Release notes for 1.25.4 (#36385 )

--------- Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Thomas Beutlich <115483027+thbeu@users.noreply.github.com>
Fix markdown newline handling during IME composition (gitea#36421) (#36424 )
2026-02-03 18:10:36 +00:00 · 2026-01-22 00:57:25 +00:00 · 2026-01-21 16:56:39 -08:00 · 2026-01-21 16:23:00 -08:00 · 2026-01-20 23:36:45 +02:00 · 2026-01-18 01:42:35 +08:00
1228 changed files with 101814 additions and 99325 deletions
@@ -4,7 +4,7 @@ tmp_dir = ".air"
 [build]
 pre_cmd = ["killall -9 gitea 2>/dev/null || true"] # kill off potential zombie processes from previous runs
 cmd = "make --no-print-directory backend"
-entrypoint = ["./gitea"]
+bin = "gitea"
 delay = 2000
 include_ext = ["go", "tmpl"]
 include_file = ["main.go"]
@@ -13,7 +13,7 @@
    "ghcr.io/devcontainers/features/git-lfs:1.2.5": {},
    "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {},
    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.14"
+      "version": "3.13"
    },
    "ghcr.io/warrenbuckley/codespace-features/sqlite:1": {}
  },
@@ -74,9 +74,6 @@ cpu.out
 /VERSION
 /.air
 /.go-licenses
-/Dockerfile
-/Dockerfile.rootless
-/.venv

 # Files and folders that were previously generated
 /public/assets/img/webpack
@@ -8,4 +8,3 @@
 /vendor/** -text -eol linguist-vendored
 /web_src/js/vendor/** -text -eol linguist-vendored
 Dockerfile.* linguist-language=Dockerfile
-Makefile.* linguist-language=Makefile
@@ -1,10 +0,0 @@
-version: 2
-
-updates:
-  - package-ecosystem: github-actions
-    labels: [modifies/dependencies]
-    directory: /
-    schedule:
-      interval: daily
-    cooldown:
-      default-days: 5
@@ -46,11 +46,12 @@ modifies/internal:
          - ".gitpod.yml"
          - ".markdownlint.yaml"
          - ".spectral.yaml"
-          - "stylelint.config.*"
+          - "stylelint.config.js"
          - ".yamllint.yaml"
          - ".github/**"
          - ".gitea/**"
          - ".devcontainer/**"
+          - "build.go"
          - "build/**"
          - "contrib/**"

@@ -84,9 +85,9 @@ docs-update-needed:
 topic/code-linting:
  - changed-files:
      - any-glob-to-any-file:
+          - ".eslintrc.cjs"
          - ".golangci.yml"
          - ".markdownlint.yaml"
          - ".spectral.yaml"
          - ".yamllint.yaml"
-          - "eslint*.config.*"
-          - "stylelint.config.*"
+          - "stylelint.config.js"
@@ -9,10 +9,8 @@ jobs:
  cron-licenses:
    runs-on: ubuntu-latest
    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -20,7 +18,7 @@ jobs:
      - run: make generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@v0.0.3
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -9,11 +9,9 @@ jobs:
  crowdin-pull:
    runs-on: ubuntu-latest
    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@v6
-      - uses: crowdin/github-action@v2
+      - uses: actions/checkout@v4
+      - uses: crowdin/github-action@v1
        with:
          upload_sources: true
          upload_translations: false
@@ -29,7 +27,7 @@ jobs:
      - name: update locales
        run: ./build/update-locales.sh
      - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@v0.0.3
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
@@ -19,15 +19,11 @@ on:
        value: ${{ jobs.detect.outputs.swagger }}
      yaml:
        value: ${{ jobs.detect.outputs.yaml }}
-      json:
-        value: ${{ jobs.detect.outputs.json }}

 jobs:
  detect:
    runs-on: ubuntu-latest
    timeout-minutes: 3
-    permissions:
-      contents: read
    outputs:
      backend: ${{ steps.changes.outputs.backend }}
      frontend: ${{ steps.changes.outputs.frontend }}
@@ -37,9 +33,8 @@ jobs:
      docker: ${{ steps.changes.outputs.docker }}
      swagger: ${{ steps.changes.outputs.swagger }}
      yaml: ${{ steps.changes.outputs.yaml }}
-      json: ${{ steps.changes.outputs.json }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: changes
        with:
@@ -53,7 +48,7 @@ jobs:
              - "Makefile"
              - ".golangci.yml"
              - ".editorconfig"
-              - "options/locale/locale_en-US.json"
+              - "options/locale/locale_en-US.ini"

            frontend:
              - "*.js"
@@ -85,7 +80,6 @@ jobs:
              - "uv.lock"

            docker:
-              - ".github/workflows/pull-docker-dryrun.yml"
              - "Dockerfile"
              - "Dockerfile.rootless"
              - "docker/**"
@@ -104,6 +98,3 @@ jobs:
              - "**/*.yaml"
              - ".yamllint.yaml"
              - "pyproject.toml"
-
-            json:
-              - "**/*.json"
@@ -10,17 +10,13 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  lint-backend:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -34,18 +30,14 @@ jobs:
    if: needs.files-changed.outputs.templates == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv python install 3.14
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv python install 3.12
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-py
      - run: make deps-frontend
      - run: make lint-templates
@@ -54,44 +46,23 @@ jobs:
    if: needs.files-changed.outputs.yaml == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv python install 3.14
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv python install 3.12
      - run: make deps-py
      - run: make lint-yaml

-  lint-json:
-    if: needs.files-changed.outputs.json == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v5
-        with:
-          node-version: 24
-      - run: make deps-frontend
-      - run: make lint-json
-
  lint-swagger:
    if: needs.files-changed.outputs.swagger == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend
      - run: make lint-swagger

@@ -99,10 +70,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.templates == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -113,10 +82,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -132,10 +99,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -149,10 +114,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -164,16 +127,12 @@ jobs:
    if: needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
@@ -184,10 +143,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -218,16 +175,12 @@ jobs:
    if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend
      - run: make lint-md

@@ -235,10 +188,8 @@ jobs:
    if: needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -10,15 +10,11 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  test-pgsql:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      pgsql:
        image: postgres:14
@@ -42,7 +38,7 @@ jobs:
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -69,22 +65,20 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
      - run: make deps-backend
-      - run: GOEXPERIMENT='' make backend
+      - run: make backend
        env:
          TAGS: bindata gogit sqlite sqlite_unlock_notify
      - name: run migration tests
        run: make test-sqlite-migration
      - name: run tests
-        run: GOEXPERIMENT='' make test-sqlite
+        run: make test-sqlite
        timeout-minutes: 50
        env:
          TAGS: bindata gogit sqlite sqlite_unlock_notify
@@ -96,8 +90,6 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      elasticsearch:
        image: elasticsearch:7.5.0
@@ -132,7 +124,7 @@ jobs:
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -150,7 +142,7 @@ jobs:
          RACE_ENABLED: true
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
      - name: unit-tests-gogit
-        run: GOEXPERIMENT='' make unit-test-coverage test-check
+        run: make unit-test-coverage test-check
        env:
          TAGS: bindata gogit
          RACE_ENABLED: true
@@ -160,8 +152,6 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      mysql:
        # the bitnami mysql image has more options than the official one, it's easier to customize
@@ -187,7 +177,7 @@ jobs:
          - "587:587"
          - "993:993"
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -213,8 +203,6 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      mssql:
        image: mcr.microsoft.com/mssql/server:2019-latest
@@ -229,7 +217,7 @@ jobs:
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -10,29 +10,26 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

-  container:
-    if: needs.files-changed.outputs.docker == 'true'
+  regular:
+    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
-      - name: Build regular container image
-        uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@v5
        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: false
-      - name: Build rootless container image
-        uses: docker/build-push-action@v6
+          tags: gitea/gitea:linux-amd64
+
+  rootless:
+    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v5
        with:
-          context: .
          push: false
-          platforms: linux/amd64,linux/arm64,linux/riscv64
          file: Dockerfile.rootless
+          tags: gitea/gitea:linux-amd64
@@ -0,0 +1,35 @@
+name: e2e-tests
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    uses: ./.github/workflows/files-changed.yml
+
+  test-e2e:
+    # the "test-e2e" won't pass, and it seems that there is no useful test, so skip
+    # if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: false
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - run: make deps-frontend frontend deps-backend
+      - run: pnpm exec playwright install --with-deps
+      - run: make test-e2e-sqlite
+        timeout-minutes: 40
+        env:
+          USE_REPO_TEST_DIR: 1
@@ -15,6 +15,6 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@v5
        with:
          sync-labels: true
@@ -11,10 +11,8 @@ concurrency:
 jobs:
  nightly-binary:
    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -23,11 +21,9 @@ jobs:
          go-version-file: go.mod
          check-latest: true
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -52,7 +48,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -60,17 +56,19 @@ jobs:
      - name: upload binaries to s3
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
-
-  nightly-container:
+  nightly-docker-rootful:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - name: Get cleaned branch name
@@ -78,29 +76,6 @@ jobs:
        run: |
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@v5
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          tags: |
-            type=raw,value=${{ steps.clean_name.outputs.branch }}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v5
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            suffix=-rootless
-          tags: |
-            type=raw,value=${{ steps.clean_name.outputs.branch }}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@@ -112,20 +87,57 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular docker image
-        uses: docker/build-push-action@v6
+      - name: fetch go modules
+        run: make vendor
+      - name: build rootful docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
+          tags: |-
+            gitea/gitea:${{ steps.clean_name.outputs.branch }}
+            ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}
+  nightly-docker-rootless:
+    runs-on: namespace-profile-gitea-release-docker
+    permissions:
+      packages: write # to publish to ghcr.io
+    steps:
+      - uses: actions/checkout@v4
+      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
+      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
+      - run: git fetch --unshallow --quiet --tags --force
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Get cleaned branch name
+        id: clean_name
+        run: |
+          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR using PAT
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: fetch go modules
+        run: make vendor
      - name: build rootless docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v5
        with:
          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
+          platforms: linux/amd64,linux/arm64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
+          tags: |-
+            gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
+            ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
@@ -12,10 +12,8 @@ concurrency:
 jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -24,11 +22,9 @@ jobs:
          go-version-file: go.mod
          check-latest: true
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -53,7 +49,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -62,7 +58,7 @@ jobs:
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@v0.1.0
        with:
          gh-cli-version: 2.39.1
      - name: create github release
@@ -70,14 +66,12 @@ jobs:
          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --draft --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-
-  container:
+  docker-rootful:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -94,23 +88,6 @@ jobs:
          # 1.2.3-rc0
          tags: |
            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v5
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            latest=false
-            suffix=-rootless
-          # 1.2.3-rc0
-          tags: |
-            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@@ -122,20 +99,55 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@v6
+      - name: build rootful docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@v6
+          labels: ${{ steps.meta.outputs.labels }}
+  docker-rootless:
+    runs-on: namespace-profile-gitea-release-docker
+    permissions:
+      packages: write # to publish to ghcr.io
+    steps:
+      - uses: actions/checkout@v4
+      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
+      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
+      - run: git fetch --unshallow --quiet --tags --force
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: |-
+            gitea/gitea
+            ghcr.io/go-gitea/gitea
+          # each tag below will have the suffix of -rootless
+          flavor: |
+            latest=false
+            suffix=-rootless
+          # 1.2.3-rc0
+          tags: |
+            type=semver,pattern={{version}}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR using PAT
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: build rootless docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
@@ -15,10 +15,9 @@ jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -27,11 +26,9 @@ jobs:
          go-version-file: go.mod
          check-latest: true
      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -56,7 +53,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -65,7 +62,7 @@ jobs:
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@v0.1.0
        with:
          gh-cli-version: 2.39.1
      - name: create github release
@@ -73,14 +70,12 @@ jobs:
          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-
-  container:
+  docker-rootful:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -101,10 +96,36 @@ jobs:
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR using PAT
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: build rootful docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+  docker-rootless:
+    runs-on: namespace-profile-gitea-release-docker
+    steps:
+      - uses: actions/checkout@v4
+      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
+      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
+      - run: git fetch --unshallow --quiet --tags --force
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
      - uses: docker/metadata-action@v5
-        id: meta_rootless
+        id: meta
        with:
          images: |-
            gitea/gitea
@@ -121,8 +142,6 @@ jobs:
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
@@ -134,20 +153,12 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@v6
+      - name: build rootless docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
@@ -25,9 +25,6 @@ __debug_bin*
 # Visual Studio
 /.vs/

-# mise version managment tool
-mise.toml
-
 *.cgo1.go
 *.cgo2.c
 _cgo_defun.c
@@ -125,8 +122,3 @@ prime/
 /CLAUDE.md
 /llms.txt

-# Ignore worktrees when working on multiple branches
-.worktrees/
-
-# A Makefile for custom make targets
-Makefile.local
@@ -6,17 +6,14 @@ linters:
  default: none
  enable:
    - bidichk
-    - bodyclose
    - depguard
    - dupl
    - errcheck
    - forbidigo
-    - gocheckcompilerdirectives
    - gocritic
    - govet
    - ineffassign
    - mirror
-    - modernize
    - nakedret
    - nolintlint
    - perfsprint
@@ -48,10 +45,6 @@ linters:
              desc: do not use the ini package, use gitea's config system instead
            - pkg: gitea.com/go-chi/cache
              desc: do not use the go-chi cache package, use gitea's cache system
-            - pkg: github.com/pkg/errors
-              desc: use builtin errors package instead
-            - pkg: github.com/go-ap/errors
-              desc: use builtin errors package instead
    nolintlint:
      allow-unused: false
      require-explanation: true
@@ -62,7 +55,6 @@ linters:
      disabled-checks:
        - ifElseChain
        - singleCaseSwitch # Every time this occurred in the code, there was no other way.
-        - deprecatedComment # conflicts with go-swagger comments
    revive:
      severity: error
      rules:
@@ -115,12 +107,6 @@ linters:
        - require-error
    usetesting:
      os-temp-dir: true
-    perfsprint:
-      concat-loop: false
-    govet:
-      enable:
-        - nilness
-        - unusedwrite
  exclusions:
    generated: lax
    presets:
@@ -167,7 +153,6 @@ linters:
        text: '(?i)exitAfterDefer:'
    paths:
      - node_modules
-      - .venv
      - public
      - web_src
      - third_party$
@@ -187,7 +172,6 @@ formatters:
    generated: lax
    paths:
      - node_modules
-      - .venv
      - public
      - web_src
      - third_party$
@@ -1,10 +0,0 @@
-# Instructions for agents
-
- Use `make help` to find available development targets
- Use the latest Golang stable release when working on Go code
- Use the latest Node.js LTS release when working on TypeScript code
- Before committing `.go` changes, run `make fmt` to format, and run `make lint-go` to lint
- Before committing `.ts` changes, run `make lint-js` to lint
- Before committing `go.mod` changes, run `make tidy`
- Before committing new `.go` files, add the current year into the copyright header
- Before committing any files, remove all trailing whitespace from source code lines
@@ -4,7 +4,7 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.25.4](https://github.com/go-gitea/gitea/releases/tag/v1.25.4) - 2026-01-15
+## [1.25.4](https://github.com/go-gitea/gitea/releases/tag/1.25.4) - 2026-01-15

 * SECURITY
  * Release attachments must belong to the intended repo (#36347) (#36375)
@@ -20,8 +20,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Add more routes to the "expensive" list (#36290)
  * Make "commit statuses" API accept slashes in "ref" (#36264) (#36275)
 * BUGFIXES
-  * Fix git http service handling (#36396)
-  * Fix markdown newline handling during IME composition (#36421) (#36424)
+  * Fix markdown newline handling during IME composition (#36421) #36424
  * Fix missing repository id when migrating release attachments (#36389)
  * Fix bug when compare in the pull request (#36363) (#36372)
  * Fix incorrect text content detection (#36364) (#36369)
@@ -36,7 +35,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix regression in writing authorized principals (#36213) (#36218)
  * Fix WebAuthn error checking (#36219) (#36235)

-## [1.25.3](https://github.com/go-gitea/gitea/releases/tag/v1.25.3) - 2025-12-17
+## [1.25.3](https://github.com/go-gitea/gitea/releases/tag/1.25.3) - 2025-12-17

 * SECURITY
  * Bump toolchain to go1.25.5, misc fixes (#36082)
@@ -63,7 +62,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix error handling in mailer and wiki services (#36041) (#36053)
  * Fix bugs when comparing and creating pull request (#36166) (#36144)

-## [1.25.2](https://github.com/go-gitea/gitea/releases/tag/v1.25.2) - 2025-11-23
+## [1.25.2](https://github.com/go-gitea/gitea/releases/tag/1.25.2) - 2025-11-23

 * SECURITY
  * Upgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
@@ -80,7 +80,7 @@ The more detailed and specific you are, the faster we can fix the issue. \
 It is really helpful if you can reproduce your problem on a site running on the latest commits, i.e. <https://demo.gitea.com>, as perhaps your problem has already been fixed on a current version. \
 Please follow the guidelines described in [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html) for your report.

-Please be kind—remember that Gitea comes at no cost to you, and you're getting free help.
+Please be kind, remember that Gitea comes at no cost to you, and you're getting free help.

