entirely from commenting.
+- **Be respectful.**
+  - In particular, respect differences of opinion.
+- **Be charitable.**
+  - Interpret the arguments of others in good faith, do not seek to disagree.
+  - When we do disagree, try to understand why.
+- **Be constructive.**
+  - Avoid derailing: stay on topic; if you want to talk about something else, start a new conversation.
+  - Avoid unconstructive criticism: don't merely decry the current state of affairs; offer—or at least solicit—suggestions as to how things may be improved.
+  - Avoid snarking (pithy, unproductive, sniping comments)
+  - Avoid discussing potentially offensive or sensitive issues; this all too often leads to unnecessary conflict.
+  - Avoid microaggressions (brief and commonplace verbal, behavioral and environmental indignities that communicate hostile, derogatory or negative slights and insults to a person or group).
+- **Be responsible.**
+  - What you say and do matters. Take responsibility for your words and actions, including their consequences, whether intended or otherwise.
+
+People are complicated. You should expect to be misunderstood and to misunderstand others; when this inevitably occurs, resist the urge to be defensive or assign blame. Try not to take offense where no offense was intended. Give people the benefit of the doubt. Even if the intent was to provoke, do not rise to it. It is the responsibility of all parties to de-escalate conflict when it arises.
+
+## Code of Conduct
+
+### Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+### Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others’ private information, such as a physical or electronic address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+### Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject: comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, as well as to ban (temporarily or permanently) any contributor for behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+### Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+This Code of Conduct also applies outside the project spaces when the Project Stewards have a reasonable belief that an individual’s behavior may have a negative impact on the project or its community.
+
+### Conflict Resolution
+
+We do not believe that all conflict is bad; healthy debate and disagreement often yield positive results. However, it is never okay to be disrespectful or to engage in behavior that violates the project’s code of conduct.
+
+If you see someone violating the code of conduct, you are encouraged to address the behavior directly with those involved. Many issues can be resolved quickly and easily, and this gives people more control over the outcome of their dispute. If you are unable to resolve the matter for any reason, or if the behavior is threatening or harassing, report it. We are dedicated to providing an environment where participants feel welcome and safe.
+
+Reports should be directed to the Gitea Project Stewards at conduct@gitea.com. It is the Project Stewards’ duty to receive and address reported violations of the code of conduct. They will then work with a committee consisting of representatives from the technical-oversight-committee.
+
+We will investigate every complaint, but you may not receive a direct response. We will use our discretion in determining when and how to follow up on reported incidents, which may range from not taking action to permanent expulsion from the project and project-sponsored spaces. Under normal circumstances, we will notify the accused of the report and provide them an opportunity to discuss it before any action is taken. If there is a consensus between maintainers that such an endeavor would be useless (i.e. in case of an obvious spammer), we reserve the right to take action without notifying the accused first. The identity of the reporter will be omitted from the details of the report supplied to the accused. In potentially harmful situations, such as ongoing harassment or threats to anyone’s safety, we may take action without notice.
+
+### Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 1.4, available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+## Summary
+
+- Treat everyone with respect and kindness.
+- Be thoughtful in how you communicate.
+- Don’t be destructive or inflammatory.
+- If you encounter an issue, please mail conduct@gitea.com.

From e52ac62d8e645c721060e6c9a2b0ab77eedf8fd6 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Thu, 9 Mar 2023 23:38:29 +0900
Subject: [PATCH 27/53] Redirect to project again after editing it (#23326)

A part of https://github.com/go-gitea/gitea/pull/22865

We have edit buttons in projects list page and project view page.
But after user edit a project, it will always redirect to the projects
list page.
---
 routers/web/org/projects.go       | 7 ++++++-
 routers/web/repo/projects.go      | 7 ++++++-
 templates/projects/new.tmpl       | 1 +
 templates/projects/view.tmpl      | 2 +-
 templates/repo/projects/new.tmpl  | 1 +
 templates/repo/projects/view.tmpl | 2 +-
 6 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index 046100c72e2f5..7b5eef32d83e8 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -233,6 +233,7 @@ func EditProject(ctx *context.Context) {
 
 	ctx.Data["title"] = p.Title
 	ctx.Data["content"] = p.Description
+	ctx.Data["redirect"] = ctx.FormString("redirect")
 
 	ctx.HTML(http.StatusOK, tplProjectsNew)
 }
@@ -273,7 +274,11 @@ func EditProjectPost(ctx *context.Context) {
 	}
 
 	ctx.Flash.Success(ctx.Tr("repo.projects.edit_success", p.Title))
-	ctx.Redirect(ctx.Repo.RepoLink + "/projects")
+	if ctx.FormString("redirect") == "project" {
+		ctx.Redirect(p.Link())
+	} else {
+		ctx.Redirect(ctx.ContextUser.HomeLink() + "/-/projects")
+	}
 }
 
 // ViewProject renders the project board for a project
diff --git a/routers/web/repo/projects.go b/routers/web/repo/projects.go
index 967b81c608516..29bd59c7a3b3e 100644
--- a/routers/web/repo/projects.go
+++ b/routers/web/repo/projects.go
@@ -235,6 +235,7 @@ func EditProject(ctx *context.Context) {
 	ctx.Data["title"] = p.Title
 	ctx.Data["content"] = p.Description
 	ctx.Data["card_type"] = p.CardType
+	ctx.Data["redirect"] = ctx.FormString("redirect")
 
 	ctx.HTML(http.StatusOK, tplProjectsNew)
 }
@@ -275,7 +276,11 @@ func EditProjectPost(ctx *context.Context) {
 	}
 
 	ctx.Flash.Success(ctx.Tr("repo.projects.edit_success", p.Title))
-	ctx.Redirect(ctx.Repo.RepoLink + "/projects")
+	if ctx.FormString("redirect") == "project" {
+		ctx.Redirect(p.Link())
+	} else {
+		ctx.Redirect(ctx.Repo.RepoLink + "/projects")
+	}
 }
 
 // ViewProject renders the project board for a project
diff --git a/templates/projects/new.tmpl b/templates/projects/new.tmpl
index c96f948dedfd6..826869ac5daac 100644
--- a/templates/projects/new.tmpl
+++ b/templates/projects/new.tmpl
@@ -21,6 +21,7 @@
 		<form class="ui form grid" action="{{.Link}}" method="post">
 			{{.CsrfTokenHtml}}
 			<div class="eleven wide column">
+				<input type="hidden" id="redirect" name="redirect" value="{{.redirect}}">
 				<div class="field {{if .Err_Title}}error{{end}}">
 					<label>{{.locale.Tr "repo.projects.title"}}</label>
 					<input name="title" placeholder="{{.locale.Tr "repo.projects.title"}}" value="{{.title}}" autofocus required>
diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 14a876d8fd943..474b22a2f14ca 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -46,7 +46,7 @@
 			{{if or $.CanWriteIssues $.CanWritePulls}}
 				<div class="column right aligned">
 					<div class="ui compact right small menu">
-						<a class="item" href="{{$.Link}}/edit" data-id={{$.Project.ID}} data-title={{$.Project.Title}}>
+						<a class="item" href="{{$.Link}}/edit?redirect=project" data-id={{$.Project.ID}} data-title={{$.Project.Title}}>
 							{{svg "octicon-pencil"}}
 							<span class="gt-mx-3">{{$.locale.Tr "repo.issues.label_edit"}}</span>
 						</a>
diff --git a/templates/repo/projects/new.tmpl b/templates/repo/projects/new.tmpl
index b65601c158905..b53a47dc58e69 100644
--- a/templates/repo/projects/new.tmpl
+++ b/templates/repo/projects/new.tmpl
@@ -24,6 +24,7 @@
 		<form class="ui form grid" action="{{.Link}}" method="post">
 			{{.CsrfTokenHtml}}
 			<div class="eleven wide column">
+				<input type="hidden" id="redirect" name="redirect" value="{{.redirect}}">
 				<div class="field {{if .Err_Title}}error{{end}}">
 					<label>{{.locale.Tr "repo.projects.title"}}</label>
 					<input name="title" placeholder="{{.locale.Tr "repo.projects.title"}}" value="{{.title}}" autofocus required>
diff --git a/templates/repo/projects/view.tmpl b/templates/repo/projects/view.tmpl
index f6bc6e1a42a6e..bef9cb9bf062b 100644
--- a/templates/repo/projects/view.tmpl
+++ b/templates/repo/projects/view.tmpl
@@ -50,7 +50,7 @@
 			{{if and (or $.CanWriteIssues $.CanWritePulls) (not $.Repository.IsArchived)}}
 				<div class="column right aligned">
 					<div class="ui compact right small menu">
-						<a class="item" href="{{$.RepoLink}}/projects/{{.Project.ID}}/edit" data-id={{$.Project.ID}} data-title={{$.Project.Title}}>
+						<a class="item" href="{{$.RepoLink}}/projects/{{.Project.ID}}/edit?redirect=project" data-id={{$.Project.ID}} data-title={{$.Project.Title}}>
 							{{svg "octicon-pencil"}}
 							<span class="gt-mx-3">{{$.locale.Tr "repo.issues.label_edit"}}</span>
 						</a>

From 542cec98f8c07e0f046a35f1d516807416536e74 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Thu, 9 Mar 2023 23:48:52 +0800
Subject: [PATCH 28/53] Refactor merge/update git command calls (#23366)

Follow #22568

* Remove unnecessary ToTrustedCmdArgs calls
    * the FAQ in  #22678
* Quote: When using ToTrustedCmdArgs, the code will be very complex (see
the changes for examples). Then developers and reviewers can know that
something might be unreasonable.
* The `signArg` couldn't be empty, it's either `-S{keyID}` or
`--no-gpg-sign`.
* Use `signKeyID` instead, add comment "empty for no-sign, non-empty to
sign"
* 5-line code could be extracted to a common `NewGitCommandCommit()` to
handle the `signKeyID`, but I think it's not a must, current code is
clear enough.
---
 modules/git/command.go         |  2 +-
 services/pull/merge.go         |  9 ++++++--
 services/pull/merge_prepare.go | 19 +++++------------
 services/pull/merge_squash.go  | 38 ++++++++++++++--------------------
 4 files changed, 29 insertions(+), 39 deletions(-)

diff --git a/modules/git/command.go b/modules/git/command.go
index 0bc8103116a0b..9a65279a8cb5f 100644
--- a/modules/git/command.go
+++ b/modules/git/command.go
@@ -179,7 +179,7 @@ func (c *Command) AddDashesAndList(list ...string) *Command {
 }
 
 // ToTrustedCmdArgs converts a list of strings (trusted as argument) to TrustedCmdArgs
-// In most cases, it shouldn't be used. Use AddXxx function instead
+// In most cases, it shouldn't be used. Use NewCommand().AddXxx() function instead
 func ToTrustedCmdArgs(args []string) TrustedCmdArgs {
 	ret := make(TrustedCmdArgs, len(args))
 	for i, arg := range args {
diff --git a/services/pull/merge.go b/services/pull/merge.go
index afa924fc109ac..12e01e8ce74a5 100644
--- a/services/pull/merge.go
+++ b/services/pull/merge.go
@@ -332,8 +332,13 @@ func doMergeAndPush(ctx context.Context, pr *issues_model.PullRequest, doer *use
 }
 
 func commitAndSignNoAuthor(ctx *mergeContext, message string) error {
-	if err := git.NewCommand(ctx, "commit").AddArguments(ctx.signArg...).AddOptionFormat("--message=%s", message).
-		Run(ctx.RunOpts()); err != nil {
+	cmdCommit := git.NewCommand(ctx, "commit").AddOptionFormat("--message=%s", message)
+	if ctx.signKeyID == "" {
+		cmdCommit.AddArguments("--no-gpg-sign")
+	} else {
+		cmdCommit.AddOptionFormat("-S%s", ctx.signKeyID)
+	}
+	if err := cmdCommit.Run(ctx.RunOpts()); err != nil {
 		log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
 		return fmt.Errorf("git commit %v: %w\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
 	}
diff --git a/services/pull/merge_prepare.go b/services/pull/merge_prepare.go
index 2ba821961a2be..88f6c037ebc90 100644
--- a/services/pull/merge_prepare.go
+++ b/services/pull/merge_prepare.go
@@ -28,7 +28,7 @@ type mergeContext struct {
 	doer      *user_model.User
 	sig       *git.Signature
 	committer *git.Signature
-	signArg   git.TrustedCmdArgs
+	signKeyID string // empty for no-sign, non-empty to sign
 	env       []string
 }
 
@@ -85,12 +85,10 @@ func createTemporaryRepoForMerge(ctx context.Context, pr *issues_model.PullReque
 	// Determine if we should sign
 	sign, keyID, signer, _ := asymkey_service.SignMerge(ctx, mergeCtx.pr, mergeCtx.doer, mergeCtx.tmpBasePath, "HEAD", trackingBranch)
 	if sign {
-		mergeCtx.signArg = git.ToTrustedCmdArgs([]string{"-S" + keyID})
+		mergeCtx.signKeyID = keyID
 		if pr.BaseRepo.GetTrustModel() == repo_model.CommitterTrustModel || pr.BaseRepo.GetTrustModel() == repo_model.CollaboratorCommitterTrustModel {
 			mergeCtx.committer = signer
 		}
-	} else {
-		mergeCtx.signArg = git.ToTrustedCmdArgs([]string{"--no-gpg-sign"})
 	}
 
 	commitTimeStr := time.Now().Format(time.RFC3339)
@@ -136,18 +134,11 @@ func prepareTemporaryRepoForMerge(ctx *mergeContext) error {
 		return fmt.Errorf("Unable to close .git/info/sparse-checkout file in tmpBasePath: %w", err)
 	}
 
-	gitConfigCommand := func() *git.Command {
-		return git.NewCommand(ctx, "config", "--local")
-	}
-
 	setConfig := func(key, value string) error {
-		if err := gitConfigCommand().AddArguments(git.ToTrustedCmdArgs([]string{key, value})...).
+		if err := git.NewCommand(ctx, "config", "--local").AddDynamicArguments(key, value).
 			Run(ctx.RunOpts()); err != nil {
-			if value == "" {
-				value = "<>"
-			}
-			log.Error("git config [%s -> %s ]: %v\n%s\n%s", key, value, err, ctx.outbuf.String(), ctx.errbuf.String())
-			return fmt.Errorf("git config [%s -> %s ]: %w\n%s\n%s", key, value, err, ctx.outbuf.String(), ctx.errbuf.String())
+			log.Error("git config [%s -> %q]: %v\n%s\n%s", key, value, err, ctx.outbuf.String(), ctx.errbuf.String())
+			return fmt.Errorf("git config [%s -> %q]: %w\n%s\n%s", key, value, err, ctx.outbuf.String(), ctx.errbuf.String())
 		}
 		ctx.outbuf.Reset()
 		ctx.errbuf.Reset()
diff --git a/services/pull/merge_squash.go b/services/pull/merge_squash.go
index 0a8cc0167e400..d6e7314988d38 100644
--- a/services/pull/merge_squash.go
+++ b/services/pull/merge_squash.go
@@ -14,8 +14,8 @@ import (
 
 // doMergeStyleSquash squashes the tracking branch on the current HEAD (=base)
 func doMergeStyleSquash(ctx *mergeContext, message string) error {
-	cmd := git.NewCommand(ctx, "merge", "--squash").AddDynamicArguments(trackingBranch)
-	if err := runMergeCommand(ctx, repo_model.MergeStyleSquash, cmd); err != nil {
+	cmdMerge := git.NewCommand(ctx, "merge", "--squash").AddDynamicArguments(trackingBranch)
+	if err := runMergeCommand(ctx, repo_model.MergeStyleSquash, cmdMerge); err != nil {
 		log.Error("%-v Unable to merge --squash tracking into base: %v", ctx.pr, err)
 		return err
 	}
@@ -25,27 +25,21 @@ func doMergeStyleSquash(ctx *mergeContext, message string) error {
 		return fmt.Errorf("LoadPoster: %w", err)
 	}
 	sig := ctx.pr.Issue.Poster.NewGitSig()
-	if len(ctx.signArg) == 0 {
-		if err := git.NewCommand(ctx, "commit").
-			AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
-			AddOptionFormat("--message=%s", message).
-			Run(ctx.RunOpts()); err != nil {
-			log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
-			return fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", ctx.pr.HeadRepo.FullName(), ctx.pr.HeadBranch, ctx.pr.BaseRepo.FullName(), ctx.pr.BaseBranch, err, ctx.outbuf.String(), ctx.errbuf.String())
-		}
+	if setting.Repository.PullRequest.AddCoCommitterTrailers && ctx.committer.String() != sig.String() {
+		// add trailer
+		message += fmt.Sprintf("\nCo-authored-by: %s\nCo-committed-by: %s\n", sig.String(), sig.String())
+	}
+	cmdCommit := git.NewCommand(ctx, "commit").
+		AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
+		AddOptionFormat("--message=%s", message)
+	if ctx.signKeyID == "" {
+		cmdCommit.AddArguments("--no-gpg-sign")
 	} else {
-		if setting.Repository.PullRequest.AddCoCommitterTrailers && ctx.committer.String() != sig.String() {
-			// add trailer
-			message += fmt.Sprintf("\nCo-authored-by: %s\nCo-committed-by: %s\n", sig.String(), sig.String())
-		}
-		if err := git.NewCommand(ctx, "commit").
-			AddArguments(ctx.signArg...).
-			AddOptionFormat("--author='%s <%s>'", sig.Name, sig.Email).
-			AddOptionFormat("--message=%s", message).
-			Run(ctx.RunOpts()); err != nil {
-			log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
-			return fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", ctx.pr.HeadRepo.FullName(), ctx.pr.HeadBranch, ctx.pr.BaseRepo.FullName(), ctx.pr.BaseBranch, err, ctx.outbuf.String(), ctx.errbuf.String())
-		}
+		cmdCommit.AddOptionFormat("-S%s", ctx.signKeyID)
+	}
+	if err := cmdCommit.Run(ctx.RunOpts()); err != nil {
+		log.Error("git commit %-v: %v\n%s\n%s", ctx.pr, err, ctx.outbuf.String(), ctx.errbuf.String())
+		return fmt.Errorf("git commit [%s:%s -> %s:%s]: %w\n%s\n%s", ctx.pr.HeadRepo.FullName(), ctx.pr.HeadBranch, ctx.pr.BaseRepo.FullName(), ctx.pr.BaseBranch, err, ctx.outbuf.String(), ctx.errbuf.String())
 	}
 	ctx.outbuf.Reset()
 	ctx.errbuf.Reset()

From 689770c928ed46725e72ddaa2e988c52e44c2975 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Fri, 10 Mar 2023 01:59:50 +0900
Subject: [PATCH 29/53] Fix incorrect NotFound conditions in org/projects.go
 (#23384)

A part of https://github.com/go-gitea/gitea/pull/22865

user/org project's `RepoID` is always 0, we need to check `OwnerID`
---
 routers/web/org/projects.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index 7b5eef32d83e8..17919b7c4d8fe 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -193,7 +193,7 @@ func DeleteProject(ctx *context.Context) {
 		}
 		return
 	}
-	if p.RepoID != ctx.Repo.Repository.ID {
+	if p.OwnerID != ctx.ContextUser.ID {
 		ctx.NotFound("", nil)
 		return
 	}
@@ -226,7 +226,7 @@ func EditProject(ctx *context.Context) {
 		}
 		return
 	}
-	if p.RepoID != ctx.Repo.Repository.ID {
+	if p.OwnerID != ctx.ContextUser.ID {
 		ctx.NotFound("", nil)
 		return
 	}
@@ -261,7 +261,7 @@ func EditProjectPost(ctx *context.Context) {
 		}
 		return
 	}
-	if p.RepoID != ctx.Repo.Repository.ID {
+	if p.OwnerID != ctx.ContextUser.ID {
 		ctx.NotFound("", nil)
 		return
 	}

From 8bdc0acf97f2fce504bf43ee3843be3c638dfd2f Mon Sep 17 00:00:00 2001
From: Brecht Van Lommel <brecht@blender.org>
Date: Thu, 9 Mar 2023 19:14:22 +0100
Subject: [PATCH 30/53] Fix pull request update showing too many commits with
 multiple branches (#22856)

When the base repository contains multiple branches with the same
commits as the base branch, pull requests can show a long list of
commits already in the base branch as having been added.

What this is supposed to do is exclude commits already in the base
branch. But the mechansim to do so assumed a commit only exists in a
single branch. Now use `git rev-list A B --not branchName` instead of
filtering commits afterwards.

The logic to detect if there was a force push also was wrong for
multiple branches. If the old commit existed in any branch in the base
repository it would assume there was no force push. Instead check if the
old commit is an ancestor of the new commit.
---
 modules/git/commit.go       | 13 ++++++
 modules/git/repo_commit.go  | 21 +++++++++
 modules/repository/push.go  | 18 --------
 services/pull/comment.go    | 90 +++++--------------------------------
 services/repository/push.go |  6 +--
 5 files changed, 49 insertions(+), 99 deletions(-)

diff --git a/modules/git/commit.go b/modules/git/commit.go
index 4a55645d30346..6e8fcb3e0802e 100644
--- a/modules/git/commit.go
+++ b/modules/git/commit.go
@@ -218,6 +218,19 @@ func (c *Commit) HasPreviousCommit(commitHash SHA1) (bool, error) {
 	return false, err
 }
 
+// IsForcePush returns true if a push from oldCommitHash to this is a force push
+func (c *Commit) IsForcePush(oldCommitID string) (bool, error) {
+	if oldCommitID == EmptySHA {
+		return false, nil
+	}
+	oldCommit, err := c.repo.GetCommit(oldCommitID)
+	if err != nil {
+		return false, err
+	}
+	hasPreviousCommit, err := c.HasPreviousCommit(oldCommit.ID)
+	return !hasPreviousCommit, err
+}
+
 // CommitsBeforeLimit returns num commits before current revision
 func (c *Commit) CommitsBeforeLimit(num int) ([]*Commit, error) {
 	return c.repo.getCommitsBeforeLimit(c.ID, num)
diff --git a/modules/git/repo_commit.go b/modules/git/repo_commit.go
index a62e0670fedca..0e1b00ce082e4 100644
--- a/modules/git/repo_commit.go
+++ b/modules/git/repo_commit.go
@@ -323,6 +323,27 @@ func (repo *Repository) CommitsBetweenLimit(last, before *Commit, limit, skip in
 	return repo.parsePrettyFormatLogToList(bytes.TrimSpace(stdout))
 }
 
+// CommitsBetweenNotBase returns a list that contains commits between [before, last), excluding commits in baseBranch.
+// If before is detached (removed by reset + push) it is not included.
+func (repo *Repository) CommitsBetweenNotBase(last, before *Commit, baseBranch string) ([]*Commit, error) {
+	var stdout []byte
+	var err error
+	if before == nil {
+		stdout, _, err = NewCommand(repo.Ctx, "rev-list").AddDynamicArguments(last.ID.String()).AddOptionValues("--not", baseBranch).RunStdBytes(&RunOpts{Dir: repo.Path})
+	} else {
+		stdout, _, err = NewCommand(repo.Ctx, "rev-list").AddDynamicArguments(before.ID.String()+".."+last.ID.String()).AddOptionValues("--not", baseBranch).RunStdBytes(&RunOpts{Dir: repo.Path})
+		if err != nil && strings.Contains(err.Error(), "no merge base") {
+			// future versions of git >= 2.28 are likely to return an error if before and last have become unrelated.
+			// previously it would return the results of git rev-list before last so let's try that...
+			stdout, _, err = NewCommand(repo.Ctx, "rev-list").AddDynamicArguments(before.ID.String(), last.ID.String()).AddOptionValues("--not", baseBranch).RunStdBytes(&RunOpts{Dir: repo.Path})
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	return repo.parsePrettyFormatLogToList(bytes.TrimSpace(stdout))
+}
+
 // CommitsBetweenIDs return commits between twoe commits
 func (repo *Repository) CommitsBetweenIDs(last, before string) ([]*Commit, error) {
 	lastCommit, err := repo.GetCommit(last)
diff --git a/modules/repository/push.go b/modules/repository/push.go
index 1fa711b359c34..aa1552351d515 100644
--- a/modules/repository/push.go
+++ b/modules/repository/push.go
@@ -4,10 +4,8 @@
 package repository
 
 import (
-	"context"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/git"
 )
 
@@ -96,19 +94,3 @@ func (opts *PushUpdateOptions) RefName() string {
 func (opts *PushUpdateOptions) RepoFullName() string {
 	return opts.RepoUserName + "/" + opts.RepoName
 }
-
-// IsForcePush detect if a push is a force push
-func IsForcePush(ctx context.Context, opts *PushUpdateOptions) (bool, error) {
-	if !opts.IsUpdateBranch() {
-		return false, nil
-	}
-
-	output, _, err := git.NewCommand(ctx, "rev-list", "--max-count=1").AddDynamicArguments(opts.OldCommitID, "^"+opts.NewCommitID).
-		RunStdString(&git.RunOpts{Dir: repo_model.RepoPath(opts.RepoUserName, opts.RepoName)})
-	if err != nil {
-		return false, err
-	} else if len(output) > 0 {
-		return true, nil
-	}
-	return false, nil
-}
diff --git a/services/pull/comment.go b/services/pull/comment.go
index 068aca6cd128b..933ad09a85e9a 100644
--- a/services/pull/comment.go
+++ b/services/pull/comment.go
@@ -14,58 +14,6 @@ import (
 	issue_service "code.gitea.io/gitea/services/issue"
 )
 
-type commitBranchCheckItem struct {
-	Commit  *git.Commit
-	Checked bool
-}
-
-func commitBranchCheck(gitRepo *git.Repository, startCommit *git.Commit, endCommitID, baseBranch string, commitList map[string]*commitBranchCheckItem) error {
-	if startCommit.ID.String() == endCommitID {
-		return nil
-	}
-
-	checkStack := make([]string, 0, 10)
-	checkStack = append(checkStack, startCommit.ID.String())
-
-	for len(checkStack) > 0 {
-		commitID := checkStack[0]
-		checkStack = checkStack[1:]
-
-		item, ok := commitList[commitID]
-		if !ok {
-			continue
-		}
-
-		if item.Commit.ID.String() == endCommitID {
-			continue
-		}
-
-		if err := item.Commit.LoadBranchName(); err != nil {
-			return err
-		}
-
-		if item.Commit.Branch == baseBranch {
-			continue
-		}
-
-		if item.Checked {
-			continue
-		}
-
-		item.Checked = true
-
-		parentNum := item.Commit.ParentCount()
-		for i := 0; i < parentNum; i++ {
-			parentCommit, err := item.Commit.Parent(i)
-			if err != nil {
-				return err
-			}
-			checkStack = append(checkStack, parentCommit.ID.String())
-		}
-	}
-	return nil
-}
-
 // getCommitIDsFromRepo get commit IDs from repo in between oldCommitID and newCommitID
 // isForcePush will be true if oldCommit isn't on the branch
 // Commit on baseBranch will skip
@@ -82,47 +30,33 @@ func getCommitIDsFromRepo(ctx context.Context, repo *repo_model.Repository, oldC
 		return nil, false, err
 	}
 
-	if err = oldCommit.LoadBranchName(); err != nil {
-		return nil, false, err
-	}
-
-	if len(oldCommit.Branch) == 0 {
-		commitIDs = make([]string, 2)
-		commitIDs[0] = oldCommitID
-		commitIDs[1] = newCommitID
-
-		return commitIDs, true, err
-	}
-
 	newCommit, err := gitRepo.GetCommit(newCommitID)
 	if err != nil {
 		return nil, false, err
 	}
 
-	commits, err := newCommit.CommitsBeforeUntil(oldCommitID)
+	isForcePush, err = newCommit.IsForcePush(oldCommitID)
 	if err != nil {
 		return nil, false, err
 	}
 
-	commitIDs = make([]string, 0, len(commits))
-	commitChecks := make(map[string]*commitBranchCheckItem)
+	if isForcePush {
+		commitIDs = make([]string, 2)
+		commitIDs[0] = oldCommitID
+		commitIDs[1] = newCommitID
 
-	for _, commit := range commits {
-		commitChecks[commit.ID.String()] = &commitBranchCheckItem{
-			Commit:  commit,
-			Checked: false,
-		}
+		return commitIDs, isForcePush, err
 	}
 
-	if err = commitBranchCheck(gitRepo, newCommit, oldCommitID, baseBranch, commitChecks); err != nil {
-		return
+	// Find commits between new and old commit exclusing base branch commits
+	commits, err := gitRepo.CommitsBetweenNotBase(newCommit, oldCommit, baseBranch)
+	if err != nil {
+		return nil, false, err
 	}
 
+	commitIDs = make([]string, 0, len(commits))
 	for i := len(commits) - 1; i >= 0; i-- {
-		commitID := commits[i].ID.String()
-		if item, ok := commitChecks[commitID]; ok && item.Checked {
-			commitIDs = append(commitIDs, commitID)
-		}
+		commitIDs = append(commitIDs, commits[i].ID.String())
 	}
 
 	return commitIDs, isForcePush, err
diff --git a/services/repository/push.go b/services/repository/push.go
index cdf030396fcf6..4b574e3440679 100644
--- a/services/repository/push.go
+++ b/services/repository/push.go
@@ -206,12 +206,12 @@ func pushUpdates(optsList []*repo_module.PushUpdateOptions) error {
 						return fmt.Errorf("newCommit.CommitsBeforeUntil: %w", err)
 					}
 
-					isForce, err := repo_module.IsForcePush(ctx, opts)
+					isForcePush, err := newCommit.IsForcePush(opts.OldCommitID)
 					if err != nil {
-						log.Error("isForcePush %s:%s failed: %v", repo.FullName(), branch, err)
+						log.Error("IsForcePush %s:%s failed: %v", repo.FullName(), branch, err)
 					}
 
-					if isForce {
+					if isForcePush {
 						log.Trace("Push %s is a force push", opts.NewCommitID)
 
 						cache.Remove(repo.GetCommitsCountCacheKey(opts.RefName(), true))

From e6df743eca9f53a5f70c06c1b14e43a91c12403c Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Fri, 10 Mar 2023 04:57:20 +0900
Subject: [PATCH 31/53] Rename `canWriteUnit` to `canWriteProjects` (#23386)

A part of https://github.com/go-gitea/gitea/pull/22865
---
 routers/web/org/projects.go | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index 17919b7c4d8fe..64ae4aa70952d 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -103,7 +103,7 @@ func Projects(ctx *context.Context) {
 	pager.AddParam(ctx, "state", "State")
 	ctx.Data["Page"] = pager
 
-	ctx.Data["CanWriteProjects"] = canWriteUnit(ctx)
+	ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
 	ctx.Data["IsShowClosed"] = isShowClosed
 	ctx.Data["PageIsViewProjects"] = true
 	ctx.Data["SortType"] = sortType
@@ -111,7 +111,7 @@ func Projects(ctx *context.Context) {
 	ctx.HTML(http.StatusOK, tplProjects)
 }
 
-func canWriteUnit(ctx *context.Context) bool {
+func canWriteProjects(ctx *context.Context) bool {
 	if ctx.ContextUser.IsOrganization() {
 		return ctx.Org.CanWriteUnit(ctx, unit.TypeProjects)
 	}
@@ -122,7 +122,7 @@ func canWriteUnit(ctx *context.Context) bool {
 func NewProject(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.projects.new")
 	ctx.Data["BoardTypes"] = project_model.GetBoardConfig()
-	ctx.Data["CanWriteProjects"] = canWriteUnit(ctx)
+	ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
 	ctx.Data["HomeLink"] = ctx.ContextUser.HomeLink()
 	shared_user.RenderUserHeader(ctx)
 	ctx.HTML(http.StatusOK, tplProjectsNew)
@@ -135,7 +135,7 @@ func NewProjectPost(ctx *context.Context) {
 	shared_user.RenderUserHeader(ctx)
 
 	if ctx.HasError() {
-		ctx.Data["CanWriteProjects"] = canWriteUnit(ctx)
+		ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
 		ctx.Data["PageIsViewProjects"] = true
 		ctx.Data["BoardTypes"] = project_model.GetBoardConfig()
 		ctx.HTML(http.StatusOK, tplProjectsNew)
@@ -214,7 +214,7 @@ func EditProject(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.projects.edit")
 	ctx.Data["PageIsEditProjects"] = true
 	ctx.Data["PageIsViewProjects"] = true
-	ctx.Data["CanWriteProjects"] = canWriteUnit(ctx)
+	ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
 	shared_user.RenderUserHeader(ctx)
 
 	p, err := project_model.GetProjectByID(ctx, ctx.ParamsInt64(":id"))
@@ -244,7 +244,7 @@ func EditProjectPost(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.projects.edit")
 	ctx.Data["PageIsEditProjects"] = true
 	ctx.Data["PageIsViewProjects"] = true
-	ctx.Data["CanWriteProjects"] = canWriteUnit(ctx)
+	ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
 	shared_user.RenderUserHeader(ctx)
 
 	if ctx.HasError() {
@@ -337,7 +337,7 @@ func ViewProject(ctx *context.Context) {
 	project.RenderedContent = project.Description
 	ctx.Data["LinkedPRs"] = linkedPrsMap
 	ctx.Data["PageIsViewProjects"] = true
-	ctx.Data["CanWriteProjects"] = canWriteUnit(ctx)
+	ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
 	ctx.Data["Project"] = project
 	ctx.Data["IssuesMap"] = issuesMap
 	ctx.Data["Boards"] = boards

From 79af6e367c447f8d9f2559f7fde8b5cc3bed4ec4 Mon Sep 17 00:00:00 2001
From: Lycolia Rizzim <33796432+Lycolia@users.noreply.github.com>
Date: Fri, 10 Mar 2023 07:54:37 +0900
Subject: [PATCH 32/53] Add init file for Ubuntu (#23362)

Created an init file for Ubuntu that will be useful when running it on
WSL.
---
 contrib/init/ubuntu/gitea | 84 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 contrib/init/ubuntu/gitea

diff --git a/contrib/init/ubuntu/gitea b/contrib/init/ubuntu/gitea
new file mode 100644
index 0000000000000..da56b6e4a9750
--- /dev/null
+++ b/contrib/init/ubuntu/gitea
@@ -0,0 +1,84 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          gitea
+# Required-Start:    $syslog $network
+# Required-Stop:     $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: A self-hosted Git service written in Go.
+# Description:       A self-hosted Git service written in Go.
+### END INIT INFO
+
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin
+DESC="Gitea - Git with a cup of tea"
+NAME=gitea
+SERVICEVERBOSE=yes
+PIDFILE=/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+WORKINGDIR=/var/lib/$NAME
+DAEMON=/usr/local/bin/$NAME
+DAEMON_ARGS="web -c /etc/$NAME/app.ini"
+USER=git
+STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/1/KILL/5}"
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+do_start()
+{
+    GITEA_ENVS="USER=$USER GITEA_WORK_DIR=$WORKINGDIR HOME=/home/$USER"
+    GITEA_EXEC="$DAEMON -- $DAEMON_ARGS"
+    sh -c "start-stop-daemon --start --quiet --pidfile $PIDFILE --make-pidfile \\
+        --background --chdir $WORKINGDIR --chuid $USER \\
+        --exec /bin/bash -- -c '/usr/bin/env $GITEA_ENVS $GITEA_EXEC'"
+}
+
+do_stop()
+{
+    start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PIDFILE --name $NAME --oknodo
+    rm -f $PIDFILE
+}
+
+do_status()
+{
+    if [ -f $PIDFILE ]; then
+        if kill -0 $(cat "$PIDFILE"); then
+            echo "$NAME is running, PID is $(cat $PIDFILE)"
+        else
+            echo "$NAME process is dead, but pidfile exists"
+        fi
+    else
+        echo "$NAME is not running"
+    fi
+}
+
+case "$1" in
+    start)
+        echo "Starting $DESC" "$NAME"
+        do_start
+        ;;
+    stop)
+        echo "Stopping $DESC" "$NAME"
+        do_stop
+        ;;
+    status)
+        do_status
+        ;;
+    restart)
+        echo "Restarting $DESC" "$NAME"
+        do_stop
+        do_start
+        ;;
+    *)
+        echo "Usage: $SCRIPTNAME {start|stop|status|restart}" >&2
+        exit 2
+        ;;
+esac
+
+exit 0

From c775053476295c876791889030fb734dca5c0783 Mon Sep 17 00:00:00 2001
From: GiteaBot <teabot@gitea.io>
Date: Fri, 10 Mar 2023 00:15:59 +0000
Subject: [PATCH 33/53] [skip ci] Updated translations via Crowdin

---
 options/locale/locale_cs-CZ.ini | 150 ++++++++++++++++++++++++++++++++
 options/locale/locale_zh-TW.ini |  97 ++++++++++++++++++---
 2 files changed, 236 insertions(+), 11 deletions(-)

diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 3c8d1a79fd8ce..7a42eec181825 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -57,6 +57,7 @@ new_mirror=Nové zrcadlo
 new_fork=Nové rozštěpení repozitáře
 new_org=Nová organizace
 new_project=Nový projekt
+new_project_column=Nový sloupec
 manage_org=Spravovat organizace
 admin_panel=Administrace
 account_settings=Nastavení účtu
@@ -90,9 +91,11 @@ disabled=Zakázané
 
 copy=Kopírovat
 copy_url=Kopírovat URL
+copy_content=Kopírovat obsah
 copy_branch=Kopírovat jméno větve
 copy_success=Zkopírováno!
 copy_error=Kopírování se nezdařilo
+copy_type_unsupported=Tento typ souboru nelze zkopírovat
 
 write=Zapsat
 preview=Náhled
@@ -109,6 +112,10 @@ never=Nikdy
 rss_feed=RSS kanál
 
 [aria]
+navbar=Navigační lišta
+footer=Patička
+footer.software=O softwaru
+footer.links=Odkazy
 
 [filter]
 string.asc=A – Z
@@ -292,23 +299,71 @@ code_search_results=Výsledky hledání pro „%s“
 code_last_indexed_at=Naposledy indexováno %s
 relevant_repositories_tooltip=Repozitáře, které jsou rozštěpení nebo nemají žádné téma, ikonu a žádný popis jsou skryty.
 relevant_repositories=`Zobrazují se pouze relevantní repositáře, <a href="`
+internal_token_failed=Nepodařilo se vytvořit interní token: %v
+secret_key_failed=Nepodařilo se vytvořit tajný klíč: %v
+save_config_failed=Uložení konfigurace se nezdařilo: %v
+invalid_admin_setting=Nastavení účtu správce není správné: %v
+invalid_log_root_path=Kořenový adresář logů není správný: %v
 default_keep_email_private=Jako počáteční nastavení skrýt e-mailové adresy
+default_keep_email_private_popup=Nastaví e-mailové adresy novým uživatelským účtům jako skryté.
 default_allow_create_organization=Dovolí novým uživatelům zakládat organizace
+default_allow_create_organization_popup=Povolit novým uživatelským účtům vytvářet organizace.
 default_enable_timetracking=Povolit sledování času ve výchozím nastavení
+default_enable_timetracking_popup=Povolí sledování času pro nové repozitáře.
 no_reply_address=Skrytá e-mailová doména
+no_reply_address_helper=Název domény pro uživatele se skrytou e-mailovou adresou. Příklad: Pokud je název skryté e-mailové domény nastaven na „noreply.example.org“, uživatelské jméno „joe“ bude zaznamenáno v Gitu jako „joe@noreply.example.org“.
+password_algorithm=Hash algoritmus hesla
+password_algorithm_helper=Nastavte algoritmus hashování hesla. Algoritmy mají odlišné požadavky a sílu. `argon2` používá mnoho paměti a může být nevhodný pro malé systémy.
+enable_update_checker=Povolit kontrolu aktualizací
+enable_update_checker_helper=Kontroluje vydání nových verzí pravidelně připojením ke gitea.io.
 
 [home]
+uname_holder=Uživatelské jméno nebo e-mailová adresa
 password_holder=Heslo
+switch_dashboard_context=Přepnout kontext přehledu
 my_repos=Repozitáře
+show_more_repos=Zobrazit více repozitářů…
+collaborative_repos=Společné repozitáře
+my_orgs=Mé organizace
+my_mirrors=Má zrcadla
+view_home=Zobrazit %s
+search_repos=Nalézt repozitář…
+filter=Ostatní filtry
+filter_by_team_repositories=Filtrovat podle repozitářů týmu
+feed_of=Kanál z „%s“
 
+show_archived=Archivováno
+show_both_archived_unarchived=Zobrazeny jak archivované tak nearchivované
+show_only_archived=Zobrazeny pouze archivované
+show_only_unarchived=Zobrazeny pouze nearchivované
 
 show_private=Soukromý
+show_both_private_public=Zobrazeny jak veřejné tak soukromé
+show_only_private=Zobrazeny pouze soukromé
+show_only_public=Zobrazeny pouze veřejné
 
+issues.in_your_repos=Ve vašich repozitářích
 
 [explore]
 repos=Repozitáře
+users=Uživatelé
 organizations=Organizace
+search=Vyhledat
 code=Kód
+search.type.tooltip=Druh vyhledávání
+search.fuzzy=Fuzzy
+search.fuzzy.tooltip=Zahrnout výsledky, které také úzce odpovídají hledanému výrazu
+search.match=Shoda
+search.match.tooltip=Zahrnout pouze výsledky, které odpovídají přesnému hledanému výrazu
+code_search_unavailable=V současné době není vyhledávání kódu dostupné. Obraťte se na správce webu.
+repo_no_results=Nebyly nalezeny žádné odpovídající repozitáře.
+user_no_results=Nebyly nalezeni žádní odpovídající uživatelé.
+org_no_results=Nebyly nalezeny žádné odpovídající organizace.
+code_no_results=Nebyl nalezen žádný zdrojový kód odpovídající hledanému výrazu.
+code_search_results=Výsledky hledání pro „%s“
+code_last_indexed_at=Naposledy indexováno %s
+relevant_repositories_tooltip=Repozitáře, které jsou rozštěpení nebo nemají žádné téma, ikonu a žádný popis jsou skryty.
+relevant_repositories=Zobrazují se pouze relevantní repositáře, <a href="%s">zobrazit nefiltrované výsledky</a>.
 
