Automatically connect source code repository to package on upload operation

routers/api/packages/alpine/alpine.go

@@ -133,7 +133,7 @@ func UploadPackageFile(ctx *context.Context) {
 		return
 	}
 
-	_, _, err = packages_service.CreatePackageOrAddFileToExisting(
+	pv, _, err := packages_service.CreatePackageOrAddFileToExisting(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -178,6 +178,20 @@ func UploadPackageFile(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, ""); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }
 

routers/api/packages/cargo/cargo.go

@@ -259,6 +259,20 @@ func UploadPackage(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, cp.Metadata.RepositoryURL); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.JSON(http.StatusOK, StatusResponse{OK: true})
 }
 

routers/api/packages/chef/chef.go

@@ -285,7 +285,7 @@ func UploadPackage(ctx *context.Context) {
 		return
 	}
 
-	_, _, err = packages_service.CreatePackageAndAddFile(
+	pv, _, err := packages_service.CreatePackageAndAddFile(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -319,6 +319,20 @@ func UploadPackage(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, pck.Metadata.RepositoryURL); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.JSON(http.StatusCreated, make(map[any]any))
 }
 

routers/api/packages/composer/composer.go

@@ -219,7 +219,7 @@ func UploadPackage(ctx *context.Context) {
 		cp.Version = v.String()
 	}
 
-	_, _, err = packages_service.CreatePackageAndAddFile(
+	pv, _, err := packages_service.CreatePackageAndAddFile(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -256,5 +256,19 @@ func UploadPackage(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, ""); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }

routers/api/packages/conan/conan.go

@@ -5,6 +5,7 @@ package conan
 
 import (
 	std_ctx "context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -21,6 +22,7 @@ import (
 	packages_module "code.gitea.io/gitea/modules/packages"
 	conan_module "code.gitea.io/gitea/modules/packages/conan"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers/api/packages/helper"
 	notify_service "code.gitea.io/gitea/services/notify"
 	packages_service "code.gitea.io/gitea/services/packages"
@@ -359,6 +361,8 @@ func uploadFile(ctx *context.Context, fileFilter container.Set[string], fileKey
 		pfci.Properties[conan_module.PropertyPackageRevision] = pref.RevisionOrDefault()
 	}
 
+	var repo string
+
 	if isConanfileFile || isConaninfoFile {
 		if isConanfileFile {
 			metadata, err := conan_module.ParseConanfile(buf)
@@ -367,6 +371,9 @@ func uploadFile(ctx *context.Context, fileFilter container.Set[string], fileKey
 				apiError(ctx, http.StatusInternalServerError, err)
 				return
 			}
+
+			repo = metadata.RepositoryURL
+
 			pv, err := packages_model.GetVersionByNameAndVersion(ctx, pci.Owner.ID, pci.PackageType, pci.Name, pci.Version)
 			if err != nil && err != packages_model.ErrPackageNotExist {
 				apiError(ctx, http.StatusInternalServerError, err)
@@ -407,7 +414,7 @@ func uploadFile(ctx *context.Context, fileFilter container.Set[string], fileKey
 		}
 	}
 
-	_, _, err = packages_service.CreatePackageOrAddFileToExisting(
+	pv, _, err := packages_service.CreatePackageOrAddFileToExisting(
 		ctx,
 		pci,
 		pfci,
@@ -424,6 +431,20 @@ func uploadFile(ctx *context.Context, fileFilter container.Set[string], fileKey
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, repo); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }
 

routers/api/packages/conda/conda.go

@@ -228,7 +228,7 @@ func UploadPackageFile(ctx *context.Context) {
 		return
 	}
 
-	_, _, err = packages_service.CreatePackageOrAddFileToExisting(
+	pv, _, err := packages_service.CreatePackageOrAddFileToExisting(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -271,6 +271,20 @@ func UploadPackageFile(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, pck.VersionMetadata.RepositoryURL); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }
 

routers/api/packages/container/manifest.go

@@ -14,6 +14,9 @@ import (
 	"code.gitea.io/gitea/models/db"
 	packages_model "code.gitea.io/gitea/models/packages"
 	container_model "code.gitea.io/gitea/models/packages/container"
+	access_model "code.gitea.io/gitea/models/perm/access"
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
@@ -289,6 +292,27 @@ func processImageManifestIndex(ctx context.Context, mci *manifestCreationInfo, b
 			return err
 		}
 
+		if metadata.RepositoryURL != "" {
+			repo, err := repo_model.GetRepositoryByURL(ctx, metadata.RepositoryURL)
+			if err != nil {
+				return err
+			}
+
+			perms, err := access_model.GetUserRepoPermission(ctx, repo, mci.Creator)
+			if err != nil {
+				return err
+			}
+
+			if !perms.CanWrite(unit.TypePackages) {
+				return util.NewPermissionDeniedErrorf("no permission to link package to repository: %s, or packages are disabled", repo.Name)
+			}
+
+			err = packages_model.SetRepositoryLink(ctx, pv.PackageID, repo.ID)
+			if err != nil {
+				return err
+			}
+		}
+
 		manifestDigest = digest
 
 		return nil

routers/api/packages/cran/cran.go

@@ -182,7 +182,7 @@ func uploadPackageFile(ctx *context.Context, compositeKey string, properties map
 		return
 	}
 
-	_, _, err = packages_service.CreatePackageOrAddFileToExisting(
+	pv, _, err := packages_service.CreatePackageOrAddFileToExisting(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -218,6 +218,20 @@ func uploadPackageFile(ctx *context.Context, compositeKey string, properties map
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, ""); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }
 

routers/api/packages/debian/debian.go

@@ -158,7 +158,7 @@ func UploadPackageFile(ctx *context.Context) {
 		return
 	}
 
-	_, _, err = packages_service.CreatePackageOrAddFileToExisting(
+	pv, _, err := packages_service.CreatePackageOrAddFileToExisting(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -203,6 +203,20 @@ func UploadPackageFile(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, ""); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }
 

routers/api/packages/generic/generic.go

@@ -13,6 +13,7 @@ import (
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
 	packages_module "code.gitea.io/gitea/modules/packages"
+	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers/api/packages/helper"
 	packages_service "code.gitea.io/gitea/services/packages"
 )
@@ -88,7 +89,7 @@ func UploadPackage(ctx *context.Context) {
 	}
 	defer buf.Close()
 
-	_, _, err = packages_service.CreatePackageOrAddFileToExisting(
+	pv, _, err := packages_service.CreatePackageOrAddFileToExisting(
 		ctx,
 		&packages_service.PackageCreationInfo{
 			PackageInfo: packages_service.PackageInfo{
@@ -120,6 +121,20 @@ func UploadPackage(ctx *context.Context) {
 		return
 	}
 
+	if err = helper.TryConnectRepository(ctx, pv.PackageID, ""); err != nil {
+		switch {
+		case errors.Is(err, util.ErrPermissionDenied):
+			apiError(ctx, http.StatusForbidden, err)
+		case errors.Is(err, util.ErrNotExist):
+			apiError(ctx, http.StatusNotFound, err)
+		case errors.Is(err, util.ErrInvalidArgument):
+			apiError(ctx, http.StatusBadRequest, err)
+		default:
+			apiError(ctx, http.StatusInternalServerError, err)
+		}
+		return
+	}
+
 	ctx.Status(http.StatusCreated)
 }