 ### Types of issues

@@ -166,19 +166,19 @@ Here's how to run the test suite:

 - code lint

-|                       |                                                                              |
-| :-------------------- | :--------------------------------------------------------------------------- |
+|                       |                                                                   |
+| :-------------------- | :---------------------------------------------------------------- |
 |``make lint``          | lint everything (not needed if you only change the front- **or** backend)    |
-|``make lint-frontend`` | lint frontend files                                                          |
-|``make lint-backend``  | lint backend files                                                           |
+|``make lint-frontend`` | lint frontend files  |
+|``make lint-backend``  | lint backend files   |

 - run tests (we suggest running them on Linux)

-|  Command                                    | Action                                                   |                                             |
-| :------------------------------------------ | :------------------------------------------------------- | ------------------------------------------- |
-|``make test[\#SpecificTestName]``            |  run unit test(s)                                        |                                             |
-|``make test-sqlite[\#SpecificTestName]``     |  run [integration](tests/integration) test(s) for SQLite | [More details](tests/integration/README.md) |
-|``make test-e2e-sqlite[\#SpecificTestName]`` |  run [end-to-end](tests/e2e) test(s) for SQLite          | [More details](tests/e2e/README.md)         |
+|  Command                               | Action                                           |              |
+| :------------------------------------- | :----------------------------------------------- | ------------ |
+|``make test[\#SpecificTestName]``       |  run unit test(s)  | |
+|``make test-sqlite[\#SpecificTestName]``|  run [integration](tests/integration) test(s) for SQLite |[More details](tests/integration/README.md)  |
+|``make test-e2e-sqlite[\#SpecificTestName]``|  run [end-to-end](tests/e2e) test(s) for SQLite |[More details](tests/e2e/README.md)  |

 ## Translation

@@ -1,8 +1,8 @@
-# syntax=docker/dockerfile:1
 # Build stage
-FROM docker.io/library/golang:1.25-alpine3.23 AS build-env
+FROM docker.io/library/golang:1.25-alpine3.22 AS build-env

-ARG GOPROXY=direct
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-direct}

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
@@ -14,32 +14,35 @@ RUN apk --no-cache add \
    build-base \
    git \
    nodejs \
-    pnpm
+    npm \
+    && npm install -g pnpm@10 \
+    && rm -rf /var/cache/apk/*

+# Setup repo
+COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
-# Use COPY but not "mount" because some directories like "node_modules" contain platform-depended contents and these directories need to be ignored.
-# ".git" directory will be mounted later separately for getting version data.
-# TODO: in the future, maybe we can pre-build the frontend assets on one platform and share them for different platforms, the benefit is that it won't be affected by webpack plugin compatibility problems, then the working directory can be fully mounted and the COPY is not needed.
-COPY --exclude=.git/ . .

-# Build gitea, .git mount is required for version data
-RUN --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=cache,target=/root/.local/share/pnpm/store \
-    --mount=type=bind,source=".git/",target=".git/" \
-    make
+# Checkout version if set
+RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+ && make clean-all build

+# Begin env-to-ini build
+RUN go build contrib/environment-to-ini/environment-to-ini.go
+
+# Copy local files
 COPY docker/root /tmp/local

-# Set permissions for builds that made under windows which strips the executable bit from file
+# Set permissions
 RUN chmod 755 /tmp/local/usr/bin/entrypoint \
-              /tmp/local/usr/local/bin/* \
+              /tmp/local/usr/local/bin/gitea \
              /tmp/local/etc/s6/gitea/* \
              /tmp/local/etc/s6/openssh/* \
              /tmp/local/etc/s6/.s6-svscan/* \
-              /go/src/code.gitea.io/gitea/gitea
+              /go/src/code.gitea.io/gitea/gitea \
+              /go/src/code.gitea.io/gitea/environment-to-ini

-FROM docker.io/library/alpine:3.23 AS gitea
+FROM docker.io/library/alpine:3.22
+LABEL maintainer="maintainers@gitea.io"

 EXPOSE 22 3000

@@ -54,7 +57,8 @@ RUN apk --no-cache add \
    s6 \
    sqlite \
    su-exec \
-    gnupg
+    gnupg \
+    && rm -rf /var/cache/apk/*

 RUN addgroup \
    -S -g 1000 \
@@ -68,14 +72,14 @@ RUN addgroup \
    git && \
  echo "git:*" | chpasswd -e

-COPY --from=build-env /tmp/local /
-COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
-
 ENV USER=git
 ENV GITEA_CUSTOM=/data/gitea

 VOLUME ["/data"]

-# HINT: HEALTH-CHECK-ENDPOINT: don't use HEALTHCHECK, search this hint keyword for more information
 ENTRYPOINT ["/usr/bin/entrypoint"]
 CMD ["/usr/bin/s6-svscan", "/etc/s6"]
+
+COPY --from=build-env /tmp/local /
+COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
@@ -1,39 +1,46 @@
-# syntax=docker/dockerfile:1
 # Build stage
-FROM docker.io/library/golang:1.25-alpine3.23 AS build-env
+FROM docker.io/library/golang:1.25-alpine3.22 AS build-env

-ARG GOPROXY=direct
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-direct}

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

-# Build deps
+#Build deps
 RUN apk --no-cache add \
    build-base \
    git \
    nodejs \
-    pnpm
+    npm \
+    && npm install -g pnpm@10 \
+    && rm -rf /var/cache/apk/*

+# Setup repo
+COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
-# See the comments in Dockerfile
-COPY --exclude=.git/ . .

-# Build gitea, .git mount is required for version data
-RUN --mount=type=cache,target=/go/pkg/mod \
-    --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=cache,target=/root/.local/share/pnpm/store \
-    --mount=type=bind,source=".git/",target=".git/" \
-    make
+# Checkout version if set
+RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+ && make clean-all build

+# Begin env-to-ini build
+RUN go build contrib/environment-to-ini/environment-to-ini.go
+
+# Copy local files
 COPY docker/rootless /tmp/local

-# Set permissions for builds that made under windows which strips the executable bit from file
-RUN chmod 755 /tmp/local/usr/local/bin/* \
-              /go/src/code.gitea.io/gitea/gitea
+# Set permissions
+RUN chmod 755 /tmp/local/usr/local/bin/docker-entrypoint.sh \
+              /tmp/local/usr/local/bin/docker-setup.sh \
+              /tmp/local/usr/local/bin/gitea \
+              /go/src/code.gitea.io/gitea/gitea \
+              /go/src/code.gitea.io/gitea/environment-to-ini

-FROM docker.io/library/alpine:3.23 AS gitea-rootless
+FROM docker.io/library/alpine:3.22
+LABEL maintainer="maintainers@gitea.io"

 EXPOSE 2222 3000

@@ -45,7 +52,8 @@ RUN apk --no-cache add \
    git \
    curl \
    gnupg \
-    openssh-keygen
+    openssh-keygen \
+    && rm -rf /var/cache/apk/*

 RUN addgroup \
    -S -g 1000 \
@@ -63,6 +71,7 @@ RUN chown git:git /var/lib/gitea /etc/gitea

 COPY --from=build-env /tmp/local /
 COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini

 # git:git
 USER 1000:1000
@@ -77,6 +86,5 @@ ENV HOME="/var/lib/gitea/git"
 VOLUME ["/var/lib/gitea", "/etc/gitea"]
 WORKDIR /var/lib/gitea

-# HINT: HEALTH-CHECK-ENDPOINT: don't use HEALTHCHECK, search this hint keyword for more information
 ENTRYPOINT ["/usr/bin/dumb-init", "--", "/usr/local/bin/docker-entrypoint.sh"]
 CMD []
@@ -18,10 +18,6 @@ DIST := dist
 DIST_DIRS := $(DIST)/binaries $(DIST)/release
 IMPORT := code.gitea.io/gitea

-# By default use go's 1.25 experimental json v2 library when building
-# TODO: remove when no longer experimental
-export GOEXPERIMENT ?= jsonv2
-
 GO ?= go
 SHASUM ?= shasum -a 256
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
@@ -31,15 +27,17 @@ XGO_VERSION := go-1.25.x

 AIR_PACKAGE ?= github.com/air-verse/air@v1
 EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3
-GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.9.2
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0
+GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.9.1
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.7.0
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@717e3cb29becaaf00e56953556c6d80f8a01b286
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
 GO_LICENSES_PACKAGE ?= github.com/google/go-licenses@v1
 GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.10
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.8
+GOPLS_PACKAGE ?= golang.org/x/tools/gopls@v0.20.0
+GOPLS_MODERNIZE_PACKAGE ?= golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@v0.20.0

 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
@@ -100,7 +98,7 @@ GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)

 # Enable typescript support in Node.js before 22.18
 # TODO: Remove this once we can raise the minimum Node.js version to 22.18 (alpine >= 3.23)
-NODE_VERSION := $(shell printf "%03d%03d%03d" $(shell node -v 2>/dev/null | cut -c2- | sed 's/-.*//' | tr '.' ' '))
+NODE_VERSION := $(shell printf "%03d%03d%03d" $(shell node -v 2>/dev/null | cut -c2- | tr '.' ' '))
 ifeq ($(shell test "$(NODE_VERSION)" -lt "022018000"; echo $$?),0)
 	NODE_VARS := NODE_OPTIONS="--experimental-strip-types"
 else
@@ -161,13 +159,13 @@ TEST_TAGS ?= $(TAGS_SPLIT) sqlite sqlite_unlock_notify

 TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR) $(GO_LICENSE_TMP_DIR)

-GO_DIRS := build cmd models modules routers services tests tools
+GO_DIRS := build cmd models modules routers services tests
 WEB_DIRS := web_src/js web_src/css

 ESLINT_FILES := web_src/js tools *.ts tests/e2e
 STYLELINT_FILES := web_src/css web_src/js/components/*.vue
-SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(filter-out CHANGELOG.md, $(wildcard *.go *.md *.yml *.yaml *.toml))
-EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.json
+SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.ini .github $(filter-out CHANGELOG.md, $(wildcard *.go *.md *.yml *.yaml *.toml)) $(filter-out tools/misspellings.csv, $(wildcard tools/*))
+EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.ini

 GO_SOURCES := $(wildcard *.go)
 GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go")
@@ -197,10 +195,6 @@ TEST_MSSQL_DBNAME ?= gitea
 TEST_MSSQL_USERNAME ?= sa
 TEST_MSSQL_PASSWORD ?= MwantsaSecurePassword1

-# Include local Makefile
-# Makefile.local is listed in .gitignore
-sinclude Makefile.local
-
 .PHONY: all
 all: build

@@ -211,6 +205,16 @@ help: Makefile ## print Makefile help information.
 	@printf "  \033[36m%-46s\033[0m %s\n" "test[#TestSpecificName]" "run unit test"
 	@printf "  \033[36m%-46s\033[0m %s\n" "test-sqlite[#TestSpecificName]" "run integration test for sqlite"

+.PHONY: go-check
+go-check:
+	$(eval MIN_GO_VERSION_STR := $(shell grep -Eo '^go\s+[0-9]+\.[0-9]+' go.mod | cut -d' ' -f2))
+	$(eval MIN_GO_VERSION := $(shell printf "%03d%03d" $(shell echo '$(MIN_GO_VERSION_STR)' | tr '.' ' ')))
+	$(eval GO_VERSION := $(shell printf "%03d%03d" $(shell $(GO) version | grep -Eo '[0-9]+\.[0-9]+' | tr '.' ' ');))
+	@if [ "$(GO_VERSION)" -lt "$(MIN_GO_VERSION)" ]; then \
+		echo "Gitea requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
+		exit 1; \
+	fi
+
 .PHONY: git-check
 git-check:
 	@if git lfs >/dev/null 2>&1 ; then : ; else \
@@ -218,6 +222,20 @@ git-check:
 		exit 1; \
 	fi

+.PHONY: node-check
+node-check:
+	$(eval MIN_NODE_VERSION_STR := $(shell grep -Eo '"node":.*[0-9.]+"' package.json | sed -n 's/.*[^0-9.]\([0-9.]*\)"/\1/p'))
+	$(eval MIN_NODE_VERSION := $(shell printf "%03d%03d%03d" $(shell echo '$(MIN_NODE_VERSION_STR)' | tr '.' ' ')))
+	$(eval PNPM_MISSING := $(shell hash pnpm > /dev/null 2>&1 || echo 1))
+	@if [ "$(NODE_VERSION)" -lt "$(MIN_NODE_VERSION)" ]; then \
+		echo "Gitea requires Node.js $(MIN_NODE_VERSION_STR) or greater to build. You can get it at https://nodejs.org/en/download/"; \
+		exit 1; \
+	fi
+	@if [ "$(PNPM_MISSING)" = "1" ]; then \
+		echo "Gitea requires pnpm to build. You can install it at https://pnpm.io/installation"; \
+		exit 1; \
+	fi
+
 .PHONY: clean-all
 clean-all: clean ## delete backend, frontend and integration files
 	rm -rf $(WEBPACK_DEST_ENTRIES) node_modules
@@ -236,7 +254,7 @@ clean: ## delete backend and integration files

 .PHONY: fmt
 fmt: ## format the Go and template code
-	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run tools/code-batch-process.go gitea-fmt -w '{file-list}'
+	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run build/code-batch-process.go gitea-fmt -w '{file-list}'
 	$(eval TEMPLATES := $(shell find templates -type f -name '*.tmpl'))
 	@# strip whitespace after '{{' or '(' and before '}}' or ')' unless there is only
 	@# whitespace before it
@@ -254,6 +272,19 @@ fmt-check: fmt
 	  exit 1; \
 	fi

+.PHONY: fix
+fix: ## apply automated fixes to Go code
+	$(GO) run $(GOPLS_MODERNIZE_PACKAGE) -fix ./...
+
+.PHONY: fix-check
+fix-check: fix
+	@diff=$$(git diff --color=always $(GO_SOURCES)); \
+	if [ -n "$$diff" ]; then \
+	  echo "Please run 'make fix' and commit the result:"; \
+	  printf "%s" "$${diff}"; \
+	  exit 1; \
+	fi
+
 .PHONY: $(TAGS_EVIDENCE)
 $(TAGS_EVIDENCE):
 	@mkdir -p $(MAKE_EVIDENCE_DIR)
@@ -293,7 +324,7 @@ checks: checks-frontend checks-backend ## run various consistency checks
 checks-frontend: lockfile-check svg-check ## check frontend files

 .PHONY: checks-backend
-checks-backend: tidy-check swagger-check fmt-check swagger-validate security-check ## check backend files
+checks-backend: tidy-check swagger-check fmt-check fix-check swagger-validate security-check ## check backend files

 .PHONY: lint
 lint: lint-frontend lint-backend lint-spell ## lint everything
@@ -308,19 +339,19 @@ lint-frontend: lint-js lint-css ## lint frontend files
 lint-frontend-fix: lint-js-fix lint-css-fix ## lint frontend files and fix issues

 .PHONY: lint-backend
-lint-backend: lint-go lint-go-gitea-vet lint-editorconfig ## lint backend files
+lint-backend: lint-go lint-go-gitea-vet lint-go-gopls lint-editorconfig ## lint backend files

 .PHONY: lint-backend-fix
 lint-backend-fix: lint-go-fix lint-go-gitea-vet lint-editorconfig ## lint backend files and fix issues

 .PHONY: lint-js
-lint-js: node_modules ## lint js and ts files
-	$(NODE_VARS) pnpm exec eslint --color --max-warnings=0 $(ESLINT_FILES)
+lint-js: node_modules ## lint js files
+	$(NODE_VARS) pnpm exec eslint --color --max-warnings=0 --flag unstable_native_nodejs_ts_config $(ESLINT_FILES)
 	$(NODE_VARS) pnpm exec vue-tsc

 .PHONY: lint-js-fix
-lint-js-fix: node_modules ## lint js and ts files and fix issues
-	$(NODE_VARS) pnpm exec eslint --color --max-warnings=0 $(ESLINT_FILES) --fix
+lint-js-fix: node_modules ## lint js files and fix issues
+	$(NODE_VARS) pnpm exec eslint --color --max-warnings=0 --flag unstable_native_nodejs_ts_config $(ESLINT_FILES) --fix
 	$(NODE_VARS) pnpm exec vue-tsc

 .PHONY: lint-css
@@ -339,17 +370,13 @@ lint-swagger: node_modules ## lint swagger files
 lint-md: node_modules ## lint markdown files
 	$(NODE_VARS) pnpm exec markdownlint *.md

-.PHONY: lint-md-fix
-lint-md-fix: node_modules ## lint markdown files and fix issues
-	$(NODE_VARS) pnpm exec markdownlint --fix *.md
-
 .PHONY: lint-spell
 lint-spell: ## lint spelling
-	@go run $(MISSPELL_PACKAGE) -dict assets/misspellings.csv -error $(SPELLCHECK_FILES)
+	@go run $(MISSPELL_PACKAGE) -dict tools/misspellings.csv -error $(SPELLCHECK_FILES)

 .PHONY: lint-spell-fix
 lint-spell-fix: ## lint spelling and fix issues
-	@go run $(MISSPELL_PACKAGE) -dict assets/misspellings.csv -w $(SPELLCHECK_FILES)
+	@go run $(MISSPELL_PACKAGE) -dict tools/misspellings.csv -w $(SPELLCHECK_FILES)

 .PHONY: lint-go
 lint-go: ## lint go files
@@ -369,7 +396,13 @@ lint-go-windows:
 .PHONY: lint-go-gitea-vet
 lint-go-gitea-vet: ## lint go files with gitea-vet
 	@echo "Running gitea-vet..."
-	@$(GO) vet -vettool="$(shell GOOS= GOARCH= go tool -n gitea-vet)" ./...
+	@GOOS= GOARCH= $(GO) build code.gitea.io/gitea-vet
+	@$(GO) vet -vettool=gitea-vet ./...
+
+.PHONY: lint-go-gopls
+lint-go-gopls: ## lint go files with gopls
+	@echo "Running gopls check..."
+	@GO=$(GO) GOPLS_PACKAGE=$(GOPLS_PACKAGE) tools/lint-go-gopls.sh $(GO_SOURCES)

 .PHONY: lint-editorconfig
 lint-editorconfig:
@@ -389,25 +422,17 @@ lint-templates: .venv node_modules ## lint template files
 lint-yaml: .venv ## lint yaml files
 	@uv run --frozen yamllint -s .