 
 [auth]
@@ -338,6 +393,7 @@ email_not_associate=Tato e-mailová adresa není spojena s žádným účtem.
 send_reset_mail=Zaslat e-mail pro obnovení účtu
 reset_password=Obnovení účtu
 invalid_code=Tento potvrzující kód je neplatný nebo mu vypršela platnost.
+invalid_password=Vaše heslo se neshoduje s heslem, které bylo použito k vytvoření účtu.
 reset_password_helper=Obnovit účet
 reset_password_wrong_user=Jste přihlášen/a jako %s, ale odkaz pro obnovení účtu je pro %s
 password_too_short=Délka hesla musí být minimálně %d znaků.
@@ -381,6 +437,7 @@ password_pwned_err=Nelze dokončit požadavek na HaveIBeenPwned
 
 [mail]
 view_it_on=Zobrazit na %s
+reply=nebo přímo odpovědět na tento e-mail
 link_not_working_do_paste=Nefunguje? Zkuste jej zkopírovat a vložit do svého prohlížeče.
 hi_user_x=Ahoj <b>%s</b>,
 
@@ -484,6 +541,7 @@ url_error=`„%s“ není platná adresa URL.`
 include_error=` musí obsahovat řetězec „%s“.`
 glob_pattern_error=`zástupný vzor je neplatný: %s.`
 regex_pattern_error=` regex vzor je neplatný: %s.`
+invalid_group_team_map_error=` mapování je neplatné: %s`
 unknown_error=Neznámá chyba:
 captcha_incorrect=CAPTCHA kód není správný.
 password_not_match=Zadaná hesla nesouhlasí.
@@ -520,10 +578,12 @@ team_not_exist=Tento tým neexistuje.
 last_org_owner=Nemůžete odstranit posledního uživatele z týmu „vlastníci“. Musí existovat alespoň jeden vlastník pro organizaci.
 cannot_add_org_to_team=Organizace nemůže být přidána jako člen týmu.
 duplicate_invite_to_team=Uživatel byl již pozván jako člen týmu.
+organization_leave_success=Úspěšně jste opustili organizaci %s.
 
 invalid_ssh_key=Nelze ověřit váš SSH klíč: %s
 invalid_gpg_key=Nelze ověřit váš GPG klíč: %s
 invalid_ssh_principal=Neplatný SSH Principal certifikát: %s
+must_use_public_key=Zadaný klíč je soukromý klíč. Nenahrávejte svůj soukromý klíč nikde. Místo toho použijte váš veřejný klíč.
 unable_verify_ssh_key=Nelze ověřit váš SSH klíč
 auth_failed=Ověření selhalo: %v
 
@@ -1185,6 +1245,7 @@ commits.signed_by_untrusted_user_unmatched=Podepsáno nedůvěryhodným uživate
 commits.gpg_key_id=ID GPG klíče
 commits.ssh_key_fingerprint=Otisk klíče SSH
 
+commit.operations=Operace
 commit.revert=Vrátit
 commit.revert-header=Vrátit: %s
 commit.revert-content=Vyberte větev pro návrat na:
@@ -1217,11 +1278,21 @@ projects.type.bug_triage=Třídění chyb
 projects.template.desc=Šablona projektu
 projects.template.desc_helper=Vyberte šablonu projektu pro začátek
 projects.type.uncategorized=Nezařazené
+projects.column.edit=Upravit sloupec
 projects.column.edit_title=Název
 projects.column.new_title=Název
+projects.column.new_submit=Vytvořit sloupec
+projects.column.new=Nový sloupec
+projects.column.set_default=Nastavit jako výchozí
+projects.column.set_default_desc=Nastavit tento sloupec jako výchozí pro nekategorizované úkoly a požadavky na natažení
+projects.column.delete=Smazat sloupec
+projects.column.deletion_desc=Smazání projektového sloupce přesune všechny související problémy do kategorie „Nezařazené“. Pokračovat?
 projects.column.color=Barva
 projects.open=Otevřít
 projects.close=Zavřít
+projects.column.assigned_to=Přiřazeno k
+projects.card_type.images_and_text=Obrázky a text
+projects.card_type.text_only=Pouze text
 
 issues.desc=Organizování hlášení chyb, úkolů a milníků.
 issues.filter_assignees=Filtrovat zpracovatele
@@ -1298,6 +1369,7 @@ issues.filter_label_no_select=Všechny štítky
 issues.filter_milestone=Milník
 issues.filter_milestone_no_select=Všechny milníky
 issues.filter_project=Projekt
+issues.filter_project_all=Všechny projekty
 issues.filter_project_none=Žádný projekt
 issues.filter_assignee=Zpracovatel
 issues.filter_assginee_no_select=Všichni zpracovatelé
@@ -1383,6 +1455,7 @@ issues.save=Uložit
 issues.label_title=Název štítku
 issues.label_description=Popis štítku
 issues.label_color=Barva štítku
+issues.label_exclusive=Exkluzivní
 issues.label_count=%d štítků
 issues.label_open_issues=%d otevřených úkolů
 issues.label_edit=Upravit
@@ -1828,6 +1901,7 @@ settings.mirror_sync_in_progress=Právě probíhá synchronizace zrcadla. Zkuste
 settings.site=Webová stránka
 settings.update_settings=Aktualizovat nastavení
 settings.branches.update_default_branch=Aktualizovat výchozí větev
+settings.branches.add_new_rule=Přidat nové pravidlo
 settings.advanced_settings=Pokročilá nastavení
 settings.wiki_desc=Povolit Wiki repozitáře
 settings.use_internal_wiki=Používat vestavěnou Wiki
@@ -2022,6 +2096,8 @@ settings.event_package=Balíček
 settings.event_package_desc=Balíček vytvořen nebo odstraněn v repozitáři.
 settings.branch_filter=Filtr větví
 settings.branch_filter_desc=Povolené větve pro události nahrání, vytvoření větve a smazání větve jsou určeny pomocí zástupného vzoru. Pokud je prázdný nebo <code>*</code>, všechny události jsou ohlášeny. Podívejte se na dokumentaci syntaxe na <a href="https://pkg.go.dev/github.com/gobwas/glob#Compile">github.com/gobwas/glob</a>. Příklady: <code>master</code>, <code>{master,release*}</code>.
+settings.authorization_header=Autorizační hlavička
+settings.authorization_header_desc=Pokud vyplněno, bude připojeno k požadavkům jako autorizační hlavička. Příklady: %s.
 settings.active=Aktivní
 settings.active_helper=Informace o spuštěných událostech budou odeslány na URL webového háčku.
 settings.add_hook_success=Webový háček byl přidán.
@@ -2066,6 +2142,8 @@ settings.deploy_key_deletion_desc=Odstranění klíče pro nasazení zruší jeh
 settings.deploy_key_deletion_success=Klíč pro nasazení byl odstraněn.
 settings.branches=Větve
 settings.protected_branch=Ochrana větví
+settings.protected_branch.save_rule=Uložit pravidlo
+settings.protected_branch.delete_rule=Odstranit pravidlo
 settings.protected_branch_can_push=Povolit nahrání?
 settings.protected_branch_can_push_yes=Můžete nahrávat
 settings.protected_branch_can_push_no=Nemůžete nahrávat
@@ -2543,6 +2621,9 @@ dashboard.delete_old_actions=Odstranit všechny staré akce z databáze
 dashboard.delete_old_actions.started=Začalo odstraňování všech starých akcí z databáze.
 dashboard.update_checker=Kontrola aktualizací
 dashboard.delete_old_system_notices=Odstranit všechna stará systémová upozornění z databáze
+dashboard.stop_zombie_tasks=Zastavit zombie úkoly
+dashboard.stop_endless_tasks=Zastavit nekonečné úkoly
+dashboard.cancel_abandoned_jobs=Zrušit opuštěné úlohy
 
 users.user_manage_panel=Správa uživatelských účtů
 users.new_account=Vytvořit uživatelský účet
@@ -2724,6 +2805,7 @@ auths.oauth2_required_claim_value_helper=Nastavte tuto hodnotu pro omezení při
 auths.oauth2_group_claim_name=Název tvrzení poskytující názvy skupin pro tento zdroj. (nepovinné)
 auths.oauth2_admin_group=Hodnota tvrzení pro skupinu uživatelů administrátorů. (Volitelné - vyžaduje název tvrzení výše)
 auths.oauth2_restricted_group=Hodnota tvrzení pro skupinu omezených uživatelů. (Volitelné - vyžaduje název tvrzení výše)
+auths.oauth2_map_group_to_team_removal=Odebrat uživatele z synchronizovaných týmů, pokud uživatel nepatří do odpovídající skupiny.
 auths.enable_auto_register=Povolit zaregistrování se
 auths.sspi_auto_create_users=Automaticky vytvářet uživatele
 auths.sspi_auto_create_users_helper=Povolit SSPI autentizační metodě automaticky vytvářet nové účty pro uživatele, kteří se poprvé přihlásili
@@ -2986,6 +3068,7 @@ monitor.queue.pool.cancel_desc=Opustit frontu bez skupin workerů může způsob
 
 notices.system_notice_list=Systémová oznámení
 notices.view_detail_header=Zobrazit detaily oznámení
+notices.operations=Operace
 notices.select_all=Vybrat vše
 notices.deselect_all=Zrušit výběr všech
 notices.inverse_selection=Inverzní výběr
@@ -3011,6 +3094,7 @@ reopen_pull_request=`znovuotevřel/a požadavek na natažení <a href="%[1]s">%[
 comment_issue=`okomentoval/a problém <a href="%[1]s">%[3]s#%[2]s</a>`
 comment_pull=`okomentoval/a požadavek na natažení <a href="%[1]s">%[3]s#%[2]s</a>`
 merge_pull_request=`sloučil/a požadavek na natažení <a href="%[1]s">%[3]s#%[2]s</a>`
+auto_merge_pull_request=`automaticky sloučen požadavek na natažení <a href="%[1]s">%[3]s#%[2]s</a>`
 transfer_repo=předal/a repozitář <code>%s</code> uživateli/organizaci <a href="%s">%s</a>
 push_tag=nahrál/a značku <a href="%[2]s">%[3]s</a> do <a href="%[1]s">%[4]s</a>
 delete_tag=smazal/a značku %[2]s z <a href="%[1]s">%[3]s</a>
@@ -3109,6 +3193,8 @@ keywords=Klíčová slova
 details=Podrobnosti
 details.author=Autor
 details.project_site=Stránka projektu
+details.repository_site=Stránka repositáře
+details.documentation_site=Stránka dokumentace
 details.license=Licence
 assets=Prostředky
 versions=Verze
@@ -3116,7 +3202,13 @@ versions.on=
 versions.view_all=Zobrazit všechny
 dependency.id=ID
 dependency.version=Verze
+cargo.install=Chcete-li nainstalovat balíček pomocí Cargo, spusťte následující příkaz:
+cargo.documentation=Další informace o registru Cargo naleznete v <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/cargo/">dokumentaci</a>.
+cargo.details.repository_site=Stránka repositáře
+cargo.details.documentation_site=Stránka dokumentace
+chef.registry=Nastavit tento registr v souboru <code>~/.chef/config.rb</code>:
 chef.install=Pro instalaci balíčku spusťte následující příkaz:
+chef.documentation=Další informace o registru Chef naleznete v <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/chef/">dokumentaci</a>.
 composer.registry=Nastavit tento registr v souboru <code>~/.composer/config.json</code>:
 composer.install=Pro instalaci balíčku pomocí Compposer spusťte následující příkaz:
 composer.documentation=Další informace o registru Composer naleznete v <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/composer/">dokumentaci</a>.
@@ -3126,6 +3218,11 @@ conan.details.repository=Repozitář
 conan.registry=Nastavte tento registr z příkazového řádku:
 conan.install=Pro instalaci balíčku pomocí Conan spusťte následující příkaz:
 conan.documentation=Další informace o registru Conan naleznete v <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/conan/">dokumentaci</a>.
+conda.registry=Nastavte tento registr jako Conda repozitář ve vašem <code>.condarc</code>:
+conda.install=Pro instalaci balíčku pomocí Conda spusťte následující příkaz:
+conda.documentation=Další informace o registru Conda naleznete v <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/conda/">dokumentaci</a>.
+conda.details.repository_site=Stránka repositáře
+conda.details.documentation_site=Stránka dokumentace
 container.details.type=Typ obrazu
 container.details.platform=Platforma
 container.pull=Stáhněte obraz z příkazové řádky:
@@ -3184,26 +3281,79 @@ settings.delete.description=Smazání balíčku je trvalé a nelze ho vrátit zp
 settings.delete.notice=Chystáte se odstranit %s (%s). Tato operace je nevratná, jste si jisti?
 settings.delete.success=Balíček byl odstraněn.
 settings.delete.error=Nepodařilo se odstranit balíček.
+owner.settings.cargo.initialize=Inicializovat index
+owner.settings.cargo.initialize.description=K použití registru Cargo je zapotřebí speciální indexový repozitář git. Zde jej můžete (znovu) vytvořit s požadovanou konfigurací.
+owner.settings.cargo.initialize.error=Nepodařilo se inicializovat Cargo index: %v
+owner.settings.cargo.initialize.success=Index Cargo byl úspěšně vytvořen.
+owner.settings.cargo.rebuild=Znovu vytvořit Index
+owner.settings.cargo.rebuild.description=Pokud index není synchronizován s uloženými balíčky Cargo, můžete jej zde obnovit.
+owner.settings.cargo.rebuild.error=Obnovení Cargo indexu se nezdařilo: %v
+owner.settings.cargo.rebuild.success=Cargo Index byl úspěšně obnoven.
+owner.settings.cleanuprules.title=Spravovat pravidla pro čištění
+owner.settings.cleanuprules.add=Přidat pravidlo pro čištění
+owner.settings.cleanuprules.edit=Upravit pravidlo pro čištění
+owner.settings.cleanuprules.none=Nejsou k dispozici žádná pravidla čištění. Přečtěte si dokumentaci a dozvíte se více.
+owner.settings.cleanuprules.preview=Náhled pravidla pro čištění
+owner.settings.cleanuprules.preview.overview=%d balíčků má být odstraněno.
+owner.settings.cleanuprules.preview.none=Pravidlo čištění neodpovídá žádným balíčkům.
 owner.settings.cleanuprules.enabled=Povolený
+owner.settings.cleanuprules.pattern_full_match=Použít vzor na úplný název balíčku
+owner.settings.cleanuprules.keep.title=Verze, které odpovídají těmto pravidlům, jsou zachovány, i když odpovídají níže uvedenému pravidlu pro odstranění.
+owner.settings.cleanuprules.keep.count=Zachovat nejnovější
+owner.settings.cleanuprules.keep.count.1=1 verze na balíček
+owner.settings.cleanuprules.keep.count.n=%d verzí na balíček
+owner.settings.cleanuprules.keep.pattern=Ponechat odpovídající verze
+owner.settings.cleanuprules.keep.pattern.container=U balíčků Container je vždy zachována <code>nejnovější</code> verze.
+owner.settings.cleanuprules.remove.title=Verze, které odpovídají těmto pravidlům, jsou odstraněny, pokud výše uvedené pravidlo neukládá jejich zachování.
+owner.settings.cleanuprules.remove.days=Odstranit verze starší než
+owner.settings.cleanuprules.remove.pattern=Odstranit odpovídající verze
+owner.settings.cleanuprules.success.update=Pravidlo pro čištění bylo aktualizováno.
+owner.settings.cleanuprules.success.delete=Pravidlo pro čištění bylo odstraněno.
+owner.settings.chef.keypair=Generovat pár klíčů
 
 [secrets]
+secrets=Tajné klíče
 value=Hodnota
 name=Název
 
 [actions]
+actions=Akce
 
+unit.desc=Spravovat akce
 
+status.unknown=Neznámý
+status.waiting=Čekání
+status.running=Probíhá
+status.success=Úspěch
+status.failure=Chyba
+status.cancelled=Zrušeno
+status.skipped=Přeskočeno
+status.blocked=Blokováno
 
+runners.status=Status
 runners.id=ID
 runners.name=Název
 runners.owner_type=Typ
 runners.description=Popis
 runners.labels=Štítky
+runners.last_online=Poslední čas online
+runners.agent_labels=Štítky agenta
+runners.custom_labels=Vlastní štítky
+runners.custom_labels_helper=Vlastní štítky jsou štítky, které správce přidává ručně. Štítky se oddělují čárkou, bílé znaky na začátku a na konci každého štítku se ignorují.
 runners.task_list.run=Spustit
+runners.task_list.status=Status
 runners.task_list.repository=Repozitář
 runners.task_list.commit=Commit
+runners.task_list.done_at=Dokončeno v
+runners.update_runner=Aktualizovat změny
+runners.status.unspecified=Neznámý
+runners.status.idle=Nečinný
 runners.status.active=Aktivní
+runners.status.offline=Offline
 
+runs.all_workflows=Všechny pracovní postupy
+runs.open_tab=%d otevřeno
+runs.closed_tab=%d uzavřeno
 runs.commit=Commit
 
 
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index 4f2e0ebb13c3e..51610f4e82d74 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -328,6 +328,7 @@ email_not_associate=此電子信箱未與任何帳戶連結
 send_reset_mail=發送帳戶救援信
 reset_password=帳戶救援
 invalid_code=您的確認代碼無效或已過期。
+invalid_password=您的密碼和用來建立帳戶的不符。
 reset_password_helper=帳戶救援
 reset_password_wrong_user=您已經使用 %s 的帳戶登入，但帳戶救援連結是給 %s 的
 password_too_short=密碼長度不能少於 %d 個字！
@@ -430,6 +431,10 @@ repo.transfer.body=請造訪 %s 以接受或拒絕轉移，您也可以忽略它
 repo.collaborator.added.subject=%s 把您加入到 %s
 repo.collaborator.added.text=您已被新增為儲存庫的協作者：
 
+team_invite.subject=%[1]s 邀請您加入組織 %[2]s
+team_invite.text_1=%[1]s 邀請您加入組織 %[3]s 中的 %[2]s 團隊
+team_invite.text_2=請點擊下方連結加入團隊:
+team_invite.text_3=備註: 這是寄給 %[1]s 的邀請。若您未預期收到此邀請，請忽略此郵件。
 
 [modal]
 yes=是
@@ -446,7 +451,7 @@ SSHTitle=SSH 金鑰名稱
 HttpsUrl=HTTPS URL 地址
 PayloadUrl=推送地址
 TeamName=團隊名稱
-AuthName=認證名稱
+AuthName=授權名稱
 AdminEmail=管理員電子信箱
 
 NewBranchName=新的分支名稱
@@ -506,11 +511,13 @@ user_not_exist=該用戶名不存在
 team_not_exist=團隊不存在
 last_org_owner=你不能從「Owners」團隊中刪除最後一個使用者。每個組織中至少要有一個擁有者。
 cannot_add_org_to_team=組織不能被新增為團隊成員。
+duplicate_invite_to_team=該使用者已經被邀請為團隊成員。
 organization_leave_success=您已成功離開組織 %s。
 
 invalid_ssh_key=無法驗證您的 SSH 密鑰：%s
 invalid_gpg_key=無法驗證您的 GPG 密鑰：%s
 invalid_ssh_principal=無效的主體: %s
+must_use_public_key=您提供的金鑰是私有金鑰，請勿上傳您的私有金鑰到任何地方，請使用您的公鑰。
 unable_verify_ssh_key=無法驗證 SSH 密鑰
 auth_failed=授權認證失敗：%v
 
@@ -747,6 +754,8 @@ access_token_deletion_cancel_action=取消
 access_token_deletion_confirm_action=刪除
 access_token_deletion_desc=刪除 Token 後，使用此 Token 的應用程式將無法再存取您的帳戶，此動作不可還原。是否繼續？
 delete_token_success=已刪除 Token。使用此 Token 的應用程式無法再存取您的帳戶。
+select_scopes=選擇範圍 (Scope)
+scopes_list=範圍 (Scope):
 
 manage_oauth2_applications=管理 OAuth2 應用程式
 edit_oauth2_application=編輯 OAuth2 應用程式
@@ -759,6 +768,7 @@ create_oauth2_application_button=建立應用程式
 create_oauth2_application_success=您已成功新增一個 OAuth2 應用程式。
 update_oauth2_application_success=您已成功更新了 OAuth2 應用程式。
 oauth2_application_name=應用程式名稱
+oauth2_confidential_client=機密客戶端 (Confidential Client)。請為能保持機密性的程式勾選，例如網頁應用程式。使用原生程式時不要勾選，包含桌面、行動應用程式。
 oauth2_redirect_uri=重新導向 URI
 save_application=儲存
 oauth2_client_id=客戶端 ID
@@ -1203,7 +1213,7 @@ projects.edit_success=已更新專案「%s」。
 projects.type.none=無
 projects.type.basic_kanban=基本看板
 projects.type.bug_triage=Bug 檢傷分類
-projects.template.desc=專案範本
+projects.template.desc=範本
 projects.template.desc_helper=選擇專案範本以開始
 projects.type.uncategorized=未分類
 projects.column.edit=編輯欄位
@@ -1215,7 +1225,7 @@ projects.column.set_default=設為預設
 projects.column.set_default_desc=將此欄位設定為未分類問題及合併請求的預設預設值
 projects.column.delete=刪除欄位
 projects.column.deletion_desc=刪除專案欄位會將所有相關的問題移動到「未分類」，是否繼續？
-projects.column.color=彩色
+projects.column.color=顏色
 projects.open=開啟
 projects.close=關閉
 projects.column.assigned_to=已指派給
@@ -1310,6 +1320,7 @@ issues.filter_type.assigned_to_you=指派給您的
 issues.filter_type.created_by_you=由您建立的
 issues.filter_type.mentioning_you=提及您的
 issues.filter_type.review_requested=已提出審核請求
+issues.filter_type.reviewed_by_you=由您審核
 issues.filter_sort=排序
 issues.filter_sort.latest=最新建立
 issues.filter_sort.oldest=最早建立
@@ -1383,11 +1394,14 @@ issues.sign_in_require_desc=<a href="%s"> 登入</a> 才能加入這對話。
 issues.edit=編輯
 issues.cancel=取消
 issues.save=儲存
-issues.label_title=標籤名稱
-issues.label_description=標籤描述
-issues.label_color=標籤顏色
+issues.label_title=名稱
+issues.label_description=描述
+issues.label_color=顏色
+issues.label_exclusive=互斥
+issues.label_exclusive_desc=請以此格式命名標籤: <code>scope/item</code>，使它和其他 <code>scope/</code> (相同範圍) 標籤互斥。
+issues.label_exclusive_warning=在編輯問題及合併請求的標籤時，將會刪除任何有相同範圍的標籤。
 issues.label_count=%d 個標籤
-issues.label_open_issues=%d 個開放中的問題
+issues.label_open_issues=%d 個開放中的問題/合併請求
 issues.label_edit=編輯
 issues.label_delete=刪除
 issues.label_modify=編輯標籤
@@ -1640,6 +1654,7 @@ pulls.reopened_at=`重新開放了這個合併請求 <a id="%[1]s" href="#%[1]s"
 pulls.merge_instruction_hint=`您也可以查看<a class="show-instruction">命令列指南</a>。`
 pulls.merge_instruction_step1_desc=在您的儲存庫中切換到新分支並測試變更。
 pulls.merge_instruction_step2_desc=合併變更並更新到 Gitea。
+pulls.clear_merge_message=清除合併訊息
 
 pulls.auto_merge_button_when_succeed=(當通過檢查後)
 pulls.auto_merge_when_succeed=通過所有檢查後自動合併
@@ -2423,7 +2438,7 @@ teams.leave.detail=確定要離開 %s 嗎？
 teams.can_create_org_repo=建立儲存庫
 teams.can_create_org_repo_helper=成員可以在組織中新增儲存庫。建立者將自動取得新儲存庫的管理員權限。
 teams.none_access=沒有權限
-teams.none_access_helper=成員無法檢視此單元或對其執行其他動作。
+teams.none_access_helper=成員無法檢視此單元或對其執行其他動作，這對公開儲存庫沒有影響。
 teams.general_access=一般權限
 teams.general_access_helper=成員權限將由下列權限表決定。
 teams.read_access=讀取
@@ -2561,6 +2576,10 @@ dashboard.delete_old_actions=從資料庫刪除所有舊行為
 dashboard.delete_old_actions.started=從資料庫刪除所有舊行為的任務已啟動。
 dashboard.update_checker=更新檢查器
 dashboard.delete_old_system_notices=從資料庫刪除所有舊系統提示
+dashboard.gc_lfs=對 LFS meta objects 進行垃圾回收
+dashboard.stop_zombie_tasks=停止殭屍任務
+dashboard.stop_endless_tasks=停止永不停止的任務
+dashboard.cancel_abandoned_jobs=取消已放棄的工作
 
 users.user_manage_panel=使用者帳戶管理
 users.new_account=建立使用者帳戶
@@ -2649,6 +2668,7 @@ repos.size=大小
 
 packages.package_manage_panel=套件管理
 packages.total_size=總大小: %s
+packages.unreferenced_size=未參考大小: %s
 packages.owner=擁有者
 packages.creator=建立者
 packages.name=名稱
@@ -2742,6 +2762,7 @@ auths.oauth2_required_claim_value_helper=填寫此名稱以限制 Claim 中有
 auths.oauth2_group_claim_name=Claim 名稱提供群組名稱給此來源。(選用)
 auths.oauth2_admin_group=管理員使用者的群組 Claim 值。(選用 - 需要上面的 Claim 名稱)
 auths.oauth2_restricted_group=受限制使用者的群組 Claim 值。(選用 - 需要上面的 Claim 名稱)
+auths.oauth2_map_group_to_team_removal=如果使用者不屬於相對應的群組，將使用者從已同步的團隊移除。
 auths.enable_auto_register=允許授權用戶自動註冊
 auths.sspi_auto_create_users=自動建立使用者
 auths.sspi_auto_create_users_helper=允許 SSPI 認證方法於使用者首次登入時自動建立新帳戶
@@ -3218,8 +3239,14 @@ settings.delete.description=刪除套件是永久且不可還原的。
 settings.delete.notice=您正要刪除 %s (%s)，此動作是無法還原的，您確定嗎？
 settings.delete.success=已刪除該套件。
 settings.delete.error=刪除套件失敗。
+owner.settings.cargo.title=Cargo Registry 索引
 owner.settings.cargo.initialize=初始化索引
+owner.settings.cargo.initialize.error=初始化 Cargo 索引失敗: %v
+owner.settings.cargo.initialize.success=成功建立了 Cargo 索引。
 owner.settings.cargo.rebuild=重建索引
+owner.settings.cargo.rebuild.description=如果索引和 Cargo 套件不同步，您可在此重建它。
+owner.settings.cargo.rebuild.error=重建 Cargo 索引失敗: %v
+owner.settings.cargo.rebuild.success=成功重建了 Cargo 索引。
 owner.settings.cleanuprules.title=管理清理規則
 owner.settings.cleanuprules.add=加入清理規則
 owner.settings.cleanuprules.edit=編輯清理規則
@@ -3239,32 +3266,80 @@ owner.settings.cleanuprules.remove.days=移除早於天數的版本
 owner.settings.cleanuprules.remove.pattern=移除版本的比對規則
 owner.settings.cleanuprules.success.update=已更新清理規則。
 owner.settings.cleanuprules.success.delete=已刪除清理規則。
+owner.settings.chef.title=Chef Registry
+owner.settings.chef.keypair=產生密鑰組
+owner.settings.chef.keypair.description=產生用來認證 Chef Registry 的密鑰組，之前的密鑰未來將無法使用。
 
 [secrets]
+secrets=Secret
+description=Secret 會被傳給特定的 Action，其他情況無法讀取。
+none=還沒有 Secret。
 value=值
 name=組織名稱
+creation=加入 Secret
+creation.value_placeholder=輸入任何內容，頭尾的空白都會被忽略。
+creation.success=已加入 Secret「%s」。
+creation.failed=加入 Secret 失敗。
+deletion=移除 Secret
+deletion.description=移除 Secret 是永久的且不可還原，是否繼續？
+deletion.success=已移除此 Secret。
+deletion.failed=移除 Secret 失敗。
 
 [actions]
-
-
-
+actions=Actions
+
+unit.desc=管理 Actions
+
+status.unknown=未知
+status.waiting=正在等候
+status.running=正在執行
+status.success=成功
+status.failure=失敗
+status.cancelled=已取消
+status.skipped=已略過
+status.blocked=已阻塞
+
+runners=Runner
+runners.runner_manage_panel=Runner 管理
+runners.new=建立 Runner
+runners.new_notice=如何啟動 Runner
 runners.status=狀態
 runners.id=ID
 runners.name=組織名稱
 runners.owner_type=認證類型
 runners.description=組織描述
 runners.labels=標籤
+runners.last_online=最後上線時間
 runners.agent_labels=代理程式標籤
 runners.custom_labels=自訂標籤
+runners.custom_labels_helper=自訂標籤是由管理員手動加上的標籤。標籤之間以半形逗號「,」分隔，標籤頭尾的空白將被忽略。
+runners.runner_title=Runner
+runners.task_list=最近在此 Runner 上的任務
 runners.task_list.run=執行
 runners.task_list.status=狀態
 runners.task_list.repository=儲存庫
 runners.task_list.commit=提交
 runners.task_list.done_at=完成於
+runners.edit_runner=編輯 Runner
+runners.update_runner=更新變更
+runners.update_runner_success=更新 Runner 成功
+runners.update_runner_failed=更新 Runner 失敗
+runners.delete_runner=刪除此 Runner
+runners.delete_runner_success=刪除 Runner 成功
+runners.delete_runner_failed=刪除 Runner 失敗
+runners.delete_runner_header=確認刪除此 Runner
+runners.delete_runner_notice=如果有任務正在此 Runner 上執行，它可能會被中止並標記為失敗，這可能會打斷建置工作流程。
+runners.none=沒有可用的 Runner
+runners.status.unspecified=未知
+runners.status.idle=閒置
 runners.status.active=啟用
+runners.status.offline=離線
 
+runs.all_workflows=所有工作流程
 runs.open_tab=%d 開放中
 runs.closed_tab=%d 已關閉
 runs.commit=提交
+runs.pushed_by=推送者
 
+need_approval_desc=來自 Frok 儲存庫的合併請求需要核可才能執行工作流程。
 

From 17c8a0523a9f1bf717046823d4c0f69d606fe90a Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Fri, 10 Mar 2023 04:14:45 +0100
Subject: [PATCH 34/53] Fix and move "Use this template" button (#23398)

Before:
<img width="1157" alt="Screenshot 2023-03-09 at 23 21 25"
src="https://user-images.githubusercontent.com/115237/224174168-869966cc-fa59-4231-b449-23bd9db12862.png">

After:
<img width="1145" alt="Screenshot 2023-03-09 at 23 24 34"
src="https://user-images.githubusercontent.com/115237/224174173-7f5b9c22-44c4-4eed-990c-da49d749eb0e.png">

---------

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 templates/repo/home.tmpl      | 16 ++++++----------
 web_src/less/_repository.less |  2 +-
 web_src/less/helpers.less     | 21 +++++++++++++++++++++
 3 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/templates/repo/home.tmpl b/templates/repo/home.tmpl
index 2a79c51ddf946..73afbd663db39 100644
--- a/templates/repo/home.tmpl
+++ b/templates/repo/home.tmpl
@@ -63,7 +63,7 @@
 		{{end}}
 		{{template "repo/sub_menu" .}}
 		<div class="repo-button-row gt-df gt-ac gt-sb gt-fw">
-			<div class="gt-df gt-ac">
+			<div class="gt-df gt-ac gt-fw gt-gap-y-3">
 				{{template "repo/branch_dropdown" dict "root" .}}
 				{{$n := len .TreeNames}}
 				{{$l := Subtract $n 1}}
@@ -99,20 +99,16 @@
 						{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 					</button>
 				{{end}}
+				{{if and (eq $n 0) (.Repository.IsTemplate)}}
+					<a role="button" class="ui primary compact button" href="{{AppSubUrl}}/repo/create?template_id={{.Repository.ID}}">
+						{{.locale.Tr "repo.use_template"}}
+					</a>
+				{{end}}
 				{{if ne $n 0}}
 					<span class="ui breadcrumb repo-path gt-ml-2"><a class="section" href="{{.RepoLink}}/src/{{.BranchNameSubURL}}" title="{{.Repository.Name}}">{{EllipsisString .Repository.Name 30}}</a>{{range $i, $v := .TreeNames}}<span class="divider">/</span>{{if eq $i $l}}<span class="active section" title="{{$v}}">{{EllipsisString $v 30}}</span>{{else}}{{$p := index $.Paths $i}}<span class="section"><a href="{{$.BranchLink}}/{{PathEscapeSegments $p}}" title="{{$v}}">{{EllipsisString $v 30}}</a></span>{{end}}{{end}}</span>
 				{{end}}
 			</div>
 			<div class="gt-df gt-ac">
-				{{if eq $n 0}}
-					{{if .Repository.IsTemplate}}
-						<div class="ui tiny primary buttons">
-							<a href="{{AppSubUrl}}/repo/create?template_id={{.Repository.ID}}" class="ui button">
-								{{.locale.Tr "repo.use_template"}}
-							</a>
-						</div>
-					{{end}}
-				{{end}}
 				<!-- Only show clone panel in repository home page -->
 				{{if eq $n 0}}
 					<div class="ui action tiny input" id="clone-panel">
diff --git a/web_src/less/_repository.less b/web_src/less/_repository.less
index 3b93a76a16ebc..2c47135a2452b 100644
--- a/web_src/less/_repository.less
+++ b/web_src/less/_repository.less
@@ -2876,7 +2876,7 @@
 }
 
 .repo-button-row > * {
-  margin-top: 10px;
+  margin-top: 8px;
 }
 
 .wiki .repo-button-row {
diff --git a/web_src/less/helpers.less b/web_src/less/helpers.less
index baa5959946e82..08589fdaab9ff 100644
--- a/web_src/less/helpers.less
+++ b/web_src/less/helpers.less
@@ -172,6 +172,27 @@
 .gt-py-4 { padding-top: 1rem !important; padding-bottom: 1rem !important; }
 .gt-py-5 { padding-top: 2rem !important; padding-bottom: 2rem !important; }
 
+.gt-gap-0 { gap: 0 !important; }
+.gt-gap-1 { gap: .125rem !important; }
+.gt-gap-2 { gap: .25rem !important; }
+.gt-gap-3 { gap: .5rem !important; }
+.gt-gap-4 { gap: 1rem !important; }
+.gt-gap-5 { gap: 2rem !important; }
+
+.gt-gap-x-0 { column-gap: 0 !important; }
+.gt-gap-x-1 { column-gap: .125rem !important; }
+.gt-gap-x-2 { column-gap: .25rem !important; }
+.gt-gap-x-3 { column-gap: .5rem !important; }
+.gt-gap-x-4 { column-gap: 1rem !important; }
+.gt-gap-x-5 { column-gap: 2rem !important; }
+
+.gt-gap-y-0 { row-gap: 0 !important; }
+.gt-gap-y-1 { row-gap: .125rem !important; }
+.gt-gap-y-2 { row-gap: .25rem !important; }
+.gt-gap-y-3 { row-gap: .5rem !important; }
+.gt-gap-y-4 { row-gap: 1rem !important; }
+.gt-gap-y-5 { row-gap: 2rem !important; }
+
 .gt-content-center { align-content: center !important; }
 
 @media @mediaSm {

From 92d3e2a6f899347cfa47221d5b25cdcaf2cce486 Mon Sep 17 00:00:00 2001
From: InsanusMokrassar <insanus-mokrassar@yandex.ru>
Date: Fri, 10 Mar 2023 09:14:59 +0600
Subject: [PATCH 35/53] Add gradle samples in maven doc of packages (#23374)

Samples for gitea.io docs to help to use maven packages with
gradle-oriented projects

---------

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
---
 docs/content/doc/packages/maven.en-us.md | 48 +++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/docs/content/doc/packages/maven.en-us.md b/docs/content/doc/packages/maven.en-us.md
index 22da3c16d2945..2ec5ca2ab710c 100644
--- a/docs/content/doc/packages/maven.en-us.md
+++ b/docs/content/doc/packages/maven.en-us.md
@@ -23,7 +23,7 @@ Publish [Maven](https://maven.apache.org) packages for your user or organization
 ## Requirements
 
 To work with the Maven package registry, you can use [Maven](https://maven.apache.org/install.html) or [Gradle](https://gradle.org/install/).
-The following examples use `Maven`.
+The following examples use `Maven` and `Gradle Groovy`.
 
 ## Configuring the package registry
 
@@ -73,6 +73,40 @@ Afterwards add the following sections to your project `pom.xml` file:
 | `access_token` | Your [personal access token]({{< relref "doc/developers/api-usage.en-us.md#authentication" >}}). |
 | `owner`        | The owner of the package. |
 
+### Gradle variant
+
+When you plan to add some packages from Gitea instance in your project, you should add it in repositories section:
+
+```groovy
+repositories {
+    // other repositories
+    maven { url "https://gitea.example.com/api/packages/{owner}/maven" }
+}
+```
+
+In Groovy gradle you may include next script in your publishing part:
+
+```groovy
+publishing {
+    // other settings of publication
+    repositories {
+        maven {
+            name = "Gitea"
+            url = uri("https://gitea.example.com/api/packages/{owner}/maven")
+
+            credentials(HttpHeaderCredentials) {
+                name = "Authorization"
+                value = "token {access_token}"
+            }
+
+            authentication {
+                header(HttpHeaderAuthentication)
+            }
+        }
+    }
+}
+```
+
 ## Publish a package
 
 To publish a package simply run:
@@ -81,6 +115,12 @@ To publish a package simply run:
 mvn deploy
 ```
 
+Or call `gradle` with task `publishAllPublicationsToGiteaRepository` in case you are using gradle:
+
+```groovy
+./gradlew publishAllPublicationsToGiteaRepository
+```
+
 If you want to publish a prebuild package to the registry, you can use [`mvn deploy:deploy-file`](https://maven.apache.org/plugins/maven-deploy-plugin/deploy-file-mojo.html):
 
 ```shell
@@ -105,6 +145,12 @@ To install a Maven package from the package registry, add a new dependency to yo
 </dependency>
 ```
 
+And analog in gradle groovy:
+
+```groovy
+implementation "com.test.package:test_project:1.0.0"
+```
+
 Afterwards run:
 
 ```shell

From 0141d1667d4d0e98124c11e179928a42ffe6ab1a Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Fri, 10 Mar 2023 11:16:16 +0800
Subject: [PATCH 36/53] Fix broken Chroma CSS styles (#23174)

The CSS styles in Gitea themes are out-of-sync of Chroma's styles.

This PR introduces a `chroma-style-diff.go` tool to compare the diff.
The missing CSS styles have been added manually. They are left as empty
to reduce arguments because there was no color for them before.

And this PR fixes #22348, with just 2 lines changed: `.chroma .kt & .n`,
these colors are taken from GitHub.

It's good enough for #22348


![image](https://user-images.githubusercontent.com/2114189/221551941-0d27d11d-e71e-498f-8e88-92b558fe4a18.png)

---------

Co-authored-by: silverwind <me@silverwind.io>
---
 .stylelintrc.yaml                        |  6 ++
 web_src/less/chroma/chroma-style-diff.go | 79 ++++++++++++++++++++++++
 web_src/less/chroma/dark.less            | 14 +++--
 web_src/less/chroma/light.less           | 13 +++-
 web_src/less/themes/theme-arc-green.less |  1 +
 5 files changed, 105 insertions(+), 8 deletions(-)
 create mode 100644 web_src/less/chroma/chroma-style-diff.go

diff --git a/.stylelintrc.yaml b/.stylelintrc.yaml
index ca0f16b07b6c0..c488d0677f18a 100644
--- a/.stylelintrc.yaml
+++ b/.stylelintrc.yaml
@@ -1,12 +1,18 @@
 plugins:
   - stylelint-declaration-strict-value
 
+ignoreFiles:
+  - "**/*.go"
+
 overrides:
   - files: ["**/*.less"]
     customSyntax: postcss-less
   - files: ["**/chroma/*", "**/codemirror/*", "**/standalone/*", "**/console/*"]
     rules:
       scale-unlimited/declaration-strict-value: null
+  - files: ["**/chroma/*", "**/codemirror/*"]
+    rules:
+      block-no-empty: null
 
 rules:
   alpha-value-notation: null
diff --git a/web_src/less/chroma/chroma-style-diff.go b/web_src/less/chroma/chroma-style-diff.go
new file mode 100644
index 0000000000000..4243259689550
--- /dev/null
+++ b/web_src/less/chroma/chroma-style-diff.go
@@ -0,0 +1,79 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build ignore
+
+/*
+This tool is used to compare the CSS names in a chroma builtin styles with the Gitea theme CSS names.
+
+It outputs the difference between the two sets of CSS names, eg:
+
+```
+CSS names not in builtin:
+.chroma .ln
+----
+Builtin CSS names not in file:
+.chroma .vm
+```
+
+Developers could use this tool to re-sync the CSS names in the Gitea theme.
+*/
+
+package main
+
+import (
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/alecthomas/chroma/v2"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		println("Usage: chroma-style-diff css-or-less-file")
+		os.Exit(1)
+	}
+
+	data, err := os.ReadFile(os.Args[1])
+	if err != nil {
+		println(err.Error())
+		os.Exit(1)
+	}
+
+	content := string(data)
+
+	// a simple CSS parser to collect CSS names
+	content = regexp.MustCompile("//.*\r?\n").ReplaceAllString(content, "\n")
+	content = regexp.MustCompile("/\\*.*?\\*/").ReplaceAllString(content, "")
+	matches := regexp.MustCompile("\\s*([-.#:\\w\\s]+)\\s*\\{[^}]*}").FindAllStringSubmatch(content, -1)
+
+	cssNames := map[string]bool{}
+	for _, matchGroup := range matches {
+		cssName := strings.TrimSpace(matchGroup[1])
+		cssNames[cssName] = true
+	}
+
+	// collect Chroma builtin CSS names
+	builtin := map[string]bool{}
+	for tokenType, cssName := range chroma.StandardTypes {
+		if tokenType > 0 && cssName != "" {
+			builtin[".chroma ."+cssName] = true
+		}
+	}
+
+	// show the diff
+	println("CSS names not in builtin:")
+	for cssName := range cssNames {
+		if !builtin[cssName] {
+			println(cssName)
+		}
+	}
+	println("----")
+	println("Builtin CSS names not in file:")
+	for cssName := range builtin {
+		if !cssNames[cssName] {
+			println(cssName)
+		}
+	}
+}
diff --git a/web_src/less/chroma/dark.less b/web_src/less/chroma/dark.less
index 4be9cf7912e0b..1b0c722a164c5 100644
--- a/web_src/less/chroma/dark.less
+++ b/web_src/less/chroma/dark.less
@@ -7,17 +7,19 @@
 .chroma .cpf { color: #649bc4; } /* CommentPreprocFile */
 .chroma .cs { color: #9075cd; } /* CommentSpecial */
 .chroma .dl { color: #649bc4; } /* LiteralStringDelimiter */
+.chroma .fm {} /* NameFunctionMagic */
+.chroma .g {} /* Generic */
 .chroma .gd { color: #ffffff; background-color: #5f3737; } /* GenericDeleted */
 .chroma .ge { color: #ddee30; } /* GenericEmph */
 .chroma .gh { color: #ffaa10; } /* GenericHeading */
 .chroma .gi { color: #ffffff; background-color: #3a523a; } /* GenericInserted */
+.chroma .gl {} /* GenericUnderline */
 .chroma .go { color: #777e94; } /* GenericOutput */
 .chroma .gp { color: #ebdbb2; } /* GenericPrompt */
 .chroma .gr { color: #ff4433; } /* GenericError */
 .chroma .gs { color: #ebdbb2; } /* GenericStrong */
 .chroma .gt { color: #ff7540; } /* GenericTraceback */
 .chroma .gu { color: #b8bb26; } /* GenericSubheading */
-.chroma .hl { background-color: #3f424d; } /* LineHighlight */
 .chroma .il { color: #649bc4; } /* LiteralNumberIntegerLong */
 .chroma .k { color: #ff7540; } /* Keyword */
 .chroma .kc { color: #649bc4; } /* KeywordConstant */
@@ -25,16 +27,16 @@
 .chroma .kn { color: #ffaa10; } /* KeywordNamespace */
 .chroma .kp { color: #5f8700; } /* KeywordPseudo */
 .chroma .kr { color: #ff7540; } /* KeywordReserved */
-.chroma .kt { color: #fabd2f; } /* KeywordType */
-.chroma .ln { color: #7f8699; } /* LineNumbers */
-.chroma .lnt { color: #7f8699; } /* LineNumbersTable */
+.chroma .kt { color: #ff7b72; } /* KeywordType */
+.chroma .l {} /* Literal */
+.chroma .ld {} /* LiteralDate */
 .chroma .m { color: #649bc4; } /* LiteralNumber */
 .chroma .mb { color: #649bc4; } /* LiteralNumberBin */
 .chroma .mf { color: #649bc4; } /* LiteralNumberFloat */
 .chroma .mh { color: #649bc4; } /* LiteralNumberHex */
 .chroma .mi { color: #649bc4; } /* LiteralNumberInteger */
 .chroma .mo { color: #649bc4; } /* LiteralNumberOct */
-.chroma .n { color: #fabd2f; } /* Name */
+.chroma .n { color: #c9d1d9; } /* Name */
 .chroma .na { color: #b8bb26; } /* NameAttribute */
 .chroma .nb { color: #fabd2f; } /* NameBuiltin */
 .chroma .nc { color: #ffaa10; } /* NameClass */
@@ -51,6 +53,7 @@
 .chroma .o { color: #ff7540; } /* Operator */
 .chroma .ow { color: #5f8700; } /* OperatorWord */
 .chroma .p { color: #d2d4db; } /* Punctuation */
+.chroma .py {} /* NameProperty */
 .chroma .s { color: #b8bb26; } /* LiteralString */
 .chroma .s1 { color: #b8bb26; } /* LiteralStringSingle */
 .chroma .s2 { color: #b8bb26; } /* LiteralStringDouble */
@@ -67,4 +70,5 @@
 .chroma .vc { color: #ff7540; } /* NameVariableClass */
 .chroma .vg { color: #ffaa10; } /* NameVariableGlobal */
 .chroma .vi { color: #ffaa10; } /* NameVariableInstance */
+.chroma .vm {} /* NameVariableMagic */
 .chroma .w { color: #7f8699; } /* TextWhitespace */
diff --git a/web_src/less/chroma/light.less b/web_src/less/chroma/light.less
index 2e811844c2ddd..4bfce8fe71720 100644
--- a/web_src/less/chroma/light.less
+++ b/web_src/less/chroma/light.less
@@ -7,16 +7,19 @@
 .chroma .cpf { color: #4c4dbc; } /* CommentPreprocFile */
 .chroma .cs { color: #999999; } /* CommentSpecial */
 .chroma .dl { color: #106303; } /* LiteralStringDelimiter */
+.chroma .fm {} /* NameFunctionMagic */
+.chroma .g {} /* Generic */
 .chroma .gd { color: #000000; background-color: #ffdddd; } /* GenericDeleted */
 .chroma .ge { color: #000000; } /* GenericEmph */
 .chroma .gh { color: #999999; } /* GenericHeading */
 .chroma .gi { color: #000000; background-color: #ddffdd; } /* GenericInserted */
+.chroma .gl {} /* GenericUnderline */
 .chroma .go { color: #888888; } /* GenericOutput */
 .chroma .gp { color: #555555; } /* GenericPrompt */
 .chroma .gr { color: #aa0000; } /* GenericError */
+.chroma .gs {} /* GenericStrong */
 .chroma .gt { color: #aa0000; } /* GenericTraceback */
 .chroma .gu { color: #aaaaaa; } /* GenericSubheading */
-.chroma .hl { background-color: #e5e5e5; } /* LineHighlight */
 .chroma .il { color: #009999; } /* LiteralNumberIntegerLong */
 .chroma .k { color: #d73a49; } /* Keyword */
 .chroma .kc { color: #d73a49; } /* KeywordConstant */
@@ -25,14 +28,15 @@
 .chroma .kp { color: #d73a49; } /* KeywordPseudo */
 .chroma .kr { color: #d73a49; } /* KeywordReserved */
 .chroma .kt { color: #445588; } /* KeywordType */
-.chroma .ln { color: #7f7f7f; } /* LineNumbers */
-.chroma .lnt { color: #7f7f7f; } /* LineNumbersTable */
+.chroma .l {} /* Literal */
+.chroma .ld {} /* LiteralDate */
 .chroma .m { color: #009999; } /* LiteralNumber */
 .chroma .mb { color: #009999; } /* LiteralNumberBin */
 .chroma .mf { color: #009999; } /* LiteralNumberFloat */
 .chroma .mh { color: #009999; } /* LiteralNumberHex */
 .chroma .mi { color: #009999; } /* LiteralNumberInteger */
 .chroma .mo { color: #009999; } /* LiteralNumberOct */
+.chroma .n {} /* Name */
 .chroma .na { color: #d73a49; } /* NameAttribute */
 .chroma .nb { color: #005cc5; } /* NameBuiltin */
 .chroma .nc { color: #445588; } /* NameClass */
@@ -48,6 +52,8 @@
 .chroma .nx { color: #24292e; } /* NameOther */
 .chroma .o { color: #d73a49; } /* Operator */
 .chroma .ow { color: #d73a49; } /* OperatorWord */
+.chroma .p {} /* Punctuation */
+.chroma .py {} /* NameProperty */
 .chroma .s { color: #106303; } /* LiteralString */
 .chroma .s1 { color: #cc7a00; } /* LiteralStringSingle */
 .chroma .s2 { color: #106303; } /* LiteralStringDouble */
@@ -64,4 +70,5 @@
 .chroma .vc { color: #008080; } /* NameVariableClass */
 .chroma .vg { color: #008080; } /* NameVariableGlobal */
 .chroma .vi { color: #008080; } /* NameVariableInstance */
+.chroma .vm {} /* NameVariableMagic */
 .chroma .w { color: #bbbbbb; } /* TextWhitespace */
diff --git a/web_src/less/themes/theme-arc-green.less b/web_src/less/themes/theme-arc-green.less
index 2f06f33aca705..17b8f9bae0347 100644
--- a/web_src/less/themes/theme-arc-green.less
+++ b/web_src/less/themes/theme-arc-green.less
@@ -1,3 +1,4 @@
+@import "../chroma/base.less";
 @import "../chroma/dark.less";
 @import "../codemirror/dark.less";
 

From d647e74502fdf734c89b3e6592a9ad88c3005971 Mon Sep 17 00:00:00 2001
From: Brecht Van Lommel <brecht@blender.org>
Date: Fri, 10 Mar 2023 04:17:04 +0100
Subject: [PATCH 37/53] Improve squash merge commit author and co-author with
 private emails (#22977)

When emails addresses are private, squash merges always use
`@noreply.localhost` for the author of the squash commit. And the author
is redundantly added as a co-author in the commit message.

Also without private mails, the redundant co-author is possible when
committing with a signature that's different than the user full name and
primary email.

Now try to find a commit by the same user in the list of commits, and
prefer the signature from that over one constructed from the account
settings.
---
 services/pull/merge_squash.go | 48 +++++++++++++++++++++++++++++++----
 services/pull/pull.go         | 12 +++++++--
 2 files changed, 53 insertions(+), 7 deletions(-)

diff --git a/services/pull/merge_squash.go b/services/pull/merge_squash.go
index d6e7314988d38..f52a2301d906c 100644
--- a/services/pull/merge_squash.go
+++ b/services/pull/merge_squash.go
@@ -7,24 +7,62 @@ import (
 	"fmt"
 
 	repo_model "code.gitea.io/gitea/models/repo"
+	user_model "code.gitea.io/gitea/models/user"
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 )
 
+// doMergeStyleSquash gets a commit author signature for squash commits
+func getAuthorSignatureSquash(ctx *mergeContext) (*git.Signature, error) {
+	if err := ctx.pr.Issue.LoadPoster(ctx); err != nil {
+		log.Error("%-v Issue[%d].LoadPoster: %v", ctx.pr, ctx.pr.Issue.ID, err)
+		return nil, err
+	}
+
+	// Try to get an signature from the same user in one of the commits, as the
+	// poster email might be private or commits might have a different signature
+	// than the primary email address of the poster.
+	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, ctx.tmpBasePath)
+	if err != nil {
+		log.Error("%-v Unable to open base repository: %v", ctx.pr, err)
+		return nil, err
+	}
+	defer closer.Close()
+
+	commits, err := gitRepo.CommitsBetweenIDs(trackingBranch, "HEAD")
+	if err != nil {
+		log.Error("%-v Unable to get commits between: %s %s: %v", ctx.pr, "HEAD", trackingBranch, err)
+		return nil, err
+	}
+
+	uniqueEmails := make(container.Set[string])
+	for _, commit := range commits {
+		if commit.Author != nil && uniqueEmails.Add(commit.Author.Email) {
+			commitUser, _ := user_model.GetUserByEmail(ctx, commit.Author.Email)
+			if commitUser != nil && commitUser.ID == ctx.pr.Issue.Poster.ID {
+				return commit.Author, nil
+			}
+		}
+	}
+
+	return ctx.pr.Issue.Poster.NewGitSig(), nil
+}
+
 // doMergeStyleSquash squashes the tracking branch on the current HEAD (=base)
 func doMergeStyleSquash(ctx *mergeContext, message string) error {
+	sig, err := getAuthorSignatureSquash(ctx)
+	if err != nil {
+		return fmt.Errorf("getAuthorSignatureSquash: %w", err)
+	}
+
 	cmdMerge := git.NewCommand(ctx, "merge", "--squash").AddDynamicArguments(trackingBranch)
 	if err := runMergeCommand(ctx, repo_model.MergeStyleSquash, cmdMerge); err != nil {
 		log.Error("%-v Unable to merge --squash tracking into base: %v", ctx.pr, err)
 		return err
 	}
 
-	if err := ctx.pr.Issue.LoadPoster(ctx); err != nil {
-		log.Error("%-v Issue[%d].LoadPoster: %v", ctx.pr, ctx.pr.Issue.ID, err)
-		return fmt.Errorf("LoadPoster: %w", err)
-	}
-	sig := ctx.pr.Issue.Poster.NewGitSig()
 	if setting.Repository.PullRequest.AddCoCommitterTrailers && ctx.committer.String() != sig.String() {
 		// add trailer
 		message += fmt.Sprintf("\nCo-authored-by: %s\nCo-committed-by: %s\n", sig.String(), sig.String())
diff --git a/services/pull/pull.go b/services/pull/pull.go
index d8923d0d57251..e40e59a2c5002 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -669,7 +669,12 @@ func GetSquashMergeCommitMessages(ctx context.Context, pr *issues_model.PullRequ
 
 		authorString := commit.Author.String()
 		if uniqueAuthors.Add(authorString) && authorString != posterSig {
-			authors = append(authors, authorString)
+			// Compare use account as well to avoid adding the same author multiple times
+			// times when email addresses are private or multiple emails are used.
+			commitUser, _ := user_model.GetUserByEmail(ctx, commit.Author.Email)
+			if commitUser == nil || commitUser.ID != pr.Issue.Poster.ID {
+				authors = append(authors, authorString)
+			}
 		}
 	}
 
@@ -690,7 +695,10 @@ func GetSquashMergeCommitMessages(ctx context.Context, pr *issues_model.PullRequ
 			for _, commit := range commits {
 				authorString := commit.Author.String()
 				if uniqueAuthors.Add(authorString) && authorString != posterSig {
-					authors = append(authors, authorString)
+					commitUser, _ := user_model.GetUserByEmail(ctx, commit.Author.Email)
+					if commitUser == nil || commitUser.ID != pr.Issue.Poster.ID {
+						authors = append(authors, authorString)
+					}
 				}
 			}
 			skip += limit

From f92e0a4018ca65936c95ac119c57d4b9ab62bc2d Mon Sep 17 00:00:00 2001
From: John Olheiser <john.olheiser@gmail.com>
Date: Fri, 10 Mar 2023 00:13:17 -0600
Subject: [PATCH 38/53] Split CI pipelines (#23385)

- This PR attempts to split our various DB tests into separate
pipelines.
- It splits up some of the extra feature-related tests rather than
having most of them in the MySQL test.
- It disables the race detector for some of the pipelines as well, as it
can cause slower runs and is mostly redundant when the pipelines just
swap DBs.
- It builds without SQLite support for any of the non-SQLite pipelines.
- It moves the e2e test to using SQLite rather than PG (partially
because I moved the minio tests to PG and that mucked up the test
config, and partially because it avoids another running service)
- It splits up the `go mod download` task in the Makefile from the tool
installation, as the tools are only needed in the compliance pipeline.
(Arguably even some of the tools aren't needed there, but that could be
a follow-up PR)
- SQLite is now the only arm64 pipeline, moving PG back to amd64 which
can leverage autoscaler

Should resolve #22010 - one thing that wasn't changed here but is
mentioned in that issue, unit tests are needed in the same pipeline as
an integration test in order to form a complete coverage report (at
least as far as I could tell), so for now it remains in a pipeline with
a DB integration test.