-.PHONY: lint-json
-lint-json: node_modules ## lint json files
-	$(NODE_VARS) pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0
-
-.PHONY: lint-json-fix
-lint-json-fix: node_modules ## lint and fix json files
-	$(NODE_VARS) pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --fix
-
 .PHONY: watch
 watch: ## watch everything and continuously rebuild
 	@bash tools/watch.sh

 .PHONY: watch-frontend
-watch-frontend: node_modules ## watch frontend files and continuously rebuild
+watch-frontend: node-check node_modules ## watch frontend files and continuously rebuild
 	@rm -rf $(WEBPACK_DEST_ENTRIES)
 	NODE_ENV=development $(NODE_VARS) pnpm exec webpack --watch --progress --disable-interpret

 .PHONY: watch-backend
-watch-backend: ## watch backend files and continuously rebuild
+watch-backend: go-check ## watch backend files and continuously rebuild
 	GITEA_RUN_MODE=dev $(GO) run $(AIR_PACKAGE) -c .air.toml

 .PHONY: test
@@ -443,7 +468,7 @@ test\#%:
 coverage:
 	grep '^\(mode: .*\)\|\(.*:[0-9]\+\.[0-9]\+,[0-9]\+\.[0-9]\+ [0-9]\+ [0-9]\+\)$$' coverage.out > coverage-bodged.out
 	grep '^\(mode: .*\)\|\(.*:[0-9]\+\.[0-9]\+,[0-9]\+\.[0-9]\+ [0-9]\+ [0-9]\+\)$$' integration.coverage.out > integration.coverage-bodged.out
-	$(GO) run tools/gocovmerge.go integration.coverage-bodged.out coverage-bodged.out > coverage.all
+	$(GO) run build/gocovmerge.go integration.coverage-bodged.out coverage-bodged.out > coverage.all

 .PHONY: unit-test-coverage
 unit-test-coverage:
@@ -487,11 +512,11 @@ generate-ini-sqlite:

 .PHONY: test-sqlite
 test-sqlite: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.sqlite.test

 .PHONY: test-sqlite\#%
 test-sqlite\#%: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.run $(subst .,/,$*)

 .PHONY: test-sqlite-migration
 test-sqlite-migration:  migrations.sqlite.test migrations.individual.sqlite.test
@@ -508,11 +533,11 @@ generate-ini-mysql:

 .PHONY: test-mysql
 test-mysql: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.mysql.test

 .PHONY: test-mysql\#%
 test-mysql\#%: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.mysql.test -test.run $(subst .,/,$*)

 .PHONY: test-mysql-migration
 test-mysql-migration: migrations.mysql.test migrations.individual.mysql.test
@@ -531,11 +556,11 @@ generate-ini-pgsql:

 .PHONY: test-pgsql
 test-pgsql: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./integrations.pgsql.test

 .PHONY: test-pgsql\#%
 test-pgsql\#%: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.run $(subst .,/,$*)

 .PHONY: test-pgsql-migration
 test-pgsql-migration: migrations.pgsql.test migrations.individual.pgsql.test
@@ -552,11 +577,11 @@ generate-ini-mssql:

 .PHONY: test-mssql
 test-mssql: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./integrations.mssql.test

 .PHONY: test-mssql\#%
 test-mssql\#%: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./integrations.mssql.test -test.run $(subst .,/,$*)

 .PHONY: test-mssql-migration
 test-mssql-migration: migrations.mssql.test migrations.individual.mssql.test
@@ -575,59 +600,59 @@ test-e2e: test-e2e-sqlite

 .PHONY: test-e2e-sqlite
 test-e2e-sqlite: playwright e2e.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./e2e.sqlite.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./e2e.sqlite.test

 .PHONY: test-e2e-sqlite\#%
 test-e2e-sqlite\#%: playwright e2e.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./e2e.sqlite.test -test.run TestE2e/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./e2e.sqlite.test -test.run TestE2e/$*

 .PHONY: test-e2e-mysql
 test-e2e-mysql: playwright e2e.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./e2e.mysql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./e2e.mysql.test

 .PHONY: test-e2e-mysql\#%
 test-e2e-mysql\#%: playwright e2e.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./e2e.mysql.test -test.run TestE2e/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./e2e.mysql.test -test.run TestE2e/$*

 .PHONY: test-e2e-pgsql
 test-e2e-pgsql: playwright e2e.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./e2e.pgsql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./e2e.pgsql.test

 .PHONY: test-e2e-pgsql\#%
 test-e2e-pgsql\#%: playwright e2e.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./e2e.pgsql.test -test.run TestE2e/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./e2e.pgsql.test -test.run TestE2e/$*

 .PHONY: test-e2e-mssql
 test-e2e-mssql: playwright e2e.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./e2e.mssql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./e2e.mssql.test

 .PHONY: test-e2e-mssql\#%
 test-e2e-mssql\#%: playwright e2e.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./e2e.mssql.test -test.run TestE2e/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./e2e.mssql.test -test.run TestE2e/$*

 .PHONY: bench-sqlite
 bench-sqlite: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: bench-mysql
 bench-mysql: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.mysql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: bench-mssql
 bench-mssql: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./integrations.mssql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: bench-pgsql
 bench-pgsql: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: integration-test-coverage
 integration-test-coverage: integrations.cover.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.cover.test -test.coverprofile=integration.coverage.out
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.cover.test -test.coverprofile=integration.coverage.out

 .PHONY: integration-test-coverage-sqlite
 integration-test-coverage-sqlite: integrations.cover.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.cover.sqlite.test -test.coverprofile=integration.coverage.out
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.cover.sqlite.test -test.coverprofile=integration.coverage.out

 integrations.mysql.test: git-check $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.mysql.test
@@ -650,54 +675,54 @@ integrations.cover.sqlite.test: git-check $(GO_SOURCES)
 .PHONY: migrations.mysql.test
 migrations.mysql.test: $(GO_SOURCES) generate-ini-mysql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mysql.test
-	GITEA_TEST_CONF=tests/mysql.ini ./migrations.mysql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./migrations.mysql.test

 .PHONY: migrations.pgsql.test
 migrations.pgsql.test: $(GO_SOURCES) generate-ini-pgsql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.pgsql.test
-	GITEA_TEST_CONF=tests/pgsql.ini ./migrations.pgsql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./migrations.pgsql.test

 .PHONY: migrations.mssql.test
 migrations.mssql.test: $(GO_SOURCES) generate-ini-mssql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mssql.test
-	GITEA_TEST_CONF=tests/mssql.ini ./migrations.mssql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./migrations.mssql.test

 .PHONY: migrations.sqlite.test
 migrations.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.sqlite.test -tags '$(TEST_TAGS)'
-	GITEA_TEST_CONF=tests/sqlite.ini ./migrations.sqlite.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./migrations.sqlite.test

 .PHONY: migrations.individual.mysql.test
 migrations.individual.mysql.test: $(GO_SOURCES)
-	GITEA_TEST_CONF=tests/mysql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.sqlite.test\#%
 migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 .PHONY: migrations.individual.pgsql.test
 migrations.individual.pgsql.test: $(GO_SOURCES)
-	GITEA_TEST_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.pgsql.test\#%
 migrations.individual.pgsql.test\#%: $(GO_SOURCES) generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 .PHONY: migrations.individual.mssql.test
 migrations.individual.mssql.test: $(GO_SOURCES) generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.mssql.test\#%
 migrations.individual.mssql.test\#%: $(GO_SOURCES) generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 .PHONY: migrations.individual.sqlite.test
 migrations.individual.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.sqlite.test\#%
 migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 e2e.mysql.test: $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.mysql.test
@@ -725,7 +750,7 @@ build: frontend backend ## build everything
 frontend: $(WEBPACK_DEST) ## build frontend files

 .PHONY: backend
-backend: generate-backend $(EXECUTABLE) ## build backend files
+backend: go-check generate-backend $(EXECUTABLE) ## build backend files

 # We generate the backend before the frontend in case we in future we want to generate things in the frontend from generated files in backend
 .PHONY: generate
@@ -741,11 +766,11 @@ generate-go: $(TAGS_PREREQ)

 .PHONY: security-check
 security-check:
-	GOEXPERIMENT= go run $(GOVULNCHECK_PACKAGE) -show color ./...
+	go run $(GOVULNCHECK_PACKAGE) -show color ./...

 $(EXECUTABLE): $(GO_SOURCES) $(TAGS_PREREQ)
 ifneq ($(and $(STATIC),$(findstring pam,$(TAGS))),)
-  $(error pam support set via TAGS does not support static builds)
+  $(error pam support set via TAGS doesn't support static builds)
 endif
 	CGO_ENABLED="$(CGO_ENABLED)" CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@

@@ -822,6 +847,8 @@ deps-tools: ## install tool dependencies
 	$(GO) install $(GO_LICENSES_PACKAGE) & \
 	$(GO) install $(GOVULNCHECK_PACKAGE) & \
 	$(GO) install $(ACTIONLINT_PACKAGE) & \
+	$(GO) install $(GOPLS_PACKAGE) & \
+	$(GO) install $(GOPLS_MODERNIZE_PACKAGE) & \
 	wait

 node_modules: pnpm-lock.yaml
@@ -836,7 +863,7 @@ node_modules: pnpm-lock.yaml
 update: update-js update-py ## update js and py dependencies

 .PHONY: update-js
-update-js: node_modules ## update js dependencies
+update-js: node-check | node_modules ## update js dependencies
 	$(NODE_VARS) pnpm exec updates -u -f package.json
 	rm -rf node_modules pnpm-lock.yaml
 	$(NODE_VARS) pnpm install
@@ -845,7 +872,7 @@ update-js: node_modules ## update js dependencies
 	@touch node_modules

 .PHONY: update-py
-update-py: node_modules ## update py dependencies
+update-py: node-check | node_modules ## update py dependencies
 	$(NODE_VARS) pnpm exec updates -u -f pyproject.toml
 	rm -rf .venv uv.lock
 	uv sync
@@ -855,14 +882,14 @@ update-py: node_modules ## update py dependencies
 webpack: $(WEBPACK_DEST) ## build webpack files

 $(WEBPACK_DEST): $(WEBPACK_SOURCES) $(WEBPACK_CONFIGS) pnpm-lock.yaml
-	@$(MAKE) -s node_modules
+	@$(MAKE) -s node-check node_modules
 	@rm -rf $(WEBPACK_DEST_ENTRIES)
 	@echo "Running webpack..."
 	@BROWSERSLIST_IGNORE_OLD_DATA=true $(NODE_VARS) pnpm exec webpack --disable-interpret
 	@touch $(WEBPACK_DEST)

 .PHONY: svg
-svg: node_modules ## build svg files
+svg: node-check | node_modules ## build svg files
 	rm -rf $(SVG_DEST_DIR)
 	node tools/generate-svg.ts

@@ -887,6 +914,16 @@ lockfile-check:
 		exit 1; \
 	fi

+.PHONY: update-translations
+update-translations:
+	mkdir -p ./translations
+	cd ./translations && curl -L https://crowdin.com/download/project/gitea.zip > gitea.zip && unzip gitea.zip
+	rm ./translations/gitea.zip
+	$(SED_INPLACE) -e 's/="/=/g' -e 's/"$$//g' ./translations/*.ini
+	$(SED_INPLACE) -e 's/\\"/"/g' ./translations/*.ini
+	mv ./translations/*.ini ./options/locale/
+	rmdir ./translations
+
 .PHONY: generate-gitignore
 generate-gitignore: ## update gitignore files
 	$(GO) run build/generate-gitignores.go
@@ -46,7 +46,7 @@
 `build` 目标分为两个子目标：

 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定义。
- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本以及 [pnpm](https://pnpm.io/installation)。
+- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本。

 需要互联网连接来下载 go 和 npm 模块。从包含预构建前端文件的官方源代码压缩包构建时，不会触发 `frontend` 目标，因此可以在没有 Node.js 的情况下构建。

@@ -46,7 +46,7 @@
 `build` 目標分為兩個子目標：

 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定義。
- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本以及 [pnpm](https://pnpm.io/installation)。
+- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本。

 需要互聯網連接來下載 go 和 npm 模塊。從包含預構建前端文件的官方源代碼壓縮包構建時，不會觸發 `frontend` 目標，因此可以在沒有 Node.js 的情況下構建。

@@ -409,6 +409,16 @@
    "path": "github.com/dimiro1/reply/LICENSE",
    "licenseText": "MIT License\n\nCopyright (c) Discourse\nCopyright (c) Claudemiro\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
  },
+  {
+    "name": "github.com/djherbis/buffer",
+    "path": "github.com/djherbis/buffer/LICENSE.txt",
+    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2015 Dustin H\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n"
+  },
+  {
+    "name": "github.com/djherbis/nio/v3",
+    "path": "github.com/djherbis/nio/v3/LICENSE.txt",
+    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2015 Dustin H\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n"
+  },
  {
    "name": "github.com/dlclark/regexp2",
    "path": "github.com/dlclark/regexp2/LICENSE",
@@ -0,0 +1,14 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build vendor
+
+package main
+
+// Libraries that are included to vendor utilities used during Makefile build.
+// These libraries will not be included in a normal compilation.
+
+import (
+	// for vet
+	_ "code.gitea.io/gitea-vet"
+)
@@ -12,11 +12,10 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"

-	"code.gitea.io/gitea/tools/codeformat"
+	"code.gitea.io/gitea/build/codeformat"
 )

 // Windows has a limitation for command line arguments, the size can not exceed 32KB.
@@ -218,6 +217,15 @@ func newFileCollectorFromMainOptions(mainOptions map[string]string) (fc *fileCol
 	return newFileCollector(fileFilter, batchSize)
 }

+func containsString(a []string, s string) bool {
+	for _, v := range a {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}
+
 func giteaFormatGoImports(files []string, doWriteFile bool) error {
 	for _, file := range files {
 		if err := codeformat.FormatGoImports(file, doWriteFile); err != nil {
@@ -256,10 +264,10 @@ func main() {
 		logVerbose("batch cmd: %s %v", subCmd, substArgs)
 		switch subCmd {
 		case "gitea-fmt":
-			if slices.Contains(subArgs, "-d") {
+			if containsString(subArgs, "-d") {
 				log.Print("the -d option is not supported by gitea-fmt")
 			}
-			cmdErrors = append(cmdErrors, giteaFormatGoImports(files, slices.Contains(subArgs, "-w")))
+			cmdErrors = append(cmdErrors, giteaFormatGoImports(files, containsString(subArgs, "-w")))
 			cmdErrors = append(cmdErrors, passThroughCmd("gofmt", append([]string{"-w", "-r", "interface{} -> any"}, substArgs...)))
 			cmdErrors = append(cmdErrors, passThroughCmd("go", append([]string{"run", os.Getenv("GOFUMPT_PACKAGE"), "-extra"}, substArgs...)))
 		default:
@@ -1,22 +1,52 @@
 #!/bin/sh

 # this script runs in alpine image which only has `sh` shell
-if [ ! -f ./options/locale/locale_en-US.json ]; then
+
+set +e
+if sed --version 2>/dev/null | grep -q GNU; then
+  SED_INPLACE="sed -i"
+else
+  SED_INPLACE="sed -i ''"
+fi
+set -e
+
+if [ ! -f ./options/locale/locale_en-US.ini ]; then
  echo "please run this script in the root directory of the project"
  exit 1
 fi

-mv ./options/locale/locale_en-US.json ./options/
+mv ./options/locale/locale_en-US.ini ./options/
+
+# the "ini" library for locale has many quirks, its behavior is different from Crowdin.
+# see i18n_test.go for more details
+
+# this script helps to unquote the Crowdin outputs for the quirky ini library
+# * find all `key="...\"..."` lines
+# * remove the leading quote
+# * remove the trailing quote
+# * unescape the quotes
+# * eg: key="...\"..." => key=..."...
+$SED_INPLACE -r -e '/^[-.A-Za-z0-9_]+[ ]*=[ ]*".*"$/ {
+	s/^([-.A-Za-z0-9_]+)[ ]*=[ ]*"/\1=/
+	s/"$//
+	s/\\"/"/g
+	}' ./options/locale/*.ini
+
+# * if the escaped line is incomplete like `key="...` or `key=..."`, quote it with backticks
+# * eg: key="... => key=`"...`
+# * eg: key=..." => key=`..."`
+$SED_INPLACE -r -e 's/^([-.A-Za-z0-9_]+)[ ]*=[ ]*(".*[^"])$/\1=`\2`/' ./options/locale/*.ini
+$SED_INPLACE -r -e 's/^([-.A-Za-z0-9_]+)[ ]*=[ ]*([^"].*")$/\1=`\2`/' ./options/locale/*.ini

 # Remove translation under 25% of en_us
-baselines=$(cat "./options/locale_en-US.json" | wc -l)
+baselines=$(wc -l "./options/locale_en-US.ini" | cut -d" " -f1)
 baselines=$((baselines / 4))
-for filename in ./options/locale/*.json; do
-  lines=$(cat "$filename" | wc -l)
-  if [ "$lines" -lt "$baselines" ]; then
+for filename in ./options/locale/*.ini; do
+  lines=$(wc -l "$filename" | cut -d" " -f1)
+  if [ $lines -lt $baselines ]; then
    echo "Removing $filename: $lines/$baselines"
    rm "$filename"
  fi
 done

-mv ./options/locale_en-US.json ./options/locale/
+mv ./options/locale_en-US.ini ./options/locale/
@@ -121,7 +121,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 		}
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
-			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RelativePath())
+			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RepoPath())
 			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
@@ -147,7 +147,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 				continue
 			}

-			log.Trace("repo %s releases synchronized to tags: from %d to %d",
+			log.Trace(" repo %s releases synchronized to tags: from %d to %d",
 				repo.FullName(), oldnum, count)
 			gitRepo.Close()
 		}
@@ -94,10 +94,6 @@ func commonLdapCLIFlags() []cli.Flag {
 			Name:  "public-ssh-key-attribute",
 			Usage: "The attribute of the user’s LDAP record containing the user’s public ssh key.",
 		},
-		&cli.BoolFlag{
-			Name:  "ssh-keys-are-verified",
-			Usage: "Set to true to automatically flag SSH keys in LDAP as verified.",
-		},
 		&cli.BoolFlag{
 			Name:  "skip-local-2fa",
 			Usage: "Set to true to skip local 2fa for users authenticated by this source",
@@ -298,9 +294,6 @@ func parseLdapConfig(c *cli.Command, config *ldap.Source) error {
 	if c.IsSet("public-ssh-key-attribute") {
 		config.AttributeSSHPublicKey = c.String("public-ssh-key-attribute")
 	}
-	if c.IsSet("ssh-keys-are-verified") {
-		config.SSHKeysAreVerified = c.Bool("ssh-keys-are-verified")
-	}
 	if c.IsSet("avatar-attribute") {
 		config.AttributeAvatar = c.String("avatar-attribute")
 	}
@@ -233,7 +233,7 @@ func TestAddLdapBindDn(t *testing.T) {
 			},
 			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
 				assert.FailNow(t, "getAuthSourceByID called", "case %d: should not call getAuthSourceByID", n)
-				return nil, nil //nolint:nilnil // mock function covering improper behavior
+				return nil, nil
 			},
 		}

@@ -463,7 +463,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 			},
 			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
 				assert.FailNow(t, "getAuthSourceById called", "case %d: should not call getAuthSourceByID", n)
-				return nil, nil //nolint:nilnil // mock function covering improper behavior
+				return nil, nil
 			},
 		}

@@ -151,7 +151,6 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 		if err != nil {
 			return err
 		}
-		// codeql[disable-next-line=go/clear-text-logging]
 		fmt.Printf("generated random password is '%s'\n", password)
 	} else if userType == user_model.UserTypeIndividual {
 		return errors.New("must set either password or random-password flag")
@@ -58,7 +58,6 @@ func runMustChangePassword(ctx context.Context, c *cli.Command) error {
 		return err
 	}

-	// codeql[disable-next-line=go/clear-text-logging]
 	fmt.Printf("Updated %d users setting MustChangePassword to %t\n", n, mustChangePassword)
 	return nil
 }
@@ -1,156 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-
-	"code.gitea.io/gitea/modules/setting"
-
-	"github.com/urfave/cli/v3"
-)
-
-func cmdConfig() *cli.Command {
-	subcmdConfigEditIni := &cli.Command{
-		Name:  "edit-ini",
-		Usage: "Load an existing INI file, apply environment variables, keep specified keys, and output to a new INI file.",
-		Description: `
-Help users to edit the Gitea configuration INI file.
-
-# Keep Specified Keys
-
-If you need to re-create the configuration file with only a subset of keys,
-you can provide an INI template file for the kept keys and use the "--config-keep-keys" flag.
-For example, if a helm chart needs to reset the settings and only keep SECRET_KEY,
-it can use a template file (only keys take effect, values are ignored):
-
-  [security]
-  SECRET_KEY=
-
-$ ./gitea config edit-ini --config app-old.ini --config-keep-keys app-keys.ini --out app-new.ini
-
-# Map Environment Variables to INI Configuration
-
-Environment variables of the form "GITEA__section_name__KEY_NAME"
-will be mapped to the ini section "[section_name]" and the key
-"KEY_NAME" with the value as provided.
-
-Environment variables of the form "GITEA__section_name__KEY_NAME__FILE"
-will be mapped to the ini section "[section_name]" and the key
-"KEY_NAME" with the value loaded from the specified file.
-
-Environment variable keys can only contain characters "0-9A-Z_",
-if a section or key name contains dot ".", it needs to be escaped as _0x2E_.
-For example, to apply this config:
-
-	[git.config]
-	foo.bar=val
-
-$ export GITEA__git_0x2E_config__foo_0x2E_bar=val
-
-# Put All Together
-
-$ ./gitea config edit-ini --config app.ini --config-keep-keys app-keys.ini --apply-env {--in-place|--out app-new.ini}
-`,
-		Flags: []cli.Flag{
-			// "--config" flag is provided by global flags, and this flag is also used by "environment-to-ini" script wrapper
-			// "--in-place" is also used by "environment-to-ini" script wrapper for its old behavior: always overwrite the existing config file
-			&cli.BoolFlag{
-				Name:  "in-place",
-				Usage: "Output to the same config file as input. This flag will be ignored if --out is set.",
-			},
-			&cli.StringFlag{
-				Name:  "config-keep-keys",
-				Usage: "An INI template file containing keys for keeping. Only the keys defined in the INI template will be kept from old config. If not set, all keys will be kept.",
-			},
-			&cli.BoolFlag{
-				Name:  "apply-env",
-				Usage: "Apply all GITEA__* variables from the environment to the config.",
-			},
-			&cli.StringFlag{
-				Name:  "out",
-				Usage: "Destination config file to write to.",
-			},
-		},
-		Action: runConfigEditIni,
-	}
-
-	return &cli.Command{
-		Name:  "config",
-		Usage: "Manage Gitea configuration",
-		Commands: []*cli.Command{
-			subcmdConfigEditIni,
-		},
-	}
-}
-
-func runConfigEditIni(_ context.Context, c *cli.Command) error {
-	// the config system may change the environment variables, so get a copy first, to be used later
-	env := append([]string{}, os.Environ()...)
-
-	// don't use the guessed setting.CustomConf, instead, require the user to provide --config explicitly
-	if !c.IsSet("config") {
-		return errors.New("flag is required but not set: --config")
-	}
-	configFileIn := c.String("config")
-
-	cfgIn, err := setting.NewConfigProviderFromFile(configFileIn)
-	if err != nil {
-		return fmt.Errorf("failed to load config file %q: %v", configFileIn, err)
-	}
-
-	// determine output config file: use "--out" flag or use "--in-place" flag to overwrite input file
-	inPlace := c.Bool("in-place")
-	configFileOut := c.String("out")
-	if configFileOut == "" {
-		if !inPlace {
-			return errors.New("either --in-place or --out must be specified")
-		}
-		configFileOut = configFileIn // in-place edit
-	}
-
-	needWriteOut := configFileOut != configFileIn
-
-	cfgOut := cfgIn
-	configKeepKeys := c.String("config-keep-keys")
-	if configKeepKeys != "" {
-		needWriteOut = true
-		cfgOut, err = setting.NewConfigProviderFromFile(configKeepKeys)
-		if err != nil {
-			return fmt.Errorf("failed to load config-keep-keys template file %q: %v", configKeepKeys, err)
-		}
-
-		for _, secOut := range cfgOut.Sections() {
-			for _, keyOut := range secOut.Keys() {
-				secIn := cfgIn.Section(secOut.Name())
-				keyIn := setting.ConfigSectionKey(secIn, keyOut.Name())
-				if keyIn != nil {
-					keyOut.SetValue(keyIn.String())
-				} else {
-					secOut.DeleteKey(keyOut.Name())
-				}
-			}
-			if len(secOut.Keys()) == 0 {
-				cfgOut.DeleteSection(secOut.Name())
-			}
-		}
-	}
-
-	if c.Bool("apply-env") {
-		if setting.EnvironmentToConfig(cfgOut, env) {
-			needWriteOut = true
-		}
-	}
-
-	if needWriteOut {
-		err = cfgOut.SaveTo(configFileOut)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
@@ -1,85 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestConfigEdit(t *testing.T) {
-	tmpDir := t.TempDir()
-	configOld := tmpDir + "/app-old.ini"
-	configTemplate := tmpDir + "/app-template.ini"
-	_ = os.WriteFile(configOld, []byte(`
-[sec]
-k1=v1
-k2=v2
-`), os.ModePerm)
-
-	_ = os.WriteFile(configTemplate, []byte(`
-[sec]
-k1=in-template
-
-[sec2]
-k3=v3
-`), os.ModePerm)
-
-	t.Setenv("GITEA__EnV__KeY", "val")
-
-	t.Run("OutputToNewWithEnv", func(t *testing.T) {
-		configNew := tmpDir + "/app-new.ini"
-		err := NewMainApp(AppVersion{}).Run(t.Context(), []string{
-			"./gitea", "--config", configOld,
-			"config", "edit-ini",
-			"--apply-env",
-			"--config-keep-keys", configTemplate,
-			"--out", configNew,
-		})
-		require.NoError(t, err)
-
-		// "k1" old value is kept because its key is in the template
-		// "k2" is removed because it isn't in the template
-		// "k3" isn't in new config because it isn't in the old config
-		// [env] is applied from environment variable
-		data, _ := os.ReadFile(configNew)
-		require.Equal(t, `[sec]
-k1 = v1
-
-[env]
-KeY = val
-`, string(data))
-	})
-
-	t.Run("OutputToExisting(environment-to-ini)", func(t *testing.T) {
-		// the legacy "environment-to-ini" (now a wrapper script) behavior:
-		// if no "--out", then "--in-place" must be used to overwrite the existing "--config" file
-		err := NewMainApp(AppVersion{}).Run(t.Context(), []string{
-			"./gitea", "config", "edit-ini",
-			"--apply-env",
-			"--config", configOld,
-		})
-		require.ErrorContains(t, err, "either --in-place or --out must be specified")
-
-		// simulate the "environment-to-ini" behavior with "--in-place"
-		err = NewMainApp(AppVersion{}).Run(t.Context(), []string{
-			"./gitea", "config", "edit-ini",
-			"--in-place",
-			"--apply-env",
-			"--config", configOld,
-		})
-		require.NoError(t, err)
-
-		data, _ := os.ReadFile(configOld)
-		require.Equal(t, `[sec]
-k1 = v1
-k2 = v2
-
-[env]
-KeY = val
-`, string(data))
-	})
-}
@@ -91,7 +91,6 @@ func runGenerateSecretKey(_ context.Context, c *cli.Command) error {
 		return err
 	}

-	// codeql[disable-next-line=go/clear-text-logging]
 	fmt.Printf("%s", secretKey)

 	if isatty.IsTerminal(os.Stdout.Fd()) {
@@ -194,7 +194,7 @@ Gitea or set your environment appropriately.`, "")
 	userID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	prID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPRID), 10, 64)
 	deployKeyID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvDeployKeyID), 10, 64)
-	actionPerm, _ := strconv.Atoi(os.Getenv(repo_module.EnvActionPerm))
+	actionPerm, _ := strconv.ParseInt(os.Getenv(repo_module.EnvActionPerm), 10, 64)

 	hookOptions := private.HookOptions{
 		UserID:                          userID,
@@ -204,7 +204,7 @@ Gitea or set your environment appropriately.`, "")
 		GitPushOptions:                  pushOptions(),
 		PullRequestID:                   prID,
 		DeployKeyID:                     deployKeyID,
-		ActionPerm:                      actionPerm,
+		ActionPerm:                      int(actionPerm),
 	}

 	scanner := bufio.NewScanner(os.Stdin)
@@ -318,7 +318,7 @@ func runHookPostReceive(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))

 	// First of all run update-server-info no matter what
-	if err := gitcmd.NewCommand("update-server-info").RunWithStderr(ctx); err != nil {
+	if _, _, err := gitcmd.NewCommand("update-server-info").RunStdString(ctx, nil); err != nil {
 		return fmt.Errorf("failed to call 'git update-server-info': %w", err)
 	}

@@ -596,8 +596,8 @@ Gitea or set your environment appropriately.`, "")
 	hookOptions.RefFullNames = make([]git.RefName, 0, hookBatchSize)

 	for {
-		// note: pktLineTypeUnknown means pktLineTypeFlush and pktLineTypeData all allowed
-		rs, err = readPktLine(ctx, reader, pktLineTypeUnknown)
+		// note: pktLineTypeUnknow means pktLineTypeFlush and pktLineTypeData all allowed
+		rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
 		if err != nil {
 			return err
 		}
@@ -616,7 +616,7 @@ Gitea or set your environment appropriately.`, "")

 	if hasPushOptions {
 		for {
-			rs, err = readPktLine(ctx, reader, pktLineTypeUnknown)
+			rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
 			if err != nil {
 				return err
 			}
@@ -713,8 +713,8 @@ Gitea or set your environment appropriately.`, "")
 type pktLineType int64

 const (
-	// Unknown type
-	pktLineTypeUnknown pktLineType = 0
+	// UnKnow type
+	pktLineTypeUnknow pktLineType = 0
 	// flush-pkt "0000"
 	pktLineTypeFlush pktLineType = iota
 	// data line
@@ -132,7 +132,6 @@ func NewMainApp(appVer AppVersion) *cli.Command {

 	// these sub-commands do not need the config file, and they do not depend on any path or environment variable.
 	subCmdStandalone := []*cli.Command{
-		cmdConfig(),
 		cmdCert(),
 		CmdGenerate,
 		CmdDocs,
@@ -149,7 +148,7 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 	app.Commands = append(app.Commands, subCmdWithConfig...)
 	app.Commands = append(app.Commands, subCmdStandalone...)

-	setting.UnsetUnnecessaryEnvVars()
+	setting.InitGiteaEnvVars()
 	return app
 }

@@ -157,7 +157,6 @@ func TestCliCmd(t *testing.T) {

 	for _, c := range cases {
 		t.Run(c.cmd, func(t *testing.T) {
-			defer test.MockVariableValue(&setting.InstallLock, false)()
 			app := newTestApp(cli.Command{
 				Action: func(ctx context.Context, cmd *cli.Command) error {
 					_, _ = fmt.Fprint(cmd.Root().Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
@@ -171,10 +170,7 @@ func TestCliCmd(t *testing.T) {
 			r, err := runTestApp(app, args...)
 			assert.NoError(t, err, c.cmd)
 			assert.NotEmpty(t, c.exp, c.cmd)
-			if !assert.Contains(t, r.Stdout, c.exp, c.cmd) {
-				t.Log("Full output:\n" + r.Stdout)
-				t.Log("Expected:\n" + c.exp)
-			}
+			assert.Contains(t, r.Stdout, c.exp, c.cmd)
 		})
 	}
 }
@@ -36,7 +36,7 @@ var CmdMigrateStorage = &cli.Command{
 			Name:    "type",
 			Aliases: []string{"t"},
 			Value:   "",
-			Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts'",
+			Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts",
 		},
 		&cli.StringFlag{
 			Name:    "storage",
@@ -8,13 +8,14 @@ import (
 	"fmt"
 	"net"
 	"net/http"
-	"net/http/pprof"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"time"

+	_ "net/http/pprof" // Used for debugging if enabled and a web server is running
+
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/gtprof"
@@ -22,7 +23,6 @@ import (
 	"code.gitea.io/gitea/modules/process"
 	"code.gitea.io/gitea/modules/public"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers"
 	"code.gitea.io/gitea/routers/install"
@@ -156,6 +156,7 @@ func serveInstall(cmd *cli.Command) error {
 	case <-graceful.GetManager().IsShutdown():
 		<-graceful.GetManager().Done()
 		log.Info("PID: %d Gitea Web Finished", os.Getpid())
+		log.GetManager().Close()
 		return err
 	default:
 	}
@@ -230,26 +231,27 @@ func serveInstalled(c *cli.Command) error {
 	err := listen(webRoutes, true)
 	<-graceful.GetManager().Done()
 	log.Info("PID: %d Gitea Web Finished", os.Getpid())
+	log.GetManager().Close()
 	return err
 }

 func servePprof() {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/debug/pprof/", pprof.Index)
-	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
-	mux.Handle("/debug/fgprof", fgprof.Handler())
-	// FIXME: it should use a proper context
+	// FIXME: it shouldn't use the global DefaultServeMux, and it should use a proper context
+	http.DefaultServeMux.Handle("/debug/fgprof", fgprof.Handler())
 	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
 	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
-	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux))
+	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", nil))
 	finished()
 }

 func runWeb(ctx context.Context, cmd *cli.Command) error {
+	defer func() {
+		if panicked := recover(); panicked != nil {
+			log.Fatal("PANIC: %v\n%s", panicked, log.Stack(2))
+		}
+	}()
+
 	if subCmdName, valid := isValidDefaultSubCommand(cmd); !valid {
 		return fmt.Errorf("unknown command: %s", subCmdName)
 	}
@@ -269,10 +271,6 @@ func runWeb(ctx context.Context, cmd *cli.Command) error {
 		createPIDFile(cmd.String("pid"))
 	}