Please let me know if I've inadvertently changed something that was how
it was on purpose.

---

I will say sometimes it's hard to pin down the average time, as a
pipeline could be waiting for a runner for X minutes and that brings the
total up by X minutes as well, but overall this does seem to be faster
on average.

---------

Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 .drone.yml           | 462 +++++++++++++++++++++++++++++++------------
 Makefile             |   6 +-
 tests/mysql.ini.tmpl |  25 +--
 tests/pgsql.ini.tmpl |  21 +-
 4 files changed, 364 insertions(+), 150 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index d1ad625e329f9..0e1d799834ec5 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -32,6 +32,7 @@ steps:
     pull: always
     commands:
       - make deps-backend
+      - make deps-tools
     volumes:
       - name: deps
         path: /go
@@ -168,7 +169,7 @@ steps:
 ---
 kind: pipeline
 type: docker
-name: testing-amd64
+name: testing-pgsql
 
 platform:
   os: linux
@@ -191,51 +192,26 @@ volumes:
     temp: {}
 
 services:
-  - name: mysql
-    image: mysql:5.7
-    pull: always
-    environment:
-      MYSQL_ALLOW_EMPTY_PASSWORD: yes
-      MYSQL_DATABASE: test
-
-  - name: mysql8
-    image: mysql:8
-    pull: always
-    environment:
-      MYSQL_ALLOW_EMPTY_PASSWORD: yes
-      MYSQL_DATABASE: testgitea
-
-  - name: mssql
-    image: mcr.microsoft.com/mssql/server:latest
-    pull: always
+  - name: pgsql
+    pull: default
+    image: postgres:15
     environment:
-      ACCEPT_EULA: Y
-      MSSQL_PID: Standard
-      SA_PASSWORD: MwantsaSecurePassword1
+      POSTGRES_DB: test
+      POSTGRES_PASSWORD: postgres
 
   - name: ldap
     image: gitea/test-openldap:latest
     pull: always
 
-  - name: elasticsearch
-    image: elasticsearch:7.5.0
-    pull: always
-    environment:
-      discovery.type: single-node
-
   - name: minio
     image: minio/minio:RELEASE.2021-03-12T00-00-47Z
     pull: always
     commands:
-    - minio server /data
+      - minio server /data
     environment:
       MINIO_ACCESS_KEY: 123456
       MINIO_SECRET_KEY: 12345678
 
-  - name: smtpimap
-    image: tabascoterrier/docker-imap-devel:latest
-    pull: always
-
 steps:
   - name: fetch-tags
     image: docker:git
@@ -257,12 +233,6 @@ steps:
       - name: deps
         path: /go
 
-  - name: tag-pre-condition
-    image: drone/git
-    pull: always
-    commands:
-      - git update-ref refs/heads/tag_test ${DRONE_COMMIT_SHA}
-
   - name: prepare-test-env
     image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     pull: always
@@ -278,88 +248,157 @@ steps:
     environment:
       GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
       GOSUMDB: sum.golang.org
-      TAGS: bindata sqlite sqlite_unlock_notify
+      TAGS: bindata
     depends_on: [deps-backend, prepare-test-env]
     volumes:
       - name: deps
         path: /go
 
-  - name: unit-test
+  - name: test-pgsql
     image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - make unit-test-coverage test-check
+      - timeout -s ABRT 50m make test-pgsql-migration test-pgsql
     environment:
       GOPROXY: https://goproxy.io
-      TAGS: bindata sqlite sqlite_unlock_notify
+      TAGS: bindata gogit
       RACE_ENABLED: true
-      GITHUB_READ_TOKEN:
-        from_secret: github_read_token
-    depends_on: [deps-backend, prepare-test-env]
+      TEST_TAGS: gogit
+      TEST_LDAP: 1
+      USE_REPO_TEST_DIR: 1
+    depends_on: [build]
     volumes:
       - name: deps
         path: /go
 
-  - name: unit-test-gogit
+---
+kind: pipeline
+type: docker
+name: testing-mysql
+
+platform:
+  os: linux
+  arch: amd64
+
+depends_on:
+  - compliance
+
+trigger:
+  event:
+    - push
+    - tag
+    - pull_request
+  paths:
+    exclude:
+      - docs/**
+
+volumes:
+  - name: deps
+    temp: {}
+
+services:
+  - name: mysql
+    image: mysql:5.7
+    pull: always
+    environment:
+      MYSQL_ALLOW_EMPTY_PASSWORD: yes
+      MYSQL_DATABASE: test
+
+  - name: elasticsearch
+    image: elasticsearch:7.5.0
+    pull: always
+    environment:
+      discovery.type: single-node
+
+  - name: smtpimap
+    image: tabascoterrier/docker-imap-devel:latest
+    pull: always
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git config --global --add safe.directory /drone/src
+      - git fetch --tags --force
+    when:
+      event:
+        exclude:
+          - pull_request
+
+  - name: deps-backend
+    image: golang:1.20
+    pull: always
+    commands:
+      - make deps-backend
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: prepare-test-env
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
+    pull: always
+    commands:
+      - ./build/test-env-prepare.sh
+
+  - name: build
     image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - make unit-test-coverage test-check
+      - ./build/test-env-check.sh
+      - make backend
     environment:
-      GOPROXY: https://goproxy.io
-      TAGS: bindata gogit sqlite sqlite_unlock_notify
-      RACE_ENABLED: true
-      GITHUB_READ_TOKEN:
-        from_secret: github_read_token
+      GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
+      GOSUMDB: sum.golang.org
+      TAGS: bindata
     depends_on: [deps-backend, prepare-test-env]
     volumes:
       - name: deps
         path: /go
 
-  - name: test-mysql
+  - name: unit-test
     image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - make test-mysql-migration integration-test-coverage
+      - make unit-test-coverage test-check
     environment:
       GOPROXY: https://goproxy.io
       TAGS: bindata
       RACE_ENABLED: true
-      TEST_LDAP: 1
-      USE_REPO_TEST_DIR: 1
-      TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"
-    depends_on: [build]
+      GITHUB_READ_TOKEN:
+        from_secret: github_read_token
+    depends_on: [deps-backend, prepare-test-env]
     volumes:
       - name: deps
         path: /go
 
-  - name: test-mysql8
+  - name: unit-test-gogit
     image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - timeout -s ABRT 50m make test-mysql8-migration test-mysql8
+      - make unit-test-coverage test-check
     environment:
       GOPROXY: https://goproxy.io
-      TAGS: bindata
+      TAGS: bindata gogit
       RACE_ENABLED: true
-      TEST_LDAP: 1
-      USE_REPO_TEST_DIR: 1
-    depends_on: [build]
+      GITHUB_READ_TOKEN:
+        from_secret: github_read_token
+    depends_on: [deps-backend, prepare-test-env]
     volumes:
       - name: deps
         path: /go
 
-  - name: test-mssql
+  - name: test-mysql
     image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - make test-mssql-migration test-mssql
+      - make test-mysql-migration integration-test-coverage
     environment:
       GOPROXY: https://goproxy.io
       TAGS: bindata
       RACE_ENABLED: true
-      TEST_LDAP: 1
       USE_REPO_TEST_DIR: 1
+      TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"
     depends_on: [build]
     volumes:
       - name: deps
@@ -398,11 +437,12 @@ steps:
 
 ---
 kind: pipeline
-name: testing-arm64
+type: docker
+name: testing-mysql8
 
 platform:
   os: linux
-  arch: arm64
+  arch: amd64
 
 depends_on:
   - compliance
@@ -421,16 +461,102 @@ volumes:
     temp: {}
 
 services:
-  - name: pgsql
-    pull: default
-    image: postgres:10
+  - name: mysql8
+    image: mysql:8
+    pull: always
     environment:
-      POSTGRES_DB: test
-      POSTGRES_PASSWORD: postgres
+      MYSQL_ALLOW_EMPTY_PASSWORD: yes
+      MYSQL_DATABASE: testgitea
 
-  - name: ldap
-    pull: default
-    image: gitea/test-openldap:latest
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git config --global --add safe.directory /drone/src
+      - git fetch --tags --force
+    when:
+      event:
+        exclude:
+          - pull_request
+
+  - name: deps-backend
+    image: golang:1.20
+    pull: always
+    commands:
+      - make deps-backend
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: prepare-test-env
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
+    pull: always
+    commands:
+      - ./build/test-env-prepare.sh
+
+  - name: build
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
+    user: gitea
+    commands:
+      - ./build/test-env-check.sh
+      - make backend
+    environment:
+      GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
+      GOSUMDB: sum.golang.org
+      TAGS: bindata
+    depends_on: [deps-backend, prepare-test-env]
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: test-mysql8
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
+    user: gitea
+    commands:
+      - timeout -s ABRT 50m make test-mysql8-migration test-mysql8
+    environment:
+      GOPROXY: https://goproxy.io
+      TAGS: bindata
+      USE_REPO_TEST_DIR: 1
+    depends_on: [build]
+    volumes:
+      - name: deps
+        path: /go
+
+---
+kind: pipeline
+type: docker
+name: testing-mssql
+
+platform:
+  os: linux
+  arch: amd64
+
+depends_on:
+  - compliance
+
+trigger:
+  event:
+    - push
+    - tag
+    - pull_request
+  paths:
+    exclude:
+      - docs/**
+
+volumes:
+  - name: deps
+    temp: {}
+
+services:
+  - name: mssql
+    image: mcr.microsoft.com/mssql/server:latest
+    pull: always
+    environment:
+      ACCEPT_EULA: Y
+      MSSQL_PID: Standard
+      SA_PASSWORD: MwantsaSecurePassword1
 
 steps:
   - name: fetch-tags
@@ -454,13 +580,13 @@ steps:
         path: /go
 
   - name: prepare-test-env
-    image: gitea/test_env:linux-arm64  # https://gitea.com/gitea/test-env
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     pull: always
     commands:
       - ./build/test-env-prepare.sh
 
   - name: build
-    image: gitea/test_env:linux-arm64  # https://gitea.com/gitea/test-env
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
       - ./build/test-env-check.sh
@@ -468,39 +594,102 @@ steps:
     environment:
       GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
       GOSUMDB: sum.golang.org
-      TAGS: bindata gogit sqlite sqlite_unlock_notify
+      TAGS: bindata
     depends_on: [deps-backend, prepare-test-env]
     volumes:
       - name: deps
         path: /go
 
-  - name: test-sqlite
-    image: gitea/test_env:linux-arm64  # https://gitea.com/gitea/test-env
+  - name: test-mssql
+    image: gitea/test_env:linux-amd64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - timeout -s ABRT 50m make test-sqlite-migration test-sqlite
+      - make test-mssql-migration test-mssql
     environment:
       GOPROXY: https://goproxy.io
-      TAGS: bindata gogit sqlite sqlite_unlock_notify
-      RACE_ENABLED: true
-      TEST_TAGS: gogit sqlite sqlite_unlock_notify
+      TAGS: bindata
       USE_REPO_TEST_DIR: 1
     depends_on: [build]
     volumes:
       - name: deps
         path: /go
 
-  - name: test-pgsql
+---
+kind: pipeline
+name: testing-sqlite
+
+platform:
+  os: linux
+  arch: arm64
+
+depends_on:
+  - compliance
+
+trigger:
+  event:
+    - push
+    - tag
+    - pull_request
+  paths:
+    exclude:
+      - docs/**
+
+volumes:
+  - name: deps
+    temp: {}
+
+steps:
+  - name: fetch-tags
+    image: docker:git
+    pull: always
+    commands:
+      - git config --global --add safe.directory /drone/src
+      - git fetch --tags --force
+    when:
+      event:
+        exclude:
+          - pull_request
+
+  - name: deps-backend
+    image: golang:1.20
+    pull: always
+    commands:
+      - make deps-backend
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: prepare-test-env
+    image: gitea/test_env:linux-arm64  # https://gitea.com/gitea/test-env
+    pull: always
+    commands:
+      - ./build/test-env-prepare.sh
+
+  - name: build
     image: gitea/test_env:linux-arm64  # https://gitea.com/gitea/test-env
     user: gitea
     commands:
-      - timeout -s ABRT 50m make test-pgsql-migration test-pgsql
+      - ./build/test-env-check.sh
+      - make backend
+    environment:
+      GOPROXY: https://goproxy.io # proxy.golang.org is blocked in China, this proxy is not
+      GOSUMDB: sum.golang.org
+      TAGS: bindata gogit sqlite sqlite_unlock_notify
+    depends_on: [deps-backend, prepare-test-env]
+    volumes:
+      - name: deps
+        path: /go
+
+  - name: test-sqlite
+    image: gitea/test_env:linux-arm64  # https://gitea.com/gitea/test-env
+    user: gitea
+    commands:
+      - timeout -s ABRT 50m make test-sqlite-migration test-sqlite
     environment:
       GOPROXY: https://goproxy.io
-      TAGS: bindata gogit
+      TAGS: bindata gogit sqlite sqlite_unlock_notify
       RACE_ENABLED: true
-      TEST_TAGS: gogit
-      TEST_LDAP: 1
+      TEST_TAGS: gogit sqlite sqlite_unlock_notify
       USE_REPO_TEST_DIR: 1
     depends_on: [build]
     volumes:
@@ -530,15 +719,6 @@ volumes:
   - name: deps
     temp: {}
 
-services:
-  - name: pgsql
-    pull: default
-    image: postgres:10
-    environment:
-      POSTGRES_DB: testgitea-e2e
-      POSTGRES_PASSWORD: postgres
-      POSTGRES_INITDB_ARGS: --encoding=UTF8 --lc-collate='en_US.UTF-8' --lc-ctype='en_US.UTF-8'
-
 steps:
   - name: deps-frontend
     image: node:18
@@ -568,14 +748,12 @@ steps:
       - curl -sLO https://go.dev/dl/go1.20.linux-amd64.tar.gz && tar -C /usr/local -xzf go1.20.linux-amd64.tar.gz
       - groupadd --gid 1001 gitea && useradd -m --gid 1001 --uid 1001 gitea
       - apt-get -qq update && apt-get -qqy install build-essential
-      - export TEST_PGSQL_SCHEMA=''
       - ./build/test-env-prepare.sh
-      - su gitea bash -c "export PATH=$PATH:/usr/local/go/bin && timeout -s ABRT 40m make test-e2e-pgsql"
+      - su gitea bash -c "export PATH=$PATH:/usr/local/go/bin && timeout -s ABRT 40m make test-e2e-sqlite"
     environment:
       GOPROXY: https://goproxy.io
       GOSUMDB: sum.golang.org
       USE_REPO_TEST_DIR: 1
-      TEST_PGSQL_DBNAME: 'testgitea-e2e'
       DEBIAN_FRONTEND: noninteractive
     depends_on: [build-frontend, deps-backend]
     volumes:
@@ -709,8 +887,11 @@ trigger:
       - docs/**
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 volumes:
   - name: deps
@@ -842,8 +1023,11 @@ trigger:
     - tag
 
 depends_on:
-  - testing-arm64
-  - testing-amd64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 volumes:
   - name: deps
@@ -994,8 +1178,11 @@ platform:
   arch: amd64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1064,8 +1251,11 @@ platform:
   arch: amd64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1129,8 +1319,11 @@ platform:
   arch: amd64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1192,8 +1385,11 @@ platform:
   arch: amd64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1292,8 +1488,11 @@ platform:
   arch: arm64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1362,8 +1561,11 @@ platform:
   arch: arm64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1427,8 +1629,11 @@ platform:
   arch: arm64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1493,8 +1698,11 @@ platform:
   arch: arm64
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
 
 trigger:
   ref:
@@ -1607,7 +1815,6 @@ platform:
 
 steps:
   - name: manifest-rootless
-    pull: always
     image: plugins/manifest
     pull: always
     settings:
@@ -1671,8 +1878,11 @@ trigger:
     - failure
 
 depends_on:
-  - testing-amd64
-  - testing-arm64
+  - testing-mysql
+  - testing-mysql8
+  - testing-mssql
+  - testing-pgsql
+  - testing-sqlite
   - release-version
   - release-latest
   - docker-linux-amd64-release
diff --git a/Makefile b/Makefile
index 19cd455aba30c..d770ed453f4fa 100644
--- a/Makefile
+++ b/Makefile
@@ -190,6 +190,7 @@ help:
 	@echo " - deps                             install dependencies"
 	@echo " - deps-frontend                    install frontend dependencies"
 	@echo " - deps-backend                     install backend dependencies"
+	@echo " - deps-tools                       install tool dependencies"
 	@echo " - lint                             lint everything"
 	@echo " - lint-frontend                    lint frontend files"
 	@echo " - lint-backend                     lint backend files"
@@ -821,7 +822,7 @@ docs:
 	cd docs; make trans-copy clean build-offline;
 
 .PHONY: deps
-deps: deps-frontend deps-backend
+deps: deps-frontend deps-backend deps-tools
 
 .PHONY: deps-frontend
 deps-frontend: node_modules
@@ -829,6 +830,9 @@ deps-frontend: node_modules
 .PHONY: deps-backend
 deps-backend:
 	$(GO) mod download
+
+.PHONY: deps-tools
+deps-tools:
 	$(GO) install $(AIR_PACKAGE)
 	$(GO) install $(EDITORCONFIG_CHECKER_PACKAGE)
 	$(GO) install $(ERRCHECK_PACKAGE)
diff --git a/tests/mysql.ini.tmpl b/tests/mysql.ini.tmpl
index 1dd7bfab2a49c..b286f37bf83e2 100644
--- a/tests/mysql.ini.tmpl
+++ b/tests/mysql.ini.tmpl
@@ -55,28 +55,6 @@ LFS_START_SERVER = true
 LFS_JWT_SECRET   = Tv_MjmZuHqpIY6GFl12ebgkRAMt4RlWt0v4EHKSXO0w
 SSH_TRUSTED_USER_CA_KEYS = ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCb4DC1dMFnJ6pXWo7GMxTchtzmJHYzfN6sZ9FAPFR4ijMLfGki+olvOMO5Fql1/yGnGfbELQa1S6y4shSvj/5K+zUFScmEXYf3Gcr87RqilLkyk16RS+cHNB1u87xTHbETaa3nyCJeGQRpd4IQ4NKob745mwDZ7jQBH8AZEng50Oh8y8fi8skBBBzaYp1ilgvzG740L7uex6fHV62myq0SXeCa+oJUjq326FU8y+Vsa32H8A3e7tOgXZPdt2TVNltx2S9H2WO8RMi7LfaSwARNfy1zu+bfR50r6ef8Yx5YKCMz4wWb1SHU1GS800mjOjlInLQORYRNMlSwR1+vLlVDciOqFapDSbj+YOVOawR0R1aqlSKpZkt33DuOBPx9qe6CVnIi7Z+Px/KqM+OLCzlLY/RS+LbxQpDWcfTVRiP+S5qRTcE3M3UioN/e0BE/1+MpX90IGpvVkA63ILYbKEa4bM3ASL7ChTCr6xN5XT+GpVJveFKK1cfNx9ExHI4rzYE=
 
-[lfs]
-MINIO_BASE_PATH = lfs/
-
-[attachment]
-MINIO_BASE_PATH = attachments/
-
-[avatars]
-MINIO_BASE_PATH = avatars/
-
-[repo-avatars]
-MINIO_BASE_PATH = repo-avatars/
-
-[storage]
-STORAGE_TYPE = minio
-SERVE_DIRECT = false
-MINIO_ENDPOINT = minio:9000
-MINIO_ACCESS_KEY_ID = 123456
-MINIO_SECRET_ACCESS_KEY = 12345678
-MINIO_BUCKET = gitea
-MINIO_LOCATION = us-east-1
-MINIO_USE_SSL = false
-
 [mailer]
 ENABLED = true
 MAILER_TYPE = dummy
@@ -122,6 +100,9 @@ INSTALL_LOCK   = true
 SECRET_KEY     = 9pCviYTWSb
 INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0OTU1NTE2MTh9.hhSVGOANkaKk3vfCd2jDOIww4pUk0xtg9JRde5UogyQ
 
+[lfs]
+PATH = tests/{{TEST_TYPE}}/gitea-{{TEST_TYPE}}-mysql/data/lfs
+
 [packages]
 ENABLED = true
 
diff --git a/tests/pgsql.ini.tmpl b/tests/pgsql.ini.tmpl
index c39b6a79c3a8b..fbfbae7c68130 100644
--- a/tests/pgsql.ini.tmpl
+++ b/tests/pgsql.ini.tmpl
@@ -105,7 +105,26 @@ SECRET_KEY     = 9pCviYTWSb
 INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0OTU1NTE2MTh9.hhSVGOANkaKk3vfCd2jDOIww4pUk0xtg9JRde5UogyQ
 
 [lfs]
-PATH = tests/{{TEST_TYPE}}/gitea-{{TEST_TYPE}}-pgsql/data/lfs
+MINIO_BASE_PATH = lfs/
+
+[attachment]
+MINIO_BASE_PATH = attachments/
+
+[avatars]
+MINIO_BASE_PATH = avatars/
+
+[repo-avatars]
+MINIO_BASE_PATH = repo-avatars/
+
+[storage]
+STORAGE_TYPE = minio
+SERVE_DIRECT = false
+MINIO_ENDPOINT = minio:9000
+MINIO_ACCESS_KEY_ID = 123456
+MINIO_SECRET_ACCESS_KEY = 12345678
+MINIO_BUCKET = gitea
+MINIO_LOCATION = us-east-1
+MINIO_USE_SSL = false
 
 [packages]
 ENABLED = true

From dad057b6393548ad389ead07c2cce5b3ac2811e0 Mon Sep 17 00:00:00 2001
From: zeripath <art27@cantab.net>
Date: Fri, 10 Mar 2023 06:14:43 +0000
Subject: [PATCH 39/53] Handle OpenID discovery URL errors a little nicer when
 creating/editing sources (#23397)

When there is an error creating a new openIDConnect authentication
source try to handle the error a little better.

Close #23283

Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 cmd/admin.go                                  | 11 ++++++++-
 options/locale/locale_en-US.ini               |  2 ++
 routers/web/admin/auths.go                    | 23 +++++++++++++++++++
 .../auth/source/oauth2/source_register.go     |  4 ++++
 templates/admin/auth/source/oauth.tmpl        |  2 +-
 5 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/cmd/admin.go b/cmd/admin.go
index b913b817bdc5d..f9fb1b6c68f07 100644
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -7,6 +7,7 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"net/url"
 	"os"
 	"strings"
 	"text/tabwriter"
@@ -469,11 +470,19 @@ func runAddOauth(c *cli.Context) error {
 		return err
 	}
 
+	config := parseOAuth2Config(c)
+	if config.Provider == "openidConnect" {
+		discoveryURL, err := url.Parse(config.OpenIDConnectAutoDiscoveryURL)
+		if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+			return fmt.Errorf("invalid Auto Discovery URL: %s (this must be a valid URL starting with http:// or https://)", config.OpenIDConnectAutoDiscoveryURL)
+		}
+	}
+
 	return auth_model.CreateSource(&auth_model.Source{
 		Type:     auth_model.OAuth2,
 		Name:     c.String("name"),
 		IsActive: true,
-		Cfg:      parseOAuth2Config(c),
+		Cfg:      config,
 	})
 }
 
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 3695bd0384aa9..6f0d06a6e8c26 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -2808,6 +2808,8 @@ auths.still_in_used = The authentication source is still in use. Convert or dele
 auths.deletion_success = The authentication source has been deleted.
 auths.login_source_exist = The authentication source '%s' already exists.
 auths.login_source_of_type_exist = An authentication source of this type already exists.
+auths.unable_to_initialize_openid = Unable to initialize OpenID Connect Provider: %s
+auths.invalid_openIdConnectAutoDiscoveryURL = Invalid Auto Discovery URL (this must be a valid URL starting with http:// or https://)
 
 config.server_config = Server Configuration
 config.app_name = Site Title
diff --git a/routers/web/admin/auths.go b/routers/web/admin/auths.go
index 8ce45720fec37..d2953f753d7a4 100644
--- a/routers/web/admin/auths.go
+++ b/routers/web/admin/auths.go
@@ -271,6 +271,15 @@ func NewAuthSourcePost(ctx *context.Context) {
 		}
 	case auth.OAuth2:
 		config = parseOAuth2Config(form)
+		oauth2Config := config.(*oauth2.Source)
+		if oauth2Config.Provider == "openidConnect" {
+			discoveryURL, err := url.Parse(oauth2Config.OpenIDConnectAutoDiscoveryURL)
+			if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+				ctx.Data["Err_DiscoveryURL"] = true
+				ctx.RenderWithErr(ctx.Tr("admin.auths.invalid_openIdConnectAutoDiscoveryURL"), tplAuthNew, form)
+				return
+			}
+		}
 	case auth.SSPI:
 		var err error
 		config, err = parseSSPIConfig(ctx, form)
@@ -305,6 +314,10 @@ func NewAuthSourcePost(ctx *context.Context) {
 		if auth.IsErrSourceAlreadyExist(err) {
 			ctx.Data["Err_Name"] = true
 			ctx.RenderWithErr(ctx.Tr("admin.auths.login_source_exist", err.(auth.ErrSourceAlreadyExist).Name), tplAuthNew, form)
+		} else if oauth2.IsErrOpenIDConnectInitialize(err) {
+			ctx.Data["Err_DiscoveryURL"] = true
+			unwrapped := err.(oauth2.ErrOpenIDConnectInitialize).Unwrap()
+			ctx.RenderWithErr(ctx.Tr("admin.auths.unable_to_initialize_openid", unwrapped), tplAuthNew, form)
 		} else {
 			ctx.ServerError("auth.CreateSource", err)
 		}
@@ -389,6 +402,15 @@ func EditAuthSourcePost(ctx *context.Context) {
 		}
 	case auth.OAuth2:
 		config = parseOAuth2Config(form)
+		oauth2Config := config.(*oauth2.Source)
+		if oauth2Config.Provider == "openidConnect" {
+			discoveryURL, err := url.Parse(oauth2Config.OpenIDConnectAutoDiscoveryURL)
+			if err != nil || (discoveryURL.Scheme != "http" && discoveryURL.Scheme != "https") {
+				ctx.Data["Err_DiscoveryURL"] = true
+				ctx.RenderWithErr(ctx.Tr("admin.auths.invalid_openIdConnectAutoDiscoveryURL"), tplAuthEdit, form)
+				return
+			}
+		}
 	case auth.SSPI:
 		config, err = parseSSPIConfig(ctx, form)
 		if err != nil {
@@ -408,6 +430,7 @@ func EditAuthSourcePost(ctx *context.Context) {
 	if err := auth.UpdateSource(source); err != nil {
 		if oauth2.IsErrOpenIDConnectInitialize(err) {
 			ctx.Flash.Error(err.Error(), true)
+			ctx.Data["Err_DiscoveryURL"] = true
 			ctx.HTML(http.StatusOK, tplAuthEdit)
 		} else {
 			ctx.ServerError("UpdateSource", err)
diff --git a/services/auth/source/oauth2/source_register.go b/services/auth/source/oauth2/source_register.go
index 3527d54b65c59..82a36acaa67d4 100644
--- a/services/auth/source/oauth2/source_register.go
+++ b/services/auth/source/oauth2/source_register.go
@@ -36,6 +36,10 @@ func (err ErrOpenIDConnectInitialize) Error() string {
 	return fmt.Sprintf("Failed to initialize OpenID Connect Provider with name '%s' with url '%s': %v", err.ProviderName, err.OpenIDConnectAutoDiscoveryURL, err.Cause)
 }
 
+func (err ErrOpenIDConnectInitialize) Unwrap() error {
+	return err.Cause
+}
+
 // wrapOpenIDConnectInitializeError is used to wrap the error but this cannot be done in modules/auth/oauth2
 // inside oauth2: import cycle not allowed models -> modules/auth/oauth2 -> models
 func wrapOpenIDConnectInitializeError(err error, providerName string, source *Source) error {
diff --git a/templates/admin/auth/source/oauth.tmpl b/templates/admin/auth/source/oauth.tmpl
index b7ee00822f522..1080937f9134c 100644
--- a/templates/admin/auth/source/oauth.tmpl
+++ b/templates/admin/auth/source/oauth.tmpl
@@ -24,7 +24,7 @@
 		<label for="oauth2_icon_url">{{.locale.Tr "admin.auths.oauth2_icon_url"}}</label>
 		<input id="oauth2_icon_url" name="oauth2_icon_url" value="{{.oauth2_icon_url}}">
 	</div>
-	<div class="open_id_connect_auto_discovery_url required field">
+	<div class="open_id_connect_auto_discovery_url required field{{if .Err_DiscoveryURL}} error{{end}}">
 		<label for="open_id_connect_auto_discovery_url">{{.locale.Tr "admin.auths.openIdConnectAutoDiscoveryURL"}}</label>
 		<input id="open_id_connect_auto_discovery_url" name="open_id_connect_auto_discovery_url" value="{{.open_id_connect_auto_discovery_url}}">
 	</div>

From 2173f14708ff3b35d7821fc9b6dcb5fcd06b8494 Mon Sep 17 00:00:00 2001
From: KN4CK3R <admin@oldschoolhack.me>
Date: Fri, 10 Mar 2023 15:28:32 +0100
Subject: [PATCH 40/53] Add user webhooks (#21563)

Currently we can add webhooks for organizations but not for users. This
PR adds the latter. You can access it from the current users settings.


![grafik](https://user-images.githubusercontent.com/1666336/197391408-15dfdc23-b476-4d0c-82f7-9bc9b065988f.png)
---
 .../doc/developers/oauth2-provider.en-us.md   |   1 +
 models/auth/token_scope.go                    |  10 +-
 models/auth/token_scope_test.go               |   4 +-
 models/fixtures/webhook.yml                   |   2 +-
 models/migrations/migrations.go               |   2 +
 models/migrations/v1_20/v245.go               |  74 +++++++++
 models/webhook/webhook.go                     |  24 +--
 models/webhook/webhook_system.go              |  10 +-
 models/webhook/webhook_test.go                |  24 +--
 options/locale/locale_en-US.ini               |   2 +
 routers/api/v1/admin/hooks.go                 |   5 +-
 routers/api/v1/api.go                         |   7 +
 routers/api/v1/org/hook.go                    |  79 +++------
 routers/api/v1/repo/hook.go                   |   6 +-
 routers/api/v1/user/hook.go                   | 154 ++++++++++++++++++
 routers/api/v1/utils/hook.go                  |  89 +++++++---
 routers/web/org/setting.go                    |   8 +-
 routers/web/repo/webhook.go                   |  67 ++++----
 routers/web/user/setting/webhooks.go          |  48 ++++++
 routers/web/web.go                            | 123 ++++++--------
 services/repository/hooks.go                  |   2 +-
 services/webhook/webhook.go                   |  10 +-
 templates/repo/settings/webhook/history.tmpl  |   2 +-
 templates/swagger/v1_json.tmpl                | 146 +++++++++++++++++
 templates/user/settings/applications.tmpl     |   6 +
 templates/user/settings/hook_new.tmpl         |  53 ++++++
 templates/user/settings/hooks.tmpl            |   8 +
 templates/user/settings/navbar.tmpl           |   5 +
 28 files changed, 737 insertions(+), 234 deletions(-)
 create mode 100644 models/migrations/v1_20/v245.go
 create mode 100644 routers/api/v1/user/hook.go
 create mode 100644 routers/web/user/setting/webhooks.go
 create mode 100644 templates/user/settings/hook_new.tmpl
 create mode 100644 templates/user/settings/hooks.tmpl

diff --git a/docs/content/doc/developers/oauth2-provider.en-us.md b/docs/content/doc/developers/oauth2-provider.en-us.md
index 17c12d22f2423..1ef30a7f0e4a2 100644
--- a/docs/content/doc/developers/oauth2-provider.en-us.md
+++ b/docs/content/doc/developers/oauth2-provider.en-us.md
@@ -60,6 +60,7 @@ Gitea supports the following scopes for tokens:
 | &nbsp;&nbsp;&nbsp; **write:public_key** | Grant read/write access to public keys |
 | &nbsp;&nbsp;&nbsp; **read:public_key** | Grant read-only access to public keys |
 | **admin:org_hook** | Grants full access to organizational-level hooks |
+| **admin:user_hook** | Grants full access to user-level hooks |
 | **notification** | Grants full access to notifications |
 | **user** | Grants full access to user profile info |
 | &nbsp;&nbsp;&nbsp; **read:user** | Grants read access to user's profile |
diff --git a/models/auth/token_scope.go b/models/auth/token_scope.go
index 38733a1c8f305..06c89fecc2e4d 100644
--- a/models/auth/token_scope.go
+++ b/models/auth/token_scope.go
@@ -32,6 +32,8 @@ const (
 
 	AccessTokenScopeAdminOrgHook AccessTokenScope = "admin:org_hook"
 
+	AccessTokenScopeAdminUserHook AccessTokenScope = "admin:user_hook"
+
 	AccessTokenScopeNotification AccessTokenScope = "notification"
 
 	AccessTokenScopeUser       AccessTokenScope = "user"
@@ -64,7 +66,7 @@ type AccessTokenScopeBitmap uint64
 const (
 	// AccessTokenScopeAllBits is the bitmap of all access token scopes, except `sudo`.
 	AccessTokenScopeAllBits AccessTokenScopeBitmap = AccessTokenScopeRepoBits |
-		AccessTokenScopeAdminOrgBits | AccessTokenScopeAdminPublicKeyBits | AccessTokenScopeAdminOrgHookBits |
+		AccessTokenScopeAdminOrgBits | AccessTokenScopeAdminPublicKeyBits | AccessTokenScopeAdminOrgHookBits | AccessTokenScopeAdminUserHookBits |
 		AccessTokenScopeNotificationBits | AccessTokenScopeUserBits | AccessTokenScopeDeleteRepoBits |
 		AccessTokenScopePackageBits | AccessTokenScopeAdminGPGKeyBits | AccessTokenScopeAdminApplicationBits
 
@@ -86,6 +88,8 @@ const (
 
 	AccessTokenScopeAdminOrgHookBits AccessTokenScopeBitmap = 1 << iota
 
+	AccessTokenScopeAdminUserHookBits AccessTokenScopeBitmap = 1 << iota
+
 	AccessTokenScopeNotificationBits AccessTokenScopeBitmap = 1 << iota
 
 	AccessTokenScopeUserBits       AccessTokenScopeBitmap = 1<<iota | AccessTokenScopeReadUserBits | AccessTokenScopeUserEmailBits | AccessTokenScopeUserFollowBits
@@ -123,6 +127,7 @@ var allAccessTokenScopes = []AccessTokenScope{
 	AccessTokenScopeAdminPublicKey, AccessTokenScopeWritePublicKey, AccessTokenScopeReadPublicKey,
 	AccessTokenScopeAdminRepoHook, AccessTokenScopeWriteRepoHook, AccessTokenScopeReadRepoHook,
 	AccessTokenScopeAdminOrgHook,
+	AccessTokenScopeAdminUserHook,
 	AccessTokenScopeNotification,
 	AccessTokenScopeUser, AccessTokenScopeReadUser, AccessTokenScopeUserEmail, AccessTokenScopeUserFollow,
 	AccessTokenScopeDeleteRepo,
@@ -147,6 +152,7 @@ var allAccessTokenScopeBits = map[AccessTokenScope]AccessTokenScopeBitmap{
 	AccessTokenScopeWriteRepoHook:    AccessTokenScopeWriteRepoHookBits,
 	AccessTokenScopeReadRepoHook:     AccessTokenScopeReadRepoHookBits,
 	AccessTokenScopeAdminOrgHook:     AccessTokenScopeAdminOrgHookBits,
+	AccessTokenScopeAdminUserHook:    AccessTokenScopeAdminUserHookBits,
 	AccessTokenScopeNotification:     AccessTokenScopeNotificationBits,
 	AccessTokenScopeUser:             AccessTokenScopeUserBits,
 	AccessTokenScopeReadUser:         AccessTokenScopeReadUserBits,
@@ -263,7 +269,7 @@ func (bitmap AccessTokenScopeBitmap) ToScope() AccessTokenScope {
 	scope := AccessTokenScope(strings.Join(scopes, ","))
 	scope = AccessTokenScope(strings.ReplaceAll(
 		string(scope),
-		"repo,admin:org,admin:public_key,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key,admin:application",
+		"repo,admin:org,admin:public_key,admin:org_hook,admin:user_hook,notification,user,delete_repo,package,admin:gpg_key,admin:application",
 		"all",
 	))
 	return scope
diff --git a/models/auth/token_scope_test.go b/models/auth/token_scope_test.go
index 1d7f4794a477f..b96a5fd469479 100644
--- a/models/auth/token_scope_test.go
+++ b/models/auth/token_scope_test.go
@@ -40,8 +40,8 @@ func TestAccessTokenScope_Normalize(t *testing.T) {
 		{"admin:gpg_key,write:gpg_key,user", "user,admin:gpg_key", nil},
 		{"admin:application,write:application,user", "user,admin:application", nil},
 		{"all", "all", nil},
-		{"repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key,admin:application", "all", nil},
-		{"repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,notification,user,delete_repo,package,admin:gpg_key,admin:application,sudo", "all,sudo", nil},
+		{"repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,admin:user_hook,notification,user,delete_repo,package,admin:gpg_key,admin:application", "all", nil},
+		{"repo,admin:org,admin:public_key,admin:repo_hook,admin:org_hook,admin:user_hook,notification,user,delete_repo,package,admin:gpg_key,admin:application,sudo", "all,sudo", nil},
 	}
 
 	for _, test := range tests {
diff --git a/models/fixtures/webhook.yml b/models/fixtures/webhook.yml
index 5563dcada7b65..f62bae1f311ce 100644
--- a/models/fixtures/webhook.yml
+++ b/models/fixtures/webhook.yml
@@ -16,7 +16,7 @@
 
 -
   id: 3
-  org_id: 3
+  owner_id: 3
   repo_id: 3
   url: www.example.com/url3
   content_type: 1 # json
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
index 585457e474f05..4cbcd95d20df5 100644
--- a/models/migrations/migrations.go
+++ b/models/migrations/migrations.go
@@ -467,6 +467,8 @@ var migrations = []Migration{
 
 	// v244 -> v245
 	NewMigration("Add NeedApproval to actions tables", v1_20.AddNeedApprovalToActionRun),
+	// v245 -> v246
+	NewMigration("Rename Webhook org_id to owner_id", v1_20.RenameWebhookOrgToOwner),
 }
 
 // GetCurrentDBVersion returns the current db version
diff --git a/models/migrations/v1_20/v245.go b/models/migrations/v1_20/v245.go
new file mode 100644
index 0000000000000..466f21c239d09
--- /dev/null
+++ b/models/migrations/v1_20/v245.go
@@ -0,0 +1,74 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_20 //nolint
+
+import (
+	"context"
+	"fmt"
+
+	"code.gitea.io/gitea/models/migrations/base"
+	"code.gitea.io/gitea/modules/setting"
+
+	"xorm.io/xorm"
+)
+
+func RenameWebhookOrgToOwner(x *xorm.Engine) error {
+	type Webhook struct {
+		OrgID int64 `xorm:"INDEX"`
+	}
+
+	// This migration maybe rerun so that we should check if it has been run
+	ownerExist, err := x.Dialect().IsColumnExist(x.DB(), context.Background(), "webhook", "owner_id")
+	if err != nil {
+		return err
+	}
+
+	if ownerExist {
+		orgExist, err := x.Dialect().IsColumnExist(x.DB(), context.Background(), "webhook", "org_id")
+		if err != nil {
+			return err
+		}
+		if !orgExist {
+			return nil
+		}
+	}
+
+	sess := x.NewSession()
+	defer sess.Close()
+	if err := sess.Begin(); err != nil {
+		return err
+	}
+
+	if err := sess.Sync2(new(Webhook)); err != nil {
+		return err
+	}
+
+	if ownerExist {
+		if err := base.DropTableColumns(sess, "webhook", "owner_id"); err != nil {
+			return err
+		}
+	}
+
+	switch {
+	case setting.Database.Type.IsMySQL():
+		inferredTable, err := x.TableInfo(new(Webhook))
+		if err != nil {
+			return err
+		}
+		sqlType := x.Dialect().SQLType(inferredTable.GetColumn("org_id"))
+		if _, err := sess.Exec(fmt.Sprintf("ALTER TABLE `webhook` CHANGE org_id owner_id %s", sqlType)); err != nil {
+			return err
+		}
+	case setting.Database.Type.IsMSSQL():
+		if _, err := sess.Exec("sp_rename 'webhook.org_id', 'owner_id', 'COLUMN'"); err != nil {
+			return err
+		}
+	default:
+		if _, err := sess.Exec("ALTER TABLE `webhook` RENAME COLUMN org_id TO owner_id"); err != nil {
+			return err
+		}
+	}
+
+	return sess.Commit()
+}
diff --git a/models/webhook/webhook.go b/models/webhook/webhook.go
index 64119f1494958..e3f6b593d977a 100644
--- a/models/webhook/webhook.go
+++ b/models/webhook/webhook.go
@@ -122,7 +122,7 @@ func IsValidHookContentType(name string) bool {
 type Webhook struct {
 	ID                        int64 `xorm:"pk autoincr"`
 	RepoID                    int64 `xorm:"INDEX"` // An ID of 0 indicates either a default or system webhook
-	OrgID                     int64 `xorm:"INDEX"`
+	OwnerID                   int64 `xorm:"INDEX"`
 	IsSystemWebhook           bool
 	URL                       string `xorm:"url TEXT"`
 	HTTPMethod                string `xorm:"http_method"`
@@ -412,11 +412,11 @@ func GetWebhookByRepoID(repoID, id int64) (*Webhook, error) {
 	})
 }
 
-// GetWebhookByOrgID returns webhook of organization by given ID.
-func GetWebhookByOrgID(orgID, id int64) (*Webhook, error) {
+// GetWebhookByOwnerID returns webhook of a user or organization by given ID.
+func GetWebhookByOwnerID(ownerID, id int64) (*Webhook, error) {
 	return getWebhook(&Webhook{
-		ID:    id,
-		OrgID: orgID,
+		ID:      id,
+		OwnerID: ownerID,
 	})
 }
 
@@ -424,7 +424,7 @@ func GetWebhookByOrgID(orgID, id int64) (*Webhook, error) {
 type ListWebhookOptions struct {
 	db.ListOptions
 	RepoID   int64
-	OrgID    int64
+	OwnerID  int64
 	IsActive util.OptionalBool
 }
 
@@ -433,8 +433,8 @@ func (opts *ListWebhookOptions) toCond() builder.Cond {
 	if opts.RepoID != 0 {
 		cond = cond.And(builder.Eq{"webhook.repo_id": opts.RepoID})
 	}
-	if opts.OrgID != 0 {
-		cond = cond.And(builder.Eq{"webhook.org_id": opts.OrgID})
+	if opts.OwnerID != 0 {
+		cond = cond.And(builder.Eq{"webhook.owner_id": opts.OwnerID})
 	}
 	if !opts.IsActive.IsNone() {
 		cond = cond.And(builder.Eq{"webhook.is_active": opts.IsActive.IsTrue()})
@@ -503,10 +503,10 @@ func DeleteWebhookByRepoID(repoID, id int64) error {
 	})
 }
 
-// DeleteWebhookByOrgID deletes webhook of organization by given ID.
-func DeleteWebhookByOrgID(orgID, id int64) error {
+// DeleteWebhookByOwnerID deletes webhook of a user or organization by given ID.
+func DeleteWebhookByOwnerID(ownerID, id int64) error {
 	return deleteWebhook(&Webhook{
-		ID:    id,
-		OrgID: orgID,
+		ID:      id,
+		OwnerID: ownerID,
 	})
 }
diff --git a/models/webhook/webhook_system.go b/models/webhook/webhook_system.go
index 21dc0406a0d19..2e89f9547bba2 100644
--- a/models/webhook/webhook_system.go
+++ b/models/webhook/webhook_system.go
@@ -15,7 +15,7 @@ import (
 func GetDefaultWebhooks(ctx context.Context) ([]*Webhook, error) {
 	webhooks := make([]*Webhook, 0, 5)
 	return webhooks, db.GetEngine(ctx).
-		Where("repo_id=? AND org_id=? AND is_system_webhook=?", 0, 0, false).
+		Where("repo_id=? AND owner_id=? AND is_system_webhook=?", 0, 0, false).
 		Find(&webhooks)
 }
 
@@ -23,7 +23,7 @@ func GetDefaultWebhooks(ctx context.Context) ([]*Webhook, error) {
 func GetSystemOrDefaultWebhook(ctx context.Context, id int64) (*Webhook, error) {
 	webhook := &Webhook{ID: id}
 	has, err := db.GetEngine(ctx).
-		Where("repo_id=? AND org_id=?", 0, 0).
+		Where("repo_id=? AND owner_id=?", 0, 0).
 		Get(webhook)
 	if err != nil {
 		return nil, err
@@ -38,11 +38,11 @@ func GetSystemWebhooks(ctx context.Context, isActive util.OptionalBool) ([]*Webh
 	webhooks := make([]*Webhook, 0, 5)
 	if isActive.IsNone() {
 		return webhooks, db.GetEngine(ctx).
-			Where("repo_id=? AND org_id=? AND is_system_webhook=?", 0, 0, true).
+			Where("repo_id=? AND owner_id=? AND is_system_webhook=?", 0, 0, true).
 			Find(&webhooks)
 	}
 	return webhooks, db.GetEngine(ctx).
-		Where("repo_id=? AND org_id=? AND is_system_webhook=? AND is_active = ?", 0, 0, true, isActive.IsTrue()).
+		Where("repo_id=? AND owner_id=? AND is_system_webhook=? AND is_active = ?", 0, 0, true, isActive.IsTrue()).
 		Find(&webhooks)
 }
 
@@ -50,7 +50,7 @@ func GetSystemWebhooks(ctx context.Context, isActive util.OptionalBool) ([]*Webh
 func DeleteDefaultSystemWebhook(ctx context.Context, id int64) error {
 	return db.WithTx(ctx, func(ctx context.Context) error {
 		count, err := db.GetEngine(ctx).
-			Where("repo_id=? AND org_id=?", 0, 0).
+			Where("repo_id=? AND owner_id=?", 0, 0).
 			Delete(&Webhook{ID: id})
 		if err != nil {
 			return err
diff --git a/models/webhook/webhook_test.go b/models/webhook/webhook_test.go
index c368fc620e2f2..74f7aeaa03028 100644
--- a/models/webhook/webhook_test.go
+++ b/models/webhook/webhook_test.go
@@ -109,13 +109,13 @@ func TestGetWebhookByRepoID(t *testing.T) {
 	assert.True(t, IsErrWebhookNotExist(err))
 }
 
-func TestGetWebhookByOrgID(t *testing.T) {
+func TestGetWebhookByOwnerID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	hook, err := GetWebhookByOrgID(3, 3)
+	hook, err := GetWebhookByOwnerID(3, 3)
 	assert.NoError(t, err)
 	assert.Equal(t, int64(3), hook.ID)
 
-	_, err = GetWebhookByOrgID(unittest.NonexistentID, unittest.NonexistentID)
+	_, err = GetWebhookByOwnerID(unittest.NonexistentID, unittest.NonexistentID)
 	assert.Error(t, err)
 	assert.True(t, IsErrWebhookNotExist(err))
 }
@@ -140,9 +140,9 @@ func TestGetWebhooksByRepoID(t *testing.T) {
 	}
 }
 
-func TestGetActiveWebhooksByOrgID(t *testing.T) {
+func TestGetActiveWebhooksByOwnerID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	hooks, err := ListWebhooksByOpts(db.DefaultContext, &ListWebhookOptions{OrgID: 3, IsActive: util.OptionalBoolTrue})
+	hooks, err := ListWebhooksByOpts(db.DefaultContext, &ListWebhookOptions{OwnerID: 3, IsActive: util.OptionalBoolTrue})
 	assert.NoError(t, err)
 	if assert.Len(t, hooks, 1) {
 		assert.Equal(t, int64(3), hooks[0].ID)
@@ -150,9 +150,9 @@ func TestGetActiveWebhooksByOrgID(t *testing.T) {
 	}
 }
 
-func TestGetWebhooksByOrgID(t *testing.T) {
+func TestGetWebhooksByOwnerID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	hooks, err := ListWebhooksByOpts(db.DefaultContext, &ListWebhookOptions{OrgID: 3})
+	hooks, err := ListWebhooksByOpts(db.DefaultContext, &ListWebhookOptions{OwnerID: 3})
 	assert.NoError(t, err)
 	if assert.Len(t, hooks, 1) {
 		assert.Equal(t, int64(3), hooks[0].ID)
@@ -181,13 +181,13 @@ func TestDeleteWebhookByRepoID(t *testing.T) {
 	assert.True(t, IsErrWebhookNotExist(err))
 }
 
-func TestDeleteWebhookByOrgID(t *testing.T) {
+func TestDeleteWebhookByOwnerID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	unittest.AssertExistsAndLoadBean(t, &Webhook{ID: 3, OrgID: 3})
-	assert.NoError(t, DeleteWebhookByOrgID(3, 3))
-	unittest.AssertNotExistsBean(t, &Webhook{ID: 3, OrgID: 3})
+	unittest.AssertExistsAndLoadBean(t, &Webhook{ID: 3, OwnerID: 3})
+	assert.NoError(t, DeleteWebhookByOwnerID(3, 3))
+	unittest.AssertNotExistsBean(t, &Webhook{ID: 3, OwnerID: 3})
 
-	err := DeleteWebhookByOrgID(unittest.NonexistentID, unittest.NonexistentID)
+	err := DeleteWebhookByOwnerID(unittest.NonexistentID, unittest.NonexistentID)
 	assert.Error(t, err)
 	assert.True(t, IsErrWebhookNotExist(err))
 }
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 6f0d06a6e8c26..095257b365fb8 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -821,6 +821,8 @@ remove_account_link = Remove Linked Account
 remove_account_link_desc = Removing a linked account will revoke its access to your Gitea account. Continue?
 remove_account_link_success = The linked account has been removed.
 