-	// init the HTML renderer and load templates, if error happens, it will report the error immediately and exit with error log
-	// in dev mode, it won't exit, but watch the template files for changes
-	_ = templates.PageRenderer()
-
 	if !setting.InstallLock {
 		if err := serveInstall(cmd); err != nil {
 			return err
@@ -0,0 +1,47 @@
+Environment To Ini
+==================
+
+Multiple docker users have requested that the Gitea docker is changed
+to permit arbitrary configuration via environment variables.
+
+Gitea needs to use an ini file for configuration because the running
+environment that starts the docker may not be the same as that used
+by the hooks. An ini file also gives a good default and means that
+users do not have to completely provide a full environment.
+
+With those caveats above, this command provides a generic way of
+converting suitably structured environment variables into any ini
+value.
+
+To use the command is very simple just run it and the default gitea
+app.ini will be rewritten to take account of the variables provided,
+however there are various options to give slightly different
+behavior and these can be interrogated with the `-h` option.
+
+The environment variables should be of the form:
+
+	GITEA__SECTION_NAME__KEY_NAME
+
+Note, SECTION_NAME in the notation above is case-insensitive.
+
+Environment variables are usually restricted to a reduced character
+set "0-9A-Z_" - in order to allow the setting of sections with
+characters outside of that set, they should be escaped as following:
+"_0X2E_" for "." and "_0X2D_" for "-". The entire section and key names 
+can be escaped as a UTF8 byte string if necessary. E.g. to configure:
+
+	"""
+	...
+	[log.console]
+	COLORIZE=false
+	STDERR=true
+	...
+	"""
+
+You would set the environment variables: "GITEA__LOG_0x2E_CONSOLE__COLORIZE=false"
+and "GITEA__LOG_0x2E_CONSOLE__STDERR=false". Other examples can be found
+on the configuration cheat sheet.
+
+To build locally, run:
+
+	go build contrib/environment-to-ini/environment-to-ini.go
@@ -0,0 +1,112 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"context"
+	"os"
+
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
+
+	"github.com/urfave/cli/v3"
+)
+
+func main() {
+	app := cli.Command{}
+	app.Name = "environment-to-ini"
+	app.Usage = "Use provided environment to update configuration ini"
+	app.Description = `As a helper to allow docker users to update the gitea configuration
+	through the environment, this command allows environment variables to
+	be mapped to values in the ini.
+
+	Environment variables of the form "GITEA__SECTION_NAME__KEY_NAME"
+	will be mapped to the ini section "[section_name]" and the key
+	"KEY_NAME" with the value as provided.
+
+	Environment variables of the form "GITEA__SECTION_NAME__KEY_NAME__FILE"
+	will be mapped to the ini section "[section_name]" and the key
+	"KEY_NAME" with the value loaded from the specified file.
+
+	Environment variables are usually restricted to a reduced character
+	set "0-9A-Z_" - in order to allow the setting of sections with
+	characters outside of that set, they should be escaped as following:
+	"_0X2E_" for ".". The entire section and key names can be escaped as
+	a UTF8 byte string if necessary. E.g. to configure:
+
+		"""
+		...
+		[log.console]
+		COLORIZE=false
+		STDERR=true
+		...
+		"""
+
+	You would set the environment variables: "GITEA__LOG_0x2E_CONSOLE__COLORIZE=false"
+	and "GITEA__LOG_0x2E_CONSOLE__STDERR=false". Other examples can be found
+	on the configuration cheat sheet.`
+	app.Flags = []cli.Flag{
+		&cli.StringFlag{
+			Name:    "custom-path",
+			Aliases: []string{"C"},
+			Value:   setting.CustomPath,
+			Usage:   "Custom path file path",
+		},
+		&cli.StringFlag{
+			Name:    "config",
+			Aliases: []string{"c"},
+			Value:   setting.CustomConf,
+			Usage:   "Custom configuration file path",
+		},
+		&cli.StringFlag{
+			Name:    "work-path",
+			Aliases: []string{"w"},
+			Value:   setting.AppWorkPath,
+			Usage:   "Set the gitea working path",
+		},
+		&cli.StringFlag{
+			Name:    "out",
+			Aliases: []string{"o"},
+			Value:   "",
+			Usage:   "Destination file to write to",
+		},
+	}
+	app.Action = runEnvironmentToIni
+	err := app.Run(context.Background(), os.Args)
+	if err != nil {
+		log.Fatal("Failed to run app with %s: %v", os.Args, err)
+	}
+}
+
+func runEnvironmentToIni(_ context.Context, c *cli.Command) error {
+	// the config system may change the environment variables, so get a copy first, to be used later
+	env := append([]string{}, os.Environ()...)
+	setting.InitWorkPathAndCfgProvider(os.Getenv, setting.ArgWorkPathAndCustomConf{
+		WorkPath:   c.String("work-path"),
+		CustomPath: c.String("custom-path"),
+		CustomConf: c.String("config"),
+	})
+
+	cfg, err := setting.NewConfigProviderFromFile(setting.CustomConf)
+	if err != nil {
+		log.Fatal("Failed to load custom conf '%s': %v", setting.CustomConf, err)
+	}
+
+	changed := setting.EnvironmentToConfig(cfg, env)
+
+	// try to save the config file
+	destination := c.String("out")
+	if len(destination) == 0 {
+		destination = setting.CustomConf
+	}
+	if destination != setting.CustomConf || changed {
+		log.Info("Settings saved to: %q", destination)
+		err = cfg.SaveTo(destination)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
@@ -4,9 +4,9 @@ base_path: "."
 base_url: "https://api.crowdin.com"
 preserve_hierarchy: true
 files:
-  - source: "/options/locale/locale_en-US.json"
-    translation: "/options/locale/locale_%locale%.json"
-    type: "json"
+  - source: "/options/locale/locale_en-US.ini"
+    translation: "/options/locale/locale_%locale%.ini"
+    type: "ini"
    skip_untranslated_strings: true
    export_only_approved: true
    update_option: "update_as_unapproved"
@@ -503,6 +503,9 @@ INTERNAL_TOKEN =
 ;; Password Hash algorithm, either "argon2", "pbkdf2", "scrypt" or "bcrypt"
 ;PASSWORD_HASH_ALGO = pbkdf2
 ;;
+;; Set false to allow JavaScript to read CSRF cookie
+;CSRF_COOKIE_HTTP_ONLY = true
+;;
 ;; Validate against https://haveibeenpwned.com/Passwords to see if a password has been exposed
 ;PASSWORD_CHECK_PWN = false
 ;;
@@ -730,15 +733,15 @@ LEVEL = Info
 ;DISABLE_CORE_PROTECT_NTFS=false
 ;; Disable the usage of using partial clones for git.
 ;DISABLE_PARTIAL_CLONE = false
-;; Set the similarity threshold passed to git commands via `--find-renames=<threshold>`.
-;; Default is 50%, the same as git. Must be a integer percentage between 0% and 100%.
-;DIFF_RENAME_SIMILARITY_THRESHOLD = 50%

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Git Operation timeout in seconds
 ;[git.timeout]
+;DEFAULT = 360
 ;MIGRATE = 600
 ;MIRROR = 300
+;CLONE = 300
+;PULL = 300
 ;GC = 60

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1329,12 +1332,9 @@ LEVEL = Info
 ;; Leave it empty to allow users to select any theme from "{CustomPath}/public/assets/css/theme-*.css"
 ;THEMES =
 ;;
-;; The icon theme for files (basic/material)
+;; The icons for file list (basic/material), this is a temporary option which will be replaced by a user setting in the future.
 ;FILE_ICON_THEME = material
 ;;
-;; The icon theme for folders (basic/material)
-;FOLDER_ICON_THEME = basic
-;;
 ;; All available reactions users can choose on issues/prs and comments.
 ;; Values can be emoji alias (:smile:) or a unicode emoji.
 ;; For custom reactions, add a tightly cropped square image to public/assets/img/emoji/reaction_name.png
@@ -2334,7 +2334,7 @@ LEVEL = Info

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Resynchronize git hooks of all repositories (pre-receive, update, post-receive, proc-receive, ...)
+;; Resynchronize pre-receive, update and post-receive hooks of all repositories.
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[cron.resync_all_hooks]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2488,9 +2488,8 @@ LEVEL = Info
 ;[highlight.mapping]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Extension mapping to highlight class, for example:
-;; .toml = ini
-;; .my-js = JavaScript
+;; Extension mapping to highlight class
+;; e.g. .toml=ini

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1,2 +0,0 @@
-#!/bin/bash
-exec /app/gitea/gitea config edit-ini --in-place --apply-env "$@"
@@ -1,2 +0,0 @@
-#!/bin/bash
-exec /app/gitea/gitea config edit-ini --in-place --apply-env "$@"
@@ -3,6 +3,7 @@ import comments from '@eslint-community/eslint-plugin-eslint-comments';
 import github from 'eslint-plugin-github';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
+import noUseExtendNative from 'eslint-plugin-no-use-extend-native';
 import playwright from 'eslint-plugin-playwright';
 import regexp from 'eslint-plugin-regexp';
 import sonarjs from 'eslint-plugin-sonarjs';
@@ -15,22 +16,10 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
-import type {ESLint} from 'eslint';

 const jsExts = ['js', 'mjs', 'cjs'] as const;
 const tsExts = ['ts', 'mts', 'cts'] as const;
-
-const restrictedGlobals = [
-  {name: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
-  {name: 'fetch', message: 'Use `modules/fetch.ts` instead.'},
-];
-
-const restrictedProperties = [
-  {object: 'window', property: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
-  {object: 'globalThis', property: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
-  {object: 'window', property: 'fetch', message: 'Use `modules/fetch.ts` instead.'},
-  {object: 'globalThis', property: 'fetch', message: 'Use `modules/fetch.ts` instead.'},
-];
+const restrictedSyntax = ['WithStatement', 'ForInStatement', 'LabeledStatement', 'SequenceExpression'];

 export default defineConfig([
  globalIgnores([
@@ -44,6 +33,10 @@ export default defineConfig([
    languageOptions: {
      ecmaVersion: 'latest',
      sourceType: 'module',
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+      },
      parser: typescriptParser,
      parserOptions: {
        sourceType: 'module',
@@ -56,18 +49,24 @@ export default defineConfig([
    },
    linterOptions: {
      reportUnusedDisableDirectives: 2,
-      reportUnusedInlineConfigs: 2,
    },
    plugins: {
      '@eslint-community/eslint-comments': comments,
+      // @ts-expect-error
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
      'array-func': arrayFunc,
-      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      // @ts-expect-error -- https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      'import-x': importPlugin,
+      'no-use-extend-native': noUseExtendNative,
+      // @ts-expect-error
      regexp,
+      // @ts-expect-error
      sonarjs,
+      // @ts-expect-error
      unicorn,
      github,
+      // @ts-expect-error
      wc,
    },
    settings: {
@@ -76,7 +75,7 @@ export default defineConfig([
      'import-x/resolver': {'typescript': true},
    },
    rules: {
-      '@eslint-community/eslint-comments/disable-enable-pair': [0],
+      '@eslint-community/eslint-comments/disable-enable-pair': [2],
      '@eslint-community/eslint-comments/no-aggregating-enable': [2],
      '@eslint-community/eslint-comments/no-duplicate-disable': [2],
      '@eslint-community/eslint-comments/no-restricted-disable': [0],
@@ -156,11 +155,11 @@ export default defineConfig([
      '@typescript-eslint/adjacent-overload-signatures': [0],
      '@typescript-eslint/array-type': [0],
      '@typescript-eslint/await-thenable': [2],
-      '@typescript-eslint/ban-ts-comment': [2, {'ts-expect-error': true, 'ts-ignore': true, 'ts-nocheck': false, 'ts-check': false}],
+      '@typescript-eslint/ban-ts-comment': [2, {'ts-expect-error': false, 'ts-ignore': true, 'ts-nocheck': false, 'ts-check': false}],
      '@typescript-eslint/ban-tslint-comment': [0],
      '@typescript-eslint/class-literal-property-style': [0],
      '@typescript-eslint/class-methods-use-this': [0],
-      '@typescript-eslint/consistent-generic-constructors': [2, 'constructor'],
+      '@typescript-eslint/consistent-generic-constructors': [0],
      '@typescript-eslint/consistent-indexed-object-style': [0],
      '@typescript-eslint/consistent-return': [0],
      '@typescript-eslint/consistent-type-assertions': [2, {assertionStyle: 'as', objectLiteralTypeAssertions: 'allow'}],
@@ -222,7 +221,7 @@ export default defineConfig([
      '@typescript-eslint/no-unnecessary-condition': [0],
      '@typescript-eslint/no-unnecessary-qualifier': [0],
      '@typescript-eslint/no-unnecessary-template-expression': [0],
-      '@typescript-eslint/no-unnecessary-type-arguments': [2],
+      '@typescript-eslint/no-unnecessary-type-arguments': [0],
      '@typescript-eslint/no-unnecessary-type-assertion': [2],
      '@typescript-eslint/no-unnecessary-type-constraint': [2],
      '@typescript-eslint/no-unnecessary-type-conversion': [2],
@@ -235,12 +234,10 @@ export default defineConfig([
      '@typescript-eslint/no-unsafe-member-access': [0],
      '@typescript-eslint/no-unsafe-return': [0],
      '@typescript-eslint/no-unsafe-unary-minus': [2],
-      '@typescript-eslint/no-unused-expressions': [2],
-      '@typescript-eslint/no-unused-private-class-members': [2],
+      '@typescript-eslint/no-unused-expressions': [0],
      '@typescript-eslint/no-unused-vars': [2, {vars: 'all', args: 'all', caughtErrors: 'all', ignoreRestSiblings: false, argsIgnorePattern: '^_', varsIgnorePattern: '^_', caughtErrorsIgnorePattern: '^_', destructuredArrayIgnorePattern: '^_'}],
      '@typescript-eslint/no-use-before-define': [2, {functions: false, classes: true, variables: true, allowNamedExports: true, typedefs: false, enums: false, ignoreTypeReferences: true}],
      '@typescript-eslint/no-useless-constructor': [0],
-      '@typescript-eslint/no-useless-default-assignment': [2],
      '@typescript-eslint/no-useless-empty-export': [0],
      '@typescript-eslint/no-wrapper-object-types': [2],
      '@typescript-eslint/non-nullable-type-assertion-style': [0],
@@ -271,7 +268,6 @@ export default defineConfig([
      '@typescript-eslint/restrict-template-expressions': [0],
      '@typescript-eslint/return-await': [0],
      '@typescript-eslint/strict-boolean-expressions': [0],
-      '@typescript-eslint/strict-void-return': [0],
      '@typescript-eslint/switch-exhaustiveness-check': [0],
      '@typescript-eslint/triple-slash-reference': [2],
      '@typescript-eslint/typedef': [0],
@@ -370,7 +366,7 @@ export default defineConfig([
      'import-x/no-self-import': [2],
      'import-x/no-unassigned-import': [0],
      'import-x/no-unresolved': [2, {commonjs: true, ignore: ['\\?.+$']}],
-      'import-x/no-unused-modules': [0], // incompatible with eslint 9
+      // 'import-x/no-unused-modules': [2, {unusedExports: true}], // not compatible with eslint 9
      'import-x/no-useless-path-segments': [2, {commonjs: true}],
      'import-x/no-webpack-loader-syntax': [2],
      'import-x/order': [0],
@@ -566,10 +562,9 @@ export default defineConfig([
      'no-redeclare': [0], // must be disabled for typescript overloads
      'no-regex-spaces': [2],
      'no-restricted-exports': [0],
-      'no-restricted-globals': [2, ...restrictedGlobals],
-      'no-restricted-properties': [2, ...restrictedProperties],
+      'no-restricted-globals': [2, 'addEventListener', 'blur', 'close', 'closed', 'confirm', 'defaultStatus', 'defaultstatus', 'error', 'event', 'external', 'find', 'focus', 'frameElement', 'frames', 'history', 'innerHeight', 'innerWidth', 'isFinite', 'isNaN', 'length', 'locationbar', 'menubar', 'moveBy', 'moveTo', 'name', 'onblur', 'onerror', 'onfocus', 'onload', 'onresize', 'onunload', 'open', 'opener', 'opera', 'outerHeight', 'outerWidth', 'pageXOffset', 'pageYOffset', 'parent', 'print', 'removeEventListener', 'resizeBy', 'resizeTo', 'screen', 'screenLeft', 'screenTop', 'screenX', 'screenY', 'scroll', 'scrollbars', 'scrollBy', 'scrollTo', 'scrollX', 'scrollY', 'status', 'statusbar', 'stop', 'toolbar', 'top'],
      'no-restricted-imports': [0],
-      'no-restricted-syntax': [2, 'WithStatement', 'ForInStatement', 'LabeledStatement', 'SequenceExpression'],
+      'no-restricted-syntax': [2, ...restrictedSyntax, {selector: 'CallExpression[callee.name="fetch"]', message: 'use modules/fetch.ts instead'}],
      'no-return-assign': [0],
      'no-script-url': [2],
      'no-self-assign': [2, {props: true}],
@@ -594,12 +589,12 @@ export default defineConfig([
      'no-unreachable': [2],
      'no-unsafe-finally': [2],
      'no-unsafe-negation': [2],
-      'no-unused-expressions': [0], // handled by @typescript-eslint/no-unused-expressions
+      'no-unused-expressions': [2],
      'no-unused-labels': [2],
-      'no-unused-private-class-members': [0], // handled by @typescript-eslint/no-unused-private-class-members
+      'no-unused-private-class-members': [2],
      'no-unused-vars': [0], // handled by @typescript-eslint/no-unused-vars
      'no-use-before-define': [0], // handled by @typescript-eslint/no-use-before-define
-      'no-useless-assignment': [2],
+      'no-use-extend-native/no-use-extend-native': [2],
      'no-useless-backreference': [2],
      'no-useless-call': [2],
      'no-useless-catch': [2],
@@ -782,7 +777,6 @@ export default defineConfig([
      'unicorn/no-empty-file': [2],
      'unicorn/no-for-loop': [0],
      'unicorn/no-hex-escape': [0],
-      'unicorn/no-immediate-mutation': [0],
      'unicorn/no-instanceof-array': [0],
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
@@ -808,7 +802,6 @@ export default defineConfig([
      'unicorn/no-unreadable-array-destructuring': [0],
      'unicorn/no-unreadable-iife': [2],
      'unicorn/no-unused-properties': [2],
-      'unicorn/no-useless-collection-argument': [2],
      'unicorn/no-useless-fallback-in-spread': [2],
      'unicorn/no-useless-length-check': [2],
      'unicorn/no-useless-promise-resolve-reject': [2],
@@ -820,8 +813,8 @@ export default defineConfig([
      'unicorn/numeric-separators-style': [0],
      'unicorn/prefer-add-event-listener': [2],
      'unicorn/prefer-array-find': [2],
-      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
+      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-some': [2],
      'unicorn/prefer-at': [0],
@@ -856,7 +849,6 @@ export default defineConfig([
      'unicorn/prefer-query-selector': [2],
      'unicorn/prefer-reflect-apply': [0],
      'unicorn/prefer-regexp-test': [2],
-      'unicorn/prefer-response-static-json': [2],
      'unicorn/prefer-set-has': [0],
      'unicorn/prefer-set-size': [2],
      'unicorn/prefer-spread': [0],
@@ -908,6 +900,7 @@ export default defineConfig([
      'yoda': [2, 'never'],
    },
  },
+  // @ts-expect-error
  {
    ...playwright.configs['flat/recommended'],
    files: ['tests/e2e/**'],
@@ -923,19 +916,27 @@ export default defineConfig([
      },
    },
    extends: [
+      // @ts-expect-error
      vue.configs['flat/recommended'],
-      vueScopedCss.configs['flat/recommended'] as any,
+      // @ts-expect-error
+      vueScopedCss.configs['flat/recommended'],
    ],
    rules: {
      'vue/attributes-order': [0],
      'vue/html-closing-bracket-spacing': [2, {startTag: 'never', endTag: 'never', selfClosingTag: 'never'}],
      'vue/max-attributes-per-line': [0],
      'vue/singleline-html-element-content-newline': [0],
-      'vue/require-typed-ref': [2],
+    },
+  },
+  {
+    files: ['web_src/js/modules/fetch.ts', 'web_src/js/standalone/**/*'],
+    rules: {
+      'no-restricted-syntax': [2, ...restrictedSyntax],
    },
  },
  {
    files: ['**/*.test.ts', 'web_src/js/test/setup.ts'],
+    // @ts-expect-error - https://github.com/vitest-dev/eslint-plugin-vitest/issues/737
    plugins: {vitest},
    languageOptions: {globals: globals.vitest},
    rules: {
@@ -991,19 +992,38 @@ export default defineConfig([
      'vitest/valid-title': [2],
    },
  },
+  {
+    files: ['web_src/js/types.ts'],
+    rules: {
+      'import-x/no-unused-modules': [0],
+    },
+  },
  {
    files: ['**/*.d.ts'],
    rules: {
+      'import-x/no-unused-modules': [0],
      '@typescript-eslint/consistent-type-definitions': [0],
      '@typescript-eslint/consistent-type-imports': [0],
    },
  },
  {
-    files: ['*', 'tools/**/*'],
-    languageOptions: {globals: globals.nodeBuiltin},
+    files: ['*.config.*'],
+    rules: {
+      'import-x/no-unused-modules': [0],
+    },
+  },
+  {
+    files: ['web_src/**/*', 'docs/**/*'],
+    languageOptions: {globals: globals.browser},
  },
  {
    files: ['web_src/**/*'],
-    languageOptions: {globals: {...globals.browser, ...globals.webpack}},
+    languageOptions: {
+      globals: {
+        ...globals.browser,
+        __webpack_public_path__: true,
+        process: false, // https://github.com/webpack/webpack/issues/15833
+      },
+    },
  },
 ]);
@@ -1,30 +0,0 @@
-import {defineConfig, globalIgnores} from 'eslint/config';
-import json from '@eslint/json';
-
-export default defineConfig([
-  globalIgnores([
-    '**/.venv',
-    '**/node_modules',
-    '**/public',
-  ]),
-  {
-    files: ['**/*.json'],
-    plugins: {json},
-    language: 'json/json',
-    extends: ['json/recommended'],
-  },
-  {
-    files: [
-      'tsconfig.json',
-      '.devcontainer/*.json',
-      '.vscode/*.json',
-      'contrib/ide/vscode/*.json',
-    ],
-    plugins: {json},
-    language: 'json/jsonc',
-    languageOptions: {
-      allowTrailingCommas: true,
-    },
-    extends: ['json/recommended'],
-  },
-]);
@@ -1,12 +1,30 @@
 {
  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1760038930,
-        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
        "type": "github"
      },
      "original": {
@@ -18,8 +36,24 @@
    },
    "root": {
      "inputs": {
+        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -1,94 +1,73 @@
 {
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
  };
  outputs =
-    { nixpkgs, ... }:
-    let
-      supportedSystems = [
-        "aarch64-darwin"
-        "aarch64-linux"
-        "x86_64-darwin"
-        "x86_64-linux"
-      ];
-
-      forEachSupportedSystem =
-        f:
-        nixpkgs.lib.genAttrs supportedSystems (
-          system:
+    { nixpkgs, flake-utils, ... }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        devShells.default =
+          with pkgs;
          let
-            pkgs = import nixpkgs {
-              inherit system;
+            # only bump toolchain versions here
+            go = go_1_25;
+            nodejs = nodejs_24;
+            python3 = python312;
+            pnpm = pnpm_10;
+
+            # Platform-specific dependencies
+            linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
+              glibc.static
+            ];
+
+            linuxOnlyEnv = lib.optionalAttrs pkgs.stdenv.isLinux {
+              CFLAGS = "-I${glibc.static.dev}/include";
+              LDFLAGS = "-L ${glibc.static}/lib";
            };
          in
-          f { inherit pkgs; }
-        );
-    in
-    {
-      devShells = forEachSupportedSystem (
-        { pkgs, ... }:
-        {
-          default =
-            let
-              inherit (pkgs) lib;
+          pkgs.mkShell (
+            {
+              buildInputs = [
+                # generic
+                git
+                git-lfs
+                gnumake
+                gnused
+                gnutar
+                gzip
+                zip