+hooks.desc = Add webhooks which will be triggered for <strong>all repositories</strong> owned by this user.
+
 orgs_none = You are not a member of any organizations.
 repos_none = You do not own any repositories
 
diff --git a/routers/api/v1/admin/hooks.go b/routers/api/v1/admin/hooks.go
index 2aed4139f3cb6..8264503c9d2f9 100644
--- a/routers/api/v1/admin/hooks.go
+++ b/routers/api/v1/admin/hooks.go
@@ -105,10 +105,7 @@ func CreateHook(ctx *context.APIContext) {
 	//     "$ref": "#/responses/Hook"
 
 	form := web.GetForm(ctx).(*api.CreateHookOption)
-	// TODO in body params
-	if !utils.CheckCreateHookOption(ctx, form) {
-		return
-	}
+
 	utils.AddSystemHook(ctx, form)
 }
 
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index 1d2f8b18e0190..735939a5517c9 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -835,6 +835,13 @@ func Routes(ctx gocontext.Context) *web.Route {
 			m.Get("/stopwatches", reqToken(auth_model.AccessTokenScopeRepo), repo.GetStopwatches)
 			m.Get("/subscriptions", reqToken(auth_model.AccessTokenScopeRepo), user.GetMyWatchedRepos)
 			m.Get("/teams", reqToken(auth_model.AccessTokenScopeRepo), org.ListUserTeams)
+			m.Group("/hooks", func() {
+				m.Combo("").Get(user.ListHooks).
+					Post(bind(api.CreateHookOption{}), user.CreateHook)
+				m.Combo("/{id}").Get(user.GetHook).
+					Patch(bind(api.EditHookOption{}), user.EditHook).
+					Delete(user.DeleteHook)
+			}, reqToken(auth_model.AccessTokenScopeAdminUserHook), reqWebhooksEnabled())
 		}, reqToken(""))
 
 		// Repositories
diff --git a/routers/api/v1/org/hook.go b/routers/api/v1/org/hook.go
index 4e435c9599a16..a6ea618a7d896 100644
--- a/routers/api/v1/org/hook.go
+++ b/routers/api/v1/org/hook.go
@@ -6,7 +6,6 @@ package org
 import (
 	"net/http"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
 	"code.gitea.io/gitea/modules/context"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/web"
@@ -39,34 +38,10 @@ func ListHooks(ctx *context.APIContext) {
 	//   "200":
 	//     "$ref": "#/responses/HookList"
 
-	opts := &webhook_model.ListWebhookOptions{
-		ListOptions: utils.GetListOptions(ctx),
-		OrgID:       ctx.Org.Organization.ID,
-	}
-
-	count, err := webhook_model.CountWebhooksByOpts(opts)
-	if err != nil {
-		ctx.InternalServerError(err)
-		return
-	}
-
-	orgHooks, err := webhook_model.ListWebhooksByOpts(ctx, opts)
-	if err != nil {
-		ctx.InternalServerError(err)
-		return
-	}
-
-	hooks := make([]*api.Hook, len(orgHooks))
-	for i, hook := range orgHooks {
-		hooks[i], err = webhook_service.ToHook(ctx.Org.Organization.AsUser().HomeLink(), hook)
-		if err != nil {
-			ctx.InternalServerError(err)
-			return
-		}
-	}
-
-	ctx.SetTotalCountHeader(count)
-	ctx.JSON(http.StatusOK, hooks)
+	utils.ListOwnerHooks(
+		ctx,
+		ctx.ContextUser,
+	)
 }
 
 // GetHook get an organization's hook by id
@@ -92,14 +67,12 @@ func GetHook(ctx *context.APIContext) {
 	//   "200":
 	//     "$ref": "#/responses/Hook"
 
-	org := ctx.Org.Organization
-	hookID := ctx.ParamsInt64(":id")
-	hook, err := utils.GetOrgHook(ctx, org.ID, hookID)
+	hook, err := utils.GetOwnerHook(ctx, ctx.ContextUser.ID, ctx.ParamsInt64("id"))
 	if err != nil {
 		return
 	}
 
-	apiHook, err := webhook_service.ToHook(org.AsUser().HomeLink(), hook)
+	apiHook, err := webhook_service.ToHook(ctx.ContextUser.HomeLink(), hook)
 	if err != nil {
 		ctx.InternalServerError(err)
 		return
@@ -131,15 +104,14 @@ func CreateHook(ctx *context.APIContext) {
 	//   "201":
 	//     "$ref": "#/responses/Hook"
 
-	form := web.GetForm(ctx).(*api.CreateHookOption)
-	// TODO in body params
-	if !utils.CheckCreateHookOption(ctx, form) {
-		return
-	}
-	utils.AddOrgHook(ctx, form)
+	utils.AddOwnerHook(
+		ctx,
+		ctx.ContextUser,
+		web.GetForm(ctx).(*api.CreateHookOption),
+	)
 }
 
-// EditHook modify a hook of a repository
+// EditHook modify a hook of an organization
 func EditHook(ctx *context.APIContext) {
 	// swagger:operation PATCH /orgs/{org}/hooks/{id} organization orgEditHook
 	// ---
@@ -168,11 +140,12 @@ func EditHook(ctx *context.APIContext) {
 	//   "200":
 	//     "$ref": "#/responses/Hook"
 
-	form := web.GetForm(ctx).(*api.EditHookOption)
-
-	// TODO in body params
-	hookID := ctx.ParamsInt64(":id")
-	utils.EditOrgHook(ctx, form, hookID)
+	utils.EditOwnerHook(
+		ctx,
+		ctx.ContextUser,
+		web.GetForm(ctx).(*api.EditHookOption),
+		ctx.ParamsInt64("id"),
+	)
 }
 
 // DeleteHook delete a hook of an organization
@@ -198,15 +171,9 @@ func DeleteHook(ctx *context.APIContext) {
 	//   "204":
 	//     "$ref": "#/responses/empty"
 
-	org := ctx.Org.Organization
-	hookID := ctx.ParamsInt64(":id")
-	if err := webhook_model.DeleteWebhookByOrgID(org.ID, hookID); err != nil {
-		if webhook_model.IsErrWebhookNotExist(err) {
-			ctx.NotFound()
-		} else {
-			ctx.Error(http.StatusInternalServerError, "DeleteWebhookByOrgID", err)
-		}
-		return
-	}
-	ctx.Status(http.StatusNoContent)
+	utils.DeleteOwnerHook(
+		ctx,
+		ctx.ContextUser,
+		ctx.ParamsInt64("id"),
+	)
 }
diff --git a/routers/api/v1/repo/hook.go b/routers/api/v1/repo/hook.go
index fd54d1f740ef7..39d83912b016e 100644
--- a/routers/api/v1/repo/hook.go
+++ b/routers/api/v1/repo/hook.go
@@ -223,12 +223,8 @@ func CreateHook(ctx *context.APIContext) {
 	// responses:
 	//   "201":
 	//     "$ref": "#/responses/Hook"
-	form := web.GetForm(ctx).(*api.CreateHookOption)
 
-	if !utils.CheckCreateHookOption(ctx, form) {
-		return
-	}
-	utils.AddRepoHook(ctx, form)
+	utils.AddRepoHook(ctx, web.GetForm(ctx).(*api.CreateHookOption))
 }
 
 // EditHook modify a hook of a repository
diff --git a/routers/api/v1/user/hook.go b/routers/api/v1/user/hook.go
new file mode 100644
index 0000000000000..50be519c815fa
--- /dev/null
+++ b/routers/api/v1/user/hook.go
@@ -0,0 +1,154 @@
+// Copyright 2022 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package user
+
+import (
+	"net/http"
+
+	"code.gitea.io/gitea/modules/context"
+	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/web"
+	"code.gitea.io/gitea/routers/api/v1/utils"
+	webhook_service "code.gitea.io/gitea/services/webhook"
+)
+
+// ListHooks list the authenticated user's webhooks
+func ListHooks(ctx *context.APIContext) {
+	// swagger:operation GET /user/hooks user userListHooks
+	// ---
+	// summary: List the authenticated user's webhooks
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: page
+	//   in: query
+	//   description: page number of results to return (1-based)
+	//   type: integer
+	// - name: limit
+	//   in: query
+	//   description: page size of results
+	//   type: integer
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/HookList"
+
+	utils.ListOwnerHooks(
+		ctx,
+		ctx.Doer,
+	)
+}
+
+// GetHook get the authenticated user's hook by id
+func GetHook(ctx *context.APIContext) {
+	// swagger:operation GET /user/hooks/{id} user userGetHook
+	// ---
+	// summary: Get a hook
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: id
+	//   in: path
+	//   description: id of the hook to get
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/Hook"
+
+	hook, err := utils.GetOwnerHook(ctx, ctx.Doer.ID, ctx.ParamsInt64("id"))
+	if err != nil {
+		return
+	}
+
+	apiHook, err := webhook_service.ToHook(ctx.Doer.HomeLink(), hook)
+	if err != nil {
+		ctx.InternalServerError(err)
+		return
+	}
+	ctx.JSON(http.StatusOK, apiHook)
+}
+
+// CreateHook create a hook for the authenticated user
+func CreateHook(ctx *context.APIContext) {
+	// swagger:operation POST /user/hooks user userCreateHook
+	// ---
+	// summary: Create a hook
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: body
+	//   in: body
+	//   required: true
+	//   schema:
+	//     "$ref": "#/definitions/CreateHookOption"
+	// responses:
+	//   "201":
+	//     "$ref": "#/responses/Hook"
+
+	utils.AddOwnerHook(
+		ctx,
+		ctx.Doer,
+		web.GetForm(ctx).(*api.CreateHookOption),
+	)
+}
+
+// EditHook modify a hook of the authenticated user
+func EditHook(ctx *context.APIContext) {
+	// swagger:operation PATCH /user/hooks/{id} user userEditHook
+	// ---
+	// summary: Update a hook
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: id
+	//   in: path
+	//   description: id of the hook to update
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/EditHookOption"
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/Hook"
+
+	utils.EditOwnerHook(
+		ctx,
+		ctx.Doer,
+		web.GetForm(ctx).(*api.EditHookOption),
+		ctx.ParamsInt64("id"),
+	)
+}
+
+// DeleteHook delete a hook of the authenticated user
+func DeleteHook(ctx *context.APIContext) {
+	// swagger:operation DELETE /user/hooks/{id} user userDeleteHook
+	// ---
+	// summary: Delete a hook
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: id
+	//   in: path
+	//   description: id of the hook to delete
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+
+	utils.DeleteOwnerHook(
+		ctx,
+		ctx.Doer,
+		ctx.ParamsInt64("id"),
+	)
+}
diff --git a/routers/api/v1/utils/hook.go b/routers/api/v1/utils/hook.go
index f6aaf74aff123..44625cc9b81b8 100644
--- a/routers/api/v1/utils/hook.go
+++ b/routers/api/v1/utils/hook.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"strings"
 
+	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/models/webhook"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/json"
@@ -18,15 +19,46 @@ import (
 	webhook_service "code.gitea.io/gitea/services/webhook"
 )
 
-// GetOrgHook get an organization's webhook. If there is an error, write to
-// `ctx` accordingly and return the error
-func GetOrgHook(ctx *context.APIContext, orgID, hookID int64) (*webhook.Webhook, error) {
-	w, err := webhook.GetWebhookByOrgID(orgID, hookID)
+// ListOwnerHooks lists the webhooks of the provided owner
+func ListOwnerHooks(ctx *context.APIContext, owner *user_model.User) {
+	opts := &webhook.ListWebhookOptions{
+		ListOptions: GetListOptions(ctx),
+		OwnerID:     owner.ID,
+	}
+
+	count, err := webhook.CountWebhooksByOpts(opts)
+	if err != nil {
+		ctx.InternalServerError(err)
+		return
+	}
+
+	hooks, err := webhook.ListWebhooksByOpts(ctx, opts)
+	if err != nil {
+		ctx.InternalServerError(err)
+		return
+	}
+
+	apiHooks := make([]*api.Hook, len(hooks))
+	for i, hook := range hooks {
+		apiHooks[i], err = webhook_service.ToHook(owner.HomeLink(), hook)
+		if err != nil {
+			ctx.InternalServerError(err)
+			return
+		}
+	}
+
+	ctx.SetTotalCountHeader(count)
+	ctx.JSON(http.StatusOK, apiHooks)
+}
+
+// GetOwnerHook gets an user or organization webhook. Errors are written to ctx.
+func GetOwnerHook(ctx *context.APIContext, ownerID, hookID int64) (*webhook.Webhook, error) {
+	w, err := webhook.GetWebhookByOwnerID(ownerID, hookID)
 	if err != nil {
 		if webhook.IsErrWebhookNotExist(err) {
 			ctx.NotFound()
 		} else {
-			ctx.Error(http.StatusInternalServerError, "GetWebhookByOrgID", err)
+			ctx.Error(http.StatusInternalServerError, "GetWebhookByOwnerID", err)
 		}
 		return nil, err
 	}
@@ -48,9 +80,9 @@ func GetRepoHook(ctx *context.APIContext, repoID, hookID int64) (*webhook.Webhoo
 	return w, nil
 }
 
-// CheckCreateHookOption check if a CreateHookOption form is valid. If invalid,
+// checkCreateHookOption check if a CreateHookOption form is valid. If invalid,
 // write the appropriate error to `ctx`. Return whether the form is valid
-func CheckCreateHookOption(ctx *context.APIContext, form *api.CreateHookOption) bool {
+func checkCreateHookOption(ctx *context.APIContext, form *api.CreateHookOption) bool {
 	if !webhook_service.IsValidHookTaskType(form.Type) {
 		ctx.Error(http.StatusUnprocessableEntity, "", fmt.Sprintf("Invalid hook type: %s", form.Type))
 		return false
@@ -81,14 +113,13 @@ func AddSystemHook(ctx *context.APIContext, form *api.CreateHookOption) {
 	}
 }
 
-// AddOrgHook add a hook to an organization. Writes to `ctx` accordingly
-func AddOrgHook(ctx *context.APIContext, form *api.CreateHookOption) {
-	org := ctx.Org.Organization
-	hook, ok := addHook(ctx, form, org.ID, 0)
+// AddOwnerHook adds a hook to an user or organization
+func AddOwnerHook(ctx *context.APIContext, owner *user_model.User, form *api.CreateHookOption) {
+	hook, ok := addHook(ctx, form, owner.ID, 0)
 	if !ok {
 		return
 	}
-	apiHook, ok := toAPIHook(ctx, org.AsUser().HomeLink(), hook)
+	apiHook, ok := toAPIHook(ctx, owner.HomeLink(), hook)
 	if !ok {
 		return
 	}
@@ -128,14 +159,18 @@ func pullHook(events []string, event string) bool {
 	return util.SliceContainsString(events, event, true) || util.SliceContainsString(events, string(webhook_module.HookEventPullRequest), true)
 }
 
-// addHook add the hook specified by `form`, `orgID` and `repoID`. If there is
+// addHook add the hook specified by `form`, `ownerID` and `repoID`. If there is
 // an error, write to `ctx` accordingly. Return (webhook, ok)
-func addHook(ctx *context.APIContext, form *api.CreateHookOption, orgID, repoID int64) (*webhook.Webhook, bool) {
+func addHook(ctx *context.APIContext, form *api.CreateHookOption, ownerID, repoID int64) (*webhook.Webhook, bool) {
+	if !checkCreateHookOption(ctx, form) {
+		return nil, false
+	}
+
 	if len(form.Events) == 0 {
 		form.Events = []string{"push"}
 	}
 	w := &webhook.Webhook{
-		OrgID:       orgID,
+		OwnerID:     ownerID,
 		RepoID:      repoID,
 		URL:         form.Config["url"],
 		ContentType: webhook.ToHookContentType(form.Config["content_type"]),
@@ -234,21 +269,20 @@ func EditSystemHook(ctx *context.APIContext, form *api.EditHookOption, hookID in
 	ctx.JSON(http.StatusOK, h)
 }
 
-// EditOrgHook edit webhook `w` according to `form`. Writes to `ctx` accordingly
-func EditOrgHook(ctx *context.APIContext, form *api.EditHookOption, hookID int64) {
-	org := ctx.Org.Organization
-	hook, err := GetOrgHook(ctx, org.ID, hookID)
+// EditOwnerHook updates a webhook of an user or organization
+func EditOwnerHook(ctx *context.APIContext, owner *user_model.User, form *api.EditHookOption, hookID int64) {
+	hook, err := GetOwnerHook(ctx, owner.ID, hookID)
 	if err != nil {
 		return
 	}
 	if !editHook(ctx, form, hook) {
 		return
 	}
-	updated, err := GetOrgHook(ctx, org.ID, hookID)
+	updated, err := GetOwnerHook(ctx, owner.ID, hookID)
 	if err != nil {
 		return
 	}
-	apiHook, ok := toAPIHook(ctx, org.AsUser().HomeLink(), updated)
+	apiHook, ok := toAPIHook(ctx, owner.HomeLink(), updated)
 	if !ok {
 		return
 	}
@@ -362,3 +396,16 @@ func editHook(ctx *context.APIContext, form *api.EditHookOption, w *webhook.Webh
 	}
 	return true
 }
+
+// DeleteOwnerHook deletes the hook owned by the owner.
+func DeleteOwnerHook(ctx *context.APIContext, owner *user_model.User, hookID int64) {
+	if err := webhook.DeleteWebhookByOwnerID(owner.ID, hookID); err != nil {
+		if webhook.IsErrWebhookNotExist(err) {
+			ctx.NotFound()
+		} else {
+			ctx.Error(http.StatusInternalServerError, "DeleteWebhookByOwnerID", err)
+		}
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}
diff --git a/routers/web/org/setting.go b/routers/web/org/setting.go
index f713d096639bc..b57ebfbcda23a 100644
--- a/routers/web/org/setting.go
+++ b/routers/web/org/setting.go
@@ -218,9 +218,9 @@ func Webhooks(ctx *context.Context) {
 	ctx.Data["BaseLinkNew"] = ctx.Org.OrgLink + "/settings/hooks"
 	ctx.Data["Description"] = ctx.Tr("org.settings.hooks_desc")
 
-	ws, err := webhook.ListWebhooksByOpts(ctx, &webhook.ListWebhookOptions{OrgID: ctx.Org.Organization.ID})
+	ws, err := webhook.ListWebhooksByOpts(ctx, &webhook.ListWebhookOptions{OwnerID: ctx.Org.Organization.ID})
 	if err != nil {
-		ctx.ServerError("GetWebhooksByOrgId", err)
+		ctx.ServerError("ListWebhooksByOpts", err)
 		return
 	}
 
@@ -230,8 +230,8 @@ func Webhooks(ctx *context.Context) {
 
 // DeleteWebhook response for delete webhook
 func DeleteWebhook(ctx *context.Context) {
-	if err := webhook.DeleteWebhookByOrgID(ctx.Org.Organization.ID, ctx.FormInt64("id")); err != nil {
-		ctx.Flash.Error("DeleteWebhookByOrgID: " + err.Error())
+	if err := webhook.DeleteWebhookByOwnerID(ctx.Org.Organization.ID, ctx.FormInt64("id")); err != nil {
+		ctx.Flash.Error("DeleteWebhookByOwnerID: " + err.Error())
 	} else {
 		ctx.Flash.Success(ctx.Tr("repo.settings.webhook_deletion_success"))
 	}
diff --git a/routers/web/repo/webhook.go b/routers/web/repo/webhook.go
index d27d0f1bf01d8..f30588967e836 100644
--- a/routers/web/repo/webhook.go
+++ b/routers/web/repo/webhook.go
@@ -33,6 +33,7 @@ const (
 	tplHooks        base.TplName = "repo/settings/webhook/base"
 	tplHookNew      base.TplName = "repo/settings/webhook/new"
 	tplOrgHookNew   base.TplName = "org/settings/hook_new"
+	tplUserHookNew  base.TplName = "user/settings/hook_new"
 	tplAdminHookNew base.TplName = "admin/hook_new"
 )
 
@@ -54,8 +55,8 @@ func Webhooks(ctx *context.Context) {
 	ctx.HTML(http.StatusOK, tplHooks)
 }
 
-type orgRepoCtx struct {
-	OrgID           int64
+type ownerRepoCtx struct {
+	OwnerID         int64
 	RepoID          int64
 	IsAdmin         bool
 	IsSystemWebhook bool
@@ -64,10 +65,10 @@ type orgRepoCtx struct {
 	NewTemplate     base.TplName
 }
 
-// getOrgRepoCtx determines whether this is a repo, organization, or admin (both default and system) context.
-func getOrgRepoCtx(ctx *context.Context) (*orgRepoCtx, error) {
-	if len(ctx.Repo.RepoLink) > 0 {
-		return &orgRepoCtx{
+// getOwnerRepoCtx determines whether this is a repo, owner, or admin (both default and system) context.
+func getOwnerRepoCtx(ctx *context.Context) (*ownerRepoCtx, error) {
+	if is, ok := ctx.Data["IsRepositoryWebhook"]; ok && is.(bool) {
+		return &ownerRepoCtx{
 			RepoID:      ctx.Repo.Repository.ID,
 			Link:        path.Join(ctx.Repo.RepoLink, "settings/hooks"),
 			LinkNew:     path.Join(ctx.Repo.RepoLink, "settings/hooks"),
@@ -75,37 +76,35 @@ func getOrgRepoCtx(ctx *context.Context) (*orgRepoCtx, error) {
 		}, nil
 	}
 
-	if len(ctx.Org.OrgLink) > 0 {
-		return &orgRepoCtx{
-			OrgID:       ctx.Org.Organization.ID,
+	if is, ok := ctx.Data["IsOrganizationWebhook"]; ok && is.(bool) {
+		return &ownerRepoCtx{
+			OwnerID:     ctx.ContextUser.ID,
 			Link:        path.Join(ctx.Org.OrgLink, "settings/hooks"),
 			LinkNew:     path.Join(ctx.Org.OrgLink, "settings/hooks"),
 			NewTemplate: tplOrgHookNew,
 		}, nil
 	}
 
-	if ctx.Doer.IsAdmin {
-		// Are we looking at default webhooks?
-		if ctx.Params(":configType") == "default-hooks" {
-			return &orgRepoCtx{
-				IsAdmin:     true,
-				Link:        path.Join(setting.AppSubURL, "/admin/hooks"),
-				LinkNew:     path.Join(setting.AppSubURL, "/admin/default-hooks"),
-				NewTemplate: tplAdminHookNew,
-			}, nil
-		}
+	if is, ok := ctx.Data["IsUserWebhook"]; ok && is.(bool) {
+		return &ownerRepoCtx{
+			OwnerID:     ctx.Doer.ID,
+			Link:        path.Join(setting.AppSubURL, "/user/settings/hooks"),
+			LinkNew:     path.Join(setting.AppSubURL, "/user/settings/hooks"),
+			NewTemplate: tplUserHookNew,
+		}, nil
+	}
 
-		// Must be system webhooks instead
-		return &orgRepoCtx{
+	if ctx.Doer.IsAdmin {
+		return &ownerRepoCtx{
 			IsAdmin:         true,
-			IsSystemWebhook: true,
+			IsSystemWebhook: ctx.Params(":configType") == "system-hooks",
 			Link:            path.Join(setting.AppSubURL, "/admin/hooks"),
 			LinkNew:         path.Join(setting.AppSubURL, "/admin/system-hooks"),
 			NewTemplate:     tplAdminHookNew,
 		}, nil
 	}
 
-	return nil, errors.New("unable to set OrgRepo context")
+	return nil, errors.New("unable to set OwnerRepo context")
 }
 
 func checkHookType(ctx *context.Context) string {
@@ -122,9 +121,9 @@ func WebhooksNew(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.settings.add_webhook")
 	ctx.Data["Webhook"] = webhook.Webhook{HookEvent: &webhook_module.HookEvent{}}
 
-	orCtx, err := getOrgRepoCtx(ctx)
+	orCtx, err := getOwnerRepoCtx(ctx)
 	if err != nil {
-		ctx.ServerError("getOrgRepoCtx", err)
+		ctx.ServerError("getOwnerRepoCtx", err)
 		return
 	}
 
@@ -205,9 +204,9 @@ func createWebhook(ctx *context.Context, params webhookParams) {
 	ctx.Data["Webhook"] = webhook.Webhook{HookEvent: &webhook_module.HookEvent{}}
 	ctx.Data["HookType"] = params.Type
 
-	orCtx, err := getOrgRepoCtx(ctx)
+	orCtx, err := getOwnerRepoCtx(ctx)
 	if err != nil {
-		ctx.ServerError("getOrgRepoCtx", err)
+		ctx.ServerError("getOwnerRepoCtx", err)
 		return
 	}
 	ctx.Data["BaseLink"] = orCtx.LinkNew
@@ -236,7 +235,7 @@ func createWebhook(ctx *context.Context, params webhookParams) {
 		IsActive:        params.WebhookForm.Active,
 		Type:            params.Type,
 		Meta:            string(meta),
-		OrgID:           orCtx.OrgID,
+		OwnerID:         orCtx.OwnerID,
 		IsSystemWebhook: orCtx.IsSystemWebhook,
 	}
 	err = w.SetHeaderAuthorization(params.WebhookForm.AuthorizationHeader)
@@ -577,19 +576,19 @@ func packagistHookParams(ctx *context.Context) webhookParams {
 	}
 }
 
-func checkWebhook(ctx *context.Context) (*orgRepoCtx, *webhook.Webhook) {
-	orCtx, err := getOrgRepoCtx(ctx)
+func checkWebhook(ctx *context.Context) (*ownerRepoCtx, *webhook.Webhook) {
+	orCtx, err := getOwnerRepoCtx(ctx)
 	if err != nil {
-		ctx.ServerError("getOrgRepoCtx", err)
+		ctx.ServerError("getOwnerRepoCtx", err)
 		return nil, nil
 	}
 	ctx.Data["BaseLink"] = orCtx.Link
 
 	var w *webhook.Webhook
 	if orCtx.RepoID > 0 {
-		w, err = webhook.GetWebhookByRepoID(ctx.Repo.Repository.ID, ctx.ParamsInt64(":id"))
-	} else if orCtx.OrgID > 0 {
-		w, err = webhook.GetWebhookByOrgID(ctx.Org.Organization.ID, ctx.ParamsInt64(":id"))
+		w, err = webhook.GetWebhookByRepoID(orCtx.RepoID, ctx.ParamsInt64(":id"))
+	} else if orCtx.OwnerID > 0 {
+		w, err = webhook.GetWebhookByOwnerID(orCtx.OwnerID, ctx.ParamsInt64(":id"))
 	} else if orCtx.IsAdmin {
 		w, err = webhook.GetSystemOrDefaultWebhook(ctx, ctx.ParamsInt64(":id"))
 	}
diff --git a/routers/web/user/setting/webhooks.go b/routers/web/user/setting/webhooks.go
new file mode 100644
index 0000000000000..9b0b0c9611c1a
--- /dev/null
+++ b/routers/web/user/setting/webhooks.go
@@ -0,0 +1,48 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"net/http"
+
+	"code.gitea.io/gitea/models/webhook"
+	"code.gitea.io/gitea/modules/base"
+	"code.gitea.io/gitea/modules/context"
+	"code.gitea.io/gitea/modules/setting"
+)
+
+const (
+	tplSettingsHooks base.TplName = "user/settings/hooks"
+)
+
+// Webhooks render webhook list page
+func Webhooks(ctx *context.Context) {
+	ctx.Data["Title"] = ctx.Tr("settings")
+	ctx.Data["PageIsSettingsHooks"] = true
+	ctx.Data["BaseLink"] = setting.AppSubURL + "/user/settings/hooks"
+	ctx.Data["BaseLinkNew"] = setting.AppSubURL + "/user/settings/hooks"
+	ctx.Data["Description"] = ctx.Tr("settings.hooks.desc")
+
+	ws, err := webhook.ListWebhooksByOpts(ctx, &webhook.ListWebhookOptions{OwnerID: ctx.Doer.ID})
+	if err != nil {
+		ctx.ServerError("ListWebhooksByOpts", err)
+		return
+	}
+
+	ctx.Data["Webhooks"] = ws
+	ctx.HTML(http.StatusOK, tplSettingsHooks)
+}
+
+// DeleteWebhook response for delete webhook
+func DeleteWebhook(ctx *context.Context) {
+	if err := webhook.DeleteWebhookByOwnerID(ctx.Doer.ID, ctx.FormInt64("id")); err != nil {
+		ctx.Flash.Error("DeleteWebhookByOwnerID: " + err.Error())
+	} else {
+		ctx.Flash.Success(ctx.Tr("repo.settings.webhook_deletion_success"))
+	}
+
+	ctx.JSON(http.StatusOK, map[string]interface{}{
+		"redirect": setting.AppSubURL + "/user/settings/hooks",
+	})
+}
diff --git a/routers/web/web.go b/routers/web/web.go
index ff312992dda0f..e4179d5802955 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -315,6 +315,35 @@ func RegisterRoutes(m *web.Route) {
 		}
 	}
 
+	addWebhookAddRoutes := func() {
+		m.Get("/{type}/new", repo.WebhooksNew)
+		m.Post("/gitea/new", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksNewPost)
+		m.Post("/gogs/new", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksNewPost)
+		m.Post("/slack/new", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksNewPost)
+		m.Post("/discord/new", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksNewPost)
+		m.Post("/dingtalk/new", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksNewPost)
+		m.Post("/telegram/new", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksNewPost)
+		m.Post("/matrix/new", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksNewPost)
+		m.Post("/msteams/new", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksNewPost)
+		m.Post("/feishu/new", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksNewPost)
+		m.Post("/wechatwork/new", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksNewPost)
+		m.Post("/packagist/new", web.Bind(forms.NewPackagistHookForm{}), repo.PackagistHooksNewPost)
+	}
+
+	addWebhookEditRoutes := func() {
+		m.Post("/gitea/{id}", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksEditPost)
+		m.Post("/gogs/{id}", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksEditPost)
+		m.Post("/slack/{id}", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksEditPost)
+		m.Post("/discord/{id}", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksEditPost)
+		m.Post("/dingtalk/{id}", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksEditPost)
+		m.Post("/telegram/{id}", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksEditPost)
+		m.Post("/matrix/{id}", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksEditPost)
+		m.Post("/msteams/{id}", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksEditPost)
+		m.Post("/feishu/{id}", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksEditPost)
+		m.Post("/wechatwork/{id}", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksEditPost)
+		m.Post("/packagist/{id}", web.Bind(forms.NewPackagistHookForm{}), repo.PackagistHooksEditPost)
+	}
+
 	// FIXME: not all routes need go through same middleware.
 	// Especially some AJAX requests, we can reduce middleware number to improve performance.
 	// Routers.
@@ -482,6 +511,19 @@ func RegisterRoutes(m *web.Route) {
 		m.Get("/organization", user_setting.Organization)
 		m.Get("/repos", user_setting.Repos)
 		m.Post("/repos/unadopted", user_setting.AdoptOrDeleteRepository)
+
+		m.Group("/hooks", func() {
+			m.Get("", user_setting.Webhooks)
+			m.Post("/delete", user_setting.DeleteWebhook)
+			addWebhookAddRoutes()
+			m.Group("/{id}", func() {
+				m.Get("", repo.WebHooksEdit)
+				m.Post("/replay/{uuid}", repo.ReplayWebhook)
+			})
+			addWebhookEditRoutes()
+		}, webhooksEnabled, func(ctx *context.Context) {
+			ctx.Data["IsUserWebhook"] = true
+		})
 	}, reqSignIn, func(ctx *context.Context) {
 		ctx.Data["PageIsUserSettings"] = true
 		ctx.Data["AllThemes"] = setting.UI.Themes
@@ -575,32 +617,11 @@ func RegisterRoutes(m *web.Route) {
 				m.Get("", repo.WebHooksEdit)
 				m.Post("/replay/{uuid}", repo.ReplayWebhook)
 			})
-			m.Post("/gitea/{id}", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksEditPost)
-			m.Post("/gogs/{id}", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksEditPost)
-			m.Post("/slack/{id}", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksEditPost)
-			m.Post("/discord/{id}", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksEditPost)
-			m.Post("/dingtalk/{id}", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksEditPost)
-			m.Post("/telegram/{id}", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksEditPost)
-			m.Post("/matrix/{id}", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksEditPost)
-			m.Post("/msteams/{id}", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksEditPost)
-			m.Post("/feishu/{id}", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksEditPost)
-			m.Post("/wechatwork/{id}", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksEditPost)
-			m.Post("/packagist/{id}", web.Bind(forms.NewPackagistHookForm{}), repo.PackagistHooksEditPost)
+			addWebhookEditRoutes()
 		}, webhooksEnabled)
 
 		m.Group("/{configType:default-hooks|system-hooks}", func() {
-			m.Get("/{type}/new", repo.WebhooksNew)
-			m.Post("/gitea/new", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksNewPost)
-			m.Post("/gogs/new", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksNewPost)
-			m.Post("/slack/new", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksNewPost)
-			m.Post("/discord/new", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksNewPost)
-			m.Post("/dingtalk/new", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksNewPost)
-			m.Post("/telegram/new", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksNewPost)
-			m.Post("/matrix/new", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksNewPost)
-			m.Post("/msteams/new", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksNewPost)
-			m.Post("/feishu/new", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksNewPost)
-			m.Post("/wechatwork/new", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksNewPost)
-			m.Post("/packagist/new", web.Bind(forms.NewPackagistHookForm{}), repo.PackagistHooksNewPost)
+			addWebhookAddRoutes()
 		})
 
 		m.Group("/auths", func() {
@@ -759,32 +780,15 @@ func RegisterRoutes(m *web.Route) {
 				m.Group("/hooks", func() {
 					m.Get("", org.Webhooks)
 					m.Post("/delete", org.DeleteWebhook)
-					m.Get("/{type}/new", repo.WebhooksNew)
-					m.Post("/gitea/new", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksNewPost)
-					m.Post("/gogs/new", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksNewPost)
-					m.Post("/slack/new", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksNewPost)
-					m.Post("/discord/new", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksNewPost)
-					m.Post("/dingtalk/new", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksNewPost)
-					m.Post("/telegram/new", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksNewPost)
-					m.Post("/matrix/new", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksNewPost)
-					m.Post("/msteams/new", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksNewPost)
-					m.Post("/feishu/new", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksNewPost)
-					m.Post("/wechatwork/new", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksNewPost)
+					addWebhookAddRoutes()
 					m.Group("/{id}", func() {
 						m.Get("", repo.WebHooksEdit)
 						m.Post("/replay/{uuid}", repo.ReplayWebhook)
 					})
-					m.Post("/gitea/{id}", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksEditPost)
-					m.Post("/gogs/{id}", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksEditPost)
-					m.Post("/slack/{id}", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksEditPost)
-					m.Post("/discord/{id}", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksEditPost)
-					m.Post("/dingtalk/{id}", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksEditPost)
-					m.Post("/telegram/{id}", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksEditPost)
-					m.Post("/matrix/{id}", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksEditPost)
-					m.Post("/msteams/{id}", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksEditPost)
-					m.Post("/feishu/{id}", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksEditPost)
-					m.Post("/wechatwork/{id}", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksEditPost)
-				}, webhooksEnabled)
+					addWebhookEditRoutes()
+				}, webhooksEnabled, func(ctx *context.Context) {
+					ctx.Data["IsOrganizationWebhook"] = true
+				})
 
 				m.Group("/labels", func() {
 					m.Get("", org.RetrieveLabels, org.Labels)
@@ -962,35 +966,16 @@ func RegisterRoutes(m *web.Route) {
 			m.Group("/hooks", func() {
 				m.Get("", repo.Webhooks)
 				m.Post("/delete", repo.DeleteWebhook)
-				m.Get("/{type}/new", repo.WebhooksNew)
-				m.Post("/gitea/new", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksNewPost)
-				m.Post("/gogs/new", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksNewPost)
-				m.Post("/slack/new", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksNewPost)
-				m.Post("/discord/new", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksNewPost)
-				m.Post("/dingtalk/new", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksNewPost)
-				m.Post("/telegram/new", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksNewPost)
-				m.Post("/matrix/new", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksNewPost)
-				m.Post("/msteams/new", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksNewPost)
-				m.Post("/feishu/new", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksNewPost)
-				m.Post("/wechatwork/new", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksNewPost)
-				m.Post("/packagist/new", web.Bind(forms.NewPackagistHookForm{}), repo.PackagistHooksNewPost)
+				addWebhookAddRoutes()
 				m.Group("/{id}", func() {
 					m.Get("", repo.WebHooksEdit)
 					m.Post("/test", repo.TestWebhook)
 					m.Post("/replay/{uuid}", repo.ReplayWebhook)
 				})
-				m.Post("/gitea/{id}", web.Bind(forms.NewWebhookForm{}), repo.GiteaHooksEditPost)
-				m.Post("/gogs/{id}", web.Bind(forms.NewGogshookForm{}), repo.GogsHooksEditPost)
-				m.Post("/slack/{id}", web.Bind(forms.NewSlackHookForm{}), repo.SlackHooksEditPost)
-				m.Post("/discord/{id}", web.Bind(forms.NewDiscordHookForm{}), repo.DiscordHooksEditPost)
-				m.Post("/dingtalk/{id}", web.Bind(forms.NewDingtalkHookForm{}), repo.DingtalkHooksEditPost)
-				m.Post("/telegram/{id}", web.Bind(forms.NewTelegramHookForm{}), repo.TelegramHooksEditPost)
-				m.Post("/matrix/{id}", web.Bind(forms.NewMatrixHookForm{}), repo.MatrixHooksEditPost)
-				m.Post("/msteams/{id}", web.Bind(forms.NewMSTeamsHookForm{}), repo.MSTeamsHooksEditPost)
-				m.Post("/feishu/{id}", web.Bind(forms.NewFeishuHookForm{}), repo.FeishuHooksEditPost)
-				m.Post("/wechatwork/{id}", web.Bind(forms.NewWechatWorkHookForm{}), repo.WechatworkHooksEditPost)
-				m.Post("/packagist/{id}", web.Bind(forms.NewPackagistHookForm{}), repo.PackagistHooksEditPost)
-			}, webhooksEnabled)
+				addWebhookEditRoutes()
+			}, webhooksEnabled, func(ctx *context.Context) {
+				ctx.Data["IsRepositoryWebhook"] = true
+			})
 
 			m.Group("/keys", func() {
 				m.Combo("").Get(repo.DeployKeys).
diff --git a/services/repository/hooks.go b/services/repository/hooks.go
index a8b6f7a622280..8506fa341369f 100644
--- a/services/repository/hooks.go
+++ b/services/repository/hooks.go
@@ -101,7 +101,7 @@ func GenerateWebhooks(ctx context.Context, templateRepo, generateRepo *repo_mode
 			HookEvent:   templateWebhook.HookEvent,
 			IsActive:    templateWebhook.IsActive,
 			Type:        templateWebhook.Type,
-			OrgID:       templateWebhook.OrgID,
+			OwnerID:     templateWebhook.OwnerID,
 			Events:      templateWebhook.Events,
 			Meta:        templateWebhook.Meta,
 		})
diff --git a/services/webhook/webhook.go b/services/webhook/webhook.go
index afd8e3c105cb1..b862d5bff10e4 100644
--- a/services/webhook/webhook.go
+++ b/services/webhook/webhook.go
@@ -229,16 +229,16 @@ func PrepareWebhooks(ctx context.Context, source EventSource, event webhook_modu
 		owner = source.Repository.MustOwner(ctx)
 	}
 
-	// check if owner is an org and append additional webhooks
-	if owner != nil && owner.IsOrganization() {
-		orgHooks, err := webhook_model.ListWebhooksByOpts(ctx, &webhook_model.ListWebhookOptions{
-			OrgID:    owner.ID,
+	// append additional webhooks of a user or organization
+	if owner != nil {
+		ownerHooks, err := webhook_model.ListWebhooksByOpts(ctx, &webhook_model.ListWebhookOptions{
+			OwnerID:  owner.ID,
 			IsActive: util.OptionalBoolTrue,
 		})
 		if err != nil {
 			return fmt.Errorf("ListWebhooksByOpts: %w", err)
 		}
-		ws = append(ws, orgHooks...)
+		ws = append(ws, ownerHooks...)
 	}
 
 	// Add any admin-defined system webhooks
diff --git a/templates/repo/settings/webhook/history.tmpl b/templates/repo/settings/webhook/history.tmpl
index bf7fe05de2242..f76cdb147d7cc 100644
--- a/templates/repo/settings/webhook/history.tmpl
+++ b/templates/repo/settings/webhook/history.tmpl
@@ -40,7 +40,7 @@
 									<span class="ui label">N/A</span>
 								{{end}}
 							</a>
-							{{if or $.Permission.IsAdmin $.IsOrganizationOwner $.PageIsAdmin}}
+							{{if or $.Permission.IsAdmin $.IsOrganizationOwner $.PageIsAdmin $.PageIsUserSettings}}
 							<div class="right menu">
 								<form class="item" action="{{$.Link}}/replay/{{.UUID}}" method="post">
 									{{$.CsrfTokenHtml}}
diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl
index 0605937599b5f..cb88e175ea5f8 100644
--- a/templates/swagger/v1_json.tmpl
+++ b/templates/swagger/v1_json.tmpl
@@ -13014,6 +13014,152 @@
         }
       }
     },
+    "/user/hooks": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "user"
+        ],
+        "summary": "List the authenticated user's webhooks",
+        "operationId": "userListHooks",
+        "parameters": [
+          {
+            "type": "integer",
+            "description": "page number of results to return (1-based)",
+            "name": "page",
+            "in": "query"
+          },
+          {
+            "type": "integer",
+            "description": "page size of results",
+            "name": "limit",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/HookList"
+          }
+        }
+      },
+      "post": {
+        "consumes": [
+          "application/json"
+        ],
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "user"
+        ],
+        "summary": "Create a hook",
+        "operationId": "userCreateHook",
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/CreateHookOption"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "$ref": "#/responses/Hook"
+          }
+        }
+      }
+    },
+    "/user/hooks/{id}": {
+      "get": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "user"
+        ],
+        "summary": "Get a hook",
+        "operationId": "userGetHook",
+        "parameters": [
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "id of the hook to get",
+            "name": "id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/Hook"
+          }
+        }
+      },
+      "delete": {
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "user"
+        ],
+        "summary": "Delete a hook",
+        "operationId": "userDeleteHook",
+        "parameters": [
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "id of the hook to delete",
+            "name": "id",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "204": {
+            "$ref": "#/responses/empty"
+          }
+        }
+      },
+      "patch": {
+        "consumes": [
+          "application/json"
+        ],
+        "produces": [
+          "application/json"
+        ],
+        "tags": [
+          "user"
+        ],
+        "summary": "Update a hook",
+        "operationId": "userEditHook",
+        "parameters": [
+          {
+            "type": "integer",
+            "format": "int64",
+            "description": "id of the hook to update",
+            "name": "id",
+            "in": "path",
+            "required": true
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "schema": {
+              "$ref": "#/definitions/EditHookOption"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "$ref": "#/responses/Hook"
+          }
+        }
+      }
+    },
     "/user/keys": {
       "get": {
         "produces": [
diff --git a/templates/user/settings/applications.tmpl b/templates/user/settings/applications.tmpl
index ef9ac9a97784c..b0cd37d44c47c 100644
--- a/templates/user/settings/applications.tmpl
+++ b/templates/user/settings/applications.tmpl
@@ -138,6 +138,12 @@
 							<label>admin:org_hook</label>
 						</div>
 					</div>
+					<div class="field">
+						<div class="ui checkbox">
+							<input class="enable-system" type="checkbox" name="scope" value="admin:user_hook">
+							<label>admin:user_hook</label>
+						</div>
+					</div>
 					<div class="field">
 						<div class="ui checkbox">
 							<input class="enable-system" type="checkbox" name="scope" value="notification">
diff --git a/templates/user/settings/hook_new.tmpl b/templates/user/settings/hook_new.tmpl
new file mode 100644
index 0000000000000..20aaf65f62d78
--- /dev/null
+++ b/templates/user/settings/hook_new.tmpl
@@ -0,0 +1,53 @@
+{{template "base/head" .}}
+<div class="page-content user  settings new webhook">
+	{{template "user/settings/navbar" .}}
+	<div class="ui container">
+		<div class="twelve wide column content">
+			{{template "base/alert" .}}
+			<h4 class="ui top attached header">
+				{{if .PageIsSettingsHooksNew}}{{.locale.Tr "repo.settings.add_webhook"}}{{else}}{{.locale.Tr "repo.settings.update_webhook"}}{{end}}
+				<div class="ui right">
+					{{if eq .HookType "gitea"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/gitea.svg">
+					{{else if eq .HookType "gogs"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/gogs.ico">
+					{{else if eq .HookType "slack"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/slack.png">
+					{{else if eq .HookType "discord"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/discord.png">
+					{{else if eq .HookType "dingtalk"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/dingtalk.ico">
+					{{else if eq .HookType "telegram"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/telegram.png">
+					{{else if eq .HookType "msteams"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/msteams.png">
+					{{else if eq .HookType "feishu"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/feishu.png">
+					{{else if eq .HookType "matrix"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/matrix.svg">
+					{{else if eq .HookType "wechatwork"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/wechatwork.png">
+					{{else if eq .HookType "packagist"}}
+						<img width="26" height="26" src="{{AssetUrlPrefix}}/img/packagist.png">
+					{{end}}
+				</div>
+			</h4>
+			<div class="ui attached segment">
+				{{template "repo/settings/webhook/gitea" .}}
+				{{template "repo/settings/webhook/gogs" .}}
+				{{template "repo/settings/webhook/slack" .}}
+				{{template "repo/settings/webhook/discord" .}}
+				{{template "repo/settings/webhook/dingtalk" .}}
+				{{template "repo/settings/webhook/telegram" .}}
+				{{template "repo/settings/webhook/msteams" .}}
+				{{template "repo/settings/webhook/feishu" .}}
+				{{template "repo/settings/webhook/matrix" .}}
+				{{template "repo/settings/webhook/wechatwork" .}}
+				{{template "repo/settings/webhook/packagist" .}}
+			</div>
+
+			{{template "repo/settings/webhook/history" .}}
+		</div>
+	</div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/user/settings/hooks.tmpl b/templates/user/settings/hooks.tmpl
new file mode 100644
index 0000000000000..02bfa8a4e6704
--- /dev/null
+++ b/templates/user/settings/hooks.tmpl
@@ -0,0 +1,8 @@
+{{template "base/head" .}}
+<div class="page-content user settings webhooks">
+	{{template "user/settings/navbar" .}}
+	<div class="ui container">
+		{{template "repo/settings/webhook/list" .}}
+	</div>
+</div>
+{{template "base/footer" .}}
diff --git a/templates/user/settings/navbar.tmpl b/templates/user/settings/navbar.tmpl
index 8deffde0b2242..4afe2173c2bda 100644
--- a/templates/user/settings/navbar.tmpl
+++ b/templates/user/settings/navbar.tmpl
@@ -26,6 +26,11 @@
 			{{.locale.Tr "packages.title"}}
 		</a>
 		{{end}}
+		{{if not DisableWebhooks}}
+		<a class="{{if .PageIsSettingsHooks}}active {{end}}item" href="{{AppSubUrl}}/user/settings/hooks">
+			{{.locale.Tr "repo.settings.hooks"}}
+		</a>
+		{{end}}
 		<a class="{{if .PageIsSettingsOrganization}}active {{end}}item" href="{{AppSubUrl}}/user/settings/organization">
 			{{.locale.Tr "settings.organization"}}
 		</a>

From cf29ee6dd290525635a0e1b823506e81f845b978 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Sat, 11 Mar 2023 00:18:20 +0900
Subject: [PATCH 41/53] Add missing tabs to org projects page (#22705)

Fixes https://github.com/go-gitea/gitea/issues/22676

Context Data `IsOrganizationMember` and `IsOrganizationOwner` is used to
control the visibility of `people` and `team` tab.

https://github.com/go-gitea/gitea/blob/2871ea08096cba15546f357d0ec473734ee9d8be/templates/org/menu.tmpl#L19-L40

And because of the reuse of user projects page, User Context is changed
to Organization Context. But the value of `IsOrganizationMember` and
`IsOrganizationOwner` are not being given.

I reused func `HandleOrgAssignment` to add them to the ctx, but may have
some unnecessary variables, idk whether it is ok.

I found there is a missing `PageIsViewProjects` at create project page.
---
 models/organization/org.go          | 26 ++++++++++
 models/user/user.go                 |  5 ++
 modules/context/org.go              | 78 ++++++++++++++++-------------
 routers/web/org/home.go             |  1 +
 routers/web/org/projects.go         |  1 +
 routers/web/shared/user/header.go   |  2 +
 routers/web/user/code.go            |  1 +
 routers/web/user/profile.go         |  1 +
 routers/web/web.go                  | 40 +++++++++------
 services/context/user.go            |  9 ----
 templates/org/menu.tmpl             |  8 +--
 templates/user/overview/header.tmpl |  6 ++-
 12 files changed, 115 insertions(+), 63 deletions(-)

diff --git a/models/organization/org.go b/models/organization/org.go
index f05027be729d4..269b3e83288dc 100644
--- a/models/organization/org.go
+++ b/models/organization/org.go
@@ -239,6 +239,32 @@ func (org *Organization) CustomAvatarRelativePath() string {
 	return org.Avatar
 }
 
+// UnitPermission returns unit permission
+func (org *Organization) UnitPermission(ctx context.Context, doer *user_model.User, unitType unit.Type) perm.AccessMode {
+	if doer != nil {
+		teams, err := GetUserOrgTeams(ctx, org.ID, doer.ID)
+		if err != nil {
+			log.Error("GetUserOrgTeams: %v", err)
+			return perm.AccessModeNone
+		}
+
+		if err := teams.LoadUnits(ctx); err != nil {
+			log.Error("LoadUnits: %v", err)
+			return perm.AccessModeNone
+		}
+
+		if len(teams) > 0 {
+			return teams.UnitMaxAccess(unitType)
+		}
+	}
+
+	if org.Visibility.IsPublic() {
+		return perm.AccessModeRead
+	}
+
+	return perm.AccessModeNone
+}
+
 // CreateOrganization creates record of a new organization.
 func CreateOrganization(org *Organization, owner *user_model.User) (err error) {
 	if !owner.CanCreateOrganization() {
diff --git a/models/user/user.go b/models/user/user.go
index f6fafe64f3915..454779b9ea361 100644
--- a/models/user/user.go
+++ b/models/user/user.go
@@ -393,6 +393,11 @@ func (u *User) IsOrganization() bool {
 	return u.Type == UserTypeOrganization
 }
 
+// IsIndividual returns true if user is actually a individual user.
+func (u *User) IsIndividual() bool {
+	return u.Type == UserTypeIndividual
+}
+
 // DisplayName returns full name if it's not empty,
 // returns username otherwise.
 func (u *User) DisplayName() string {
diff --git a/modules/context/org.go b/modules/context/org.go
index 0add7f2c0c3de..39a3038f910cb 100644
--- a/modules/context/org.go
+++ b/modules/context/org.go
@@ -11,7 +11,6 @@ import (
 	"code.gitea.io/gitea/models/perm"
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/structs"
 )
@@ -31,29 +30,34 @@ type Organization struct {
 }
 
 func (org *Organization) CanWriteUnit(ctx *Context, unitType unit.Type) bool {
-	if ctx.Doer == nil {
-		return false
-	}
-	return org.UnitPermission(ctx, ctx.Doer.ID, unitType) >= perm.AccessModeWrite
+	return org.Organization.UnitPermission(ctx, ctx.Doer, unitType) >= perm.AccessModeWrite
 }
 
-func (org *Organization) UnitPermission(ctx *Context, doerID int64, unitType unit.Type) perm.AccessMode {
-	if doerID > 0 {
-		teams, err := organization.GetUserOrgTeams(ctx, org.Organization.ID, doerID)
-		if err != nil {
-			log.Error("GetUserOrgTeams: %v", err)
-			return perm.AccessModeNone
-		}
-		if len(teams) > 0 {
-			return teams.UnitMaxAccess(unitType)
-		}
-	}
+func (org *Organization) CanReadUnit(ctx *Context, unitType unit.Type) bool {
+	return org.Organization.UnitPermission(ctx, ctx.Doer, unitType) >= perm.AccessModeRead
+}
 
-	if org.Organization.Visibility == structs.VisibleTypePublic {
-		return perm.AccessModeRead
-	}
+func GetOrganizationByParams(ctx *Context) {
+	orgName := ctx.Params(":org")
+
+	var err error
 
-	return perm.AccessModeNone
+	ctx.Org.Organization, err = organization.GetOrgByName(ctx, orgName)
+	if err != nil {
+		if organization.IsErrOrgNotExist(err) {
+			redirectUserID, err := user_model.LookupUserRedirect(orgName)
+			if err == nil {
+				RedirectToUser(ctx, orgName, redirectUserID)
+			} else if user_model.IsErrUserRedirectNotExist(err) {
+				ctx.NotFound("GetUserByName", err)
+			} else {
+				ctx.ServerError("LookupUserRedirect", err)
+			}
+		} else {
+			ctx.ServerError("GetUserByName", err)
+		}
+		return
+	}
 }
 
 // HandleOrgAssignment handles organization assignment
@@ -77,25 +81,26 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 		requireTeamAdmin = args[3]
 	}
 
-	orgName := ctx.Params(":org")
-
 	var err error
-	ctx.Org.Organization, err = organization.GetOrgByName(ctx, orgName)
-	if err != nil {
-		if organization.IsErrOrgNotExist(err) {
-			redirectUserID, err := user_model.LookupUserRedirect(orgName)
-			if err == nil {
-				RedirectToUser(ctx, orgName, redirectUserID)
-			} else if user_model.IsErrUserRedirectNotExist(err) {
-				ctx.NotFound("GetUserByName", err)
-			} else {
-				ctx.ServerError("LookupUserRedirect", err)
+
+	if ctx.ContextUser == nil {
+		// if Organization is not defined, get it from params
+		if ctx.Org.Organization == nil {
+			GetOrganizationByParams(ctx)
+			if ctx.Written() {
+				return
 			}
-		} else {
-			ctx.ServerError("GetUserByName", err)
 		}
+	} else if ctx.ContextUser.IsOrganization() {
+		if ctx.Org == nil {
+			ctx.Org = &Organization{}
+		}
+		ctx.Org.Organization = (*organization.Organization)(ctx.ContextUser)
+	} else {
+		// ContextUser is an individual User
 		return
 	}
+
 	org := ctx.Org.Organization
 
 	// Handle Visibility
@@ -156,6 +161,7 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 	}
 	ctx.Data["IsOrganizationOwner"] = ctx.Org.IsOwner
 	ctx.Data["IsOrganizationMember"] = ctx.Org.IsMember
+	ctx.Data["IsProjectEnabled"] = true
 	ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 	ctx.Data["IsPublicMember"] = func(uid int64) bool {
@@ -231,6 +237,10 @@ func HandleOrgAssignment(ctx *Context, args ...bool) {
 			return
 		}
 	}
+
+	ctx.Data["CanReadProjects"] = ctx.Org.CanReadUnit(ctx, unit.TypeProjects)
+	ctx.Data["CanReadPackages"] = ctx.Org.CanReadUnit(ctx, unit.TypePackages)
+	ctx.Data["CanReadCode"] = ctx.Org.CanReadUnit(ctx, unit.TypeCode)
 }
 
 // OrgAssignment returns a middleware to handle organization assignment
diff --git a/routers/web/org/home.go b/routers/web/org/home.go
index 4cc364acd3a01..8c9cc8a9d86be 100644
--- a/routers/web/org/home.go
+++ b/routers/web/org/home.go
@@ -156,6 +156,7 @@ func Home(ctx *context.Context) {
 	pager.SetDefaultParams(ctx)
 	pager.AddParam(ctx, "language", "Language")
 	ctx.Data["Page"] = pager
+	ctx.Data["ContextUser"] = ctx.ContextUser
 
 	ctx.HTML(http.StatusOK, tplOrgHome)
 }
diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index 64ae4aa70952d..c9d63fec5df0c 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -123,6 +123,7 @@ func NewProject(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.projects.new")
 	ctx.Data["BoardTypes"] = project_model.GetBoardConfig()
 	ctx.Data["CanWriteProjects"] = canWriteProjects(ctx)
+	ctx.Data["PageIsViewProjects"] = true
 	ctx.Data["HomeLink"] = ctx.ContextUser.HomeLink()
 	shared_user.RenderUserHeader(ctx)
 	ctx.HTML(http.StatusOK, tplProjectsNew)
diff --git a/routers/web/shared/user/header.go b/routers/web/shared/user/header.go
index 94e59e2a490fd..05e45f999eed9 100644
--- a/routers/web/shared/user/header.go
+++ b/routers/web/shared/user/header.go
@@ -9,6 +9,8 @@ import (
 )
 
 func RenderUserHeader(ctx *context.Context) {
+	ctx.Data["IsProjectEnabled"] = true
+	ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 	ctx.Data["ContextUser"] = ctx.ContextUser
 }
diff --git a/routers/web/user/code.go b/routers/web/user/code.go
index 81e3e65b4b67a..b3adbcb8d3a8f 100644
--- a/routers/web/user/code.go
+++ b/routers/web/user/code.go
@@ -24,6 +24,7 @@ func CodeSearch(ctx *context.Context) {
 		return
 	}
 
+	ctx.Data["IsProjectEnabled"] = true
 	ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 	ctx.Data["Title"] = ctx.Tr("explore.code")
diff --git a/routers/web/user/profile.go b/routers/web/user/profile.go
index b4452604599f7..f4d458c040d72 100644
--- a/routers/web/user/profile.go
+++ b/routers/web/user/profile.go
@@ -304,6 +304,7 @@ func Profile(ctx *context.Context) {
 		pager.AddParam(ctx, "date", "Date")
 	}
 	ctx.Data["Page"] = pager
+	ctx.Data["IsProjectEnabled"] = true
 	ctx.Data["IsPackageEnabled"] = setting.Packages.Enabled
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
 
diff --git a/routers/web/web.go b/routers/web/web.go
index e4179d5802955..292268dc8055a 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -711,6 +711,21 @@ func RegisterRoutes(m *web.Route) {
 		}
 	}
 
+	reqUnitAccess := func(unitType unit.Type, accessMode perm.AccessMode) func(ctx *context.Context) {
+		return func(ctx *context.Context) {
+			if ctx.ContextUser == nil {
+				ctx.NotFound(unitType.String(), nil)
+				return
+			}
+			if ctx.ContextUser.IsOrganization() {
+				if ctx.Org.Organization.UnitPermission(ctx, ctx.Doer, unitType) < accessMode {
+					ctx.NotFound(unitType.String(), nil)
+					return
+				}
+			}
+		}
+	}
+
 	// ***** START: Organization *****
 	m.Group("/org", func() {
 		m.Group("/{org}", func() {
@@ -873,8 +888,10 @@ func RegisterRoutes(m *web.Route) {
 		}
 
 		m.Group("/projects", func() {
-			m.Get("", org.Projects)
-			m.Get("/{id}", org.ViewProject)
+			m.Group("", func() {
+				m.Get("", org.Projects)
+				m.Get("/{id}", org.ViewProject)
+			}, reqUnitAccess(unit.TypeProjects, perm.AccessModeRead))
 			m.Group("", func() { //nolint:dupl
 				m.Get("/new", org.NewProject)
 				m.Post("/new", web.Bind(forms.CreateProjectForm{}), org.NewProjectPost)
@@ -894,25 +911,18 @@ func RegisterRoutes(m *web.Route) {
 						m.Post("/move", org.MoveIssues)
 					})
 				})
-			}, reqSignIn, func(ctx *context.Context) {
-				if ctx.ContextUser == nil {
-					ctx.NotFound("NewProject", nil)
-					return
-				}
-				if ctx.ContextUser.IsOrganization() {
-					if !ctx.Org.CanWriteUnit(ctx, unit.TypeProjects) {
-						ctx.NotFound("NewProject", nil)
-						return
-					}
-				} else if ctx.ContextUser.ID != ctx.Doer.ID {
+			}, reqSignIn, reqUnitAccess(unit.TypeProjects, perm.AccessModeWrite), func(ctx *context.Context) {
+				if ctx.ContextUser.IsIndividual() && ctx.ContextUser.ID != ctx.Doer.ID {
 					ctx.NotFound("NewProject", nil)
 					return
 				}
 			})
 		}, repo.MustEnableProjects)
 
-		m.Get("/code", user.CodeSearch)
-	}, context_service.UserAssignmentWeb())
+		m.Group("", func() {
+			m.Get("/code", user.CodeSearch)
+		}, reqUnitAccess(unit.TypeCode, perm.AccessModeRead))
+	}, context_service.UserAssignmentWeb(), context.OrgAssignment())
 
 	// ***** Release Attachment Download without Signin
 	m.Get("/{username}/{reponame}/releases/download/{vTag}/{fileName}", ignSignIn, context.RepoAssignment, repo.MustBeNotEmpty, repo.RedirectDownload)
diff --git a/services/context/user.go b/services/context/user.go
index 7642cba4e1f03..9dc84c3ac15e1 100644
--- a/services/context/user.go
+++ b/services/context/user.go
@@ -8,7 +8,6 @@ import (
 	"net/http"
 	"strings"
 
-	org_model "code.gitea.io/gitea/models/organization"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/context"
 )
@@ -57,14 +56,6 @@ func userAssignment(ctx *context.Context, errCb func(int, string, interface{}))
 			} else {
 				errCb(http.StatusInternalServerError, "GetUserByName", err)
 			}
-		} else {
-			if ctx.ContextUser.IsOrganization() {
-				if ctx.Org == nil {
-					ctx.Org = &context.Organization{}
-				}
-				ctx.Org.Organization = (*org_model.Organization)(ctx.ContextUser)
-				ctx.Data["Org"] = ctx.Org.Organization
-			}
 		}
 	}
 }
diff --git a/templates/org/menu.tmpl b/templates/org/menu.tmpl
index 25f459c09c56a..2a359d811134c 100644
--- a/templates/org/menu.tmpl
+++ b/templates/org/menu.tmpl
@@ -3,16 +3,18 @@
 		<a class="{{if .PageIsViewRepositories}}active {{end}}item" href="{{$.Org.HomeLink}}">
 			{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
 		</a>
+		{{if and .IsProjectEnabled .CanReadProjects}}
 		<a class="{{if .PageIsViewProjects}}active {{end}}item" href="{{$.Org.HomeLink}}/-/projects">
 			{{svg "octicon-project-symlink"}} {{.locale.Tr "user.projects"}}
 		</a>
-		{{if .IsPackageEnabled}}
+		{{end}}
+		{{if and .IsPackageEnabled .CanReadPackages}}
 		<a class="item" href="{{$.Org.HomeLink}}/-/packages">
 			{{svg "octicon-package"}} {{.locale.Tr "packages.title"}}
 		</a>
 		{{end}}
-		{{if .IsRepoIndexerEnabled}}
-		<a class="{{if $.PageIsOrgCode}}active {{end}}item" href="{{$.Org.HomeLink}}/-/code">
+		{{if and .IsRepoIndexerEnabled .CanReadCode}}
+		<a class="item" href="{{$.Org.HomeLink}}/-/code">
 			{{svg "octicon-code"}}&nbsp;{{$.locale.Tr "org.code"}}
 		</a>
 		{{end}}
diff --git a/templates/user/overview/header.tmpl b/templates/user/overview/header.tmpl
index ce9ecb46adbc8..b4f7d6f900911 100644
--- a/templates/user/overview/header.tmpl
+++ b/templates/user/overview/header.tmpl
@@ -22,15 +22,17 @@
 			<a class="item" href="{{.ContextUser.HomeLink}}">
 				{{svg "octicon-repo"}} {{.locale.Tr "user.repositories"}}
 			</a>
+			{{if and .IsProjectEnabled (or .ContextUser.IsIndividual (and .ContextUser.IsOrganization .CanReadProjects))}}
 			<a href="{{.ContextUser.HomeLink}}/-/projects" class="{{if .PageIsViewProjects}}active {{end}}item">
 				{{svg "octicon-project-symlink"}} {{.locale.Tr "user.projects"}}
 			</a>
-			{{if (not .UnitPackagesGlobalDisabled)}}
+			{{end}}
+			{{if and .IsPackageEnabled (or .ContextUser.IsIndividual (and .ContextUser.IsOrganization .CanReadPackages))}}
 				<a href="{{.ContextUser.HomeLink}}/-/packages" class="{{if .IsPackagesPage}}active {{end}}item">
 					{{svg "octicon-package"}} {{.locale.Tr "packages.title"}}
 				</a>
 			{{end}}
-			{{if .IsRepoIndexerEnabled}}
+			{{if and .IsRepoIndexerEnabled (or .ContextUser.IsIndividual (and .ContextUser.IsOrganization .CanReadCode))}}
 				<a href="{{.ContextUser.HomeLink}}/-/code" class="{{if .IsCodePage}}active {{end}}item">
 					{{svg "octicon-code"}} {{.locale.Tr "user.code"}}
 				</a>

From 5155ec35c571de8df62318df78c78cebc20e1aa0 Mon Sep 17 00:00:00 2001
From: sillyguodong <33891828+sillyguodong@users.noreply.github.com>
Date: Fri, 10 Mar 2023 23:54:32 +0800
Subject: [PATCH 42/53] Parse external request id from request headers, and
 print it in access log (#22906)

Close: #22890.

---
### Configure in .ini file:
```ini
[log]
REQUEST_ID_HEADERS = X-Request-ID, X-Trace-Id
```

### Params in Request Header
```
X-Trace-ID: trace-id-1q2w3e4r
```

![image](https://user-images.githubusercontent.com/33891828/218665296-8fd19a0f-ada6-4236-8bdb-f99201c703e8.png)



### Log output:

![image](https://user-images.githubusercontent.com/33891828/218665225-cc242a57-4ffc-449a-a1f6-f45ded0ead60.png)
---
 custom/conf/app.example.ini                   | 16 +++++++++
 .../doc/advanced/config-cheat-sheet.en-us.md  |  6 ++++
 .../doc/advanced/config-cheat-sheet.zh-cn.md  | 17 +++++++++-
 modules/context/access_log.go                 | 34 +++++++++++++++++++
 modules/setting/log.go                        |  2 ++
 5 files changed, 74 insertions(+), 1 deletion(-)

diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index b7875c12dd8e1..c3c20a216c2df 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -576,6 +576,22 @@ ROUTER = console
 ;; The routing level will default to that of the system but individual router level can be set in
 ;; [log.<mode>.router] LEVEL
 ;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; Print request id which parsed from request headers in access log, when access log is enabled.
+;; * E.g:
+;; * In request Header:         X-Request-ID: test-id-123
+;; * Configuration in app.ini:  REQUEST_ID_HEADERS = X-Request-ID
+;; * Print in log:              127.0.0.1:58384 - - [14/Feb/2023:16:33:51 +0800] "test-id-123"
+;; 
+;; If you configure more than one in the .ini file, it will match in the order of configuration, 
+;; and the first match will be finally printed in the log.
+;; * E.g:
+;; * In reuqest Header:         X-Trace-ID: trace-id-1q2w3e4r
+;; * Configuration in app.ini:  REQUEST_ID_HEADERS = X-Request-ID, X-Trace-ID, X-Req-ID
+;; * Print in log:              127.0.0.1:58384 - - [14/Feb/2023:16:33:51 +0800] "trace-id-1q2w3e4r"
+;;
+;; REQUEST_ID_HEADERS = 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
index c4ff8bafb9209..a5ef977f15bed 100644
--- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md
@@ -881,7 +881,13 @@ Default templates for project boards:
   - `Identity`: the SignedUserName or `"-"` if not logged in.
   - `Start`: the start time of the request.
   - `ResponseWriter`: the responseWriter from the request.
+  - `RequestID`: the value matching REQUEST_ID_HEADERS（default: `-`, if not matched）.
   - You must be very careful to ensure that this template does not throw errors or panics as this template runs outside of the panic/recovery script.
+- `REQUEST_ID_HEADERS`: **\<empty\>**: You can configure multiple values that are splited by comma here. It will match in the order of configuration, and the first match will be finally printed in the access log.
+  - e.g.
+  - In the Request Header:        X-Request-ID: **test-id-123**
+  - Configuration in app.ini:     REQUEST_ID_HEADERS = X-Request-ID
+  - Print in log:                 127.0.0.1:58384 - - [14/Feb/2023:16:33:51 +0800]  "**test-id-123**" ...
 
 ### Log subsections (`log.name`, `log.name.*`)
 
diff --git a/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md b/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
index aae64d97bac1e..84186d0e9af1b 100644
--- a/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
+++ b/docs/content/doc/advanced/config-cheat-sheet.zh-cn.md
@@ -262,7 +262,22 @@ test01.xls: application/vnd.ms-excel; charset=binary
 
 - `ROOT_PATH`: 日志文件根目录。
 - `MODE`: 日志记录模式，默认是为 `console`。如果要写到多个通道，用逗号分隔
-- `LEVEL`: 日志级别，默认为`Trace`。
+- `LEVEL`: 日志级别，默认为 `Trace`。
+- `DISABLE_ROUTER_LOG`: 关闭日志中的路由日志。
+- `ENABLE_ACCESS_LOG`: 是否开启 Access Log, 默认为 false。
+- `ACCESS_LOG_TEMPLATE`: `access.log` 输出内容的模板，默认模板：**`{{.Ctx.RemoteAddr}} - {{.Identity}} {{.Start.Format "[02/Jan/2006:15:04:05 -0700]" }} "{{.Ctx.Req.Method}} {{.Ctx.Req.URL.RequestURI}} {{.Ctx.Req.Proto}}" {{.ResponseWriter.Status}} {{.ResponseWriter.Size}} "{{.Ctx.Req.Referer}}\" \"{{.Ctx.Req.UserAgent}}"`**
+  模板支持以下参数:
+  - `Ctx`: 请求上下文。
+  - `Identity`: 登录用户名，默认: “`-`”。
+  - `Start`: 请求开始时间。
+  - `ResponseWriter`:
+  - `RequestID`: 从请求头中解析得到的与 `REQUEST_ID_HEADERS` 匹配的值，默认: “`-`”。
+  - 一定要谨慎配置该模板，否则可能会引起panic.
+- `REQUEST_ID_HEADERS`: 从 Request Header 中匹配指定 Key，并将匹配到的值输出到 `access.log` 中(需要在 `ACCESS_LOG_TEMPLATE` 中指定输出位置)。如果在该参数中配置多个 Key， 请用逗号分割，程序将按照配置的顺序进行匹配。
+  - 示例：
+  - 请求头：       X-Request-ID: **test-id-123**
+  - 配置文件：     REQUEST_ID_HEADERS = X-Request-ID
+  - 日志输出：     127.0.0.1:58384 - - [14/Feb/2023:16:33:51 +0800]  "**test-id-123**" ...
 
 ## Cron (`cron`)
 
diff --git a/modules/context/access_log.go b/modules/context/access_log.go
index 1aaba9dc2d5c9..515682b64b0e6 100644
--- a/modules/context/access_log.go
+++ b/modules/context/access_log.go
@@ -6,7 +6,9 @@ package context
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"net/http"
+	"strings"
 	"text/template"
 	"time"
 
@@ -20,13 +22,39 @@ type routerLoggerOptions struct {
 	Start          *time.Time
 	ResponseWriter http.ResponseWriter
 	Ctx            map[string]interface{}
+	RequestID      *string
 }
 
 var signedUserNameStringPointerKey interface{} = "signedUserNameStringPointerKey"
 
+const keyOfRequestIDInTemplate = ".RequestID"
+
+// According to:
+// TraceId: A valid trace identifier is a 16-byte array with at least one non-zero byte
+// MD5 output is 16 or 32 bytes: md5-bytes is 16, md5-hex is 32
+// SHA1: similar, SHA1-bytes is 20, SHA1-hex is 40.
+// UUID is 128-bit, 32 hex chars, 36 ASCII chars with 4 dashes
+// So, we accept a Request ID with a maximum character length of 40
+const maxRequestIDByteLength = 40
+
+func parseRequestIDFromRequestHeader(req *http.Request) string {
+	requestID := "-"
+	for _, key := range setting.Log.RequestIDHeaders {
+		if req.Header.Get(key) != "" {
+			requestID = req.Header.Get(key)
+			break
+		}
+	}
+	if len(requestID) > maxRequestIDByteLength {
+		requestID = fmt.Sprintf("%s...", requestID[:maxRequestIDByteLength])
+	}
+	return requestID
+}
+
 // AccessLogger returns a middleware to log access logger
 func AccessLogger() func(http.Handler) http.Handler {
 	logger := log.GetLogger("access")
+	needRequestID := len(setting.Log.RequestIDHeaders) > 0 && strings.Contains(setting.Log.AccessLogTemplate, keyOfRequestIDInTemplate)
 	logTemplate, _ := template.New("log").Parse(setting.Log.AccessLogTemplate)
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
@@ -34,6 +62,11 @@ func AccessLogger() func(http.Handler) http.Handler {
 			identity := "-"
 			r := req.WithContext(context.WithValue(req.Context(), signedUserNameStringPointerKey, &identity))
 
+			var requestID string
+			if needRequestID {
+				requestID = parseRequestIDFromRequestHeader(req)
+			}
+
 			next.ServeHTTP(w, r)
 			rw := w.(ResponseWriter)
 
@@ -47,6 +80,7 @@ func AccessLogger() func(http.Handler) http.Handler {
 					"RemoteAddr": req.RemoteAddr,
 					"Req":        req,
 				},
+				RequestID: &requestID,
 			})
 			if err != nil {
 				log.Error("Could not set up chi access logger: %v", err.Error())
diff --git a/modules/setting/log.go b/modules/setting/log.go
index 5448650aadb9c..dabdb543abdf5 100644
--- a/modules/setting/log.go
+++ b/modules/setting/log.go
@@ -38,6 +38,7 @@ var Log struct {
 	EnableAccessLog   bool
 	AccessLogTemplate string
 	BufferLength      int64
+	RequestIDHeaders  []string
 }
 
 // GetLogDescriptions returns a race safe set of descriptions
@@ -153,6 +154,7 @@ func loadLogFrom(rootCfg ConfigProvider) {
 	Log.AccessLogTemplate = sec.Key("ACCESS_LOG_TEMPLATE").MustString(
 		`{{.Ctx.RemoteAddr}} - {{.Identity}} {{.Start.Format "[02/Jan/2006:15:04:05 -0700]" }} "{{.Ctx.Req.Method}} {{.Ctx.Req.URL.RequestURI}} {{.Ctx.Req.Proto}}" {{.ResponseWriter.Status}} {{.ResponseWriter.Size}} "{{.Ctx.Req.Referer}}\" \"{{.Ctx.Req.UserAgent}}"`,
 	)
+	Log.RequestIDHeaders = sec.Key("REQUEST_ID_HEADERS").Strings(",")
 	// the `MustString` updates the default value, and `log.ACCESS` is used by `generateNamedLogger("access")` later
 	_ = rootCfg.Section("log").Key("ACCESS").MustString("file")
 

From 3de9e63fd04d61e08fcbdec035c9f138347d9f37 Mon Sep 17 00:00:00 2001
From: Zettat123 <zettat123@gmail.com>
Date: Sat, 11 Mar 2023 00:42:38 +0800
Subject: [PATCH 43/53] Hide target selector if tag exists when creating new
 release (#23171)

Close #22649.

|status|screenshot|
|-|-|
|empty tag name|<img
src="https://user-images.githubusercontent.com/15528715/221490165-fd3abd2e-6dc5-4562-bece-d1d6a305479e.png"
width="300px"/>|
|new tag|<img
src="https://user-images.githubusercontent.com/15528715/221490450-49b2a48e-b206-49f4-bd79-34b1ea64156f.png"
width="300px"/>|
|existing tag|<img
src="https://user-images.githubusercontent.com/15528715/221490301-4d1879dd-4947-4abc-9b9a-e77be1806981.png"
width="300px"/>|
---
 options/locale/locale_en-US.ini     |  2 ++
 templates/repo/release/new.tmpl     | 33 +++++++++++++-----------
 web_src/js/features/repo-release.js | 39 +++++++++++++++++++++++++++--
 web_src/js/index.js                 |  4 +--
 4 files changed, 60 insertions(+), 18 deletions(-)

diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 095257b365fb8..dccf184335b28 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -2290,6 +2290,8 @@ release.edit_subheader = Releases organize project versions.
 release.tag_name = Tag name
 release.target = Target
 release.tag_helper = Choose an existing tag or create a new tag.
+release.tag_helper_new = New tag. This tag will be created from the target.
+release.tag_helper_existing = Existing tag.
 release.title = Title
 release.content = Content
 release.prerelease_desc = Mark as Pre-Release
diff --git a/templates/repo/release/new.tmpl b/templates/repo/release/new.tmpl
index 37d7ca032196e..d7c580fed9693 100644
--- a/templates/repo/release/new.tmpl
+++ b/templates/repo/release/new.tmpl
@@ -20,22 +20,27 @@
 						<b>{{.tag_name}}</b><span class="at">@</span><strong>{{.tag_target}}</strong>
 					{{else}}
 						<input id="tag-name" name="tag_name" value="{{.tag_name}}" placeholder="{{.locale.Tr "repo.release.tag_name"}}" autofocus required maxlength="255">
-						<span class="at">@</span>
-						<div class="ui selection dropdown">
-							<input type="hidden" name="tag_target" value="{{.tag_target}}"/>
-							{{svg "octicon-git-branch"}}
-							<div class="text">
-								{{.locale.Tr "repo.release.target"}} :
-								<strong id="repo-branch-current">{{.Repository.DefaultBranch}}</strong>
-							</div>
-							{{svg "octicon-triangle-down" 14 "dropdown icon"}}
-							<div class="menu">
-								{{range .Branches}}
-									<div class="item" data-value="{{.}}">{{.}}</div>
-								{{end}}
+						<input id="tag-name-editor" type="hidden" data-existing-tags={{Json .Tags}} data-tag-helper={{.locale.Tr "repo.release.tag_helper"}} data-tag-helper-new={{.locale.Tr "repo.release.tag_helper_new"}} data-tag-helper-existing={{.locale.Tr "repo.release.tag_helper_existing"}} />
+						<div id="tag-target-selector" class="gt-dib">
+							<span class="at">@</span>
+							<div class="ui selection dropdown">
+								<input type="hidden" name="tag_target" value="{{.tag_target}}"/>
+								{{svg "octicon-git-branch"}}
+								<div class="text">
+									{{.locale.Tr "repo.release.target"}} :
+									<strong id="repo-branch-current">{{.Repository.DefaultBranch}}</strong>
+								</div>
+								{{svg "octicon-triangle-down" 14 "dropdown icon"}}
+								<div class="menu">
+									{{range .Branches}}
+										<div class="item" data-value="{{.}}">{{.}}</div>
+									{{end}}
+								</div>
 							</div>
 						</div>
-						<span class="help">{{.locale.Tr "repo.release.tag_helper"}}</span>
+						<div>
+							<span id="tag-helper" class="help gt-mt-2">{{.locale.Tr "repo.release.tag_helper"}}</span>
+						</div>
 					{{end}}
 				</div>
 			</div>
diff --git a/web_src/js/features/repo-release.js b/web_src/js/features/repo-release.js
index a061c6b23f832..a230d7765e223 100644
--- a/web_src/js/features/repo-release.js
+++ b/web_src/js/features/repo-release.js
@@ -3,7 +3,7 @@ import {attachTribute} from './tribute.js';
 import {initCompMarkupContentPreviewTab} from './comp/MarkupContentPreview.js';
 import {initEasyMDEImagePaste} from './comp/ImagePaste.js';
 import {createCommentEasyMDE} from './comp/EasyMDE.js';
-import {hideElem} from '../utils/dom.js';
+import {hideElem, showElem} from '../utils/dom.js';
 
 export function initRepoRelease() {
   $(document).on('click', '.remove-rel-attach', function() {
@@ -14,8 +14,43 @@ export function initRepoRelease() {
   });
 }
 
+export function initRepoReleaseNew() {
+  const $repoReleaseNew = $('.repository.new.release');
+  if (!$repoReleaseNew.length) return;
 
-export function initRepoReleaseEditor() {
+  initTagNameEditor();
+  initRepoReleaseEditor();
+}
+
+function initTagNameEditor() {
+  const el = document.getElementById('tag-name-editor');
+  if (!el) return;
+
+  const existingTags = JSON.parse(el.getAttribute('data-existing-tags'));
+  if (!Array.isArray(existingTags)) return;
+
+  const defaultTagHelperText = el.getAttribute('data-tag-helper');
+  const newTagHelperText = el.getAttribute('data-tag-helper-new');
+  const existingTagHelperText = el.getAttribute('data-tag-helper-existing');
+
+  document.getElementById('tag-name').addEventListener('keyup', (e) => {
+    const value = e.target.value;
+    if (existingTags.includes(value)) {
+      // If the tag already exists, hide the target branch selector.
+      hideElem('#tag-target-selector');
+      document.getElementById('tag-helper').innerText = existingTagHelperText;
+    } else {
+      showElem('#tag-target-selector');
+      if (value) {
+        document.getElementById('tag-helper').innerText = newTagHelperText;
+      } else {
+        document.getElementById('tag-helper').innerText = defaultTagHelperText;
+      }
+    }
+  });
+}
+
+function initRepoReleaseEditor() {
   const $editor = $('.repository.new.release .content-editor');
   if ($editor.length === 0) {
     return;
diff --git a/web_src/js/index.js b/web_src/js/index.js
index 611c09d2b8c16..6b4f4ef3ebe12 100644
--- a/web_src/js/index.js
+++ b/web_src/js/index.js
@@ -76,7 +76,7 @@ import {
 import {initViewedCheckboxListenerFor} from './features/pull-view-file.js';
 import {initOrgTeamSearchRepoBox, initOrgTeamSettings} from './features/org-team.js';
 import {initUserAuthWebAuthn, initUserAuthWebAuthnRegister} from './features/user-auth-webauthn.js';
-import {initRepoRelease, initRepoReleaseEditor} from './features/repo-release.js';
+import {initRepoRelease, initRepoReleaseNew} from './features/repo-release.js';
 import {initRepoEditor} from './features/repo-editor.js';
 import {initCompSearchUserBox} from './features/comp/SearchUserBox.js';
 import {initInstall} from './features/install.js';
@@ -179,7 +179,7 @@ $(document).ready(() => {
   initRepoPullRequestAllowMaintainerEdit();
   initRepoPullRequestReview();
   initRepoRelease();
-  initRepoReleaseEditor();
+  initRepoReleaseNew();
   initRepoSettingGitHook();
   initRepoSettingSearchTeamBox();
   initRepoSettingsCollaboration();

From f20bf2fe3b17d998940d5277db75c16b41d2a12c Mon Sep 17 00:00:00 2001
From: GiteaBot <teabot@gitea.io>
Date: Sat, 11 Mar 2023 00:15:59 +0000
Subject: [PATCH 44/53] [skip ci] Updated translations via Crowdin

---
 options/locale/locale_tr-TR.ini | 14 ++++-----
 options/locale/locale_zh-TW.ini | 52 +++++++++++++++++++--------------
 2 files changed, 37 insertions(+), 29 deletions(-)

diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index c0e5bb220847b..877d767ae068f 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -334,7 +334,7 @@ non_local_account=Yerel olmayan kullanıcılar parolalarını Gitea web arayüz
 verify=Doğrula
 scratch_code=Çizgi kodu
 use_scratch_code=Bir çizgi kodu kullanınız
-twofa_scratch_used=Çizgi kodunuzu kullandınız. İki aşamalı ayarlar sayfasına yönlendirildiniz, burada cihaz kaydınızı kaldırabilir veya yeni bir çizgi kodu oluşturabilirsiniz.
+twofa_scratch_used=Geçici kodunuzu kullandınız. İki aşamalı ayarlar sayfasına yönlendirildiniz, burada aygıt kaydınızı kaldırabilir veya yeni bir geçici kod oluşturabilirsiniz.
 twofa_passcode_incorrect=Şifreniz yanlış. Aygıtınızı yanlış yerleştirdiyseniz, oturum açmak için çizgi kodunuzu kullanın.
 twofa_scratch_token_incorrect=Çizgi kodunuz doğru değildir.
 login_userpass=Oturum Aç
@@ -736,12 +736,12 @@ unbind=Bağlantıyı Kaldır
 unbind_success=Sosyal hesabın bağlantısı Gitea hesabınızdan kaldırılmıştır.
 
 manage_access_token=Erişim Jetonlarını Yönet
-generate_new_token=Yeni Jeton Üret
+generate_new_token=Yeni Erişim Anahtarı Üret
 tokens_desc=Bu jetonlar Gitea API'sini kullanarak hesabınıza erişim sağlar.
 new_token_desc=Jeton kullanan uygulamalar hesabınıza tam erişime sahiptir.
 token_name=Jeton İsmi
-generate_token=Jeton Üret
-generate_token_success=Yeni bir jeton oluşturuldu. Tekrar gösterilmeyeceği için şimdi kopyalayın.
+generate_token=Erişim Anahtarı Üret
+generate_token_success=Yeni bir erişim anahtarı oluşturuldu. Tekrar gösterilmeyeceği için şimdi kopyalayın.
 generate_token_name_duplicate=<strong>%s</strong> zaten bir uygulama adı olarak kullanılmış. Lütfen yeni bir tane kullanın.
 delete_token=Sil
 access_token_deletion=Erişim Jetonunu Sil
@@ -784,12 +784,12 @@ twofa_desc=İki faktörlü kimlik doğrulama, hesabınızın güvenliğini artı
 twofa_is_enrolled=Hesabınız şu anda iki faktörlü kimlik doğrulaması içinde <strong>kaydedilmiş</strong>.
 twofa_not_enrolled=Hesabınız şu anda iki faktörlü kimlik doğrulaması içinde kaydedilmemiş.
 twofa_disable=İki Aşamalı Doğrulamayı Devre Dışı Bırak
-twofa_scratch_token_regenerate=Kazıma Belirtecini Yenile
-twofa_scratch_token_regenerated=Kazıma belirteciniz şimdi %s. Güvenli bir yerde saklayın.
+twofa_scratch_token_regenerate=Geçici Kodu Yeniden Üret
+twofa_scratch_token_regenerated=Geçici kodunuz artık %s. Güvenilir bir yerde saklayın.
 twofa_enroll=İki Faktörlü Kimlik Doğrulamaya Kaydolun
 twofa_disable_note=Gerekirse iki faktörlü kimlik doğrulamayı devre dışı bırakabilirsiniz.
 twofa_disable_desc=İki faktörlü kimlik doğrulamayı devre dışı bırakmak hesabınızı daha az güvenli hale getirir. Devam edilsin mi?
-regenerate_scratch_token_desc=Karalama belirtecinizi yanlış yerleştirdiyseniz veya oturum açmak için kullandıysanız, buradan sıfırlayabilirsiniz.
+regenerate_scratch_token_desc=Geçici kodunuzu kaybettiyseniz veya oturum açmak için kullandıysanız, buradan sıfırlayabilirsiniz.
 twofa_disabled=İki faktörlü kimlik doğrulama devre dışı bırakıldı.
 scan_this_image=Kim doğrulama uygulamanızla bu görüntüyü tarayın:
 or_enter_secret=Veya gizli şeyi girin: %s
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index 51610f4e82d74..fa39225c1b894 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -54,7 +54,7 @@ mirror=鏡像
 new_repo=新增儲存庫
 new_migrate=遷移外部儲存庫
 new_mirror=新鏡像
-new_fork=新增儲存庫 fork
+new_fork=新增儲存庫 Fork
 new_org=新增組織
 new_project=新增專案
 new_project_column=新增欄位
@@ -476,6 +476,8 @@ url_error=`'%s' 是無效的 URL。`
 include_error=` 必須包含子字串「%s」。
 glob_pattern_error=` glob 比對模式無效：%s.`
 regex_pattern_error=` 正規表示式模式無效：%s.`
+username_error=`只能包含英文字母數字 ('0-9'、'a-z'、'A-Z')、破折號 ('-')、底線 ('_')、句點 ('.')，不能以非英文字母數字開頭或結尾，也不允許連續的非英文字母數字。`
+invalid_group_team_map_error=` 對應無效: %s`
 unknown_error=未知錯誤：
 captcha_incorrect=驗證碼不正確。
 password_not_match=密碼錯誤。
@@ -521,11 +523,11 @@ must_use_public_key=您提供的金鑰是私有金鑰，請勿上傳您的私有
 unable_verify_ssh_key=無法驗證 SSH 密鑰
 auth_failed=授權認證失敗：%v
 
-still_own_repo=此帳戶仍然擁有一個或多個儲存庫，您必須先刪除或轉移它們。
-still_has_org=此帳戶仍是一個或多個組織的成員，您必須先離開它們。
-still_own_packages=您的帳戶擁有一個或多個套件，請先刪除他們。
-org_still_own_repo=該組織仍然是某些儲存庫的擁有者，您必須先轉移或刪除它們才能執行刪除組織！
-org_still_own_packages=此組織擁有一個或多個套件，請先刪除他們。
+still_own_repo=您的帳戶擁有一個以上的儲存庫，請先刪除或轉移它們。
+still_has_org=您的帳戶是一個或多個組織的成員，請先離開它們。
+still_own_packages=您的帳戶擁有一個以上的套件，請先刪除它們。
+org_still_own_repo=此組織仍然擁有一個以上的儲存庫，請先刪除或轉移它們。
+org_still_own_packages=此組織仍然擁有一個以上的套件，請先刪除它們。
 
 target_branch_not_exist=目標分支不存在
 
@@ -1132,6 +1134,7 @@ editor.commit_directly_to_this_branch=直接提交到 <strong class="branch-name
 editor.create_new_branch=為此提交建立<strong>新分支</strong>並提出合併請求。
 editor.create_new_branch_np=為本次提交建立<strong>新分支</strong>。
 editor.propose_file_change=提出檔案變更
+editor.new_branch_name=命名此提交的新分支
 editor.new_branch_name_desc=新的分支名稱...
 editor.cancel=取消
 editor.filename_cannot_be_empty=檔案名稱不能為空。
@@ -1217,8 +1220,8 @@ projects.template.desc=範本
 projects.template.desc_helper=選擇專案範本以開始
 projects.type.uncategorized=未分類
 projects.column.edit=編輯欄位
-projects.column.edit_title=組織名稱
-projects.column.new_title=組織名稱
+projects.column.edit_title=名稱
+projects.column.new_title=名稱
 projects.column.new_submit=建立欄位
 projects.column.new=新增欄位
 projects.column.set_default=設為預設
@@ -1238,7 +1241,7 @@ issues.filter_assignees=篩選負責人
 issues.filter_milestones=篩選里程碑
 issues.filter_projects=篩選專案
 issues.filter_labels=篩選標籤
-issues.filter_reviewers=篩選審查者
+issues.filter_reviewers=篩選審核者
 issues.new=新增問題
 issues.new.title_empty=標題不可為空
 issues.new.labels=標籤
@@ -1655,6 +1658,7 @@ pulls.merge_instruction_hint=`您也可以查看<a class="show-instruction">命
 pulls.merge_instruction_step1_desc=在您的儲存庫中切換到新分支並測試變更。
 pulls.merge_instruction_step2_desc=合併變更並更新到 Gitea。
 pulls.clear_merge_message=清除合併訊息
+pulls.clear_merge_message_hint=清除合併訊息將僅移除提交訊息內容，留下產生的 git 結尾，如「Co-Authored-By …」。
 
 pulls.auto_merge_button_when_succeed=(當通過檢查後)
 pulls.auto_merge_when_succeed=通過所有檢查後自動合併
@@ -2619,7 +2623,7 @@ users.still_own_repo=這個使用者還擁有一個或更多的儲存庫。請
 users.still_has_org=此使用者是組織的成員。請先將他從組織中移除。
 users.purge=清除使用者
 users.purge_help=強制刪除使用者和他擁有的所有儲存庫、組織、套件，所有留言也會被刪除。
-users.still_own_packages=此使用者擁有一個或多個套件，請先刪除這些套件。
+users.still_own_packages=此使用者仍然擁有一個以上的套件，請先刪除這些套件。
 users.deletion_success=使用者帳戶已被刪除。
 users.reset_2fa=重設兩步驟驗證
 users.list_status_filter.menu_text=篩選
@@ -2649,7 +2653,7 @@ emails.change_email_header=更新電子信箱屬性
 emails.change_email_text=您確定要更新這個電子信箱？
 
 orgs.org_manage_panel=組織管理
-orgs.name=組織名稱
+orgs.name=名稱
 orgs.teams=團隊數
 orgs.members=成員數
 orgs.new_orga=新增組織
@@ -2658,7 +2662,7 @@ repos.repo_manage_panel=儲存庫管理
 repos.unadopted=未接管的儲存庫
 repos.unadopted.no_more=找不到其他未接管的儲存庫
 repos.owner=擁有者
-repos.name=儲存庫名稱
+repos.name=名稱
 repos.private=私有
 repos.watches=關注數
 repos.stars=星號數
@@ -2690,8 +2694,8 @@ systemhooks.update_webhook=更新系統 Webhook
 
 auths.auth_manage_panel=認證來源管理
 auths.new=新增認證來源
-auths.name=認證名稱
-auths.type=認證類型
+auths.name=名稱
+auths.type=類型
 auths.enabled=已啟用
 auths.syncenabled=啟用使用者同步
 auths.updated=最後更新時間
@@ -2762,6 +2766,7 @@ auths.oauth2_required_claim_value_helper=填寫此名稱以限制 Claim 中有
 auths.oauth2_group_claim_name=Claim 名稱提供群組名稱給此來源。(選用)
 auths.oauth2_admin_group=管理員使用者的群組 Claim 值。(選用 - 需要上面的 Claim 名稱)
 auths.oauth2_restricted_group=受限制使用者的群組 Claim 值。(選用 - 需要上面的 Claim 名稱)
+auths.oauth2_map_group_to_team=將已 Claim 的群組對應到組織團隊。(選用 - 需要上述 Claim 名稱)
 auths.oauth2_map_group_to_team_removal=如果使用者不屬於相對應的群組，將使用者從已同步的團隊移除。
 auths.enable_auto_register=允許授權用戶自動註冊
 auths.sspi_auto_create_users=自動建立使用者
@@ -2843,7 +2848,7 @@ config.lfs_http_auth_expiry=LFS HTTP 驗證有效時間
 config.db_config=資料庫組態
 config.db_type=資料庫類型
 config.db_host=主機地址
-config.db_name=資料庫名稱
+config.db_name=名稱
 config.db_user=使用者名稱
 config.db_schema=結構描述
 config.db_ssl_mode=SSL
@@ -2946,7 +2951,7 @@ config.get_setting_failed=讀取設定值 %s 失敗
 config.set_setting_failed=寫入設定值 %s 失敗
 
 monitor.cron=Cron 任務
-monitor.name=任務名稱
+monitor.name=名稱
 monitor.schedule=任務安排
 monitor.next=下次執行時間
 monitor.previous=上次執行時間
@@ -3031,7 +3036,7 @@ notices.deselect_all=取消所有選取
 notices.inverse_selection=反向選取
 notices.delete_selected=刪除選取項
 notices.delete_all=刪除所有提示
-notices.type=提示類型
+notices.type=類型
 notices.type_1=儲存庫
 notices.type_2=任務
 notices.desc=描述
@@ -3196,7 +3201,7 @@ generic.documentation=關於通用 registry 的詳情請參閱<a target="_blank"
 helm.registry=透過下列命令設定此註冊中心:
 helm.install=執行下列命令安裝此套件:
 helm.documentation=關於 Helm registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/helm/">說明文件</a>。
-maven.registry=在您的 <code>pom.xml</code> 檔設定此註冊中心:
+maven.registry=在您專案的 <code>pom.xml</code> 檔設定此註冊中心:
 maven.install=若要使用此套件，請在您 <code>pom.xml</code> 檔的 <code>dependencies</code> 段落加入下列內容:
 maven.install2=透過下列命令執行:
 maven.download=透過下列命令下載相依性:
@@ -3205,7 +3210,7 @@ nuget.registry=透過下列命令設定此註冊中心:
 nuget.install=執行下列命令以使用 NuGet 安裝此套件:
 nuget.documentation=關於 NuGet registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/nuget/">說明文件</a>。
 nuget.dependency.framework=目標框架
-npm.registry=在您的 <code>.npmrc</code> 檔設定此註冊中心:
+npm.registry=在您專案的 <code>.npmrc</code> 檔設定此註冊中心:
 npm.install=執行下列命令以使用 npm 安裝此套件:
 npm.install2=或將它加到 package.json 檔:
 npm.documentation=關於 npm registry 的詳情請參閱<a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/npm/">說明文件</a>。
@@ -3241,6 +3246,7 @@ settings.delete.success=已刪除該套件。
 settings.delete.error=刪除套件失敗。
 owner.settings.cargo.title=Cargo Registry 索引
 owner.settings.cargo.initialize=初始化索引
+owner.settings.cargo.initialize.description=使用 Cargo Registry 時需要一個特別的 Git 儲存庫作為索引。您可以在此使用必要的設定建立和重建它。
 owner.settings.cargo.initialize.error=初始化 Cargo 索引失敗: %v
 owner.settings.cargo.initialize.success=成功建立了 Cargo 索引。
 owner.settings.cargo.rebuild=重建索引
@@ -3252,6 +3258,7 @@ owner.settings.cleanuprules.add=加入清理規則
 owner.settings.cleanuprules.edit=編輯清理規則
 owner.settings.cleanuprules.none=沒有可用的清理規則。閱讀文件以了解更多。
 owner.settings.cleanuprules.preview=清理規則預覽
+owner.settings.cleanuprules.preview.overview=已排定要移除 %d 個套件。
 owner.settings.cleanuprules.preview.none=清理規則不符合任何套件。
 owner.settings.cleanuprules.enabled=已啟用
 owner.settings.cleanuprules.pattern_full_match=將比對規則套用到完整的套件名稱
@@ -3275,8 +3282,9 @@ secrets=Secret
 description=Secret 會被傳給特定的 Action，其他情況無法讀取。
 none=還沒有 Secret。
 value=值
-name=組織名稱
+name=名稱
 creation=加入 Secret
+creation.name_placeholder=不區分大小寫，只能包含英文字母、數字、底線 ('_')，不能以 GITEA_ 或 GITHUB_ 開頭。
 creation.value_placeholder=輸入任何內容，頭尾的空白都會被忽略。
 creation.success=已加入 Secret「%s」。
 creation.failed=加入 Secret 失敗。
@@ -3305,8 +3313,8 @@ runners.new=建立 Runner
 runners.new_notice=如何啟動 Runner
 runners.status=狀態
 runners.id=ID
-runners.name=組織名稱
-runners.owner_type=認證類型
+runners.name=名稱
+runners.owner_type=類型
 runners.description=組織描述
 runners.labels=標籤
 runners.last_online=最後上線時間

From 75022f8b1a513ca2fd7ca66a2f05ecc49e2f1460 Mon Sep 17 00:00:00 2001
From: wxiaoguang <wxiaoguang@gmail.com>
Date: Sat, 11 Mar 2023 18:47:09 +0800
Subject: [PATCH 45/53] Refactor branch/tag selector dropdown (first step)
 (#23394)

Follow:
* #23345

The branch/tag selector dropdown mixes jQuery/Fomantic UI/Vue together,
it's very diffcult to maintain and causes unfixable a11y problems. It
also causes problems like #19851 #21314 #21952

This PR is the first step for the refactoring, move `data-` attributes
to JS object and use Vue data as much as possible.