-              # only bump toolchain versions here
-              go = pkgs.go_1_25;
-              nodejs = pkgs.nodejs_24;
-              python3 = pkgs.python312;
-              pnpm = pkgs.pnpm_10;
+                # frontend
+                nodejs
+                pnpm
+                cairo
+                pixman
+                pkg-config

-              # Platform-specific dependencies
-              linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
-                pkgs.glibc.static
-              ];
+                # linting
+                python3
+                uv

-              linuxOnlyEnv = lib.optionalAttrs pkgs.stdenv.isLinux {
-                CFLAGS = "-I${pkgs.glibc.static.dev}/include";
-                LDFLAGS = "-L ${pkgs.glibc.static}/lib";
-              };
-            in
-            pkgs.mkShell {
-              packages =
-                with pkgs;
-                [
-                  # generic
-                  git
-                  git-lfs
-                  gnumake
-                  gnused
-                  gnutar
-                  gzip
-                  zip
+                # backend
+                go
+                gofumpt
+                sqlite
+              ]
+              ++ linuxOnlyInputs;

-                  # frontend
-                  nodejs
-                  pnpm
-                  cairo
-                  pixman
-                  pkg-config
+              GO = "${go}/bin/go";
+              GOROOT = "${go}/share/go";

-                  # linting
-                  python3
-                  uv
-
-                  # backend
-                  go
-                  gofumpt
-                  sqlite
-                ]
-                ++ linuxOnlyInputs;
-
-              env = {
-                GO = "${go}/bin/go";
-                GOROOT = "${go}/share/go";
-
-                TAGS = "sqlite sqlite_unlock_notify";
-                STATIC = "true";
-              }
-              // linuxOnlyEnv;
-            };
-        }
-      );
-    };
+              TAGS = "sqlite sqlite_unlock_notify";
+              STATIC = "true";
+            }
+            // linuxOnlyEnv
+          );
+      }
+    );
 }
@@ -2,7 +2,7 @@ module code.gitea.io/gitea

 go 1.25.0

-toolchain go1.25.6
+toolchain go1.25.5

 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate."
 // But some CAs use negative serial number, just relax the check. related:
@@ -11,13 +11,14 @@ godebug x509negativeserial=1

 require (
 	code.gitea.io/actions-proto-go v0.4.1
+	code.gitea.io/gitea-vet v0.2.3
 	code.gitea.io/sdk/gitea v0.22.0
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
 	connectrpc.com/connect v1.18.1
 	gitea.com/go-chi/binding v0.0.0-20240430071103-39a851e106ed
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
-	gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e
+	gitea.com/go-chi/session v0.0.0-20240316035857-16768d98ec96
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
 	github.com/42wim/httpsig v1.2.3
@@ -28,7 +29,7 @@ require (
 	github.com/ProtonMail/go-crypto v1.3.0
 	github.com/PuerkitoBio/goquery v1.10.3
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0
-	github.com/alecthomas/chroma/v2 v2.23.1
+	github.com/alecthomas/chroma/v2 v2.20.0
 	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
 	github.com/aws/aws-sdk-go-v2/service/codecommit v1.32.2
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
@@ -39,6 +40,8 @@ require (
 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20251013092601-6327009efd21
 	github.com/chi-middleware/proxy v1.1.1
 	github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21
+	github.com/djherbis/buffer v1.2.0
+	github.com/djherbis/nio/v3 v3.0.1
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.0.1
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.3
@@ -50,17 +53,16 @@ require (
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-ap/activitypub v0.0.0-20250810115208-cb73b20a1742
 	github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73
-	github.com/go-chi/chi/v5 v5.2.4
+	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/cors v1.2.2
 	github.com/go-co-op/gocron v1.37.0
-	github.com/go-enry/go-enry/v2 v2.9.4
+	github.com/go-enry/go-enry/v2 v2.9.2
 	github.com/go-git/go-billy/v5 v5.6.2
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-ldap/ldap/v3 v3.4.11
 	github.com/go-redsync/redsync/v4 v4.13.0
 	github.com/go-sql-driver/mysql v1.9.3
 	github.com/go-webauthn/webauthn v0.13.4
-	github.com/goccy/go-json v0.10.5
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.0
@@ -75,6 +77,7 @@ require (
 	github.com/huandu/xstrings v1.5.0
 	github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056
 	github.com/jhillyerd/enmime v1.3.0
+	github.com/json-iterator/go v1.1.12
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/klauspost/compress v1.18.0
 	github.com/klauspost/cpuid/v2 v2.3.0
@@ -83,7 +86,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/meilisearch/meilisearch-go v0.33.2
-	github.com/mholt/archives v0.0.0-20251009205813-e30ac6010726
+	github.com/mholt/archives v0.1.5-0.20251009205813-e30ac6010726
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.9.3
 	github.com/minio/minio-go/v7 v7.0.95
@@ -93,6 +96,7 @@ require (
 	github.com/olivere/elastic/v7 v7.0.32
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
+	github.com/pkg/errors v0.9.1
 	github.com/pquerna/otp v1.5.0
 	github.com/prometheus/client_golang v1.23.0
 	github.com/quasoft/websspi v1.1.2
@@ -110,7 +114,7 @@ require (
 	github.com/wneessen/go-mail v0.7.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/yohcop/openid-go v1.0.1
-	github.com/yuin/goldmark v1.7.16
+	github.com/yuin/goldmark v1.7.13
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	github.com/yuin/goldmark-meta v1.1.0
 	gitlab.com/gitlab-org/api/client-go v0.142.4
@@ -133,7 +137,6 @@ require (

 require (
 	cloud.google.com/go/compute/metadata v0.8.0 // indirect
-	code.gitea.io/gitea-vet v0.2.3 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 // indirect
@@ -199,6 +202,7 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-webauthn/x v0.1.24 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
@@ -218,7 +222,6 @@ require (
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.4.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/libdns/libdns v1.1.1 // indirect
@@ -248,7 +251,6 @@ require (
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pjbgf/sha1cd v0.4.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.65.0 // indirect
@@ -278,7 +280,7 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
-	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b // indirect
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
 	golang.org/x/mod v0.29.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/tools v0.38.0 // indirect
@@ -307,5 +309,3 @@ exclude github.com/gofrs/uuid v4.0.0+incompatible
 exclude github.com/goccy/go-json v0.4.11

 exclude github.com/satori/go.uuid v1.2.0
-
-tool code.gitea.io/gitea-vet
@@ -41,8 +41,8 @@ gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
 gitea.com/go-chi/cache v0.2.1/go.mod h1:Qic0HZ8hOHW62ETGbonpwz8WYypj9NieU9659wFUJ8Q=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 h1:p2ki+WK0cIeNQuqjR98IP2KZQKRzJJiV7aTeMAFwaWo=
 gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098/go.mod h1:LjzIOHlRemuUyO7WR12fmm18VZIlCAaOt9L3yKw40pk=
-gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e h1:4bugwPyGMLvblEm3pZ8fZProSPVxE4l0UXF2Kv6IJoY=
-gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
+gitea.com/go-chi/session v0.0.0-20240316035857-16768d98ec96 h1:IFDiMBObsP6CZIRaDLd54SR6zPYAffPXiXck5Xslu0Q=
+gitea.com/go-chi/session v0.0.0-20240316035857-16768d98ec96/go.mod h1:0iEpFKnwO5dG0aF98O4eq6FMsAiXkNBaDIlUOlq4BtM=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
@@ -98,11 +98,11 @@ github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0/go.mod h1:1HmmMEVsr+0R
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
-github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/chroma/v2 v2.20.0 h1:sfIHpxPyR07/Oylvmcai3X/exDlE8+FA820NTz+9sGw=
+github.com/alecthomas/chroma/v2 v2.20.0/go.mod h1:e7tViK0xh/Nf4BYHl00ycY6rV7b8iXBksI9E359yNmA=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
-github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
-github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/repr v0.5.1 h1:E3G4t2QbHTSNpPKBgMTln5KLkZHLOcU7r37J4pXBuIg=
+github.com/alecthomas/repr v0.5.1/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
 github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
@@ -260,6 +260,11 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21 h1:PdsjTl0Cg+ZJgOx/CFV5NNgO1ThTreqdgKYiDCMHJwA=
 github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21/go.mod h1:xJvkyD6Y2rZapGvPJLYo9dyx1s5dxBEDPa8T3YTuOk0=
+github.com/djherbis/buffer v1.1.0/go.mod h1:VwN8VdFkMY0DCALdY8o00d3IZ6Amz/UNVMWcSaJT44o=
+github.com/djherbis/buffer v1.2.0 h1:PH5Dd2ss0C7CRRhQCZ2u7MssF+No9ide8Ye71nPHcrQ=
+github.com/djherbis/buffer v1.2.0/go.mod h1:fjnebbZjCUpPinBRD+TDwXSOeNQ7fPQWLfGQqiAiUyE=
+github.com/djherbis/nio/v3 v3.0.1 h1:6wxhnuppteMa6RHA4L81Dq7ThkZH8SwnDzXDYy95vB4=
+github.com/djherbis/nio/v3 v3.0.1/go.mod h1:Ng4h80pbZFMla1yKzm61cF0tqqilXZYrogmWgZxOcmg=
 github.com/dlclark/regexp2 v1.2.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
@@ -316,14 +321,14 @@ github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73/go.mod h1:jyveZeGw5La
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-chi/chi/v5 v5.0.1/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
-github.com/go-chi/chi/v5 v5.2.4 h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4=
-github.com/go-chi/chi/v5 v5.2.4/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
+github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
+github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-co-op/gocron v1.37.0 h1:ZYDJGtQ4OMhTLKOKMIch+/CY70Brbb1dGdooLEhh7b0=
 github.com/go-co-op/gocron v1.37.0/go.mod h1:3L/n6BkO7ABj+TrfSVXLRzsP26zmikL4ISkLQ0O8iNY=
-github.com/go-enry/go-enry/v2 v2.9.4 h1:DS4l06/NgMzYjsJ2J52wORo6UsfFDjDCwfAn7w3gG44=
-github.com/go-enry/go-enry/v2 v2.9.4/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
+github.com/go-enry/go-enry/v2 v2.9.2 h1:giOQAtCgBX08kosrX818DCQJTCNtKwoPBGu0qb6nKTY=
+github.com/go-enry/go-enry/v2 v2.9.2/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
 github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
 github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e h1:oRq/fiirun5HqlEWMLIcDmLpIELlG4iGbd0s8iqgPi8=
@@ -567,8 +572,8 @@ github.com/meilisearch/meilisearch-go v0.33.2 h1:YgsQSLYhAkRN2ias6I1KNRTjdYCN5w2
 github.com/meilisearch/meilisearch-go v0.33.2/go.mod h1:6eOPcQ+OAuwXvnONlfSgfgvr7TIAWM/6OdhcVHg8cF0=
 github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
 github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
-github.com/mholt/archives v0.0.0-20251009205813-e30ac6010726 h1:narluFTg20M5KBwKxedpFiSMkdjQRRNUlpY4uAsKMwk=
-github.com/mholt/archives v0.0.0-20251009205813-e30ac6010726/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPpeTAXF4=
+github.com/mholt/archives v0.1.5-0.20251009205813-e30ac6010726 h1:WVjGWXBLI1Ggm2kHzNraCGgxFhLoK6gdpPSizCdxnx0=
+github.com/mholt/archives v0.1.5-0.20251009205813-e30ac6010726/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPpeTAXF4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/microsoft/go-mssqldb v1.9.3 h1:hy4p+LDC8LIGvI3JATnLVmBOLMJbmn5X400mr5j0lPs=
@@ -787,8 +792,8 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.16 h1:n+CJdUxaFMiDUNnWC3dMWCIQJSkxH4uz3ZwQBkAlVNE=
-github.com/yuin/goldmark v1.7.16/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
+github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
@@ -845,8 +850,8 @@ golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE
 golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b h1:DXr+pvt3nC887026GRP39Ej11UATqWDmWuS99x26cD0=
-golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/image v0.30.0 h1:jD5RhkmVAnjqaCUXfbGBrn3lpxbknfN9w2UhHHU+5B4=
@@ -44,7 +44,6 @@ func main() {
 	}
 	app := cmd.NewMainApp(cmd.AppVersion{Version: Version, Extra: formatBuiltWith()})
 	_ = cmd.RunMainApp(app, os.Args...) // all errors should have been handled by the RunMainApp
-	// flush the queued logs before exiting, it is a MUST, otherwise there will be log loss
 	log.GetManager().Close()
 }

@@ -16,13 +16,13 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 	webhook_module "code.gitea.io/gitea/modules/webhook"

+	"github.com/nektos/act/pkg/jobparser"
 	"xorm.io/builder"
 )

@@ -30,7 +30,7 @@ import (
 type ActionRun struct {
 	ID                int64
 	Title             string
-	RepoID            int64                  `xorm:"unique(repo_index) index(repo_concurrency)"`
+	RepoID            int64                  `xorm:"index unique(repo_index)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
 	WorkflowID        string                 `xorm:"index"`                    // the name of workflow file
@@ -49,9 +49,6 @@ type ActionRun struct {
 	TriggerEvent      string                       // the trigger event defined in the `on` configuration of the triggered workflow
 	Status            Status                       `xorm:"index"`
 	Version           int                          `xorm:"version default 0"` // Status could be updated concomitantly, so an optimistic lock is needed
-	RawConcurrency    string                       // raw concurrency
-	ConcurrencyGroup  string                       `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"`
-	ConcurrencyCancel bool                         `xorm:"NOT NULL DEFAULT FALSE"`
 	// Started and Stopped is used for recording last run time, if rerun happened, they will be reset to 0
 	Started timeutil.TimeStamp
 	Stopped timeutil.TimeStamp
@@ -105,15 +102,6 @@ func (run *ActionRun) PrettyRef() string {
 	return refName.ShortName()
 }

-// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
-func (run *ActionRun) RefTooltip() string {
-	payload, err := run.GetPullRequestEventPayload()
-	if err == nil && payload != nil && payload.PullRequest != nil {
-		return payload.PullRequest.Title
-	}
-	return git.RefName(run.Ref).ShortName()
-}
-
 // LoadAttributes load Repo TriggerUser if not loaded
 func (run *ActionRun) LoadAttributes(ctx context.Context) error {
 	if run == nil {
@@ -193,8 +181,7 @@ func (run *ActionRun) IsSchedule() bool {
 	return run.ScheduleID > 0
 }

-// UpdateRepoRunsNumbers updates the number of runs and closed runs of a repository.
-func UpdateRepoRunsNumbers(ctx context.Context, repo *repo_model.Repository) error {
+func updateRepoRunsNumbers(ctx context.Context, repo *repo_model.Repository) error {
 	_, err := db.GetEngine(ctx).ID(repo.ID).
 		NoAutoTime().
 		Cols("num_action_runs", "num_closed_action_runs").
@@ -252,62 +239,116 @@ func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID strin
 			return cancelledJobs, err
 		}