The old selector `'.choose.reference .dropdown'` was also wrong, it hits
`<div class="choose reference"><svg class="dropdown icon">` and would
cause undefined behaviors.

I have done some quick tests and it works. After this PR gets merged, I
will move the code into a Vue SFC in next PR.



![image](https://user-images.githubusercontent.com/2114189/224099638-378a8a86-0865-47d1-bcba-f972506374c7.png)


![image](https://user-images.githubusercontent.com/2114189/224099690-70276cf5-b1e4-404a-b0c6-582448abf40e.png)

---------

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 templates/repo/branch_dropdown.tmpl           | 128 ++++++++++--------
 templates/repo/commit_page.tmpl               |   8 +-
 .../js/components/RepoBranchTagDropdown.js    |  67 ++++-----
 web_src/js/features/repo-legacy.js            |   2 +-
 4 files changed, 101 insertions(+), 104 deletions(-)

diff --git a/templates/repo/branch_dropdown.tmpl b/templates/repo/branch_dropdown.tmpl
index 89d65146a9d62..8e81373aec041 100644
--- a/templates/repo/branch_dropdown.tmpl
+++ b/templates/repo/branch_dropdown.tmpl
@@ -2,101 +2,111 @@
 {{$defaultBranch := $.root.BranchName}}{{if and .root.IsViewTag (not .noTag)}}{{$defaultBranch = .root.TagName}}{{end}}{{if eq $defaultBranch ""}}{{$defaultBranch = $.root.Repository.DefaultBranch}}{{end}}
 {{$type := ""}}{{if and .root.IsViewTag (not .noTag)}}{{$type = "tag"}}{{else if .root.IsViewBranch}}{{$type = "branch"}}{{else}}{{$type = "tree"}}{{end}}
 {{$showBranchesInDropdown := not .root.HideBranchesInDropdown}}
+
+<script type="module">
+	const data = {
+		'textReleaseCompare': {{.root.locale.Tr "repo.release.compare"}},
+		'textCreateTag': {{.root.locale.Tr "repo.tag.create_tag"}},
+		'textCreateBranch': {{.root.locale.Tr "repo.branch.create_branch"}},
+		'textCreateBranchFrom': {{.root.locale.Tr "repo.branch.create_from"}},
+		'textBranches': {{.root.locale.Tr "repo.branches"}},
+		'textTags': {{.root.locale.Tr "repo.tags"}},
+
+		'mode': '{{if or .root.IsViewTag .isTag}}tags{{else}}branches{{end}}',
+		'showBranchesInDropdown': {{$showBranchesInDropdown}},
+		'searchFieldPlaceholder': '{{if $.noTag}}{{.root.locale.Tr "repo.pulls.filter_branch"}}{{else if $showBranchesInDropdown}}{{.root.locale.Tr "repo.filter_branch_and_tag"}}{{else}}{{.root.locale.Tr "repo.find_tag"}}{{end}}...',
+		'branchForm': {{$.branchForm}},
+		'disableCreateBranch': {{if .disableCreateBranch}}{{.disableCreateBranch}}{{else}}{{not .root.CanCreateBranch}}{{end}},
+		'setAction': {{.setAction}},
+		'submitForm': {{.submitForm}},
+		'viewType': {{$type}},
+		'refName': {{if and .root.IsViewTag (not .noTag)}}{{.root.TagName}}{{else if .root.IsViewBranch}}{{.root.BranchName}}{{else}}{{ShortSha .root.CommitID}}{{end}},
+		'commitIdShort': {{ShortSha .root.CommitID}},
+		'tagName': {{.root.TagName}},
+		'branchName': {{.root.BranchName}},
+		'noTag': {{.noTag}},
+		'branches': {{.root.Branches}},
+		'tags': {{.root.Tags}},
+		'defaultBranch': {{$defaultBranch}},
+		'branchURLPrefix': '{{if .branchURLPrefix}}{{.branchURLPrefix}}{{else}}{{$.root.RepoLink}}/{{if $.root.PageIsCommits}}commits{{else}}src{{end}}/branch/{{end}}',
+		'branchURLSuffix': '{{if .branchURLSuffix}}{{.branchURLSuffix}}{{else}}{{if $.root.TreePath}}/{{PathEscapeSegments $.root.TreePath}}{{end}}{{end}}',
+		'tagURLPrefix': '{{if .tagURLPrefix}}{{.tagURLPrefix}}{{else if $release}}{{$.root.RepoLink}}/compare/{{else}}{{$.root.RepoLink}}/{{if $.root.PageIsCommits}}commits{{else}}src{{end}}/tag/{{end}}',
+		'tagURLSuffix': '{{if .tagURLSuffix}}{{.tagURLSuffix}}{{else if $release}}...{{if $release.IsDraft}}{{PathEscapeSegments $release.Target}}{{else}}{{if $release.TagName}}{{PathEscapeSegments $release.TagName}}{{else}}{{PathEscapeSegments $release.Sha1}}{{end}}{{end}}{{else}}{{if $.root.TreePath}}/{{PathEscapeSegments $.root.TreePath}}{{end}}{{end}}',
+		'repoLink': {{.root.RepoLink}},
+		'treePath': {{.root.TreePath}},
+		'branchNameSubURL': {{.root.BranchNameSubURL}},
+		'noResults': {{.root.locale.Tr "repo.pulls.no_results"}},
+	};
+	{{if .release}}
+	data.release = {
+		'tagName': {{.release.TagName}},
+	};
+	{{end}}
+	window.config.pageData.branchDropdownDataList = window.config.pageData.branchDropdownDataList || [];
+	window.config.pageData.branchDropdownDataList.push(data);
+</script>
+
 <div class="fitted item choose reference">
-	<div class="ui floating filter dropdown custom"
-		data-branch-form="{{if $.branchForm}}{{$.branchForm}}{{end}}"
-		data-can-create-branch="{{if .canCreateBranch}}{{.canCreateBranch}}{{else}}{{.root.CanCreateBranch}}{{end}}"
-		data-no-results="{{.root.locale.Tr "repo.pulls.no_results"}}"
-		data-set-action="{{.setAction}}" data-submit-form="{{.submitForm}}"
-		data-view-type="{{$type}}"
-		data-ref-name="{{if and .root.IsViewTag (not .noTag)}}{{.root.TagName}}{{else if .root.IsViewBranch}}{{.root.BranchName}}{{else}}{{ShortSha .root.CommitID}}{{end}}"
-		data-branch-url-prefix="{{if .branchURLPrefix}}{{.branchURLPrefix}}{{else}}{{$.root.RepoLink}}/{{if $.root.PageIsCommits}}commits{{else}}src{{end}}/branch/{{end}}"
-		data-branch-url-suffix="{{if .branchURLSuffix}}{{.branchURLSuffix}}{{else}}{{if $.root.TreePath}}/{{PathEscapeSegments $.root.TreePath}}{{end}}{{end}}"
-		data-tag-url-prefix="{{if .tagURLPrefix}}{{.tagURLPrefix}}{{else if $release}}{{$.root.RepoLink}}/compare/{{else}}{{$.root.RepoLink}}/{{if $.root.PageIsCommits}}commits{{else}}src{{end}}/tag/{{end}}"
-		data-tag-url-suffix="{{if .tagURLSuffix}}{{.tagURLSuffix}}{{else if $release}}...{{if $release.IsDraft}}{{PathEscapeSegments $release.Target}}{{else}}{{if $release.TagName}}{{PathEscapeSegments $release.TagName}}{{else}}{{PathEscapeSegments $release.Sha1}}{{end}}{{end}}{{else}}{{if $.root.TreePath}}/{{PathEscapeSegments $.root.TreePath}}{{end}}{{end}}">
+	<div class="ui floating filter dropdown custom">
 		<button class="branch-dropdown-button gt-ellipsis ui basic small compact button gt-df" @click="menuVisible = !menuVisible" @keyup.enter="menuVisible = !menuVisible">
 			<span class="text gt-df gt-ac gt-mr-2">
-				{{if $release}}
-					{{.root.locale.Tr "repo.release.compare"}}
-				{{else}}
-					<span :class="{visible: isViewTag}" v-if="isViewTag" {{if not (eq $type "tag")}}v-cloak{{end}}>{{svg "octicon-tag"}}</span>
-					<span :class="{visible: isViewBranch}" v-if="isViewBranch" {{if not (eq $type "branch")}}v-cloak{{end}}>{{svg "octicon-git-branch"}}</span>
-					<span :class="{visible: isViewTree}" v-if="isViewTree" {{if not (eq $type "tree")}}v-cloak{{end}}>{{svg "octicon-git-branch"}}</span>
-					<strong ref="dropdownRefName" class="gt-ml-3">{{if and .root.IsViewTag (not .noTag)}}{{.root.TagName}}{{else if .root.IsViewBranch}}{{.root.BranchName}}{{else}}{{ShortSha .root.CommitID}}{{end}}</strong>
-				{{end}}
+				{{/* v-cloak is used to hide unnecessary elements before Vue componment is mounted */}}
+				<span v-cloak v-if="release">${ textReleaseCompare }</span>
+				<span :class="{visible: isViewTag}" v-if="isViewTag" {{if not (eq $type "tag")}}v-cloak{{end}}>{{svg "octicon-tag"}}</span>
+				<span :class="{visible: isViewBranch}" v-if="isViewBranch" {{if not (eq $type "branch")}}v-cloak{{end}}>{{svg "octicon-git-branch"}}</span>
+				<span :class="{visible: isViewTree}" v-if="isViewTree" {{if not (eq $type "tree")}}v-cloak{{end}}>{{svg "octicon-git-branch"}}</span>
+				<strong ref="dropdownRefName" class="gt-ml-3">{{if and .root.IsViewTag (not .noTag)}}{{.root.TagName}}{{else if .root.IsViewBranch}}{{.root.BranchName}}{{else}}{{ShortSha .root.CommitID}}{{end}}</strong>
 			</span>
 			{{svg "octicon-triangle-down" 14 "dropdown icon"}}
 		</button>
-		<div class="data gt-hidden" data-mode="{{if or .root.IsViewTag .isTag}}tags{{else}}branches{{end}}">
-			{{if $showBranchesInDropdown}}
-				{{range .root.Branches}}
-					<div class="item branch {{if eq $defaultBranch .}}selected{{end}}" data-url="{{PathEscapeSegments .}}">{{.}}</div>
-				{{end}}
-			{{end}}
-			{{if (not .noTag)}}
-				{{range .root.Tags}}
-					{{if $release}}
-						<div class="item tag {{if eq $release.TagName .}}selected{{end}}" data-url="{{PathEscapeSegments .}}">{{.}}</div>
-					{{else}}
-						<div class="item tag {{if eq $defaultBranch .}}selected{{end}}" data-url="{{PathEscapeSegments .}}">{{.}}</div>
-					{{end}}
-				{{end}}
-			{{end}}
-		</div>
 		<div class="menu transition" :class="{visible: menuVisible}" v-if="menuVisible" v-cloak>
 			<div class="ui icon search input">
 				<i class="icon gt-df gt-ac gt-jc gt-m-0">{{svg "octicon-filter" 16}}</i>
-				<input name="search" ref="searchField" autocomplete="off" v-model="searchTerm" @keydown="keydown($event)" placeholder="{{if $.noTag}}{{.root.locale.Tr "repo.pulls.filter_branch"}}{{else if $showBranchesInDropdown}}{{.root.locale.Tr "repo.filter_branch_and_tag"}}{{else}}{{.root.locale.Tr "repo.find_tag"}}{{end}}...">
+				<input name="search" ref="searchField" autocomplete="off" v-model="searchTerm" @keydown="keydown($event)" :placeholder="searchFieldPlaceholder">
 			</div>
-			{{if $showBranchesInDropdown}}
+			<template v-if="showBranchesInDropdown">
 				<div class="header branch-tag-choice">
 					<div class="ui grid">
 						<div class="two column row">
 							<a class="reference column" href="#" @click="createTag = false; mode = 'branches'; focusSearchField()">
-								<span class="text" :class="{black: mode == 'branches'}">
-									{{svg "octicon-git-branch" 16 "gt-mr-2"}}{{.root.locale.Tr "repo.branches"}}
+								<span class="text" :class="{black: mode === 'branches'}">
+									{{svg "octicon-git-branch" 16 "gt-mr-2"}}${ textBranches }
 								</span>
 							</a>
-							{{if not .noTag}}
+							<template v-if="!noTag">
 								<a class="reference column" href="#" @click="createTag = true; mode = 'tags'; focusSearchField()">
-									<span class="text" :class="{black: mode == 'tags'}">
-										{{svg "octicon-tag" 16 "gt-mr-2"}}{{.root.locale.Tr "repo.tags"}}
+									<span class="text" :class="{black: mode === 'tags'}">
+										{{svg "octicon-tag" 16 "gt-mr-2"}}${ textTags }
 									</span>
 								</a>
-							{{end}}
+							</template>
 						</div>
 					</div>
 				</div>
-			{{end}}
+			</template>
 			<div class="scrolling menu" ref="scrollContainer">
-				<div v-for="(item, index) in filteredItems" :key="item.name" class="item" :class="{selected: item.selected, active: active == index}" @click="selectItem(item)" :ref="'listItem' + index">${ item.name }</div>
-				<div class="item" v-if="showCreateNewBranch" :class="{active: active == filteredItems.length}" :ref="'listItem' + filteredItems.length">
+				<div v-for="(item, index) in filteredItems" :key="item.name" class="item" :class="{selected: item.selected, active: active === index}" @click="selectItem(item)" :ref="'listItem' + index">${ item.name }</div>
+				<div class="item" v-if="showCreateNewBranch" :class="{active: active === filteredItems.length}" :ref="'listItem' + filteredItems.length">
 					<a href="#" @click="createNewBranch()">
 						<div v-show="createTag">
 							<i class="reference tags icon"></i>
-							{{.root.locale.Tr "repo.tag.create_tag" `${ searchTerm }` | Safe}}
+							<span v-html="textCreateTag.replace('%s', searchTerm)"></span>
 						</div>
 						<div v-show="!createTag">
 							{{svg "octicon-git-branch"}}
-							{{.root.locale.Tr "repo.branch.create_branch" `${ searchTerm }` | Safe}}
+							<span v-html="textCreateBranch.replace('%s', searchTerm)"></span>
 						</div>
 						<div class="text small">
-							{{if or .root.IsViewBranch $release}}
-								{{.root.locale.Tr "repo.branch.create_from" .root.BranchName}}
-							{{else if .root.IsViewTag}}
-								{{.root.locale.Tr "repo.branch.create_from" .root.TagName}}
-							{{else}}
-								{{.root.locale.Tr "repo.branch.create_from" (ShortSha .root.CommitID)}}
-							{{end}}
+							<span v-if="isViewBranch || release">${ textCreateBranchFrom.replace('%s', branchName) }</span>
+							<span v-else-if="isViewTag">${ textCreateBranchFrom.replace('%s', tagName) }</span>
+							<span v-else>${ textCreateBranchFrom.replace('%s', commitIdShort) }</span>
 						</div>
 					</a>
 					<form ref="newBranchForm" action="{{.root.RepoLink}}/branches/_new/{{.root.BranchNameSubURL}}" method="post">
-						{{.root.CsrfTokenHtml}}
+						<input type="hidden" name="_csrf" :value="csrfToken">
 						<input type="hidden" name="new_branch_name" v-model="searchTerm">
 						<input type="hidden" name="create_tag" v-model="createTag">
-						{{if $.root.TreePath}}
-							<input type="hidden" name="current_path" value="{{.root.TreePath}}">
-						{{end}}
+						<input type="hidden" name="current_path" v-model="treePath" v-if="treePath">
 					</form>
 				</div>
 			</div>
diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl
index 028fdc7e51484..f19a4d4223c78 100644
--- a/templates/repo/commit_page.tmpl
+++ b/templates/repo/commit_page.tmpl
@@ -52,13 +52,13 @@
 										data-modal-cherry-pick-type="revert"
 										data-modal-cherry-pick-header="{{$.locale.Tr "repo.commit.revert-header" (ShortSha .CommitID)}}"
 										data-modal-cherry-pick-content="{{$.locale.Tr "repo.commit.revert-content"}}"
-										data-modal-cherry-pick-submit="{{.locale.Tr "repo.commit.revert"}}">{{.locale.Tr "repo.commit.revert"}}</a></div>
+										data-modal-cherry-pick-submit="{{.locale.Tr "repo.commit.revert"}}">{{.locale.Tr "repo.commit.revert"}}</div>
 									<div class="item cherry-pick-button show-modal"
 										data-modal="#cherry-pick-modal"
 										data-modal-cherry-pick-type="cherry-pick"
 										data-modal-cherry-pick-header="{{$.locale.Tr "repo.commit.cherry-pick-header" (ShortSha .CommitID)}}"
 										data-modal-cherry-pick-content="{{$.locale.Tr "repo.commit.cherry-pick-content"}}"
-										data-modal-cherry-pick-submit="{{.locale.Tr "repo.commit.cherry-pick"}}">{{.locale.Tr "repo.commit.cherry-pick"}}</a></div>
+										data-modal-cherry-pick-submit="{{.locale.Tr "repo.commit.cherry-pick"}}">{{.locale.Tr "repo.commit.cherry-pick"}}</div>
 									<div class="ui basic modal" id="cherry-pick-modal">
 										<div class="ui icon header">
 											<span id="cherry-pick-header"></span>
@@ -66,10 +66,10 @@
 										<div class="content center">
 											<p id="cherry-pick-content" class="branch-dropdown"></p>
 											{{template "repo/branch_dropdown" dict "root" .
-												"noTag" "true" "canCreateBranch" "false"
+												"noTag" true "disableCreateBranch" true
 												"branchForm" "branch-dropdown-form"
 												"branchURLPrefix" (printf "%s/_cherrypick/%s/" $.RepoLink .CommitID) "branchURLSuffix" ""
-												"setAction" "true" "submitForm" "true"}}
+												"setAction" true "submitForm" true}}
 											<form method="GET" action="{{$.RepoLink}}/_cherrypick/{{.CommitID}}/{{if $.BranchName}}{{PathEscapeSegments $.BranchName}}{{else}}{{PathEscapeSegments $.Repository.DefaultBranch}}{{end}}" id="branch-dropdown-form">
 												<input type="hidden" name="ref" value="{{if $.BranchName}}{{$.BranchName}}{{else}}{{$.Repository.DefaultBranch}}{{end}}">
 												<input type="hidden" name="refType" value="branch">
diff --git a/web_src/js/components/RepoBranchTagDropdown.js b/web_src/js/components/RepoBranchTagDropdown.js
index 8bed305fcaec6..e1bf35c1294d0 100644
--- a/web_src/js/components/RepoBranchTagDropdown.js
+++ b/web_src/js/components/RepoBranchTagDropdown.js
@@ -3,43 +3,41 @@ import $ from 'jquery';
 import {vueDelimiters} from './VueComponentLoader.js';
 
 export function initRepoBranchTagDropdown(selector) {
-  $(selector).each(function () {
-    const $dropdown = $(this);
-    const $data = $dropdown.find('.data');
+  $(selector).each(function (dropdownIndex, elRoot) {
     const data = {
+      csrfToken: window.config.csrfToken,
       items: [],
-      mode: $data.data('mode'),
       searchTerm: '',
-      refName: '',
-      noResults: '',
-      canCreateBranch: false,
       menuVisible: false,
       createTag: false,
+      release: null,
+
       isViewTag: false,
       isViewBranch: false,
       isViewTree: false,
+
       active: 0,
-      branchForm: '',
-      branchURLPrefix: '',
-      branchURLSuffix: '',
-      tagURLPrefix: '',
-      tagURLSuffix: '',
-      setAction: false,
-      submitForm: false,
+
+      ...window.config.pageData.branchDropdownDataList[dropdownIndex],
     };
-    $data.find('.item').each(function () {
-      data.items.push({
-        name: $(this).text(),
-        url: $(this).data('url'),
-        branch: $(this).hasClass('branch'),
-        tag: $(this).hasClass('tag'),
-        selected: $(this).hasClass('selected')
-      });
-    });
-    $data.remove();
 
-    // eslint-disable-next-line unicorn/no-this-assignment
-    const elRoot = this;
+    // the "data.defaultBranch" is ambiguous, it could be "branch name" or "tag name"
+
+    if (data.showBranchesInDropdown && data.branches) {
+      for (const branch of data.branches) {
+        data.items.push({name: branch, url: branch, branch: true, tag: false, selected: branch === data.defaultBranch});
+      }
+    }
+    if (!data.noTag && data.tags) {
+      for (const tag of data.tags) {
+        if (data.release) {
+          data.items.push({name: tag, url: tag, branch: false, tag: true, selected: tag === data.release.tagName});
+        } else {
+          data.items.push({name: tag, url: tag, branch: false, tag: true, selected: tag === data.defaultBranch});
+        }
+      }
+    }
+
     const view = createApp({
       delimiters: vueDelimiters,
       data() {
@@ -60,7 +58,7 @@ export function initRepoBranchTagDropdown(selector) {
           return this.filteredItems.length === 0 && !this.showCreateNewBranch;
         },
         showCreateNewBranch() {
-          if (!this.canCreateBranch || !this.searchTerm) {
+          if (this.disableCreateBranch || !this.searchTerm) {
             return false;
           }
 
@@ -77,10 +75,7 @@ export function initRepoBranchTagDropdown(selector) {
       },
 
       beforeMount() {
-        this.noResults = elRoot.getAttribute('data-no-results');
-        this.canCreateBranch = elRoot.getAttribute('data-can-create-branch') === 'true';
-        this.branchForm = elRoot.getAttribute('data-branch-form');
-        switch (elRoot.getAttribute('data-view-type')) {
+        switch (data.viewType) {
           case 'tree':
             this.isViewTree = true;
             break;
@@ -91,14 +86,6 @@ export function initRepoBranchTagDropdown(selector) {
             this.isViewBranch = true;
             break;
         }
-        this.refName = elRoot.getAttribute('data-ref-name');
-        this.branchURLPrefix = elRoot.getAttribute('data-branch-url-prefix');
-        this.branchURLSuffix = elRoot.getAttribute('data-branch-url-suffix');
-        this.tagURLPrefix = elRoot.getAttribute('data-tag-url-prefix');
-        this.tagURLSuffix = elRoot.getAttribute('data-tag-url-suffix');
-        this.setAction = elRoot.getAttribute('data-set-action') === 'true';
-        this.submitForm = elRoot.getAttribute('data-submit-form') === 'true';
-
 
         document.body.addEventListener('click', (event) => {
           if (elRoot.contains(event.target)) return;
@@ -116,7 +103,7 @@ export function initRepoBranchTagDropdown(selector) {
           }
           item.selected = true;
           const url = (item.tag) ? this.tagURLPrefix + item.url + this.tagURLSuffix : this.branchURLPrefix + item.url + this.branchURLSuffix;
-          if (this.branchForm === '') {
+          if (!this.branchForm) {
             window.location.href = url;
           } else {
             this.isViewTree = false;
diff --git a/web_src/js/features/repo-legacy.js b/web_src/js/features/repo-legacy.js
index 5173a5b59907c..70542ad883e9c 100644
--- a/web_src/js/features/repo-legacy.js
+++ b/web_src/js/features/repo-legacy.js
@@ -485,7 +485,7 @@ export function initRepository() {
   // File list and commits
   if ($('.repository.file.list').length > 0 || $('.branch-dropdown').length > 0 ||
     $('.repository.commits').length > 0 || $('.repository.release').length > 0) {
-    initRepoBranchTagDropdown('.choose.reference .dropdown');
+    initRepoBranchTagDropdown('.choose.reference .ui.dropdown');
   }
 
   // Wiki

From ab5bcdf98f44cabc8c2a0ffb764b7c750023baef Mon Sep 17 00:00:00 2001
From: techknowlogick <techknowlogick@gitea.io>
Date: Sat, 11 Mar 2023 16:08:56 -0500
Subject: [PATCH 46/53] Use buildkit for docker builds (#23415)

This switches Docker builds to use build kit which is less prone to
error than legacy docker-in-docker building. It also switches back to
using the upstream docker image again now that it has been updated to a
version that supports alpine 3.14+

Co-authored-by: John Olheiser <john.olheiser@gmail.com>
---
 .drone.yml | 101 +++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 83 insertions(+), 18 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 0e1d799834ec5..1181b809b0da4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1206,7 +1206,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       auto_tag: true
@@ -1218,13 +1218,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       auto_tag: true
@@ -1236,6 +1240,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1276,7 +1284,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       tags: ${DRONE_TAG##v}-linux-amd64
@@ -1287,13 +1295,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       tags: ${DRONE_TAG##v}-linux-amd64-rootless
@@ -1304,6 +1316,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1341,7 +1357,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       auto_tag: false
@@ -1353,13 +1369,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       auto_tag: false
@@ -1371,6 +1391,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1407,7 +1431,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       auto_tag: false
@@ -1419,13 +1443,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       auto_tag: false
@@ -1437,6 +1465,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1445,7 +1477,7 @@ steps:
 ---
 kind: pipeline
 type: docker
-name: docker-linux-arm64-dry-run
+name: docker-linux-amd64-dry-run
 
 platform:
   os: linux
@@ -1463,7 +1495,7 @@ trigger:
 
 steps:
   - name: dryrun
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       dry_run: true
@@ -1474,6 +1506,7 @@ steps:
     environment:
       PLUGIN_MIRROR:
         from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         - pull_request
@@ -1516,7 +1549,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       auto_tag: true
@@ -1528,13 +1561,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       auto_tag: true
@@ -1546,6 +1583,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1586,7 +1627,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       tags: ${DRONE_TAG##v}-linux-arm64
@@ -1597,13 +1638,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       tags: ${DRONE_TAG##v}-linux-arm64-rootless
@@ -1614,6 +1659,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1654,7 +1703,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       auto_tag: false
@@ -1666,13 +1715,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       auto_tag: false
@@ -1684,6 +1737,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
@@ -1720,7 +1777,7 @@ steps:
       - git fetch --tags --force
 
   - name: publish
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     pull: always
     settings:
       auto_tag: false
@@ -1732,13 +1789,17 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:
         - pull_request
 
   - name: publish-rootless
-    image: techknowlogick/drone-docker:latest
+    image: plugins/docker:latest
     settings:
       dockerfile: Dockerfile.rootless
       auto_tag: false
@@ -1750,6 +1811,10 @@ steps:
         from_secret: docker_password
       username:
         from_secret: docker_username
+    environment:
+      PLUGIN_MIRROR:
+        from_secret: plugin_mirror
+      DOCKER_BUILDKIT: 1
     when:
       event:
         exclude:

From 023521b016d004ca185f0c4e2d80d30e2722fa81 Mon Sep 17 00:00:00 2001
From: GiteaBot <teabot@gitea.io>
Date: Sun, 12 Mar 2023 00:16:02 +0000
Subject: [PATCH 47/53] [skip ci] Updated translations via Crowdin

---
 options/locale/locale_cs-CZ.ini |   1 +
 options/locale/locale_de-DE.ini |   1 +
 options/locale/locale_el-GR.ini |   1 +
 options/locale/locale_es-ES.ini |   1 +
 options/locale/locale_fa-IR.ini |   1 +
 options/locale/locale_fi-FI.ini |   1 +
 options/locale/locale_fr-FR.ini |   1 +
 options/locale/locale_hu-HU.ini |   1 +
 options/locale/locale_id-ID.ini |   1 +
 options/locale/locale_is-IS.ini |   1 +
 options/locale/locale_it-IT.ini |   1 +
 options/locale/locale_ja-JP.ini |   1 +
 options/locale/locale_ko-KR.ini |   1 +
 options/locale/locale_lv-LV.ini | 288 +++++++++++++++++++++++++++++++-
 options/locale/locale_nl-NL.ini |   1 +
 options/locale/locale_pl-PL.ini |   1 +
 options/locale/locale_pt-BR.ini |   1 +
 options/locale/locale_pt-PT.ini |   6 +
 options/locale/locale_ru-RU.ini |   1 +
 options/locale/locale_si-LK.ini |   1 +
 options/locale/locale_sk-SK.ini |   1 +
 options/locale/locale_sv-SE.ini |   1 +
 options/locale/locale_tr-TR.ini |   1 +
 options/locale/locale_uk-UA.ini |   1 +
 options/locale/locale_zh-CN.ini |   1 +
 options/locale/locale_zh-HK.ini |   1 +
 options/locale/locale_zh-TW.ini |   3 +-
 27 files changed, 317 insertions(+), 4 deletions(-)

diff --git a/options/locale/locale_cs-CZ.ini b/options/locale/locale_cs-CZ.ini
index 7a42eec181825..543cd44045dec 100644
--- a/options/locale/locale_cs-CZ.ini
+++ b/options/locale/locale_cs-CZ.ini
@@ -883,6 +883,7 @@ remove_account_link=Odstranit propojený účet
 remove_account_link_desc=Odstraněním propojeného účtu zrušíte jeho přístup k vašemu Gitea účtu. Pokračovat?
 remove_account_link_success=Propojený účet byl odstraněn.
 
+
 orgs_none=Nejste členem žádné organizace.
 repos_none=Nevlastníte žádné repozitáře
 
diff --git a/options/locale/locale_de-DE.ini b/options/locale/locale_de-DE.ini
index e8e54ded92a17..9bee2104e4d65 100644
--- a/options/locale/locale_de-DE.ini
+++ b/options/locale/locale_de-DE.ini
@@ -792,6 +792,7 @@ remove_account_link=Verknüpften Account entfernen
 remove_account_link_desc=Wenn du den verknüpften Account entfernst, wirst du darüber nicht mehr auf deinen Gitea-Account zugreifen können. Fortfahren?
 remove_account_link_success=Der verknüpfte Account wurde entfernt.
 
+
 orgs_none=Du bist kein Mitglied in einer Organisation.
 repos_none=Du besitzt keine Repositories
 
diff --git a/options/locale/locale_el-GR.ini b/options/locale/locale_el-GR.ini
index 17e5f336c01f9..6affdf7e8be77 100644
--- a/options/locale/locale_el-GR.ini
+++ b/options/locale/locale_el-GR.ini
@@ -803,6 +803,7 @@ remove_account_link=Αφαίρεση Συνδεδεμένου Λογαριασμ
 remove_account_link_desc=Η κατάργηση ενός συνδεδεμένου λογαριασμού θα ανακαλέσει την πρόσβασή του στο λογαριασμό σας στο Gitea. Συνέχεια
 remove_account_link_success=Ο συνδεδεμένος λογαριασμός έχει αφαιρεθεί.
 
+
 orgs_none=Δεν είστε μέλος σε κάποιο οργανισμό.
 repos_none=Δεν έχετε κανένα αποθετήριο
 
diff --git a/options/locale/locale_es-ES.ini b/options/locale/locale_es-ES.ini
index c705740e46fe7..f104d3c49d308 100644
--- a/options/locale/locale_es-ES.ini
+++ b/options/locale/locale_es-ES.ini
@@ -802,6 +802,7 @@ remove_account_link=Eliminar cuenta vinculada
 remove_account_link_desc=Eliminar una cuenta vinculada revocará su acceso a su cuenta de Gitea. ¿Continuar?
 remove_account_link_success=La cuenta vinculada ha sido eliminada.
 
+
 orgs_none=No eres miembro de ninguna organización.
 repos_none=No posees ningún repositorio
 
diff --git a/options/locale/locale_fa-IR.ini b/options/locale/locale_fa-IR.ini
index 7786dd69a8811..449da63b74b96 100644
--- a/options/locale/locale_fa-IR.ini
+++ b/options/locale/locale_fa-IR.ini
@@ -733,6 +733,7 @@ remove_account_link=حذف حساب پیوند خرده
 remove_account_link_desc=با حذف پیوند خارجی حساب کاربری دسترسی شما به حساب کابریتان توسط آن از بین میرود. آیا ادامه می‌دهید؟
 remove_account_link_success=پیوند حساب کاربری از حذف شد.
 
+
 orgs_none=شما عضو هیچ سازمانی نیستید.
 repos_none=شما مالک هیچ مخزنی نیستید
 
diff --git a/options/locale/locale_fi-FI.ini b/options/locale/locale_fi-FI.ini
index d0f4c6e9ca522..a589d12c21fd6 100644
--- a/options/locale/locale_fi-FI.ini
+++ b/options/locale/locale_fi-FI.ini
@@ -652,6 +652,7 @@ remove_account_link=Poista linkitetty tili
 remove_account_link_desc=Linkitetyn tilin poistaminen peruuttaa pääsyn Gitea-tiliisi linkitetyn tili kautta. Jatketaanko?
 remove_account_link_success=Linkitetty tili on poistettu.
 
+
 orgs_none=Et ole minkään organisaation jäsen.
 repos_none=Sinulla ei ole repoja
 
diff --git a/options/locale/locale_fr-FR.ini b/options/locale/locale_fr-FR.ini
index 477db4f7adb6a..15d20011eaa2d 100644
--- a/options/locale/locale_fr-FR.ini
+++ b/options/locale/locale_fr-FR.ini
@@ -694,6 +694,7 @@ oauth2_application_edit=Éditer
 link_account=Lier un Compte
 
 
+
 confirm_delete_account=Confirmez la suppression
 delete_account_title=Supprimer cet utilisateur
 
diff --git a/options/locale/locale_hu-HU.ini b/options/locale/locale_hu-HU.ini
index 542979bbf93fe..328af14d57b24 100644
--- a/options/locale/locale_hu-HU.ini
+++ b/options/locale/locale_hu-HU.ini
@@ -574,6 +574,7 @@ remove_account_link=Csatolt fiók eltávolítása
 remove_account_link_desc=Egy kapcsolt fiók törlésével visszavonja a hozzáférését a fiókjához. Folytatja?
 remove_account_link_success=A kapcsolt fiók törölve lett.
 
+
 orgs_none=Nem tagja egy szervezetnek sem.
 repos_none=Nincsen egyetlen saját tárolója sem
 
diff --git a/options/locale/locale_id-ID.ini b/options/locale/locale_id-ID.ini
index eb6a38afcdf8b..5b418231c4fe1 100644
--- a/options/locale/locale_id-ID.ini
+++ b/options/locale/locale_id-ID.ini
@@ -510,6 +510,7 @@ remove_account_link=Hapus Akun Tertaut
 remove_account_link_desc=Menghapus akun tertaut akan membuat akun itu tidak bisa mengakses akun Gitea Anda. Lanjutkan?
 remove_account_link_success=Akun tertaut sudah dihapus.
 
+
 orgs_none=Anda bukan anggota dari organisasi apapun.
 repos_none=Anda tidak memiliki repositori apapun
 
diff --git a/options/locale/locale_is-IS.ini b/options/locale/locale_is-IS.ini
index 40915596adf15..bd596105d538c 100644
--- a/options/locale/locale_is-IS.ini
+++ b/options/locale/locale_is-IS.ini
@@ -579,6 +579,7 @@ link_account=Tengja Notanda
 
 
 
+
 email_notifications.enable=Virkja Tölvupósttilkynningar
 email_notifications.onmention=Aðeins Tölvupóst Þegar Minnst Er á Mig
 email_notifications.disable=Óvirkja Tölvupósttilkynningar
diff --git a/options/locale/locale_it-IT.ini b/options/locale/locale_it-IT.ini
index 411c34663f3d9..d77baee6e502f 100644
--- a/options/locale/locale_it-IT.ini
+++ b/options/locale/locale_it-IT.ini
@@ -789,6 +789,7 @@ remove_account_link=Rimuovi account collegato
 remove_account_link_desc=Rimuovere un account collegato ne revoca l'accesso al tuo account Gitea. Continuare?
 remove_account_link_success=L'account collegato è stato rimosso.
 
+
 orgs_none=Non sei membro di alcuna organizzazione.
 repos_none=Non possiedi alcun repository
 
diff --git a/options/locale/locale_ja-JP.ini b/options/locale/locale_ja-JP.ini
index 12d9423628bdc..8e77329f5cc9b 100644
--- a/options/locale/locale_ja-JP.ini
+++ b/options/locale/locale_ja-JP.ini
@@ -821,6 +821,7 @@ remove_account_link=連携アカウントの削除
 remove_account_link_desc=連携アカウントを削除し、Giteaアカウントへのアクセス権を取り消します。 続行しますか？
 remove_account_link_success=連携アカウントを削除しました。
 
+
 orgs_none=あなたはどの組織のメンバーでもありません。
 repos_none=あなたはリポジトリを所有していません。
 
diff --git a/options/locale/locale_ko-KR.ini b/options/locale/locale_ko-KR.ini
index 9f4509839beb5..ca642ebf0049e 100644
--- a/options/locale/locale_ko-KR.ini
+++ b/options/locale/locale_ko-KR.ini
@@ -541,6 +541,7 @@ remove_account_link=연결된 계정 제거
 remove_account_link_desc=해당 계정을 연결해제 하는 경우 Gitea 계정에 대한 접근 권한이 사라지게 됩니다. 계속하시겠습니까?
 remove_account_link_success=연결된 계정이 제거 되었습니다.
 
+
 orgs_none=당신은 어떤 조직의 구성원도 아닙니다.
 repos_none=어떤 레포지터리도 존재하지 않습니다.
 
diff --git a/options/locale/locale_lv-LV.ini b/options/locale/locale_lv-LV.ini
index 13c2cee221f1b..0f7862f8a3dee 100644
--- a/options/locale/locale_lv-LV.ini
+++ b/options/locale/locale_lv-LV.ini
@@ -2,6 +2,7 @@ home=Sākums
 dashboard=Infopanelis
 explore=Izpētīt
 help=Palīdzība
+logo=Logo
 sign_in=Pierakstīties
 sign_in_with=Pierakstīties izmantojot
 sign_out=Izrakstīties
@@ -56,6 +57,7 @@ new_mirror=Jauns spogulis
 new_fork=Jauns atdalīts repozitorijs
 new_org=Jauna organizācija
 new_project=Jauns projekts
+new_project_column=Jauna kolonna
 manage_org=Pārvaldīt organizācijas
 admin_panel=Lapas administrēšana
 account_settings=Konta iestatījumi
@@ -89,9 +91,11 @@ disabled=Atspējots
 
 copy=Kopēt
 copy_url=Kopēt saiti
+copy_content=Kopēt saturu
 copy_branch=Kopēt atzara nosaukumu
 copy_success=Nokopēts!
 copy_error=Kopēšana neizdevās
+copy_type_unsupported=Šī veida failus nav iespējams nokopēt
 
 write=Rakstīt
 preview=Priekšskatītījums
@@ -108,8 +112,14 @@ never=Nekad
 rss_feed=RSS barotne
 
 [aria]
+navbar=Navigācijas josla
+footer=Kājene
+footer.software=Par programmatūru
+footer.links=Saites
 
 [filter]
+string.asc=A - Z
+string.desc=Z - A
 
 [error]
 occurred=Radusies kļūda
@@ -237,7 +247,10 @@ default_enable_timetracking_popup=Repozitorijiem pēc noklusējuma tiks iespējo
 no_reply_address=Neatbildēt e-pasta adreses domēns
 no_reply_address_helper=Domēns lietotāja e-pasta adresei git žurnālos, ja lietotājs izvēlas paturēt savu e-pasta adresi privātu. Piemēram, ja lietotājs ir 'janis' un domēns 'neatbildet.piemers.lv', tad e-pasta adrese būs 'janis@neatbildet.piemers.lv'.
 password_algorithm=Paroles jaucējsummas algoritms
+invalid_password_algorithm=Kļūdaina paroles jaucējfunkcija
 password_algorithm_helper=Norādiet paroles jaucējkoda algoritmu. Alogritmiem ir dažādas prasības un stiprums. Lai arī `argon2` ir nodrošina labu drošība, tas patērē daudz operatīvās atmiņas un var nebūt piemērots sistēmām ar nelieliem resursiem.
+enable_update_checker=Iespējot jaunu versiju paziņojumus
+enable_update_checker_helper=Periodiski pārbaudīt jaunu version pieejamību, izgūstot datus no gitea.io.
 
 [home]
 uname_holder=Lietotājvārds vai e-pasts
@@ -346,22 +359,112 @@ authorize_application_created_by=Šo lietotni izveidoja %s.
 authorize_application_description=Ja piešķirsiet tiesības, tā varēs piekļūt un mainīt Jūsu konta informāciju, ieskaitot privātos repozitorijus un organizācijas.
 authorize_title=`Autorizēt "`
 
+show_archived=Arhivētie
+show_both_archived_unarchived=Attēlot gan arhivētos, gan nearhivētos
+show_only_archived=Attēlot tikai arhivētos
+show_only_unarchived=Attēlot tikai nearhivētos
 
 show_private=Privāts
+show_both_private_public=Attēlot gan publiskos, gan privātos
+show_only_private=Attēlot tikai privātos
+show_only_public=Attēlot tikai publiskos
 
+issues.in_your_repos=Jūsu repozitorijos
 
 [explore]
 repos=Repozitoriji
+users=Lietotāji
 organizations=Organizācijas
+search=Meklēt
 code=Kods
+search.type.tooltip=Meklēšanas veids
+search.fuzzy=Aptuveni
+search.fuzzy.tooltip=Iekļaut meklēšanas rezultātos arī aptuvenas sakritības
+search.match=Precīzi
+search.match.tooltip=Iekļaut meklēšanas rezultātos tikai precīzas sakritības
+code_search_unavailable=Pašlaik koda meklēšana nav pieejama. Sazinieties ar lapas administratoru.
+repo_no_results=Netika atrasts neviens repozitorijs, kas atbilstu kritērijiem.
+user_no_results=Netika atrasts neviens lietotājs, kas atbilstu kritērijiem.
+org_no_results=Netika atrasta neviena organizācija, kas atbilstu kritērijiem.
+code_no_results=Netika atrasts pirmkods, kas atbilstu kritērijiem.
+code_search_results=Meklēšanas rezultāti '%s'
+code_last_indexed_at=Pēdējo reizi indeksēts %s
+relevant_repositories_tooltip=Repozitoriju, kas ir atdalīti vai kuriem nav tēmas, ikonas un apraksta ir paslēpti.
+relevant_repositories=Tikai būtiskie repozitoriji tiek rādīti, <a href="%s">pārādīt nefiltrētus rezultātus</a>.
 
 
 [auth]
+create_new_account=Reģistrēt kontu
+register_helper_msg=Jau ir konts? Pieraksties tagad!
+social_register_helper_msg=Jau ir konts? Piesaisti to!
+disable_register_prompt=Reģistrācija ir atspējota. Lūdzu, sazinieties ar vietnes administratoru.
+disable_register_mail=Reģistrācijas e-pasta apstiprināšana ir atspējota.
+manual_activation_only=Sazinieties ar lapas administratoru, lai pabeigtu konta aktivizāciju.
+remember_me=Atcerēties šo ierīci
+forgot_password_title=Aizmirsu paroli
+forgot_password=Aizmirsi paroli?
+sign_up_now=Nepieciešams konts? Reģistrējies tagad.
+sign_up_successful=Konts tika veiksmīgi izveidots.
+confirmation_mail_sent_prompt=Jauns apstiprināšanas e-pasts ir nosūtīts uz <b>%s</b>, pārbaudies savu e-pasta kontu tuvāko %s laikā, lai pabeigtu reģistrācijas procesu.
+must_change_password=Mainīt paroli
+allow_password_change=Pieprasīt lietotājam mainīt paroli (ieteicams)
+reset_password_mail_sent_prompt=Apstiprināšanas e-pasts tika nosūtīts uz <b>%s</b>. Pārbaudiet savu e-pasta kontu tuvāko %s laikā, lai pabeigtu paroles atjaunošanas procesu.
+active_your_account=Aktivizēt savu kontu
+account_activated=Konts ir aktivizēts
+prohibit_login=Aizliegt pieteikšanos
+prohibit_login_desc=Jūsu konts ir bloķēts, sazinieties ar sistēmas administratoru.
+resent_limit_prompt=Jūs pieprasījāt aktivizācijas e-pastu pārāk bieži. Lūdzu, uzgaidiet 3 minūtes un mēģiniet vēlreiz.
+has_unconfirmed_mail=Sveiki %s, Jums ir neapstiprināta e-pasta adrese (<b>%s</b>). Ja neesat saņēmis apstiprināšanas e-pastu vai Jums ir nepieciešams nosūtīt jaunu, lūdzu, nospiediet pogu, kas atrodas zemāk.
+resend_mail=Nospiediet šeit, lai vēlreiz nosūtītu aktivizācijas e-pastu
+email_not_associate=Šī e-pasta adrese nav saistīta ar nevienu kontu.
+send_reset_mail=Nosūtīt paroles atjaunošanas e-pastu
+reset_password=Paroles atjaunošana
+invalid_code=Jūsu apstiprināšanas kodam ir beidzies derīguma termiņš vai arī tas ir nepareizs.
+invalid_password=Jūsu parole neatbilst parolei, kas tika ievadīta veidojot so kontu.
+reset_password_helper=Atjaunot paroli
+reset_password_wrong_user=Jūs esat autorizējies kā %s, bet paroles atjaunošanas saite ir lietotājam %s
+password_too_short=Paroles garums nedrīkst būt mazāks par %d simboliem.
+non_local_account=Ārējie konti nevar mainīt paroli, izmantojot, Gitea saskarni.
+verify=Pārbaudīt
+scratch_code=Vienreizējais kods
+use_scratch_code=Izmantot vienreizējo kodu
+twofa_scratch_used=Jūs esat izmantojis vienreizējo kodu. Jūs tikāt pārsūtīts uz divu faktoru iestatījumu lapu, lai varētu piesaistīto ierīci vai lai uzģenerētu jaunu vienreizējo kodu.
+twofa_passcode_incorrect=Jūsu kods nav pareizs. Ja esat pazaudējis ierīci, izmantojiet vienreizējo kodu, lai autorizētos.
+twofa_scratch_token_incorrect=Ievadīts nepareizs vienreizējais kods.
 login_userpass=Pierakstīties
+login_openid=OpenID
+oauth_signup_tab=Reģistrēt jaunu kontu
+oauth_signup_title=Pabeigt konta veidošanu
+oauth_signup_submit=Pabeigt reģistrāciju
+oauth_signin_tab=Savienot ar esošu kontu
+oauth_signin_title=Pierakstīties, lai autorizētu saistīto kontu
 oauth_signin_submit=Saistītie konti
+oauth.signin.error=Radās kļūda apstrādājot autorizācijas pieprasījumu. Ja šī kļūda atkārtojas, sazinieties ar lapas administratoru.
+oauth.signin.error.access_denied=Autorizācijas pieprasījums tika noraidīts.
+oauth.signin.error.temporarily_unavailable=Autorizācija neizdevās, jo autentifikācijas serveris ir īslaicīgi nepieejams. Mēģiniet autorizēties vēlāk.
+openid_connect_submit=Pievienoties
+openid_connect_title=Pievienoties jau esošam kontam
+openid_connect_desc=Izvēlētais OpenID konts sistēmā netika atpazīts, bet Jūs to varat piesaistīt esošam kontam.
+openid_register_title=Izveidot jaunu kontu
+openid_register_desc=Izvēlētais OpenID konts sistēmā netika atpazīts, bet Jūs to varat piesaistīt esošam kontam.
+openid_signin_desc=Ievadiet savu OpenID URI, piemēram: https://anna.me, peteris.openid.org.lv, gnusocial.net/janis.
+disable_forgot_password_mail=Konta atjaunošana ir atspējota, jo nav uzstādīti e-pasta servera iestatījumi. Sazinieties ar lapas administratoru.
+disable_forgot_password_mail_admin=Kontu atjaunošana ir pieejama tikai, ja ir veikta e-pasta servera iestatījumu konfigurēšana. Norādiet e-pasta servera iestatījumus, lai iespējotu kontu atjaunošanu.
+email_domain_blacklisted=Nav atļauts reģistrēties ar šādu e-pasta adresi.
+authorize_application=Autorizēt lietotni
+authorize_redirect_notice=Jūs tiksiet nosūtīts uz %s, ja autorizēsiet šo lietotni.
+authorize_application_created_by=Šo lietotni izveidoja %s.
+authorize_application_description=Ja piešķirsiet tiesības, tā varēs piekļūt un mainīt Jūsu konta informāciju, ieskaitot privātos repozitorijus un organizācijas.
+authorize_title=Autorizēt "%s" piekļuvi jūsu kontam?
+authorization_failed=Autorizācija neizdevās
+authorization_failed_desc=Autorizācija neizdevās, jo tika veikts kļūdains pieprasījums. Sazinieties ar lietojumprogrammas, ar kuru mēģinājāt autorizēties, uzturētāju.
+sspi_auth_failed=SSPI autentifikācija neizdevās
+password_pwned=Ievadītā parole ir <a target="_blank" rel="noopener noreferrer" href="https://haveibeenpwned.com/Passwords">zagto paroļu sarakstā</a>, kas ir kādā no publicētājām datu zādzībām. Mēģiniet vēlreiz citu paroli.
+password_pwned_err=Neizdevās pabeigt pieprasījumu uz HaveIBeenPwned
 
 [mail]
 view_it_on=Aplūkot %s
+reply=vai atbildiet uz e-pastu
 link_not_working_do_paste=Ja saite nestrādā, mēģiniet to nokopēt un atvērt pārlūkā.
 hi_user_x=Sveiki <b>%s</b>,
 
@@ -420,6 +523,10 @@ repo.transfer.body=Ja vēlaties to noraidīt vai apstiprināt, tad apmeklējiet
 repo.collaborator.added.subject=%s pievienoja Jūs repozitorijam %s
 repo.collaborator.added.text=Jūs tikāt pievienots kā līdzstrādnieks repozitorijam:
 
+team_invite.subject=%[1]s uzaicināja Jūs pievienoties organizācijai %[2]s
+team_invite.text_1=%[1]s uzaicināja Jūs pievienoties komandai %[2] organizācijā %[3]s.
+team_invite.text_2=Uzspiediet uz šīs saites, lai pievienoties komandai:
+team_invite.text_3=Piezīme: Šis uzaicinājums ir paredzēts %[1]s. Ja uzskatāt, ka tas nav domāts Jums, varat ignorēt šo e-pastu.
 
 [modal]
 yes=Jā
@@ -433,6 +540,7 @@ Email=E-pasta adrese
 Password=Parole
 Retype=Atkārtoti ievadiet paroli
 SSHTitle=SSH atslēgas nosaukums
+HttpsUrl=HTTPS URL
 PayloadUrl=Vērtuma URL
 TeamName=Komandas nosaukums
 AuthName=Autorizācijas nosaukums
@@ -460,6 +568,8 @@ url_error=`'%s' nav korekts URL.`
 include_error=` ir jāsatur tekstu '%s'.`
 glob_pattern_error=` glob šablons nav korekts: %s.`
 regex_pattern_error=` regulārā izteiksme nav korekta: %s.`
+username_error=` drīkst saturēt tikai burtus un ciparus ('0-9','a-z','A-Z'), domuzīme ('-'), apakšsvītra ('_') un punkts ('.'). Nevar sākties vai beigties ar simbolu, kas nav burts vai skaitlis, kā arī nevar būt vairāki simboli pēc kārtas, kas nav burti vai skaitļi.`
+invalid_group_team_map_error=` sasaiste nav korekta: %s`
 unknown_error=Nezināma kļūda:
 captcha_incorrect=Ievadīts nepareizs drošības kods.
 password_not_match=Izvēlētā parole nesakrīt ar atkārtoti ievadīto.
@@ -495,10 +605,13 @@ user_not_exist=Lietotājs neeksistē.
 team_not_exist=Komanda neeksistē.
 last_org_owner=Nevar noņemt pēdejo lietotāju no īpašnieku komandas. Organizācijai ir jābūt vismaz vienam īpašniekam.
 cannot_add_org_to_team=Organizāciju nevar pievienot kā komandas biedru.
+duplicate_invite_to_team=Lietotājs jau ir uzaicināts kā komandas biedrs.
+organization_leave_success=Jūs esat pametis organizāciju %s.
 
 invalid_ssh_key=Nav iespējams pārbaudīt SSH atslēgu: %s
 invalid_gpg_key=Nav iespējams pārbaudīt GPG atslēgu: %s
 invalid_ssh_principal=Kļūdaina identitāte: %s
+must_use_public_key=Atslēga, ko norādījāt ir privātā atslēga. Nekad nenodotiet savu privātu atslēgu nevienam. Izmantojiet publisko atslēgu.
 unable_verify_ssh_key=SSH atslēgu nav iespējams pārbaudīt, pārliecinieties, ka tajā nav kļūdu.
 auth_failed=Autentifikācija neizdevās: %v
 
@@ -670,6 +783,7 @@ gpg_invalid_token_signature=Norādītā GPG atslēga, paraksts un talons neatbil
 gpg_token_required=Jānorāda paraksts zemāk esošajam talonam
 gpg_token=Talons
 gpg_token_help=Parakstu ir iespējams uzģenerēt izmantojot komandu:
+gpg_token_code=echo "%s" | gpg -a --default-key %s --detach-sig
 gpg_token_signature=Tekstuāls GPG paraksts
 key_signature_gpg_placeholder=Sākas ar '-----BEGIN PGP SIGNATURE-----'
 verify_gpg_key_success=GPG atslēga '%s' veiksmīgi pārbaudīta.
@@ -734,6 +848,8 @@ access_token_deletion_cancel_action=Atcelt
 access_token_deletion_confirm_action=Dzēst
 access_token_deletion_desc=Izdzēšot talonu, tam tiks liegta piekļuve šim kontam. Šī darbība ir neatgriezeniska. Vai turpināt?
 delete_token_success=Piekļuves talons tika noņemts. Neaizmirstiet atjaunot informāciju lietojumprogrammās, kas izmantoja šo talonu.
+select_scopes=Norādiet apgabalus
+scopes_list=Apgabali:
 
 manage_oauth2_applications=Pārvaldīt OAuth2 lietotnes
 edit_oauth2_application=Labot OAuth2 lietotni
@@ -746,6 +862,7 @@ create_oauth2_application_button=Izveidot lietotni
 create_oauth2_application_success=OAuth2 lietotne veiksmīgi izveidota.
 update_oauth2_application_success=OAuth2 lietotne veiksmīgi atjaunināta.
 oauth2_application_name=Lietotnes nosaukums
+oauth2_confidential_client=Konfidenciāls klients. Norādiet lietotēm, kas glabā noslēpumu slepenībā, piemēram, tīmekļa lietotnēm. Nenorādiet instalējamām lietotnēm, tai skaitā darbavirsmas vai mobilajām lietotnēm.
 oauth2_redirect_uri=Novirzīšanas URI
 save_application=Saglabāt
 oauth2_client_id=Klienta ID
@@ -796,6 +913,8 @@ remove_account_link=Noņemt saistīto kontu
 remove_account_link_desc=Noņemot saistīto kontu, tam tiks liegta piekļuve Jūsu Gitea kontam. Vai turpināt?
 remove_account_link_success=Saistītais konts tika noņemts.
 
+hooks.desc=Pievienot tīmekļā āķus, kas izpildīsies <strong>visiem repozitorijiem</strong>, kas pieder šim lietotājam.
+
 orgs_none=Jūs neesat nevienas organizācijas biedrs.
 repos_none=Jums nepieder neviens repozitorijs
 
@@ -1005,10 +1124,12 @@ unstar=Noņemt zvaigznīti
 star=Pievienot zvaigznīti
 fork=Atdalīts
 download_archive=Lejupielādēt repozitoriju
+more_operations=Vairāk darbību
 
 no_desc=Nav apraksta
 quick_guide=Īsa pamācība
 clone_this_repo=Klonēt šo repozitoriju
+cite_this_repo=Citēt šo repozitoriju
 create_new_repo_command=Izveidot jaunu repozitoriju komandrindā
 push_exist_repo=Nosūtīt izmaiņas no komandrindas eksistējošam repozitorijam
 empty_message=Repozitorijs ir tukšs.
@@ -1046,6 +1167,13 @@ file_view_rendered=Skatīt rezultātu
 file_view_raw=Rādīt neapstrādātu
 file_permalink=Patstāvīgā saite
 file_too_large=Šis fails ir par lielu, lai to parādītu.
+invisible_runes_header=`Šis fails satur satur neredzamus unikoda simbolus!`
+invisible_runes_description=`Šis fails satur neredzamus unikoda simbolus, kas var mainīt kā saturs tiek attēlots. Ja tie ir izmantoti ar pamatotu nodumu, tad varat ignorēt šo brīdinājumu. Izmantojiet Kodēt pogu, lai parādītu šos neredzamos simbolus.`
+ambiguous_runes_header=`Šis fails satur neviennozīmīgus unikoda simbolus!`
+ambiguous_runes_description=`Šis fails satur nevienozīmīgus unikoda simbolus, kas var būt mulsinoši un grūti atšķirami. Ja tie ir izmantoti ar pamatotu nodumu, tad varat ignorēt šo brīdinājumu. Izmantojiet Kodēt pogu, lai parādītu šos neredzamos simbolus.`
+invisible_runes_line=`Šī līnija satur neredzamus unikoda simbolus`
+ambiguous_runes_line=`Šī līnija satur neviennozīmīgus unikoda simbolus`
+ambiguous_character=`%[1]c [U+%04[1]X] var tikt sajaukts ar %[2]c [U+%04[2]X]`
 
 escape_control_characters=Kodēt
 unescape_control_characters=Atkodēt
@@ -1100,6 +1228,7 @@ editor.commit_directly_to_this_branch=Apstiprināt revīzijas izmaiņas atzarā
 editor.create_new_branch=Izveidot <strong>jaunu atzaru</strong> un izmaiņu pieprasījumu šai revīzijai.
 editor.create_new_branch_np=Izveidot <strong>jaunu atzaru</strong> šai revīzijai.
 editor.propose_file_change=Ieteikt faila izmaiņas
+editor.new_branch_name=Jaunā atzara nosaukums šai revīzijai
 editor.new_branch_name_desc=Jaunā atzara nosaukums…
 editor.cancel=Atcelt
 editor.filename_cannot_be_empty=Faila nosaukums nevar būt tukšs.
@@ -1151,6 +1280,7 @@ commits.signed_by_untrusted_user_unmatched=Parakstījis neuzticams lietotājs, k
 commits.gpg_key_id=GPG atslēgas ID
 commits.ssh_key_fingerprint=SSH atslēgas identificējošā zīmju virkne
 
+commit.operations=Darbības
 commit.revert=Atgriezt
 commit.revert-header=Atgriezt: %s
 commit.revert-content=Norādiet atzaru uz kuru atgriezt:
@@ -1183,11 +1313,22 @@ projects.type.bug_triage=Kļūdu šķirošana
 projects.template.desc=Projekta sagatave
 projects.template.desc_helper=Izvēlieties projekta sagatavi, lai sāktu darbu
 projects.type.uncategorized=Bez kategorijas
+projects.column.edit=Rediģēt kolonnas
 projects.column.edit_title=Nosaukums
 projects.column.new_title=Nosaukums
+projects.column.new_submit=Izveidot kolonnu
+projects.column.new=Jauna kolonna
+projects.column.set_default=Izvēlēties kā noklusēto
+projects.column.set_default_desc=Izvēlēties šo kolonnu kā noklusēto nekategorizētām problēmām un izmaiņu pieteikumiem
+projects.column.delete=Dzēst kolonnu
+projects.column.deletion_desc=Dzēšot projekta kolonnu visas tam piesaistītās problēmas tiks pārliktas kā nekategorizētas. Vai turpināt?
 projects.column.color=Krāsa
 projects.open=Aktīvie
 projects.close=Pabeigtie
+projects.column.assigned_to=Piešķirts
+projects.card_type.desc=Kartītes priekšskatījums
+projects.card_type.images_and_text=Attēli un teksts
+projects.card_type.text_only=Tikai teksts
 
 issues.desc=Organizēt kļūdu ziņojumus, uzdevumus un atskaites punktus.
 issues.filter_assignees=Filtrēt pēc atbildīgajiem
@@ -1223,6 +1364,8 @@ issues.new.add_reviewer_title=Pieprasīt recenziju
 issues.choose.get_started=Sākt darbu
 issues.choose.blank=Noklusējuma
 issues.choose.blank_about=Izveidot problēmu ar noklusējuma sagatavi.
+issues.choose.ignore_invalid_templates=Kļūdainās sagataves tika izlaistas
+issues.choose.invalid_templates=%v ķļūdaina sagatave(s) atrastas
 issues.no_ref=Nav norādīts atzars/tags
 issues.create=Pieteikt problēmu
 issues.new_label=Jauna etiķete
@@ -1262,16 +1405,19 @@ issues.filter_label_no_select=Visas etiķetes
 issues.filter_milestone=Atskaites punkts
 issues.filter_milestone_no_select=Visi atskaites punkti
 issues.filter_project=Projektus
+issues.filter_project_all=Visi projekti
 issues.filter_project_none=Nav projektu
 issues.filter_assignee=Atbildīgais
 issues.filter_assginee_no_select=Visi atbildīgie
 issues.filter_poster=Autors
+issues.filter_poster_no_select=Visi autori
 issues.filter_type=Veids
 issues.filter_type.all_issues=Visas problēmas
 issues.filter_type.assigned_to_you=Piešķirtās Jums
 issues.filter_type.created_by_you=Jūsu izveidotās
 issues.filter_type.mentioning_you=Esat pieminēts
 issues.filter_type.review_requested=Pieprasīta recenzija
+issues.filter_type.reviewed_by_you=Tavi recenzētie
 issues.filter_sort=Kārtot
 issues.filter_sort.latest=Jaunākie
 issues.filter_sort.oldest=Vecakie
@@ -1293,6 +1439,8 @@ issues.action_milestone=Atskaites punkts
 issues.action_milestone_no_select=Nav atskaites punkta
 issues.action_assignee=Atbildīgais
 issues.action_assignee_no_select=Nav atbildīgā
+issues.action_check=Atzīmēt/Notīrīt
+issues.action_check_all=Atzīmēt/Notīrīt visus ierakstus
 issues.opened_by=<a href="%[2]s">%[3]s</a> atvēra %[1]s
 pulls.merged_by=<a href="%[2]s">%[3]s</a> sapludināja %[1]s
 pulls.merged_by_fake=%[2]s sapludināja %[1]s
@@ -1346,6 +1494,9 @@ issues.save=Saglabāt
 issues.label_title=Etiķetes nosaukums
 issues.label_description=Etiķetes apraksts
 issues.label_color=Etiķetes krāsa
+issues.label_exclusive=Ekskluzīvs
+issues.label_exclusive_desc=Nosauciet etiķeti <code>grupa/nosaukums</code>, lai grupētu etiķētes un varētu norādīt tās kā ekskluzīvas ar citām <code>grupa/</code> etiķetēm.
+issues.label_exclusive_warning=Jebkura konfliktējoša ekskluzīvas grupas etiķete tiks noņemta, labojot pieteikumu vai izmaiņu pietikumu etiķetes.
 issues.label_count=%d etiķetes
 issues.label_open_issues=%d atvērtas problēmas
 issues.label_edit=Labot
@@ -1414,6 +1565,7 @@ issues.push_commit_1=iesūtīja %d revīziju %s
 issues.push_commits_n=iesūtīja %d revīzijas %s
 issues.force_push_codes=`veica piespiedu izmaiņu iesūtīšanu atzarā %[1]s no revīzijas <a class="ui sha" href="%[3]s"><code>%[2]s</code></a> uz <a class="ui sha" href="%[5]s"><code>%[4]s</code></a> %[6]s`
 issues.force_push_compare=Salīdzināt
+issues.due_date_form=dd.mm.yyyy
 issues.due_date_form_add=Pievienot izpildes termiņu
 issues.due_date_form_edit=Labot
 issues.due_date_form_remove=Noņemt
@@ -1599,6 +1751,8 @@ pulls.reopened_at=`atkārtoti atvēra šo izmaiņu pieprasījumu <a id="%[1]s" h
 pulls.merge_instruction_hint=`Varat aplūkot arī <a class="show-instruction">komandrindas instrukcijas</a>.`
 pulls.merge_instruction_step1_desc=Projekta repozitorijā izveidojiet jaunu jaunu atzaru un pārbaudiet savas izmaiņas.
 pulls.merge_instruction_step2_desc=Sapludināt izmaiņas un atjaunot tās Gitea.
+pulls.clear_merge_message=Notīrīt sapludināšanas ziņojumu
+pulls.clear_merge_message_hint=Notīrot sapludināšanas ziņojumu tiks noņemts tikai pats ziņojums, bet tiks paturēti ģenerētie git ziņojumu, kā "Co-Authored-By …".
 
 pulls.auto_merge_button_when_succeed=(Kad pārbaudes veiksmīgas)
 pulls.auto_merge_when_succeed=Automātiski sapludināt, kad visas pārbaudes veiksmīgas
@@ -1754,8 +1908,11 @@ activity.git_stats_deletion_n=%d dzēšanas
 
 search=Meklēt
 search.search_repo=Meklēšana repozitorijā
+search.type.tooltip=Meklēšanas veids
 search.fuzzy=Aptuveni
+search.fuzzy.tooltip=Iekļaut meklēšanas rezultātos arī aptuvenas sakritības
 search.match=Precīzi
+search.match.tooltip=Iekļaut meklēšanas rezultātos tikai precīzas sakritības
 search.results=Meklēšanas rezultāti nosacījumam "%s" repozitorijā <a href="%s">%s</a>
 search.code_no_results=Netika atrasts pirmkods, kas atbilstu kritērijiem.
 search.code_search_unavailable=Pašlaik koda meklēšana nav pieejama. Sazinieties ar lapas administratoru.
@@ -1787,6 +1944,7 @@ settings.mirror_sync_in_progress=Notiek spoguļa sinhronizācija. Atjaunojiet la
 settings.site=Mājas lapa
 settings.update_settings=Mainīt iestatījumus
 settings.branches.update_default_branch=Atjaunot noklusēto atzaru
+settings.branches.add_new_rule=Pievienot jaunu noteikumu
 settings.advanced_settings=Papildu iestatījumi
 settings.wiki_desc=Iespējot vikivietnes
 settings.use_internal_wiki=Izmantot iebūvēto vikivietni
@@ -1816,8 +1974,11 @@ settings.pulls.ignore_whitespace=Pārbaudot konfliktus, ignorēt izmaiņas atsta
 settings.pulls.enable_autodetect_manual_merge=Iespējot manuālo sapludināšanas noteikšanu (Piezīme: dažos speciālos gadījumos, tas var nostrādāt nekorekti)
 settings.pulls.allow_rebase_update=Iespējot izmaiņu pieprasījuma atjaunošanu ar pārbāzēšanu
 settings.pulls.default_delete_branch_after_merge=Pēc noklusējuma dzēst izmaiņu pieprasījuma atzaru pēc sapludināšanas
+settings.pulls.default_allow_edits_from_maintainers=Atļaut uzturētājiem labot pēc noklusējuma
+settings.releases_desc=Iespējot repozitorija laidienus
 settings.packages_desc=Iespējot repozitorija pakotņu reģistru
 settings.projects_desc=Iespējot repozitorija projektus
+settings.actions_desc=Iespējot repozitorija darbības
 settings.admin_settings=Administratora iestatījumi
 settings.admin_enable_health_check=Iespējot veselības pārbaudi (git fsck) šim repozitorijam
 settings.admin_code_indexer=Izejas koda indeksētājs
@@ -1884,6 +2045,7 @@ settings.confirm_delete=Dzēst repozitoriju
 settings.add_collaborator=Pievienot līdzstrādnieku
 settings.add_collaborator_success=Jauns līdzstrādnieks tika pievienots.
 settings.add_collaborator_inactive_user=Nevar pievienot neaktīvu lietotāju kā līdzstrādnieku.
+settings.add_collaborator_owner=Nevar pievienot īpašnieku kā līdzstrādnieku.
 settings.add_collaborator_duplicate=Līdzstrādnieks jau ir pievienots šim repozitorijam.
 settings.delete_collaborator=Noņemt
 settings.collaborator_deletion=Noņemt līdzstrādnieku
@@ -1943,6 +2105,7 @@ settings.event_delete_desc=Atzars vai tags izdzēsts.
 settings.event_fork=Atdalīts
 settings.event_fork_desc=Repozitorijs atdalīts.
 settings.event_wiki=Vikivietni
+settings.event_wiki_desc=Vikivietnes lapa izveidota, pārsaukta, labota vai dzēsta.
 settings.event_release=Laidiens
 settings.event_release_desc=Publicēts, atjaunots vai dzēsts laidiens repozitorijā.
 settings.event_push=Izmaiņu nosūtīšana
@@ -2025,6 +2188,8 @@ settings.deploy_key_deletion_desc=Noņemot izvietošanas atslēgu, tai tiks lieg
 settings.deploy_key_deletion_success=Izvietošanas atslēga tika noņemta.
 settings.branches=Atzari
 settings.protected_branch=Atzaru aizsargāšana
+settings.protected_branch.save_rule=Saglabāt noteikumu
+settings.protected_branch.delete_rule=Dzēst noteikumu
 settings.protected_branch_can_push=Atļaut izmaiņu nosūtīšanu?
 settings.protected_branch_can_push_yes=Jūs varat nosūtīt izmaiņas
 settings.protected_branch_can_push_no=Jūs nevarat nosūtīt izmaiņas
@@ -2059,6 +2224,7 @@ settings.dismiss_stale_approvals=Pieprasīt apstiprinājumus jaunākajām izmai
 settings.dismiss_stale_approvals_desc=Kad tiek iesūtītas jaunas revīzijas, kas izmaina izmaiņu pieprasījuma saturu, iepriekšējie apstiprinājumi tiks atzīmēti kā novecojuši un būs nepieciešams apstiprināt tos atkāroti.
 settings.require_signed_commits=Pieprasīt parakstītas revīzijas
 settings.require_signed_commits_desc=Noraidīt iesūtītās izmaiņas šim atzaram, ja tās nav parakstītas vai nav iespējams pārbaudīt.
+settings.protect_branch_name_pattern=Aizsargātā zara šablons
 settings.protect_protected_file_patterns=Aizsargāto failu šablons (vairākus var norādīt atdalot ar semikolu '\;'):
 settings.protect_protected_file_patterns_desc=Aizsargātie faili, ko nevar mainīt, pat ja lietotājam ir tiesības veidot jaunus, labot vai dzēst failus šajā atzarā. Vairākus šablons ir iespējams norādīt atdalot tos ar semikolu ('\;'). Sīkāka informācija par šabloniem pieejama <a href="https://pkg.go.dev/github.com/gobwas/glob#Compile">github.com/gobwas/glob</a> dokumentācijā. Piemēram, <code>.drone.yml</code>, <code>/docs/**/*.txt</code>.
 settings.protect_unprotected_file_patterns=Neaizsargāto failu šablons (vairākus var norādīt atdalot ar semikolu '\;'):
@@ -2067,6 +2233,7 @@ settings.add_protected_branch=Iespējot aizsargāšanu
 settings.delete_protected_branch=Atspējot aizsargāšanu
 settings.update_protect_branch_success=Atzara aizsardzība atzaram '%s' tika saglabāta.
 settings.remove_protected_branch_success=Atzara aizsardzība atzaram '%s' tika atspējota.
+settings.remove_protected_branch_failed=Neizdevās izdzēst atzara '%s' aizsardzību.
 settings.protected_branch_deletion=Atspējot atzara aizsardzību
 settings.protected_branch_deletion_desc=Atspējojot atzara aizsardzību, ļaus lietotājiem ar rakstīšanas tiesībām nosūtīt izmaiņas uz atzaru. Vai turpināt?
 settings.block_rejected_reviews=Neļaut sapludināt izmaiņu pieprasījumus, kam ir pieprasītas izmaiņas
@@ -2076,10 +2243,13 @@ settings.block_on_official_review_requests_desc=Sapludināšana nebūs iespējam
 settings.block_outdated_branch=Bloķēt sapludināšanau, ja izmaiņu pieprasījums ir novecojis
 settings.block_outdated_branch_desc=Sapludināšana nebūs pieejama, ja atzars būs atpalicis no bāzes atzara.
 settings.default_branch_desc=Norādiet noklusēto repozitorija atzaru izmaiņu pieprasījumiem un koda revīzijām:
+settings.merge_style_desc=Sapludināšanas veidi
 settings.default_merge_style_desc=Noklusētais sapludināšanas veids izmaiņu pieprasījumiem:
 settings.choose_branch=Izvēlieties atzaru…
 settings.no_protected_branch=Nav neviena aizsargātā atzara.
 settings.edit_protected_branch=Labot
+settings.protected_branch_required_rule_name=Nav norādīts noteikuma nosaukums
+settings.protected_branch_duplicate_rule_name=Dublējošs noteikuma nosaukumu
 settings.protected_branch_required_approvals_min=Pieprasīto recenziju skaits nevar būt negatīvs.
 settings.tags=Tagi
 settings.tags.protection=Tagu aizsargāšana
@@ -2212,6 +2382,8 @@ release.edit_subheader=Laidieni palīdz organizēt projekta versijas.
 release.tag_name=Taga nosaukums
 release.target=Mērķis
 release.tag_helper=Izvēlieties jau esošu tagu vai izveidojiet jaunu.
+release.tag_helper_new=Jauns tags. Šis tags tiks izveidots no mērķa.
+release.tag_helper_existing=Esošs tags.
 release.title=Virsraksts
 release.content=Saturs
 release.prerelease_desc=Atzīmēt kā pirmslaidiena versiju
@@ -2235,6 +2407,8 @@ release.downloads=Lejupielādes
 release.download_count=Lejupielādes: %s
 release.add_tag_msg=Izmantot laidiena nosaukumu un saturu kā taga aprakstu.
 release.add_tag=Izveidot tikai tagu
+release.releases_for=Repozitorja %s laidieni
+release.tags_for=Repozitorija %s tagi
 
 branch.name=Atzara nosaukums
 branch.search=Meklēt atzarus
@@ -2502,6 +2676,10 @@ dashboard.delete_old_actions=Dzēst visas darbības no datu bāzes
 dashboard.delete_old_actions.started=Uzsākta visu novecojušo darbību dzēšana no datu bāzes.
 dashboard.update_checker=Atjauninājumu pārbaudītājs
 dashboard.delete_old_system_notices=Dzēst vecos sistēmas paziņojumus no datubāzes
+dashboard.gc_lfs=Veikt atkritumu uzkopšanas darbus LFS meta objektiem
+dashboard.stop_zombie_tasks=Apturēt zombija uzdevumus
+dashboard.stop_endless_tasks=Apturēt nepārtrauktus uzdevumus
+dashboard.cancel_abandoned_jobs=Atcelt pamestus darbus
 
 users.user_manage_panel=Lietotāju kontu pārvaldība
 users.new_account=Izveidot lietotāja kontu
@@ -2590,6 +2768,7 @@ repos.size=Izmērs
 
 packages.package_manage_panel=Pakotņu pārvaldība
 packages.total_size=Kopējais izmērs: %s
+packages.unreferenced_size=Izmērs bez atsauces: %s
 packages.owner=Īpašnieks
 packages.creator=Izveidotājs
 packages.name=Nosaukums
@@ -2683,6 +2862,8 @@ auths.oauth2_required_claim_value_helper=Uzstādiet šo vērtību, lai ierobežo
 auths.oauth2_group_claim_name=Prasības nosaukums, kas nodrošina grupu nosaukumus šim avotam. (Neobligāts)
 auths.oauth2_admin_group=Grupas prasības vērtība administratoriem. (Neobligāta - nepieciešams prasības nosaukums augstāk)
 auths.oauth2_restricted_group=Grupas prasības vērtība ierobežotajiem lietotājiem. (Neobligāta - nepieciešams prasības nosaukums augstāk)
+auths.oauth2_map_group_to_team=Sasaistīt prasības grupas ar organizācijas komandām. (Neobligāts - nepieciešams prasības nosaukums augstāk)
+auths.oauth2_map_group_to_team_removal=Noņemt lietotājus no sinhronizētajām komandām, ja lietotājs nav piesaistīts attiecīgajai grupai.
 auths.enable_auto_register=Iespējot automātisko reģistrāciju
 auths.sspi_auto_create_users=Automātiski izveidot lietotājus
 auths.sspi_auto_create_users_helper=Ļauj SSPI autentifikācijas metodei automātiski izveidot jaunus kontus lietotājiem, kas autorizējas pirmo reizi
@@ -2723,6 +2904,8 @@ auths.still_in_used=Šo autentificēšanās avotu joprojām izmanto viens vai va
 auths.deletion_success=Autentifikācijas avots tika atjaunots.
 auths.login_source_exist=Autentifikācijas avots ar nosaukumu '%s' jau eksistē.
 auths.login_source_of_type_exist=Autentifikācijas avots ar šādu veidu jau eksistē.
+auths.unable_to_initialize_openid=Nevarēja inicializēt OpenID Connect sliedzēju: %s
+auths.invalid_openIdConnectAutoDiscoveryURL=Kļūdains automātiskās atklāšanas URL (jābūt korektam URL, kas sākas ar http:// vai https://)
 
 config.server_config=Servera konfigurācija
 config.app_name=Vietnes nosaukums
@@ -2945,6 +3128,7 @@ monitor.queue.pool.cancel_desc=Atstājot rindu bez nevienas strādņu grupas, va
 
 notices.system_notice_list=Sistēmas paziņojumi
 notices.view_detail_header=Skatīt paziņojuma detaļas
+notices.operations=Darbības
 notices.select_all=Iezīmēt visu
 notices.deselect_all=Atcelt visa iezīmēšanu
 notices.inverse_selection=Apgriezeniskā iezīmēšana
@@ -3069,6 +3253,8 @@ keywords=Atslēgvārdi
 details=Papildu informācija
 details.author=Autors
 details.project_site=Projekta lapa
+details.repository_site=Repozitorija lapa
+details.documentation_site=Dokumentācijas lapa
 details.license=Licence
 assets=Resursi
 versions=Versijas
@@ -3076,7 +3262,14 @@ versions.on=publicēta
 versions.view_all=Parādīt visas
 dependency.id=ID
 dependency.version=Versija
+cargo.registry=Uzstādiet šo reģistru Cargo konfigurācijas failā, piemēram, <code>~/.cargo/config.toml</code>:
+cargo.install=Lai instalētu Cargo pakotni, izpildiet sekojošu komandu:
+cargo.documentation=Papildus informācija par Cargo reģistru pieejama <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/cargo/">dokumentācijā</a>.
+cargo.details.repository_site=Repozitorija lapa
+cargo.details.documentation_site=Dokumentācijas lapa
+chef.registry=Uzstādiet šo reģistru failā <code>~/.chef/config.rb</code>:
 chef.install=Lai instalētu pakotni, nepieciešams izpildīt sekojošu komandu:
+chef.documentation=Papildus informācija par Chef reģistru pieejama <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/chef/">dokumentācijā</a>.
 composer.registry=Pievienojiet šo reģistru savā <code>~/.composer/config.json</code> failā:
 composer.install=Lai instalētu Composer pakotni, izpildiet sekojošu komandu:
 composer.documentation=Papildus informācija par Composer reģistru pieejama <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/composer/">dokumentācijā</a>.
@@ -3086,6 +3279,11 @@ conan.details.repository=Repozitorijs
 conan.registry=Konfigurējiet šo reģistru no komandrindas:
 conan.install=Lai instalētu Conan pakotni, izpildiet sekojošu komandu:
 conan.documentation=Papildus informācija par Conan reģistru pieejama <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/conan/">dokumentācijā</a>.
+conda.registry=Uzstādiet šo reģistru kā Conda repozitoriju failā <code>.condarc</code>:
+conda.install=Lai instalētu Conda pakotni, izpildiet sekojošu komandu:
+conda.documentation=Papildus informācija par Conda reģistru pieejama <a target="_blank" rel="noopener noreferrer" href="https://docs.gitea.io/en-us/packages/conda/">dokumentācijā</a>.
+conda.details.repository_site=Repozitorija lapa
+conda.details.documentation_site=Dokumentācijas lapa
 container.details.type=Attēla formāts
 container.details.platform=Platforma
 container.pull=Atgādājiet šo attēlu no komandrindas:
@@ -3144,26 +3342,110 @@ settings.delete.description=Pakotne tiks neatgriezeniski izdzēsta.
 settings.delete.notice=Tiks dzēsts %s (%s). Šī darbība ir neatgriezeniska. Vai vēlaties turpināt?
 settings.delete.success=Pakotne tika izdzēsta.
 settings.delete.error=Neizdevās izdzēst pakotni.
+owner.settings.cargo.title=Cargo reģistra inkdess
+owner.settings.cargo.initialize=Inicializēt indeksu
+owner.settings.cargo.initialize.description=Lai izmantotu Cargo reģistru, nepieciešams speciāls indeksa git repozitorijs. Šeit to var izveidot ar nepieciešamo konfigurāciju.
+owner.settings.cargo.initialize.error=Neizdevās inicializēt Cargo indeksu: %v
+owner.settings.cargo.initialize.success=Cargo indekss tika veiksmīgi inicializēts.
+owner.settings.cargo.rebuild=Pārbūvēt indeksu
+owner.settings.cargo.rebuild.description=Ja indekss neatbilst tajā saglabātajām Cargo pakotnē, to var pārbūvēt šeit.
+owner.settings.cargo.rebuild.error=Neizdevās pārbūvēt Cargo indeksu: %v
+owner.settings.cargo.rebuild.success=Cargo indekss tika veiksmīgi pārbūvēts.
+owner.settings.cleanuprules.title=Pārvaldīt notīrīšanas noteikumus
+owner.settings.cleanuprules.add=Pievienot notīrīšanas noteikumu
+owner.settings.cleanuprules.edit=Labot notīrīšanas noteikumu
+owner.settings.cleanuprules.none=Nav pieejams neviens notīrīšanas noteikums. Sīkāka informācija ir pieejama dokumentācijā.
+owner.settings.cleanuprules.preview=Notīrīšānas noteikuma priekšskatījums
+owner.settings.cleanuprules.preview.overview=Ir ieplānota %d paku dzēšana.
+owner.settings.cleanuprules.preview.none=Notīrīšanas noteikumam neatbilst neviena pakotne.
 owner.settings.cleanuprules.enabled=Iespējots
+owner.settings.cleanuprules.pattern_full_match=Piešķirt šablonu visam pakotnes nosaukumam
+owner.settings.cleanuprules.keep.title=Versijas, kas atbilst šiem noteikumiem tiks saglabātas, pat ja tās atbilst noņemšanas noteikumiem zemāk.
+owner.settings.cleanuprules.keep.count=Saglabāt jaunāko versiju
+owner.settings.cleanuprules.keep.count.1=1 versija katrai pakotnei
+owner.settings.cleanuprules.keep.count.n=%d versijas katrai pakotnei
+owner.settings.cleanuprules.keep.pattern=Paturēt versijas, kas atbilst
+owner.settings.cleanuprules.keep.pattern.container=Versija <code>latest</code> vienmēr tiks paturēta konteineru pakotnēm.
+owner.settings.cleanuprules.remove.title=Versijas, kas atbilst šiem noteikumiem tiks noņemtas, ja vien neatbilst arī noteikumiem augstāk, lai tās paturētu.
+owner.settings.cleanuprules.remove.days=Noņemt versijas vecākas kā
+owner.settings.cleanuprules.remove.pattern=Noņemt versijas, kas atbilst
+owner.settings.cleanuprules.success.update=Notīrīšanas noteikumi tika atjaunoti.
+owner.settings.cleanuprules.success.delete=Notīrīšanas noteikumi tika izdzēsti.
+owner.settings.chef.title=Chef reģistrs
+owner.settings.chef.keypair=Ģenerēt atslēgu pāri
+owner.settings.chef.keypair.description=Ģenerēt atslēgu pāri, ko izmantot, lai autentificētos pret Chef reģistru. Iepriekšējo atslēgu vairs nevarēs izmantot.
 
 [secrets]
+secrets=Noslēpumi
+description=Noslēpumi tiks padoti atsevišķām darbībām un citādi nevar tikt nolasīti.
+none=Pagaidām nav neviena noslēpuma.
 value=Vērtība
 name=Nosaukums
+creation=Pievienot noslēpumu
+creation.name_placeholder=reģistr-nejūtīgs, tikai burti, cipari un apakšsvītras, nevar sākties ar GITEA_ vai GITHUB_
+creation.value_placeholder=Ievadiet jebkādu saturu. Atstarpes sākumā un beigā tiks noņemtas.
+creation.success=Noslēpums '%s' tika pievienots.
+creation.failed=Neizdevās pievienot noslēpumu.
+deletion=Dzēst noslēpumu
+deletion.description=Noslēpuma dzēšana ir neatgriezeniska. Vai turpināt?
+deletion.success=Noslēpums tika izdzēsts.
+deletion.failed=Neizdevās dzēst noslēpumu.
 
 [actions]
-
-
-
+actions=Darbības
+
+unit.desc=Pārvaldīt darbības
+
+status.unknown=Nezināms
+status.waiting=Gaida
+status.running=Izpildās
+status.success=Pabeigts
+status.failure=Neveiksmīgs
+status.cancelled=Atcelts
+status.skipped=Izlaists
+status.blocked=Bloķēts
+
+runners=Izpildītāji
+runners.runner_manage_panel=Izpildītāju pārvaldība
+runners.new=Pievienot jaunu izpildītāju
+runners.new_notice=Kā uzstādīt izpildītāju
+runners.status=Statuss
 runners.id=ID
 runners.name=Nosaukums
 runners.owner_type=Veids
 runners.description=Apraksts
 runners.labels=Etiķetes
+runners.last_online=Pēdējo reizi tiešsaistē
+runners.agent_labels=Aģenta etiķetes
+runners.custom_labels=Pielāgotas etiķetes
+runners.custom_labels_helper=Pielāgotas etiķetes, ko administrators pievienojis manuāli. Ar komatu atdalītas etiķetes, atstapres pirms un pēc etiķetes nosaukuma tiek ignorētas.
+runners.runner_title=Izpildītājs
+runners.task_list=Pēdējās darbības, kas izpildītas
 runners.task_list.run=Palaist
+runners.task_list.status=Statuss
 runners.task_list.repository=Repozitorijs
 runners.task_list.commit=Revīzija
+runners.task_list.done_at=Beigu laiks
+runners.edit_runner=Labot izpildītāju
+runners.update_runner=Atjaunot izpildītāju
+runners.update_runner_success=Izpildītājs veiksmīgi atjaunots
+runners.update_runner_failed=Neizdevās atjaunot izpildītāju
+runners.delete_runner=Dzēst izpildītāju
+runners.delete_runner_success=Izpildītājs veiksmīgi izdzēsts
+runners.delete_runner_failed=Neizdevās izdzēst izpildītāju
+runners.delete_runner_header=Apstiprināt izpildītāja izdzēšanu
+runners.delete_runner_notice=Ja šis izpildītājs veic kādus uzdevumus, tad tie tiks apturēti un atzīmēti kā neizdevušies. Tas var sabojāt būvēšanas darbaplūsmas.
+runners.none=Nav pieejami izpildītāji
+runners.status.unspecified=Nezināms
+runners.status.idle=Dīkstāvē
 runners.status.active=Aktīvs
+runners.status.offline=Bezsaistē
 
+runs.all_workflows=Visas darbaplūsmas
+runs.open_tab=%d atvērti
+runs.closed_tab=%d aizvērti
 runs.commit=Revīzija
+runs.pushed_by=Iesūtītājs
 
+need_approval_desc=Nepieciešams apstiprinājums, lai izpildītu izmaiņu pieprasījumu darbaplūsmas no atdalītiem repozitorijiem.
 
diff --git a/options/locale/locale_nl-NL.ini b/options/locale/locale_nl-NL.ini
index 0feda076afb53..450df1c3ab481 100644
--- a/options/locale/locale_nl-NL.ini
+++ b/options/locale/locale_nl-NL.ini
@@ -789,6 +789,7 @@ remove_account_link=Gekoppeld account verwijderen
 remove_account_link_desc=Als je een gekoppeld account verwijdert, verliest dit account toegang tot je Gitea-account. Doorgaan?
 remove_account_link_success=Het gekoppelde account is verwijderd.
 
+
 orgs_none=U bent geen lid van een organisatie.
 repos_none=U bezit geen repositories
 
diff --git a/options/locale/locale_pl-PL.ini b/options/locale/locale_pl-PL.ini
index 4f5811d53f6b7..e43e7a554009b 100644
--- a/options/locale/locale_pl-PL.ini
+++ b/options/locale/locale_pl-PL.ini
@@ -744,6 +744,7 @@ remove_account_link=Usuń powiązane konto
 remove_account_link_desc=Usunięcie powiązanego konta unieważni jego dostęp do Twojego konta Gitea. Kontynuować?
 remove_account_link_success=Powiązane konto zostało odłączone.
 
+
 orgs_none=Nie jesteś członkiem żadnej organizacji.
 repos_none=Nie posiadasz żadnych repozytoriów
 
diff --git a/options/locale/locale_pt-BR.ini b/options/locale/locale_pt-BR.ini
index 8909235d012f2..55529df8829af 100644
--- a/options/locale/locale_pt-BR.ini
+++ b/options/locale/locale_pt-BR.ini
@@ -819,6 +819,7 @@ remove_account_link=Remover conta vinculada
 remove_account_link_desc=A exclusão da chave SSH revogará o acesso à sua conta. Continuar?
 remove_account_link_success=A conta vinculada foi removida.
 
+
 orgs_none=Você não é membro de nenhuma organização.
 repos_none=Você não possui nenhum repositório
 
diff --git a/options/locale/locale_pt-PT.ini b/options/locale/locale_pt-PT.ini
index fb2a191b4a06a..ef7a400ec8b8c 100644
--- a/options/locale/locale_pt-PT.ini
+++ b/options/locale/locale_pt-PT.ini
@@ -821,6 +821,8 @@ remove_account_link=Remover conta vinculada
 remove_account_link_desc=A remoção de uma conta vinculada revogará o acesso dessa conta à sua conta do Gitea. Quer continuar?
 remove_account_link_success=A conta vinculada foi removida.
 
+hooks.desc=Adicionar automatismos web que serão despoletados para <strong>todos os repositórios</strong> pertencentes a este utilizador.
+
 orgs_none=Não é membro de nenhuma organização.
 repos_none=Não tem nenhum repositório
 
@@ -2288,6 +2290,8 @@ release.edit_subheader=Lançamentos organizam as versões do trabalho.
 release.tag_name=Nome da etiqueta
 release.target=Alvo
 release.tag_helper=Escolha uma etiqueta existente ou crie uma nova.
+release.tag_helper_new=Nova etiqueta. Esta etiqueta será criada a partir do destino.
+release.tag_helper_existing=Etiqueta existente.
 release.title=Título
 release.content=Conteúdo
 release.prerelease_desc=Marcar como pré-lançamento
@@ -2808,6 +2812,8 @@ auths.still_in_used=A fonte de autenticação ainda está em uso. Tem que primei
 auths.deletion_success=A fonte de autenticação foi eliminada.
 auths.login_source_exist=A fonte de autenticação '%s' já existe.
 auths.login_source_of_type_exist=Já existe uma fonte de autenticação deste tipo.
+auths.unable_to_initialize_openid=Não é possível inicializar o Fornecedor de Ligação OpenID: %s
+auths.invalid_openIdConnectAutoDiscoveryURL=URL de descoberta automática inválido (tem que ser um URL válido começando com http:// ou https://)
 
 config.server_config=Configuração do servidor
 config.app_name=Título do sítio
diff --git a/options/locale/locale_ru-RU.ini b/options/locale/locale_ru-RU.ini
index 7a400451f3081..9516a2963ad28 100644
--- a/options/locale/locale_ru-RU.ini
+++ b/options/locale/locale_ru-RU.ini
@@ -782,6 +782,7 @@ remove_account_link=Удалить привязанный аккаунт
 remove_account_link_desc=Удаление привязанной учетной записи отменит её доступ к вашей учетной записи Gitea. Продолжить?
 remove_account_link_success=Привязанная учетная запись удалена.
 
+
 orgs_none=Вы не состоите ни в одной организации.
 repos_none=Вы не владеете репозиториями
 
diff --git a/options/locale/locale_si-LK.ini b/options/locale/locale_si-LK.ini
index 23ab03b008970..1f87009005ad8 100644
--- a/options/locale/locale_si-LK.ini
+++ b/options/locale/locale_si-LK.ini
@@ -715,6 +715,7 @@ remove_account_link=සම්බන්ධිත ගිණුම ඉවත් ක
 remove_account_link_desc=සම්බන්ධිත ගිණුමක් ඉවත් කිරීම ඔබගේ Gitea ගිණුමට එහි ප්රවේශය අවලංගු කරනු ඇත. දිගටම?
 remove_account_link_success=සම්බන්ධිත ගිණුම ඉවත් කර ඇත.
 