-		cjs, err := CancelJobs(ctx, jobs)
-		if err != nil {
-			return cancelledJobs, err
+		// Iterate over each job and attempt to cancel it.
+		for _, job := range jobs {
+			// Skip jobs that are already in a terminal state (completed, cancelled, etc.).
+			status := job.Status
+			if status.IsDone() {
+				continue
+			}
+
+			// If the job has no associated task (probably an error), set its status to 'Cancelled' and stop it.
+			if job.TaskID == 0 {
+				job.Status = StatusCancelled
+				job.Stopped = timeutil.TimeStampNow()
+
+				// Update the job's status and stopped time in the database.
+				n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
+				if err != nil {
+					return cancelledJobs, err
+				}
+
+				// If the update affected 0 rows, it means the job has changed in the meantime, so we need to try again.
+				if n == 0 {
+					return cancelledJobs, errors.New("job has changed, try again")
+				}
+
+				cancelledJobs = append(cancelledJobs, job)
+				// Continue with the next job.
+				continue
+			}
+
+			// If the job has an associated task, try to stop the task, effectively cancelling the job.
+			if err := StopTask(ctx, job.TaskID, StatusCancelled); err != nil {
+				return cancelledJobs, err
+			}
+			cancelledJobs = append(cancelledJobs, job)
 		}
-		cancelledJobs = append(cancelledJobs, cjs...)
 	}

 	// Return nil to indicate successful cancellation of all running and waiting jobs.
 	return cancelledJobs, nil
 }

-func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
-	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))
-	// Iterate over each job and attempt to cancel it.
-	for _, job := range jobs {
-		// Skip jobs that are already in a terminal state (completed, cancelled, etc.).
-		status := job.Status
-		if status.IsDone() {
-			continue
-		}
-
-		// If the job has no associated task (probably an error), set its status to 'Cancelled' and stop it.
-		if job.TaskID == 0 {
-			job.Status = StatusCancelled
-			job.Stopped = timeutil.TimeStampNow()
-
-			// Update the job's status and stopped time in the database.
-			n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
-			if err != nil {
-				return cancelledJobs, err
-			}
-
-			// If the update affected 0 rows, it means the job has changed in the meantime
-			if n == 0 {
-				log.Error("Failed to cancel job %d because it has changed", job.ID)
-				continue
-			}
-
-			cancelledJobs = append(cancelledJobs, job)
-			// Continue with the next job.
-			continue
-		}
-
-		// If the job has an associated task, try to stop the task, effectively cancelling the job.
-		if err := StopTask(ctx, job.TaskID, StatusCancelled); err != nil {
-			return cancelledJobs, err
-		}
-		updatedJob, err := GetRunJobByID(ctx, job.ID)
+// InsertRun inserts a run
+// The title will be cut off at 255 characters if it's longer than 255 characters.
+func InsertRun(ctx context.Context, run *ActionRun, jobs []*jobparser.SingleWorkflow) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		index, err := db.GetNextResourceIndex(ctx, "action_run_index", run.RepoID)
 		if err != nil {
-			return cancelledJobs, fmt.Errorf("get job: %w", err)
+			return err
 		}
-		cancelledJobs = append(cancelledJobs, updatedJob)
-	}
+		run.Index = index
+		run.Title = util.EllipsisDisplayString(run.Title, 255)

-	// Return nil to indicate successful cancellation of all running and waiting jobs.
-	return cancelledJobs, nil
+		if err := db.Insert(ctx, run); err != nil {
+			return err
+		}
+
+		if run.Repo == nil {
+			repo, err := repo_model.GetRepositoryByID(ctx, run.RepoID)
+			if err != nil {
+				return err
+			}
+			run.Repo = repo
+		}
+
+		if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
+			return err
+		}
+
+		runJobs := make([]*ActionRunJob, 0, len(jobs))
+		var hasWaiting bool
+		for _, v := range jobs {
+			id, job := v.Job()
+			needs := job.Needs()
+			if err := v.SetJob(id, job.EraseNeeds()); err != nil {
+				return err
+			}
+			payload, _ := v.Marshal()
+			status := StatusWaiting
+			if len(needs) > 0 || run.NeedApproval {
+				status = StatusBlocked
+			} else {
+				hasWaiting = true
+			}
+			job.Name = util.EllipsisDisplayString(job.Name, 255)
+			runJobs = append(runJobs, &ActionRunJob{
+				RunID:             run.ID,
+				RepoID:            run.RepoID,
+				OwnerID:           run.OwnerID,
+				CommitSHA:         run.CommitSHA,
+				IsForkPullRequest: run.IsForkPullRequest,
+				Name:              job.Name,
+				WorkflowPayload:   payload,
+				JobID:             id,
+				Needs:             needs,
+				RunsOn:            job.RunsOn(),
+				Status:            status,
+			})
+		}
+		if err := db.Insert(ctx, runJobs); err != nil {
+			return err
+		}
+
+		// if there is a job in the waiting status, increase tasks version.
+		if hasWaiting {
+			if err := IncreaseTaskVersion(ctx, run.OwnerID, run.RepoID); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
 }

 func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, error) {
@@ -392,7 +433,7 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
 		if err = run.LoadRepo(ctx); err != nil {
 			return err
 		}
-		if err := UpdateRepoRunsNumbers(ctx, run.Repo); err != nil {
+		if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
 			return err
 		}
 	}
@@ -401,59 +442,3 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
 }

 type ActionRunIndex db.ResourceIndex
-
-func GetConcurrentRunsAndJobs(ctx context.Context, repoID int64, concurrencyGroup string, status []Status) ([]*ActionRun, []*ActionRunJob, error) {
-	runs, err := db.Find[ActionRun](ctx, &FindRunOptions{
-		RepoID:           repoID,
-		ConcurrencyGroup: concurrencyGroup,
-		Status:           status,
-	})
-	if err != nil {
-		return nil, nil, fmt.Errorf("find runs: %w", err)
-	}
-
-	jobs, err := db.Find[ActionRunJob](ctx, &FindRunJobOptions{
-		RepoID:           repoID,
-		ConcurrencyGroup: concurrencyGroup,
-		Statuses:         status,
-	})
-	if err != nil {
-		return nil, nil, fmt.Errorf("find jobs: %w", err)
-	}
-
-	return runs, jobs, nil
-}
-
-func CancelPreviousJobsByRunConcurrency(ctx context.Context, actionRun *ActionRun) ([]*ActionRunJob, error) {
-	if actionRun.ConcurrencyGroup == "" {
-		return nil, nil
-	}
-
-	var jobsToCancel []*ActionRunJob
-
-	statusFindOption := []Status{StatusWaiting, StatusBlocked}
-	if actionRun.ConcurrencyCancel {
-		statusFindOption = append(statusFindOption, StatusRunning)
-	}
-	runs, jobs, err := GetConcurrentRunsAndJobs(ctx, actionRun.RepoID, actionRun.ConcurrencyGroup, statusFindOption)
-	if err != nil {
-		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
-	}
-	jobsToCancel = append(jobsToCancel, jobs...)
-
-	// cancel runs in the same concurrency group
-	for _, run := range runs {
-		if run.ID == actionRun.ID {
-			continue
-		}
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
-		}
-		jobsToCancel = append(jobsToCancel, jobs...)
-	}
-
-	return CancelJobs(ctx, jobsToCancel)
-}
@@ -14,7 +14,6 @@ import (
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"

-	"github.com/nektos/act/pkg/jobparser"
 	"xorm.io/builder"
 )

@@ -23,38 +22,23 @@ type ActionRunJob struct {
 	ID                int64
 	RunID             int64                  `xorm:"index"`
 	Run               *ActionRun             `xorm:"-"`
-	RepoID            int64                  `xorm:"index(repo_concurrency)"`
+	RepoID            int64                  `xorm:"index"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
 	CommitSHA         string                 `xorm:"index"`
 	IsForkPullRequest bool
 	Name              string `xorm:"VARCHAR(255)"`
 	Attempt           int64
-
-	// WorkflowPayload is act/jobparser.SingleWorkflow for act/jobparser.Parse
-	// it should contain exactly one job with global workflow fields for this model
-	WorkflowPayload []byte
-
-	JobID  string   `xorm:"VARCHAR(255)"` // job id in workflow, not job's id
-	Needs  []string `xorm:"JSON TEXT"`
-	RunsOn []string `xorm:"JSON TEXT"`
-	TaskID int64    // the latest task of the job
-	Status Status   `xorm:"index"`
-
-	RawConcurrency string // raw concurrency from job YAML's "concurrency" section
-
-	// IsConcurrencyEvaluated is only valid/needed when this job's RawConcurrency is not empty.
-	// If RawConcurrency can't be evaluated (e.g. depend on other job's outputs or have errors), this field will be false.
-	// If RawConcurrency has been successfully evaluated, this field will be true, ConcurrencyGroup and ConcurrencyCancel are also set.
-	IsConcurrencyEvaluated bool
-
-	ConcurrencyGroup  string `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"` // evaluated concurrency.group
-	ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`                      // evaluated concurrency.cancel-in-progress
-
-	Started timeutil.TimeStamp
-	Stopped timeutil.TimeStamp
-	Created timeutil.TimeStamp `xorm:"created"`
-	Updated timeutil.TimeStamp `xorm:"updated index"`
+	WorkflowPayload   []byte
+	JobID             string   `xorm:"VARCHAR(255)"` // job id in workflow, not job's id
+	Needs             []string `xorm:"JSON TEXT"`
+	RunsOn            []string `xorm:"JSON TEXT"`
+	TaskID            int64    // the latest task of the job
+	Status            Status   `xorm:"index"`
+	Started           timeutil.TimeStamp
+	Stopped           timeutil.TimeStamp
+	Created           timeutil.TimeStamp `xorm:"created"`
+	Updated           timeutil.TimeStamp `xorm:"updated index"`
 }

 func init() {
@@ -100,24 +84,6 @@ func (job *ActionRunJob) LoadAttributes(ctx context.Context) error {
 	return job.Run.LoadAttributes(ctx)
 }

-// ParseJob parses the job structure from the ActionRunJob.WorkflowPayload
-func (job *ActionRunJob) ParseJob() (*jobparser.Job, error) {
-	// job.WorkflowPayload is a SingleWorkflow created from an ActionRun's workflow, which exactly contains this job's YAML definition.
-	// Ideally it shouldn't be called "Workflow", it is just a job with global workflow fields + trigger
-	parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
-	if err != nil {
-		return nil, fmt.Errorf("job %d single workflow: unable to parse: %w", job.ID, err)
-	} else if len(parsedWorkflows) != 1 {
-		return nil, fmt.Errorf("job %d single workflow: not single workflow", job.ID)
-	}
-	_, workflowJob := parsedWorkflows[0].Job()
-	if workflowJob == nil {
-		// it shouldn't happen, and since the callers don't check nil, so return an error instead of nil
-		return nil, util.ErrorWrap(util.ErrNotExist, "job %d single workflow: payload doesn't contain a job", job.ID)
-	}
-	return workflowJob, nil
-}
-
 func GetRunJobByID(ctx context.Context, id int64) (*ActionRunJob, error) {
 	var job ActionRunJob
 	has, err := db.GetEngine(ctx).Where("id=?", id).Get(&job)
@@ -159,7 +125,7 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return affected, nil
 	}

-	if slices.Contains(cols, "status") && job.Status.IsWaiting() {
+	if affected != 0 && slices.Contains(cols, "status") && job.Status.IsWaiting() {
 		// if the status of job changes to waiting again, increase tasks version.
 		if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
 			return 0, err
@@ -231,39 +197,3 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
 		return StatusUnknown // it shouldn't happen
 	}
 }
-
-func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob) (jobsToCancel []*ActionRunJob, _ error) {
-	if job.RawConcurrency == "" {
-		return nil, nil
-	}
-	if !job.IsConcurrencyEvaluated {
-		return nil, nil
-	}
-	if job.ConcurrencyGroup == "" {
-		return nil, nil
-	}
-
-	statusFindOption := []Status{StatusWaiting, StatusBlocked}
-	if job.ConcurrencyCancel {
-		statusFindOption = append(statusFindOption, StatusRunning)
-	}
-	runs, jobs, err := GetConcurrentRunsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, statusFindOption)
-	if err != nil {
-		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
-	}
-	jobs = slices.DeleteFunc(jobs, func(j *ActionRunJob) bool { return j.ID == job.ID })
-	jobsToCancel = append(jobsToCancel, jobs...)
-
-	// cancel runs in the same concurrency group
-	for _, run := range runs {
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
-		}
-		jobsToCancel = append(jobsToCancel, jobs...)
-	}
-
-	return CancelJobs(ctx, jobsToCancel)
-}
@@ -69,13 +69,12 @@ func (jobs ActionJobList) LoadAttributes(ctx context.Context, withRepo bool) err

 type FindRunJobOptions struct {
 	db.ListOptions
-	RunID            int64
-	RepoID           int64
-	OwnerID          int64
-	CommitSHA        string
-	Statuses         []Status
-	UpdatedBefore    timeutil.TimeStamp
-	ConcurrencyGroup string
+	RunID         int64
+	RepoID        int64
+	OwnerID       int64
+	CommitSHA     string
+	Statuses      []Status
+	UpdatedBefore timeutil.TimeStamp
 }

 func (opts FindRunJobOptions) ToConds() builder.Cond {
@@ -95,12 +94,6 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 	if opts.UpdatedBefore > 0 {
 		cond = cond.And(builder.Lt{"`action_run_job`.updated": opts.UpdatedBefore})
 	}
-	if opts.ConcurrencyGroup != "" {
-		if opts.RepoID == 0 {
-			panic("Invalid FindRunJobOptions: repo_id is required")
-		}
-		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
-	}
 	return cond
 }

@@ -64,16 +64,15 @@ func (runs RunList) LoadRepos(ctx context.Context) error {

 type FindRunOptions struct {
 	db.ListOptions
-	RepoID           int64
-	OwnerID          int64
-	WorkflowID       string
-	Ref              string // the commit/tag/… that caused this workflow
-	TriggerUserID    int64
-	TriggerEvent     webhook_module.HookEventType
-	Approved         bool // not util.OptionalBool, it works only when it's true
-	Status           []Status
-	ConcurrencyGroup string
-	CommitSHA        string
+	RepoID        int64
+	OwnerID       int64
+	WorkflowID    string
+	Ref           string // the commit/tag/… that caused this workflow
+	TriggerUserID int64
+	TriggerEvent  webhook_module.HookEventType
+	Approved      bool // not util.OptionalBool, it works only when it's true
+	Status        []Status
+	CommitSHA     string
 }

 func (opts FindRunOptions) ToConds() builder.Cond {
@@ -102,12 +101,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.CommitSHA != "" {
 		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
 	}
-	if len(opts.ConcurrencyGroup) > 0 {
-		if opts.RepoID == 0 {
-			panic("Invalid FindRunOptions: repo_id is required")
-		}
-		cond = cond.And(builder.Eq{"`action_run`.concurrency_group": opts.ConcurrencyGroup})
-	}
 	return cond
 }

@@ -27,7 +27,7 @@ func TestUpdateRepoRunsNumbers(t *testing.T) {
 	assert.Equal(t, 2, repo.NumClosedActionRuns)

 	// now update will correct them, only num_actionr_runs and num_closed_action_runs should be updated
-	err = UpdateRepoRunsNumbers(t.Context(), repo)
+	err = updateRepoRunsNumbers(t.Context(), repo)
 	assert.NoError(t, err)
 	repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
 	assert.Equal(t, 5, repo.NumActionRuns)
@@ -14,7 +14,6 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/shared/types"
 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
@@ -174,13 +173,6 @@ func (r *ActionRunner) GenerateToken() (err error) {
 	return err
 }

-// CanMatchLabels checks whether the runner's labels can match a job's "runs-on"
-// See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idruns-on
-func (r *ActionRunner) CanMatchLabels(jobRunsOn []string) bool {
-	runnerLabelSet := container.SetOf(r.AgentLabels...)
-	return runnerLabelSet.Contains(jobRunsOn...) // match all labels
-}
-
 func init() {
 	db.RegisterModel(&ActionRunner{})
 }
@@ -13,6 +13,7 @@ import (
 	auth_model "code.gitea.io/gitea/models/auth"
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/unit"
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/timeutil"
@@ -20,6 +21,7 @@ import (

 	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	lru "github.com/hashicorp/golang-lru/v2"
+	"github.com/nektos/act/pkg/jobparser"
 	"google.golang.org/protobuf/types/known/timestamppb"
 	"xorm.io/builder"
 )
@@ -244,7 +246,7 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 	var job *ActionRunJob
 	log.Trace("runner labels: %v", runner.AgentLabels)
 	for _, v := range jobs {
-		if runner.CanMatchLabels(v.RunsOn) {
+		if isSubset(runner.AgentLabels, v.RunsOn) {
 			job = v
 			break
 		}
@@ -276,10 +278,13 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 		return nil, false, err
 	}

-	workflowJob, err := job.ParseJob()
+	parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
 	if err != nil {
-		return nil, false, fmt.Errorf("load job %d: %w", job.ID, err)
+		return nil, false, fmt.Errorf("parse workflow of job %d: %w", job.ID, err)
+	} else if len(parsedWorkflows) != 1 {
+		return nil, false, fmt.Errorf("workflow of job %d: not single workflow", job.ID)
 	}
+	_, workflowJob := parsedWorkflows[0].Job()

 	if _, err := e.Insert(task); err != nil {
 		return nil, false, err
@@ -474,6 +479,20 @@ func FindOldTasksToExpire(ctx context.Context, olderThan timeutil.TimeStamp, lim
 		Find(&tasks)
 }

+func isSubset(set, subset []string) bool {
+	m := make(container.Set[string], len(set))
+	for _, v := range set {
+		m.Add(v)
+	}
+
+	for _, v := range subset {
+		if !m.Contains(v) {
+			return false
+		}
+	}
+	return true
+}
+
 func convertTimestamp(timestamp *timestamppb.Timestamp) timeutil.TimeStamp {
 	if timestamp.GetSeconds() == 0 && timestamp.GetNanos() == 0 {
 		return timeutil.TimeStamp(0)
@@ -84,7 +84,7 @@ func addKey(ctx context.Context, key *PublicKey) (err error) {
 }