+
 orgs_none=ඔබ කිසිදු සංවිධානයක සාමාජිකයෙකු නොවේ.
 repos_none=ඔබට කිසිදු ගබඩාවක් නොමැත
 
diff --git a/options/locale/locale_sk-SK.ini b/options/locale/locale_sk-SK.ini
index f7612d4c503fd..87942926ea55f 100644
--- a/options/locale/locale_sk-SK.ini
+++ b/options/locale/locale_sk-SK.ini
@@ -785,6 +785,7 @@ manage_account_links=Spravovať prepojené kontá
 manage_account_links_desc=Tieto externé účty sú prepojené s vaším účtom Gitea.
 link_account=Pripojiť účet
 
+
 orgs_none=Nieste členom žiadnej organizácie.
 repos_none=Nevlastníte žiadne repozitáre
 
diff --git a/options/locale/locale_sv-SE.ini b/options/locale/locale_sv-SE.ini
index 6afe9e71181fe..c79f99d512edd 100644
--- a/options/locale/locale_sv-SE.ini
+++ b/options/locale/locale_sv-SE.ini
@@ -619,6 +619,7 @@ remove_account_link=Ta Bort Länkat Konto
 remove_account_link_desc=Borttagning av länkade konton kommer häva dess åtkomst till ditt Gitea-konto. Vill du fortsätta?
 remove_account_link_success=Det länkade konton har tagits bort.
 
+
 orgs_none=Du är inte en medlem i någon organisation.
 repos_none=Du har inga utvecklingskataloger associerade med ditt konto
 
diff --git a/options/locale/locale_tr-TR.ini b/options/locale/locale_tr-TR.ini
index 877d767ae068f..131dfa69af192 100644
--- a/options/locale/locale_tr-TR.ini
+++ b/options/locale/locale_tr-TR.ini
@@ -812,6 +812,7 @@ remove_account_link=Bağlantılı Hesabı Kaldır
 remove_account_link_desc=Bağlantılı bir hesabı kaldırmak, onunla Gitea hesabınıza erişimi iptal edecektir. Devam edilsin mi?
 remove_account_link_success=Bağlantılı hesap kaldırıldı.
 
+
 orgs_none=Herhangi bir organizasyonun bir üyesi değilsiniz.
 repos_none=Herhangi bir depoya sahip değilsiniz
 
diff --git a/options/locale/locale_uk-UA.ini b/options/locale/locale_uk-UA.ini
index 293803c10e478..3f39f0bafa5fa 100644
--- a/options/locale/locale_uk-UA.ini
+++ b/options/locale/locale_uk-UA.ini
@@ -739,6 +739,7 @@ remove_account_link=Видалити облікові записи
 remove_account_link_desc=Видалення пов'язаного облікового запису відкликає його доступ до вашого облікового запису Gitea. Продовжити?
 remove_account_link_success=Зв'язаний обліковий запис видалено.
 
+
 orgs_none=Ви не є учасником будь-якої організації.
 repos_none=У вас немає власних репозиторіїв
 
diff --git a/options/locale/locale_zh-CN.ini b/options/locale/locale_zh-CN.ini
index 36afb5d442f80..aa4cc4dde9744 100644
--- a/options/locale/locale_zh-CN.ini
+++ b/options/locale/locale_zh-CN.ini
@@ -821,6 +821,7 @@ remove_account_link=删除已绑定的账号
 remove_account_link_desc=删除已绑定帐户将吊销其对您的 Gitea 帐户的访问权限。继续？
 remove_account_link_success=已取消绑定帐户。
 
+
 orgs_none=您现在还不是任何组织的成员。
 repos_none=你并不拥有任何仓库
 
diff --git a/options/locale/locale_zh-HK.ini b/options/locale/locale_zh-HK.ini
index 288188e911412..6fa062fc65e61 100644
--- a/options/locale/locale_zh-HK.ini
+++ b/options/locale/locale_zh-HK.ini
@@ -279,6 +279,7 @@ or_enter_secret=或者輸入密碼: %s
 
 link_account=連結帳戶
 
+
 orgs_none=您尚未成為任一組織的成員。
 repos_none=您不擁有任何存儲庫
 
diff --git a/options/locale/locale_zh-TW.ini b/options/locale/locale_zh-TW.ini
index fa39225c1b894..e98e55b77700d 100644
--- a/options/locale/locale_zh-TW.ini
+++ b/options/locale/locale_zh-TW.ini
@@ -821,6 +821,7 @@ remove_account_link=刪除已連結的帳戶
 remove_account_link_desc=刪除連結帳戶將撤銷其對 Gitea 帳戶的存取權限。是否繼續？
 remove_account_link_success=已移除連結的帳戶。
 
+
 orgs_none=您尚未成為任一組織的成員。
 repos_none=您不擁有任何存儲庫
 
@@ -2287,7 +2288,7 @@ release.new_subheader=發布、整理專案的版本。
 release.edit_subheader=發布、整理專案的版本。
 release.tag_name=標籤名稱
 release.target=目標分支
-release.tag_helper=新增或選擇既有的標籤。
+release.tag_helper=新增或選擇現有的標籤。
 release.title=標題
 release.content=內容
 release.prerelease_desc=標記為 Pre-Release

From c6f50297084ebd9ec8b8c25370b9b963167274eb Mon Sep 17 00:00:00 2001
From: Peter <peter.kurfer@googlemail.com>
Date: Sun, 12 Mar 2023 08:48:07 +0100
Subject: [PATCH 48/53] Preserve file size when creating attachments (#23406)

When creating attachments (issue, release, repo) the file size (being
part of the multipart file header) is passed through the chain of
creating an attachment to ensure the MinIO client can stream the file
directly instead of having to read it to memory completely at first.

Fixes #23393

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 routers/api/v1/repo/issue_attachment.go         | 2 +-
 routers/api/v1/repo/issue_comment_attachment.go | 2 +-
 routers/api/v1/repo/release_attachment.go       | 2 +-
 routers/web/repo/attachment.go                  | 2 +-
 services/attachment/attachment.go               | 8 ++++----
 services/attachment/attachment_test.go          | 2 +-
 services/mailer/incoming/incoming_handler.go    | 2 +-
 services/release/release_test.go                | 7 +++++--
 8 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/routers/api/v1/repo/issue_attachment.go b/routers/api/v1/repo/issue_attachment.go
index 8cbd2e11b699c..92e11386882cc 100644
--- a/routers/api/v1/repo/issue_attachment.go
+++ b/routers/api/v1/repo/issue_attachment.go
@@ -176,7 +176,7 @@ func CreateIssueAttachment(ctx *context.APIContext) {
 		filename = query
 	}
 
-	attachment, err := attachment.UploadAttachment(file, setting.Attachment.AllowedTypes, &repo_model.Attachment{
+	attachment, err := attachment.UploadAttachment(file, setting.Attachment.AllowedTypes, header.Size, &repo_model.Attachment{
 		Name:       filename,
 		UploaderID: ctx.Doer.ID,
 		RepoID:     ctx.Repo.Repository.ID,
diff --git a/routers/api/v1/repo/issue_comment_attachment.go b/routers/api/v1/repo/issue_comment_attachment.go
index 4c8452380f033..6fe4dbc977155 100644
--- a/routers/api/v1/repo/issue_comment_attachment.go
+++ b/routers/api/v1/repo/issue_comment_attachment.go
@@ -180,7 +180,7 @@ func CreateIssueCommentAttachment(ctx *context.APIContext) {
 		filename = query
 	}
 
-	attachment, err := attachment.UploadAttachment(file, setting.Attachment.AllowedTypes, &repo_model.Attachment{
+	attachment, err := attachment.UploadAttachment(file, setting.Attachment.AllowedTypes, header.Size, &repo_model.Attachment{
 		Name:       filename,
 		UploaderID: ctx.Doer.ID,
 		RepoID:     ctx.Repo.Repository.ID,
diff --git a/routers/api/v1/repo/release_attachment.go b/routers/api/v1/repo/release_attachment.go
index 597578aac578b..305b2808df543 100644
--- a/routers/api/v1/repo/release_attachment.go
+++ b/routers/api/v1/repo/release_attachment.go
@@ -194,7 +194,7 @@ func CreateReleaseAttachment(ctx *context.APIContext) {
 	}
 
 	// Create a new attachment and save the file
-	attach, err := attachment.UploadAttachment(file, setting.Repository.Release.AllowedTypes, &repo_model.Attachment{
+	attach, err := attachment.UploadAttachment(file, setting.Repository.Release.AllowedTypes, header.Size, &repo_model.Attachment{
 		Name:       filename,
 		UploaderID: ctx.Doer.ID,
 		RepoID:     release.RepoID,
diff --git a/routers/web/repo/attachment.go b/routers/web/repo/attachment.go
index 589632ad6e10d..c6d8828fac603 100644
--- a/routers/web/repo/attachment.go
+++ b/routers/web/repo/attachment.go
@@ -44,7 +44,7 @@ func uploadAttachment(ctx *context.Context, repoID int64, allowedTypes string) {
 	}
 	defer file.Close()
 
-	attach, err := attachment.UploadAttachment(file, allowedTypes, &repo_model.Attachment{
+	attach, err := attachment.UploadAttachment(file, allowedTypes, header.Size, &repo_model.Attachment{
 		Name:       header.Filename,
 		UploaderID: ctx.Doer.ID,
 		RepoID:     repoID,
diff --git a/services/attachment/attachment.go b/services/attachment/attachment.go
index 7fdacc6aae505..3e7df0cee0c0e 100644
--- a/services/attachment/attachment.go
+++ b/services/attachment/attachment.go
@@ -19,14 +19,14 @@ import (
 )
 
 // NewAttachment creates a new attachment object, but do not verify.
-func NewAttachment(attach *repo_model.Attachment, file io.Reader) (*repo_model.Attachment, error) {
+func NewAttachment(attach *repo_model.Attachment, file io.Reader, size int64) (*repo_model.Attachment, error) {
 	if attach.RepoID == 0 {
 		return nil, fmt.Errorf("attachment %s should belong to a repository", attach.Name)
 	}
 
 	err := db.WithTx(db.DefaultContext, func(ctx context.Context) error {
 		attach.UUID = uuid.New().String()
-		size, err := storage.Attachments.Save(attach.RelativePath(), file, -1)
+		size, err := storage.Attachments.Save(attach.RelativePath(), file, size)
 		if err != nil {
 			return fmt.Errorf("Create: %w", err)
 		}
@@ -39,7 +39,7 @@ func NewAttachment(attach *repo_model.Attachment, file io.Reader) (*repo_model.A
 }
 
 // UploadAttachment upload new attachment into storage and update database
-func UploadAttachment(file io.Reader, allowedTypes string, opts *repo_model.Attachment) (*repo_model.Attachment, error) {
+func UploadAttachment(file io.Reader, allowedTypes string, fileSize int64, opts *repo_model.Attachment) (*repo_model.Attachment, error) {
 	buf := make([]byte, 1024)
 	n, _ := util.ReadAtMost(file, buf)
 	buf = buf[:n]
@@ -48,5 +48,5 @@ func UploadAttachment(file io.Reader, allowedTypes string, opts *repo_model.Atta
 		return nil, err
 	}
 
-	return NewAttachment(opts, io.MultiReader(bytes.NewReader(buf), file))
+	return NewAttachment(opts, io.MultiReader(bytes.NewReader(buf), file), fileSize)
 }
diff --git a/services/attachment/attachment_test.go b/services/attachment/attachment_test.go
index 72d1b2ab3a445..1b9af34427e53 100644
--- a/services/attachment/attachment_test.go
+++ b/services/attachment/attachment_test.go
@@ -36,7 +36,7 @@ func TestUploadAttachment(t *testing.T) {
 		RepoID:     1,
 		UploaderID: user.ID,
 		Name:       filepath.Base(fPath),
-	}, f)
+	}, f, -1)
 	assert.NoError(t, err)
 
 	attachment, err := repo_model.GetAttachmentByUUID(db.DefaultContext, attach.UUID)
diff --git a/services/mailer/incoming/incoming_handler.go b/services/mailer/incoming/incoming_handler.go
index 454039c60fb5f..b594e35189bf5 100644
--- a/services/mailer/incoming/incoming_handler.go
+++ b/services/mailer/incoming/incoming_handler.go
@@ -87,7 +87,7 @@ func (h *ReplyHandler) Handle(ctx context.Context, content *MailContent, doer *u
 		attachmentIDs := make([]string, 0, len(content.Attachments))
 		if setting.Attachment.Enabled {
 			for _, attachment := range content.Attachments {
-				a, err := attachment_service.UploadAttachment(bytes.NewReader(attachment.Content), setting.Attachment.AllowedTypes, &repo_model.Attachment{
+				a, err := attachment_service.UploadAttachment(bytes.NewReader(attachment.Content), setting.Attachment.AllowedTypes, int64(len(attachment.Content)), &repo_model.Attachment{
 					Name:       attachment.Name,
 					UploaderID: doer.ID,
 					RepoID:     issue.Repo.ID,
diff --git a/services/release/release_test.go b/services/release/release_test.go
index 9b8aaa364983a..805269413d729 100644
--- a/services/release/release_test.go
+++ b/services/release/release_test.go
@@ -106,11 +106,13 @@ func TestRelease_Create(t *testing.T) {
 		IsTag:        false,
 	}, nil, ""))
 
+	testPlayload := "testtest"
+
 	attach, err := attachment.NewAttachment(&repo_model.Attachment{
 		RepoID:     repo.ID,
 		UploaderID: user.ID,
 		Name:       "test.txt",
-	}, strings.NewReader("testtest"))
+	}, strings.NewReader(testPlayload), int64(len([]byte(testPlayload))))
 	assert.NoError(t, err)
 
 	release := repo_model.Release{
@@ -239,11 +241,12 @@ func TestRelease_Update(t *testing.T) {
 	assert.Equal(t, tagName, release.TagName)
 
 	// Add new attachments
+	samplePayload := "testtest"
 	attach, err := attachment.NewAttachment(&repo_model.Attachment{
 		RepoID:     repo.ID,
 		UploaderID: user.ID,
 		Name:       "test.txt",
-	}, strings.NewReader("testtest"))
+	}, strings.NewReader(samplePayload), int64(len([]byte(samplePayload))))
 	assert.NoError(t, err)
 
 	assert.NoError(t, UpdateRelease(user, gitRepo, release, []string{attach.UUID}, nil, nil))

From e72290fd9aeb77a47311483d1d565e428ce40cd9 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Sun, 12 Mar 2023 20:09:20 +0900
Subject: [PATCH 49/53] Sync the class change of Edit Column Button to JS code
 (#23400)

In #22767, we changed the class of `Edit Column` button from `red` to
`primary`
But `red` is used to find this button in js.....

---------

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: zeripath <art27@cantab.net>
---
 templates/projects/view.tmpl         |  2 +-
 web_src/js/features/repo-projects.js | 48 +++++++++++++---------------
 2 files changed, 23 insertions(+), 27 deletions(-)

diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 474b22a2f14ca..06192f630bec7 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -128,7 +128,7 @@
 
 											<div class="text right actions">
 												<div class="ui cancel button">{{$.locale.Tr "settings.cancel"}}</div>
-												<button data-url="{{$.Link}}/{{.ID}}" class="ui primary button">{{$.locale.Tr "repo.projects.column.edit"}}</button>
+												<button data-url="{{$.Link}}/{{.ID}}" class="ui primary button edit-column-button">{{$.locale.Tr "repo.projects.column.edit"}}</button>
 											</div>
 										</form>
 									</div>
diff --git a/web_src/js/features/repo-projects.js b/web_src/js/features/repo-projects.js
index 534f517853359..a1e177e4617c3 100644
--- a/web_src/js/features/repo-projects.js
+++ b/web_src/js/features/repo-projects.js
@@ -95,39 +95,35 @@ export function initRepoProject() {
   $('.edit-project-board').each(function () {
     const projectHeader = $(this).closest('.board-column-header');
     const projectTitleLabel = projectHeader.find('.board-label');
-    const projectTitleInput = $(this).find(
-      '.content > .form > .field > .project-board-title',
-    );
-    const projectColorInput = $(this).find('.content > .form > .field  #new_board_color');
+    const projectTitleInput = $(this).find('.project-board-title');
+    const projectColorInput = $(this).find('#new_board_color');
     const boardColumn = $(this).closest('.board-column');
 
     if (boardColumn.css('backgroundColor')) {
       setLabelColor(projectHeader, rgbToHex(boardColumn.css('backgroundColor')));
     }
 
-    $(this)
-      .find('.content > .form > .actions > .red')
-      .on('click', function (e) {
-        e.preventDefault();
-
-        $.ajax({
-          url: $(this).data('url'),
-          data: JSON.stringify({title: projectTitleInput.val(), color: projectColorInput.val()}),
-          headers: {
-            'X-Csrf-Token': csrfToken,
-          },
-          contentType: 'application/json',
-          method: 'PUT',
-        }).done(() => {
-          projectTitleLabel.text(projectTitleInput.val());
-          projectTitleInput.closest('form').removeClass('dirty');
-          if (projectColorInput.val()) {
-            setLabelColor(projectHeader, projectColorInput.val());
-          }
-          boardColumn.attr('style', `background: ${projectColorInput.val()}!important`);
-          $('.ui.modal').modal('hide');
-        });
+    $(this).find('.edit-column-button').on('click', function (e) {
+      e.preventDefault();
+
+      $.ajax({
+        url: $(this).data('url'),
+        data: JSON.stringify({title: projectTitleInput.val(), color: projectColorInput.val()}),
+        headers: {
+          'X-Csrf-Token': csrfToken,
+        },
+        contentType: 'application/json',
+        method: 'PUT',
+      }).done(() => {
+        projectTitleLabel.text(projectTitleInput.val());
+        projectTitleInput.closest('form').removeClass('dirty');
+        if (projectColorInput.val()) {
+          setLabelColor(projectHeader, projectColorInput.val());
+        }
+        boardColumn.attr('style', `background: ${projectColorInput.val()}!important`);
+        $('.ui.modal').modal('hide');
       });
+    });
   });
 
   $(document).on('click', '.set-default-project-board', async function (e) {

From a04eeb2a548d4fd2b63873fc2acff49c52e19723 Mon Sep 17 00:00:00 2001
From: yp05327 <576951401@qq.com>
Date: Sun, 12 Mar 2023 22:36:47 +0900
Subject: [PATCH 50/53] Show edit/close/delete button on organization wide
 repositories (#23388)

A part of https://github.com/go-gitea/gitea/pull/22865
---
 routers/web/repo/projects.go      |  2 +-
 templates/projects/list.tmpl      |  6 +++---
 templates/projects/view.tmpl      |  4 ++--
 templates/repo/projects/list.tmpl | 12 ++++++------
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/routers/web/repo/projects.go b/routers/web/repo/projects.go
index 29bd59c7a3b3e..e15f548a38dc3 100644
--- a/routers/web/repo/projects.go
+++ b/routers/web/repo/projects.go
@@ -113,7 +113,7 @@ func Projects(ctx *context.Context) {
 	pager.AddParam(ctx, "state", "State")
 	ctx.Data["Page"] = pager
 
-	ctx.Data["CanWriteProjects"] = true
+	ctx.Data["CanWriteProjects"] = ctx.Repo.Permission.CanWrite(unit.TypeProjects)
 	ctx.Data["IsShowClosed"] = isShowClosed
 	ctx.Data["IsProjectsPage"] = true
 	ctx.Data["SortType"] = sortType
diff --git a/templates/projects/list.tmpl b/templates/projects/list.tmpl
index 489189ec45a1c..4a21c0fd28ce2 100644
--- a/templates/projects/list.tmpl
+++ b/templates/projects/list.tmpl
@@ -51,7 +51,7 @@
 							{{JsPrettyNumber .NumClosedIssues}}&nbsp;{{$.locale.Tr "repo.issues.closed_title"}}
 						</span>
 					</div>
-					{{if and (or $.CanWriteIssues $.CanWritePulls) (not $.Repository.IsArchived)}}
+					{{if and $.CanWriteProjects (not $.Repository.IsArchived)}}
 					<div class="ui right operate">
 						<a href="{{$.Link}}/{{.ID}}/edit" data-id={{.ID}} data-title={{.Title}}>{{svg "octicon-pencil"}} {{$.locale.Tr "repo.issues.label_edit"}}</a>
 						{{if .IsClosed}}
@@ -59,7 +59,7 @@
 						{{else}}
 							<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/close">{{svg "octicon-skip"}} {{$.locale.Tr "repo.projects.close"}}</a>
 						{{end}}
-						<a class="delete-button" href="#" data-url="{{$.RepoLink}}/projects/{{.ID}}/delete" data-id="{{.ID}}">{{svg "octicon-trash"}} {{$.locale.Tr "repo.issues.label_delete"}}</a>
+						<a class="delete-button" href="#" data-url="{{$.Link}}/{{.ID}}/delete" data-id="{{.ID}}">{{svg "octicon-trash"}} {{$.locale.Tr "repo.issues.label_delete"}}</a>
 					</div>
 					{{end}}
 					{{if .Description}}
@@ -75,7 +75,7 @@
 	</div>
 </div>
 
-{{if or .CanWriteIssues .CanWritePulls}}
+{{if $.CanWriteProjects}}
 <div class="ui small basic delete modal">
 	<div class="ui icon header">
 		{{svg "octicon-trash"}}
diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 06192f630bec7..6867309510f80 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -43,7 +43,7 @@
 				<h2 class="project-title">{{$.Project.Title}}</h2>
 				<div class="content project-description">{{$.Project.RenderedContent|Str2html}}</div>
 			</div>
-			{{if or $.CanWriteIssues $.CanWritePulls}}
+			{{if $.CanWriteProjects}}
 				<div class="column right aligned">
 					<div class="ui compact right small menu">
 						<a class="item" href="{{$.Link}}/edit?redirect=project" data-id={{$.Project.ID}} data-title={{$.Project.Title}}>
@@ -256,7 +256,7 @@
 
 </div>
 
-{{if or .CanWriteIssues .CanWritePulls}}
+{{if .CanWriteProjects}}
 	<div class="ui small basic delete modal">
 		<div class="ui icon header">
 			{{svg "octicon-trash"}}
diff --git a/templates/repo/projects/list.tmpl b/templates/repo/projects/list.tmpl
index 929a1b4c6fb80..f066f84ea2e8e 100644
--- a/templates/repo/projects/list.tmpl
+++ b/templates/repo/projects/list.tmpl
@@ -53,15 +53,15 @@
 							{{JsPrettyNumber .NumClosedIssues}}&nbsp;{{$.locale.Tr "repo.issues.closed_title"}}
 						</span>
 					</div>
-					{{if and (or $.CanWriteIssues $.CanWritePulls) (not $.Repository.IsArchived)}}
+					{{if and $.CanWriteProjects (not $.Repository.IsArchived)}}
 					<div class="ui right operate">
-						<a href="{{$.Link}}/{{.ID}}/edit" data-id={{.ID}} data-title={{.Title}}>{{svg "octicon-pencil"}} {{$.locale.Tr "repo.issues.label_edit"}}</a>
+						<a href="{{.Link}}/edit" data-id={{.ID}} data-title={{.Title}}>{{svg "octicon-pencil"}} {{$.locale.Tr "repo.issues.label_edit"}}</a>
 						{{if .IsClosed}}
-							<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/open">{{svg "octicon-check"}} {{$.locale.Tr "repo.projects.open"}}</a>
+							<a class="link-action" href data-url="{{.Link}}/open">{{svg "octicon-check"}} {{$.locale.Tr "repo.projects.open"}}</a>
 						{{else}}
-							<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/close">{{svg "octicon-skip"}} {{$.locale.Tr "repo.projects.close"}}</a>
+							<a class="link-action" href data-url="{{.Link}}/close">{{svg "octicon-skip"}} {{$.locale.Tr "repo.projects.close"}}</a>
 						{{end}}
-						<a class="delete-button" href="#" data-url="{{$.RepoLink}}/projects/{{.ID}}/delete" data-id="{{.ID}}">{{svg "octicon-trash"}} {{$.locale.Tr "repo.issues.label_delete"}}</a>
+						<a class="delete-button" href="#" data-url="{{.Link}}/delete" data-id="{{.ID}}">{{svg "octicon-trash"}} {{$.locale.Tr "repo.issues.label_delete"}}</a>
 					</div>
 					{{end}}
 					{{if .Description}}
@@ -77,7 +77,7 @@
 	</div>
 </div>
 
-{{if or .CanWriteIssues .CanWritePulls}}
+{{if .CanWriteProjects}}
 <div class="ui small basic delete modal">
 	<div class="ui icon header">
 		{{svg "octicon-trash"}}

From 43c136200a181858cf36a0a876cb6609aa804120 Mon Sep 17 00:00:00 2001
From: Brecht Van Lommel <brecht@blender.org>
Date: Sun, 12 Mar 2023 21:39:56 +0100
Subject: [PATCH 51/53] Deduplicate template code for label selection menu
 (#23431)

---
 .../issue/labels/labels_selector_field.tmpl   | 43 ++++++++++++++++++
 templates/repo/issue/new_form.tmpl            | 45 +------------------
 .../repo/issue/view_content/sidebar.tmpl      | 44 +-----------------
 3 files changed, 45 insertions(+), 87 deletions(-)
 create mode 100644 templates/repo/issue/labels/labels_selector_field.tmpl

diff --git a/templates/repo/issue/labels/labels_selector_field.tmpl b/templates/repo/issue/labels/labels_selector_field.tmpl
new file mode 100644
index 0000000000000..00d852bba98b3
--- /dev/null
+++ b/templates/repo/issue/labels/labels_selector_field.tmpl
@@ -0,0 +1,43 @@
+<div class="ui {{if or (not .HasIssuesOrPullsWritePermission) .Repository.IsArchived}}disabled{{end}} floating jump select-label dropdown">
+	<a class="text gt-df gt-ac muted">
+		<strong>{{.locale.Tr "repo.issues.new.labels"}}</strong>
+		{{if and .HasIssuesOrPullsWritePermission (not .Repository.IsArchived)}}
+			{{svg "octicon-gear" 16 "gt-ml-2"}}
+		{{end}}
+	</a>
+	<div class="filter menu" {{if .Issue}}data-action="update" data-issue-id="{{$.Issue.ID}}" data-update-url="{{$.RepoLink}}/issues/labels"{{else}}data-id="#label_ids"{{end}}>
+		<div class="header" style="text-transform: none;font-size:16px;">{{.locale.Tr "repo.issues.new.add_labels_title"}}</div>
+		{{if or .Labels .OrgLabels}}
+			<div class="ui icon search input">
+				<i class="icon gt-df gt-ac gt-jc">{{svg "octicon-search" 16}}</i>
+				<input type="text" placeholder="{{.locale.Tr "repo.issues.filter_labels"}}">
+			</div>
+		{{end}}
+		<a class="no-select item" href="#">{{.locale.Tr "repo.issues.new.clear_labels"}}</a>
+		{{if or .Labels .OrgLabels}}
+			{{$previousExclusiveScope := "_no_scope"}}
+			{{range .Labels}}
+				{{$exclusiveScope := .ExclusiveScope}}
+				{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
+					<div class="ui divider"></div>
+				{{end}}
+				{{$previousExclusiveScope = $exclusiveScope}}
+				<a class="{{if .IsChecked}}checked{{end}} item" href="#" data-id="{{.ID}}" data-id-selector="#label_{{.ID}}" data-scope="{{$exclusiveScope}}"><span class="octicon-check {{if not .IsChecked}}invisible{{end}}">{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}</span>&nbsp;&nbsp;{{RenderLabel $.Context .}}
+				{{if .Description}}<br><small class="desc">{{.Description | RenderEmoji $.Context}}</small>{{end}}</a>
+			{{end}}
+			<div class="ui divider"></div>
+			{{$previousExclusiveScope := "_no_scope"}}
+			{{range .OrgLabels}}
+				{{$exclusiveScope := .ExclusiveScope}}
+				{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
+					<div class="ui divider"></div>
+				{{end}}
+				{{$previousExclusiveScope = $exclusiveScope}}
+				<a class="{{if .IsChecked}}checked{{end}} item" href="#" data-id="{{.ID}}" data-id-selector="#label_{{.ID}}" data-scope="{{$exclusiveScope}}"><span class="octicon-check {{if not .IsChecked}}invisible{{end}}">{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}</span>&nbsp;&nbsp;{{RenderLabel $.Context .}}
+				{{if .Description}}<br><small class="desc">{{.Description | RenderEmoji $.Context}}</small>{{end}}</a>
+			{{end}}
+		{{else}}
+			<div class="header" style="text-transform: none;font-size:14px;">{{.locale.Tr "repo.issues.new.no_items"}}</div>
+		{{end}}
+	</div>
+</div>
diff --git a/templates/repo/issue/new_form.tmpl b/templates/repo/issue/new_form.tmpl
index 9fd6c99a5b3f0..a99ceb0451484 100644
--- a/templates/repo/issue/new_form.tmpl
+++ b/templates/repo/issue/new_form.tmpl
@@ -36,50 +36,7 @@
 			{{template "repo/issue/branch_selector_field" .}}
 
 			<input id="label_ids" name="label_ids" type="hidden" value="{{.label_ids}}">
-			<div class="ui {{if not .HasIssuesOrPullsWritePermission}}disabled{{end}} floating jump select-label dropdown">
-				<span class="text">
-					<strong>{{.locale.Tr "repo.issues.new.labels"}}</strong>
-					{{if .HasIssuesOrPullsWritePermission}}
-						{{svg "octicon-gear"}}
-					{{end}}
-				</span>
-				<div class="filter menu" data-id="#label_ids">
-					<div class="header" style="text-transform: none;font-size:16px;">{{.locale.Tr "repo.issues.new.add_labels_title"}}</div>
-					{{if or .Labels .OrgLabels}}
-					<div class="ui icon search input">
-						<i class="icon gt-df gt-ac gt-jc">{{svg "octicon-search" 16}}</i>
-						<input type="text" placeholder="{{.locale.Tr "repo.issues.filter_labels"}}">
-					</div>
-					{{end}}
-					<div class="no-select item">{{.locale.Tr "repo.issues.new.clear_labels"}}</div>
-					{{if or .Labels .OrgLabels}}
-						{{$previousExclusiveScope := "_no_scope"}}
-						{{range .Labels}}
-							{{$exclusiveScope := .ExclusiveScope}}
-							{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
-								<div class="ui divider"></div>
-							{{end}}
-							{{$previousExclusiveScope = $exclusiveScope}}
-							<a class="{{if .IsChecked}}checked{{end}} item" href="#" data-id="{{.ID}}" data-id-selector="#label_{{.ID}}" data-scope="{{$exclusiveScope}}"><span class="octicon-check {{if not .IsChecked}}invisible{{end}}">{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}</span>&nbsp;&nbsp;{{RenderLabel $.Context .}}
-							{{if .Description}}<br><small class="desc">{{.Description | RenderEmoji $.Context}}</small>{{end}}</a>
-						{{end}}
-
-						<div class="ui divider"></div>
-						{{$previousExclusiveScope := "_no_scope"}}
-						{{range .OrgLabels}}
-							{{$exclusiveScope := .ExclusiveScope}}
-							{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
-								<div class="ui divider"></div>
-							{{end}}
-							{{$previousExclusiveScope = $exclusiveScope}}
-							<a class="{{if .IsChecked}}checked{{end}} item" href="#" data-id="{{.ID}}" data-id-selector="#label_{{.ID}}" data-scope="{{$exclusiveScope}}"><span class="octicon-check {{if not .IsChecked}}invisible{{end}}">{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}</span>&nbsp;&nbsp;{{RenderLabel $.Context .}}
-							{{if .Description}}<br><small class="desc">{{.Description | RenderEmoji $.Context}}</small>{{end}}</a>
-						{{end}}
-					{{else}}
-						<div class="header" style="text-transform: none;font-size:14px;">{{.locale.Tr "repo.issues.new.no_items"}}</div>
-					{{end}}
-				</div>
-			</div>
+			{{template "repo/issue/labels/labels_selector_field" .}}
 			{{template "repo/issue/labels/labels_sidebar" dict "root" $}}
 
 			<div class="ui divider"></div>
diff --git a/templates/repo/issue/view_content/sidebar.tmpl b/templates/repo/issue/view_content/sidebar.tmpl
index 29bfac7c27ea2..e58f94aff389d 100644
--- a/templates/repo/issue/view_content/sidebar.tmpl
+++ b/templates/repo/issue/view_content/sidebar.tmpl
@@ -106,49 +106,7 @@
 			<div class="ui divider"></div>
 		{{end}}
 
-		<div class="ui {{if or (not .HasIssuesOrPullsWritePermission) .Repository.IsArchived}}disabled{{end}} floating jump select-label dropdown">
-			<a class="text gt-df gt-ac muted">
-				<strong>{{.locale.Tr "repo.issues.new.labels"}}</strong>
-				{{if and .HasIssuesOrPullsWritePermission (not .Repository.IsArchived)}}
-					{{svg "octicon-gear" 16 "gt-ml-2"}}
-				{{end}}
-			</a>
-			<div class="filter menu" data-action="update" data-issue-id="{{$.Issue.ID}}" data-update-url="{{$.RepoLink}}/issues/labels">
-				<div class="header" style="text-transform: none;font-size:16px;">{{.locale.Tr "repo.issues.new.add_labels_title"}}</div>
-				{{if or .Labels .OrgLabels}}
-					<div class="ui icon search input">
-						<i class="icon gt-df gt-ac gt-jc">{{svg "octicon-search" 16}}</i>
-						<input type="text" placeholder="{{.locale.Tr "repo.issues.filter_labels"}}">
-					</div>
-				{{end}}
-				<a class="no-select item" href="#">{{.locale.Tr "repo.issues.new.clear_labels"}}</a>
-				{{if or .Labels .OrgLabels}}
-					{{$previousExclusiveScope := "_no_scope"}}
-					{{range .Labels}}
-						{{$exclusiveScope := .ExclusiveScope}}
-						{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
-							<div class="ui divider"></div>
-						{{end}}
-						{{$previousExclusiveScope = $exclusiveScope}}
-						<a class="{{if .IsChecked}}checked{{end}} item" href="#" data-id="{{.ID}}" data-id-selector="#label_{{.ID}}" data-scope="{{$exclusiveScope}}"><span class="octicon-check {{if not .IsChecked}}invisible{{end}}">{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}</span>&nbsp;&nbsp;{{RenderLabel $.Context .}}
-						{{if .Description}}<br><small class="desc">{{.Description | RenderEmoji $.Context}}</small>{{end}}</a>
-					{{end}}
-					<div class="ui divider"></div>
-					{{$previousExclusiveScope := "_no_scope"}}
-					{{range .OrgLabels}}
-						{{$exclusiveScope := .ExclusiveScope}}
-						{{if and (ne $previousExclusiveScope "_no_scope") (ne $previousExclusiveScope $exclusiveScope)}}
-							<div class="ui divider"></div>
-						{{end}}
-						{{$previousExclusiveScope = $exclusiveScope}}
-						<a class="{{if .IsChecked}}checked{{end}} item" href="#" data-id="{{.ID}}" data-id-selector="#label_{{.ID}}" data-scope="{{$exclusiveScope}}"><span class="octicon-check {{if not .IsChecked}}invisible{{end}}">{{if $exclusiveScope}}{{svg "octicon-dot-fill"}}{{else}}{{svg "octicon-check"}}{{end}}</span>&nbsp;&nbsp;{{RenderLabel $.Context .}}
-						{{if .Description}}<br><small class="desc">{{.Description | RenderEmoji $.Context}}</small>{{end}}</a>
-					{{end}}
-				{{else}}
-					<div class="header" style="text-transform: none;font-size:14px;">{{.locale.Tr "repo.issues.new.no_items"}}</div>
-				{{end}}
-			</div>
-		</div>
+		{{template "repo/issue/labels/labels_selector_field" .}}
 		{{template "repo/issue/labels/labels_sidebar" dict "root" $}}
 
 		<div class="ui divider"></div>

From a8e13e64da7f9dc6176365e6b9295981af5d81ea Mon Sep 17 00:00:00 2001
From: Brecht Van Lommel <brecht@blender.org>
Date: Mon, 13 Mar 2023 01:46:13 +0100
Subject: [PATCH 52/53] Scoped label display and documentation tweaks (#23430)

* Fix scoped label left and right part breaking across lines.
* Remove slanted divider in scoped label display, make it straight.
After using this for a while, this feels more visually noisy than
helpful.
* Reduce contrast between scope and item to reduce probability of
unreadable text on background.
* Change documentation to remove mention of non-exclusive scoped labels.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 docs/content/doc/usage/labels.en-us.md |  8 +++-----
 modules/templates/helper.go            |  4 +---
 web_src/less/_repository.less          | 15 ++-------------
 3 files changed, 6 insertions(+), 21 deletions(-)

diff --git a/docs/content/doc/usage/labels.en-us.md b/docs/content/doc/usage/labels.en-us.md
index bf07c074edc68..8e5ff1cf8d9f1 100644
--- a/docs/content/doc/usage/labels.en-us.md
+++ b/docs/content/doc/usage/labels.en-us.md
@@ -23,17 +23,15 @@ For repositories, labels can be created by going to `Issues` and clicking on `La
 
 For organizations, you can define organization-wide labels that are shared with all organization repositories, including both already-existing repositories as well as newly created ones. Organization-wide labels can be created in the organization `Settings`.
 
-Labels have a mandatory name, a mandatory color, an optional description, and must either be exclusive or not (see `Scoped labels` below).
+Labels have a mandatory name, a mandatory color, an optional description, and must either be exclusive or not (see `Scoped Labels` below).
 
 When you create a repository, you can ensure certain labels exist by using the `Issue Labels` option. This option lists a number of available label sets that are [configured globally on your instance](../customizing-gitea/#labels). Its contained labels will all be created as well while creating the repository.
 
 ## Scoped Labels
 
-A scoped label is a label that contains `/` in its name (not at either end of the name). For example labels `kind/bug` and `kind/enhancement` both have scope `kind`. Such labels will display the scope with slightly darker color.
+Scoped labels are used to ensure at most a single label with the same scope is assigned to an issue or pull request. For example, if labels `kind/bug` and `kind/enhancement` have the Exclusive option set, an issue can only be classified as a bug or an enhancement.
 
-The scope of a label is determined based on the **last** `/`, so for example the scope of label `scope/subscope/item` is `scope/subscope`.
-
-Scoped labels can be marked as exclusive. This ensures at most a single label with the same scope is assigned to an issue or pull request. For example, if `kind/bug` and `kind/enhancement` are marked exclusive, an issue can only be classified as a bug or an enhancement.
+A scoped label must contain `/` in its name (not at either end of the name). The scope of a label is determined based on the **last** `/`, so for example the scope of label `scope/subscope/item` is `scope/subscope`.
 
 ## Filtering by Label
 
diff --git a/modules/templates/helper.go b/modules/templates/helper.go
index 19893c7c9d4de..822bbbd9b17c4 100644
--- a/modules/templates/helper.go
+++ b/modules/templates/helper.go
@@ -834,7 +834,7 @@ func RenderLabel(ctx context.Context, label *issues_model.Label) string {
 		// Make scope and item background colors slightly darker and lighter respectively.
 		// More contrast needed with higher luminance, empirically tweaked.
 		luminance := (0.299*r + 0.587*g + 0.114*b) / 255
-		contrast := 0.01 + luminance*0.06
+		contrast := 0.01 + luminance*0.03
 		// Ensure we add the same amount of contrast also near 0 and 1.
 		darken := contrast + math.Max(luminance+contrast-1.0, 0.0)
 		lighten := contrast + math.Max(contrast-luminance, 0.0)
@@ -859,12 +859,10 @@ func RenderLabel(ctx context.Context, label *issues_model.Label) string {
 
 	return fmt.Sprintf("<span class='ui label scope-parent' title='%s'>"+
 		"<div class='ui label scope-left' style='color: %s !important; background-color: %s !important'>%s</div>"+
-		"<div class='ui label scope-middle' style='background: linear-gradient(-80deg, %s 48%%, %s 52%% 0%%);'>&nbsp;</div>"+
 		"<div class='ui label scope-right' style='color: %s !important; background-color: %s !important''>%s</div>"+
 		"</span>",
 		description,
 		textColor, scopeColor, scopeText,
-		itemColor, scopeColor,
 		textColor, itemColor, itemText)
 }
 
diff --git a/web_src/less/_repository.less b/web_src/less/_repository.less
index 2c47135a2452b..0069a31cecb40 100644
--- a/web_src/less/_repository.less
+++ b/web_src/less/_repository.less
@@ -2838,11 +2838,11 @@
 
 .labels-list .label {
   margin: 2px 0;
-  display: inline-block !important;
+  display: inline-flex !important;
   line-height: 1.3em; // there is a `font-size: 1.25em` for inside emoji, so here the line-height needs to be larger slightly
 }
 
-// Scoped labels with different colors on left and right, and slanted divider in the middle
+// Scoped labels with different colors on left and right
 .scope-parent {
   background: none !important;
   padding: 0 !important;
@@ -2851,23 +2851,12 @@
 .ui.label.scope-left {
   border-bottom-right-radius: 0;
   border-top-right-radius: 0;
-  padding-right: 0;
-  margin-right: 0;
-}
-
-.ui.label.scope-middle {
-  width: 12px;
-  border-radius: 0;
-  padding-left: 0;
-  padding-right: 0;
-  margin-left: 0;
   margin-right: 0;
 }
 
 .ui.label.scope-right {
   border-bottom-left-radius: 0;
   border-top-left-radius: 0;
-  padding-left: 0;
   margin-left: 0;
 }
 

From f521e88240a2d5dd41ee42d78b96fc89309f1790 Mon Sep 17 00:00:00 2001
From: Hester Gong <hestergong@gmail.com>
Date: Mon, 13 Mar 2023 13:31:06 +0800
Subject: [PATCH 53/53] Fix actions frontend bugs (pagination, long name
 alignment) and small simplify (#23370)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1 Right now on actions page, the action list will not be aligned if
commit message is long. In this PR, the changes are:
- The branch tag is moved to bottom row
- Width percentage is given to make them aligned
- Show "..." if commit is longer than two lines.
- Align the status icon with the commit message with baseline

 Before:
<img width="1068" alt="截屏2023-03-08 12 23 22"
src="https://user-images.githubusercontent.com/17645053/223628534-6b9472cb-29f5-40a3-9714-c5152553049e.png">

 After:
<img width="756" alt="截屏2023-03-08 13 34 28"
src="https://user-images.githubusercontent.com/17645053/223628571-da94698b-0e0a-43e3-ae82-34d8c780e5ba.png">


2 Right now the actions list's pagination is not working properly
because Param is not passed to pagination template, in this PR Param
Strings are passed to the pager

Before:
<img width="1176" alt="截屏2023-03-08 12 23 50"
src="https://user-images.githubusercontent.com/17645053/223629207-8b67ce74-2342-4259-bc81-036e37752716.png">

After:
<img width="1343" alt="截屏2023-03-08 13 11 54"
src="https://user-images.githubusercontent.com/17645053/223629321-4f538f8a-45dc-4d6f-ae60-2c82680ae3e7.png">

3 A small simplify in `RepoActionView.vue` .

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
---
 routers/web/repo/actions/actions.go      |  2 ++
 templates/repo/actions/runs_list.tmpl    | 14 +++++++-------
 web_src/js/components/RepoActionView.vue |  3 +--
 web_src/less/helpers.less                |  1 +
 web_src/less/shared/issuelist.less       | 16 ++++++++++++++++
 5 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/routers/web/repo/actions/actions.go b/routers/web/repo/actions/actions.go
index e5496676a9dd3..0e7a95ed073aa 100644
--- a/routers/web/repo/actions/actions.go
+++ b/routers/web/repo/actions/actions.go
@@ -133,6 +133,8 @@ func List(ctx *context.Context) {
 
 	pager := context.NewPagination(int(total), opts.PageSize, opts.Page, 5)
 	pager.SetDefaultParams(ctx)
+	pager.AddParamString("workflow", workflow)
+	pager.AddParamString("state", ctx.FormString("state"))
 	ctx.Data["Page"] = pager
 
 	ctx.HTML(http.StatusOK, tplListActions)
diff --git a/templates/repo/actions/runs_list.tmpl b/templates/repo/actions/runs_list.tmpl
index ffabe534c8bb4..a28b9d71378b5 100644
--- a/templates/repo/actions/runs_list.tmpl
+++ b/templates/repo/actions/runs_list.tmpl
@@ -1,14 +1,18 @@
 <div class="issue list">
 	{{range .Runs}}
-		<li class="item gt-df gt-py-3">
+		<li class="item gt-df gt-py-3 gt-ab">
 			<div class="issue-item-left gt-df">
 				{{template "repo/actions/status" .Status}}
 			</div>
-			<div class="issue-item-main gt-f1 gt-fc gt-df">
+			<div class="issue-item-main action-item-main gt-f1 gt-fc gt-df gt-mr-3">
 				<div class="issue-item-top-row">
-					<a class="index gt-ml-0 gt-mr-2" href="{{if .Link}}{{.Link}}{{else}}{{$.Link}}/{{.Index}}{{end}}">
+					<a class="index gt-ml-0 gt-mr-2" title="{{.Title}}" href="{{if .Link}}{{.Link}}{{else}}{{$.Link}}/{{.Index}}{{end}}">
 						{{- .Title -}}
 					</a>
+				</div>
+				<div class="desc issue-item-bottom-row gt-df gt-ac gt-fw gt-my-1">
+					<b>{{if not $.CurWorkflow}}{{.WorkflowID}} {{end}}#{{.Index}}</b>: {{$.locale.Tr "actions.runs.commit"}}
+					<a href="{{$.RepoLink}}/commit/{{.CommitSHA}}">{{ShortSha .CommitSHA}}</a>{{$.locale.Tr "actions.runs.pushed_by"}} {{.TriggerUser.GetDisplayName}}
 					<span class="ui label">
 						{{if .RefLink}}
 							<a href="{{.RefLink}}">{{.PrettyRef}}</a>
@@ -17,10 +21,6 @@
 						{{end}}
 					</span>
 				</div>
-				<div class="desc issue-item-bottom-row gt-df gt-ac gt-fw gt-my-1">
-					<b>{{if not $.CurWorkflow}}{{.WorkflowID}} {{end}}#{{.Index}}</b>: {{$.locale.Tr "actions.runs.commit"}}
-					<a href="{{$.RepoLink}}/commit/{{.CommitSHA}}">{{ShortSha .CommitSHA}}</a>&nbsp; {{$.locale.Tr "actions.runs.pushed_by"}} {{.TriggerUser.GetDisplayName | Escape}}
-				</div>
 			</div>
 			<div class="issue-item-right">
 				<div>{{TimeSinceUnix .Updated $.locale}}</div>
diff --git a/web_src/js/components/RepoActionView.vue b/web_src/js/components/RepoActionView.vue
index aadc8369b75e6..bf84186c1ae2d 100644
--- a/web_src/js/components/RepoActionView.vue
+++ b/web_src/js/components/RepoActionView.vue
@@ -43,8 +43,7 @@
         <div class="job-step-container">
           <div class="job-step-section" v-for="(jobStep, i) in currentJob.steps" :key="i">
             <div class="job-step-summary" @click.stop="toggleStepLogs(i)">
-              <SvgIcon name="octicon-chevron-down" class="gt-mr-3" v-show="currentJobStepsStates[i].expanded"/>
-              <SvgIcon name="octicon-chevron-right" class="gt-mr-3" v-show="!currentJobStepsStates[i].expanded"/>
+              <SvgIcon :name="currentJobStepsStates[i].expanded ? 'octicon-chevron-down': 'octicon-chevron-right'" class="gt-mr-3"/>
 
               <ActionRunStatus :status="jobStep.status" class="gt-mr-3"/>
 
diff --git a/web_src/less/helpers.less b/web_src/less/helpers.less
index 08589fdaab9ff..91ea2268e28c7 100644
--- a/web_src/less/helpers.less
+++ b/web_src/less/helpers.less
@@ -3,6 +3,7 @@
 .gt-dif { display: inline-flex !important; }
 .gt-dib { display: inline-block !important; }
 .gt-ac { align-items: center !important; }
+.gt-ab { align-items: baseline !important; }
 .gt-tc { text-align: center !important; }
 .gt-tl { text-align: left !important; }
 .gt-tdn { text-decoration: none !important; }
diff --git a/web_src/less/shared/issuelist.less b/web_src/less/shared/issuelist.less
index 8d4cfc46d491c..9f69d6bb3a4c5 100644
--- a/web_src/less/shared/issuelist.less
+++ b/web_src/less/shared/issuelist.less
@@ -23,6 +23,14 @@
     .issue-item-main {
       width: 100%;
     }
+    
+    .action-item-main {
+      width: 80%;
+    }
+
+    .issue-item-right {
+      width: 15%;
+    }
 
     .issue-item-top-row {
       max-width: 100%;
@@ -30,6 +38,14 @@
       font-size: 16px;
       min-width: 0;
       font-weight: 600;
+      a.index {
+        max-width: fit-content;
+        display: -webkit-box;
+        -webkit-box-orient: vertical;
+        -webkit-line-clamp: 2;
+        overflow: hidden;
+        word-break:break-all;
+      }
     }
 
     .labels-list {