 // AddPublicKey adds new public key to database and authorized_keys file.
-func AddPublicKey(ctx context.Context, ownerID int64, name, content string, authSourceID int64, verified bool) (*PublicKey, error) {
+func AddPublicKey(ctx context.Context, ownerID int64, name, content string, authSourceID int64) (*PublicKey, error) {
 	log.Trace(content)

 	fingerprint, err := CalcFingerprint(content)
@@ -115,7 +115,6 @@ func AddPublicKey(ctx context.Context, ownerID int64, name, content string, auth
 			Mode:          perm.AccessModeWrite,
 			Type:          KeyTypeUser,
 			LoginSourceID: authSourceID,
-			Verified:      verified,
 		}
 		if err = addKey(ctx, key); err != nil {
 			return nil, fmt.Errorf("addKey: %w", err)
@@ -299,7 +298,7 @@ func deleteKeysMarkedForDeletion(ctx context.Context, keys []string) (bool, erro
 }

 // AddPublicKeysBySource add a users public keys. Returns true if there are changes.
-func AddPublicKeysBySource(ctx context.Context, usr *user_model.User, s *auth.Source, sshPublicKeys []string, verified bool) bool {
+func AddPublicKeysBySource(ctx context.Context, usr *user_model.User, s *auth.Source, sshPublicKeys []string) bool {
 	var sshKeysNeedUpdate bool
 	for _, sshKey := range sshPublicKeys {
 		var err error
@@ -318,7 +317,7 @@ func AddPublicKeysBySource(ctx context.Context, usr *user_model.User, s *auth.So
 			marshalled = marshalled[:len(marshalled)-1]
 			sshKeyName := fmt.Sprintf("%s-%s", s.Name, ssh.FingerprintSHA256(out))

-			if _, err := AddPublicKey(ctx, usr.ID, sshKeyName, marshalled, s.ID, verified); err != nil {
+			if _, err := AddPublicKey(ctx, usr.ID, sshKeyName, marshalled, s.ID); err != nil {
 				if IsErrKeyAlreadyExist(err) {
 					log.Trace("AddPublicKeysBySource[%s]: Public SSH Key %s already exists for user", sshKeyName, usr.Name)
 				} else {
@@ -337,7 +336,7 @@ func AddPublicKeysBySource(ctx context.Context, usr *user_model.User, s *auth.So
 }

 // SynchronizePublicKeys updates a user's public keys. Returns true if there are changes.
-func SynchronizePublicKeys(ctx context.Context, usr *user_model.User, s *auth.Source, sshPublicKeys []string, verified bool) bool {
+func SynchronizePublicKeys(ctx context.Context, usr *user_model.User, s *auth.Source, sshPublicKeys []string) bool {
 	var sshKeysNeedUpdate bool

 	log.Trace("synchronizePublicKeys[%s]: Handling Public SSH Key synchronization for user %s", s.Name, usr.Name)
@@ -382,7 +381,7 @@ func SynchronizePublicKeys(ctx context.Context, usr *user_model.User, s *auth.So
 			newKeys = append(newKeys, key)
 		}
 	}
-	if AddPublicKeysBySource(ctx, usr, s, newKeys, verified) {
+	if AddPublicKeysBySource(ctx, usr, s, newKeys) {
 		sshKeysNeedUpdate = true
 	}

@@ -57,7 +57,7 @@ func InitEngine(ctx context.Context) error {
 	xe, err := newXORMEngine()
 	if err != nil {
 		if strings.Contains(err.Error(), "SQLite3 support") {
-			return fmt.Errorf("sqlite3 requires: -tags sqlite,sqlite_unlock_notify\n%w", err)
+			return fmt.Errorf(`sqlite3 requires: -tags sqlite,sqlite_unlock_notify%s%w`, "\n", err)
 		}
 		return fmt.Errorf("failed to connect to database: %w", err)
 	}
@@ -139,28 +139,9 @@
  updated: 1683636626
  need_approval: 0
  approved_by: 0
+
 -
-  id: 804
-  title: "use a private action"
-  repo_id: 60
-  owner_id: 40
-  workflow_id: "run.yaml"
-  index: 189
-  trigger_user_id: 40
-  ref: "refs/heads/master"
-  commit_sha: "6e64b26de7ba966d01d90ecfaf5c7f14ef203e86"
-  event: "push"
-  trigger_event: "push"
-  is_fork_pull_request: 0
-  status: 1
-  started: 1683636528
-  stopped: 1683636626
-  created: 1683636108
-  updated: 1683636626
-  need_approval: 0
-  approved_by: 0
-
-  id: 805
+  id: 796
  title: "update actions"
  repo_id: 4
  owner_id: 1
@@ -129,23 +129,10 @@
  status: 5
  started: 1683636528
  stopped: 1683636626
+
 -
  id: 205
-  run_id: 804
-  repo_id: 6
-  owner_id: 10
-  commit_sha: 6e64b26de7ba966d01d90ecfaf5c7f14ef203e86
-  is_fork_pull_request: 0
-  name: job_2
-  attempt: 1
-  job_id: job_2
-  task_id: 48
-  status: 1
-  started: 1683636528
-  stopped: 1683636626
-
-  id: 206
-  run_id: 805
+  run_id: 796
  repo_id: 4
  owner_id: 1
  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
@@ -153,7 +140,7 @@
  name: job_2
  attempt: 1
  job_id: job_2
-  task_id: 56
+  task_id: 55
  status: 3
  started: 1683636528
  stopped: 1683636626
@@ -177,30 +177,12 @@
  log_length: 0
  log_size: 0
  log_expired: 0
+
 -
  id: 55
  job_id: 205
  attempt: 1
  runner_id: 1
-  status: 6 # 6 is the status code for "running"
-  started: 1683636528
-  stopped: 1683636626
-  repo_id: 6
-  owner_id: 10
-  commit_sha: 6e64b26de7ba966d01d90ecfaf5c7f14ef203e86
-  is_fork_pull_request: 0
-  token_hash: b8d3962425466b6709b9ac51446f93260c54afe8e7b6d3686e34f991fb8a8953822b0deed86fe41a103f34bc48dbc478422b
-  token_salt: ERxJGHvg3I
-  token_last_eight: 182199eb
-  log_filename: collaborative-owner-test/1a/49.log
-  log_in_storage: 1
-  log_length: 707
-  log_size: 90179
-  log_expired: 0
-
-  id: 56
-  attempt: 1
-  runner_id: 1
  status: 3 # 3 is the status code for "cancelled"
  started: 1683636528
  stopped: 1683636626
@@ -225,27 +225,3 @@
  is_deleted: false
  deleted_by_id: 0
  deleted_unix: 0
-
-
-  id: 27
-  repo_id: 1
-  name: 'DefaultBranch'
-  commit_id: '90c1019714259b24fb81711d4416ac0f18667dfa'
-  commit_message: 'add license'
-  commit_time: 1709345946
-  pusher_id: 1
-  is_deleted: false
-  deleted_by_id: 0
-  deleted_unix: 0
-
-
-  id: 28
-  repo_id: 1
-  name: 'sub-home-md-img-check'
-  commit_id: '4649299398e4d39a5c09eb4f534df6f1e1eb87cc'
-  commit_message: "Test how READMEs render images when found in a subfolder"
-  commit_time: 1678403550
-  pusher_id: 1
-  is_deleted: false
-  deleted_by_id: 0
-  deleted_unix: 0
@@ -736,13 +736,6 @@

 -
  id: 111
-  repo_id: 3
-  type: 10
-  config: "{}"
-  created_unix: 946684810
-
-
-  id: 112
  repo_id: 4
  type: 10
  config: "{}"
@@ -114,7 +114,7 @@ func TestFindRenamedBranch(t *testing.T) {
 	assert.True(t, exist)
 	assert.Equal(t, "master", branch.To)

-	_, exist, err = git_model.FindRenamedBranch(t.Context(), 1, "unknown")
+	_, exist, err = git_model.FindRenamedBranch(t.Context(), 1, "unknow")
 	assert.NoError(t, err)
 	assert.False(t, exist)
 }
@@ -30,21 +30,17 @@ import (

 // CommitStatus holds a single Status of a single Commit
 type CommitStatus struct {
-	ID     int64                          `xorm:"pk autoincr"`
-	Index  int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
-	RepoID int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
-	Repo   *repo_model.Repository         `xorm:"-"`
-	State  commitstatus.CommitStatusState `xorm:"VARCHAR(7) NOT NULL"`
-	SHA    string                         `xorm:"VARCHAR(64) NOT NULL INDEX UNIQUE(repo_sha_index)"`
-
-	// TargetURL points to the commit status page reported by a CI system
-	// If Gitea Actions is used, it is a relative link like "{RepoLink}/actions/runs/{RunID}/jobs{JobID}"
-	TargetURL string `xorm:"TEXT"`
-
-	Description string           `xorm:"TEXT"`
-	ContextHash string           `xorm:"VARCHAR(64) index"`
-	Context     string           `xorm:"TEXT"`
-	Creator     *user_model.User `xorm:"-"`
+	ID          int64                          `xorm:"pk autoincr"`
+	Index       int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
+	RepoID      int64                          `xorm:"INDEX UNIQUE(repo_sha_index)"`
+	Repo        *repo_model.Repository         `xorm:"-"`
+	State       commitstatus.CommitStatusState `xorm:"VARCHAR(7) NOT NULL"`
+	SHA         string                         `xorm:"VARCHAR(64) NOT NULL INDEX UNIQUE(repo_sha_index)"`
+	TargetURL   string                         `xorm:"TEXT"`
+	Description string                         `xorm:"TEXT"`
+	ContextHash string                         `xorm:"VARCHAR(64) index"`
+	Context     string                         `xorm:"TEXT"`
+	Creator     *user_model.User               `xorm:"-"`
 	CreatorID   int64

 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
@@ -215,45 +211,21 @@ func (status *CommitStatus) LocaleString(lang translation.Locale) string {

 // HideActionsURL set `TargetURL` to an empty string if the status comes from Gitea Actions
 func (status *CommitStatus) HideActionsURL(ctx context.Context) {
-	if _, ok := status.cutTargetURLGiteaActionsPrefix(ctx); ok {
-		status.TargetURL = ""
-	}
-}
-
-func (status *CommitStatus) cutTargetURLGiteaActionsPrefix(ctx context.Context) (string, bool) {
 	if status.RepoID == 0 {
-		return "", false
+		return
 	}

 	if status.Repo == nil {
 		if err := status.loadRepository(ctx); err != nil {
 			log.Error("loadRepository: %v", err)
-			return "", false
+			return
 		}
 	}

 	prefix := status.Repo.Link() + "/actions"
-	return strings.CutPrefix(status.TargetURL, prefix)
-}
-
-// ParseGiteaActionsTargetURL parses the commit status target URL as Gitea Actions link
-func (status *CommitStatus) ParseGiteaActionsTargetURL(ctx context.Context) (runID, jobID int64, ok bool) {
-	s, ok := status.cutTargetURLGiteaActionsPrefix(ctx)
-	if !ok {
-		return 0, 0, false
+	if strings.HasPrefix(status.TargetURL, prefix) {
+		status.TargetURL = ""
 	}
-
-	parts := strings.Split(s, "/") // expect: /runs/{runID}/jobs/{jobID}
-	if len(parts) < 5 || parts[1] != "runs" || parts[3] != "jobs" {
-		return 0, 0, false
-	}
-
-	runID, err1 := strconv.ParseInt(parts[2], 10, 64)
-	jobID, err2 := strconv.ParseInt(parts[4], 10, 64)
-	if err1 != nil || err2 != nil {
-		return 0, 0, false
-	}
-	return runID, jobID, true
 }

 // CalcCommitStatus returns commit status state via some status, the commit statues should order by id desc
@@ -8,6 +8,7 @@ import (
 	"fmt"

 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/perm"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
@@ -41,6 +42,30 @@ func (err ErrLFSLockNotExist) Unwrap() error {
 	return util.ErrNotExist
 }

+// ErrLFSUnauthorizedAction represents a "LFSUnauthorizedAction" kind of error.
+type ErrLFSUnauthorizedAction struct {
+	RepoID   int64
+	UserName string
+	Mode     perm.AccessMode
+}
+
+// IsErrLFSUnauthorizedAction checks if an error is a ErrLFSUnauthorizedAction.
+func IsErrLFSUnauthorizedAction(err error) bool {
+	_, ok := err.(ErrLFSUnauthorizedAction)
+	return ok
+}
+
+func (err ErrLFSUnauthorizedAction) Error() string {
+	if err.Mode == perm.AccessModeWrite {
+		return fmt.Sprintf("User %s doesn't have write access for lfs lock [rid: %d]", err.UserName, err.RepoID)
+	}
+	return fmt.Sprintf("User %s doesn't have read access for lfs lock [rid: %d]", err.UserName, err.RepoID)
+}
+
+func (err ErrLFSUnauthorizedAction) Unwrap() error {
+	return util.ErrPermissionDenied
+}
+
 // ErrLFSLockAlreadyExist represents a "LFSLockAlreadyExist" kind of error.
 type ErrLFSLockAlreadyExist struct {
 	RepoID int64
@@ -68,6 +93,12 @@ type ErrLFSFileLocked struct {
 	UserName string
 }

+// IsErrLFSFileLocked checks if an error is a ErrLFSFileLocked.
+func IsErrLFSFileLocked(err error) bool {
+	_, ok := err.(ErrLFSFileLocked)
+	return ok
+}
+
 func (err ErrLFSFileLocked) Error() string {
 	return fmt.Sprintf("File is lfs locked [repo: %d, locked by: %s, path: %s]", err.RepoID, err.UserName, err.Path)
 }
@@ -11,7 +11,10 @@ import (
 	"time"

 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/perm"
+	access_model "code.gitea.io/gitea/models/perm/access"
 	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/models/unit"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
@@ -68,6 +71,10 @@ func (l *LFSLock) LoadOwner(ctx context.Context) error {
 // CreateLFSLock creates a new lock.
 func CreateLFSLock(ctx context.Context, repo *repo_model.Repository, lock *LFSLock) (*LFSLock, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*LFSLock, error) {
+		if err := CheckLFSAccessForRepo(ctx, lock.OwnerID, repo, perm.AccessModeWrite); err != nil {
+			return nil, err
+		}
+
 		lock.Path = util.PathJoinRel(lock.Path)
 		lock.RepoID = repo.ID

@@ -158,6 +165,10 @@ func DeleteLFSLockByID(ctx context.Context, id int64, repo *repo_model.Repositor
 			return nil, err
 		}

+		if err := CheckLFSAccessForRepo(ctx, u.ID, repo, perm.AccessModeWrite); err != nil {
+			return nil, err
+		}
+
 		if !force && u.ID != lock.OwnerID {
 			return nil, errors.New("user doesn't own lock and force flag is not set")
 		}
@@ -169,3 +180,22 @@ func DeleteLFSLockByID(ctx context.Context, id int64, repo *repo_model.Repositor
 		return lock, nil
 	})
 }
+
+// CheckLFSAccessForRepo check needed access mode base on action
+func CheckLFSAccessForRepo(ctx context.Context, ownerID int64, repo *repo_model.Repository, mode perm.AccessMode) error {
+	if ownerID == 0 {
+		return ErrLFSUnauthorizedAction{repo.ID, "undefined", mode}
+	}
+	u, err := user_model.GetUserByID(ctx, ownerID)
+	if err != nil {
+		return err
+	}
+	perm, err := access_model.GetUserRepoPermission(ctx, repo, u)
+	if err != nil {
+		return err
+	}
+	if !perm.CanAccess(mode, unit.TypeCode) {
+		return ErrLFSUnauthorizedAction{repo.ID, u.DisplayName(), mode}
+	}
+	return nil
+}
@@ -20,7 +20,6 @@ import (
 	repo_model "code.gitea.io/gitea/models/repo"
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/htmlutil"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/references"
@@ -234,17 +233,11 @@ func (r RoleInRepo) LocaleHelper(lang translation.Locale) string {
 	return lang.TrString("repo.issues.role." + string(r) + "_helper")
 }

-type SpecialDoerNameType string
-
-const SpecialDoerNameCodeOwners SpecialDoerNameType = "CODEOWNERS"
-
 // CommentMetaData stores metadata for a comment, these data will not be changed once inserted into database
 type CommentMetaData struct {
 	ProjectColumnID    int64  `json:"project_column_id,omitempty"`
 	ProjectColumnTitle string `json:"project_column_title,omitempty"`
 	ProjectTitle       string `json:"project_title,omitempty"`
-
-	SpecialDoerName SpecialDoerNameType `json:"special_doer_name,omitempty"` // e.g. "CODEOWNERS" for CODEOWNERS-triggered review requests
 }

 // Comment represents a comment in commit and issue page.
@@ -771,37 +764,6 @@ func (c *Comment) CodeCommentLink(ctx context.Context) string {
 	return fmt.Sprintf("%s/files#%s", c.Issue.Link(), c.HashTag())
 }

-func (c *Comment) MetaSpecialDoerTr(locale translation.Locale) template.HTML {
-	if c.CommentMetaData == nil {
-		return ""
-	}
-	if c.CommentMetaData.SpecialDoerName == SpecialDoerNameCodeOwners {
-		return locale.Tr("repo.issues.review.codeowners_rules")
-	}
-	return htmlutil.HTMLFormat("%s", c.CommentMetaData.SpecialDoerName)
-}
-
-func (c *Comment) TimelineRequestedReviewTr(locale translation.Locale, createdStr template.HTML) template.HTML {
-	if c.AssigneeID > 0 {
-		// it guarantees LoadAssigneeUserAndTeam has been called, and c.Assignee is Ghost user but not nil if the user doesn't exist
-		if c.RemovedAssignee {
-			if c.PosterID == c.AssigneeID {
-				return locale.Tr("repo.issues.review.remove_review_request_self", createdStr)
-			}
-			return locale.Tr("repo.issues.review.remove_review_request", c.Assignee.GetDisplayName(), createdStr)
-		}
-		return locale.Tr("repo.issues.review.add_review_request", c.Assignee.GetDisplayName(), createdStr)
-	}
-	teamName := "Ghost Team"
-	if c.AssigneeTeam != nil {
-		teamName = c.AssigneeTeam.Name
-	}
-	if c.RemovedAssignee {
-		return locale.Tr("repo.issues.review.remove_review_request", teamName, createdStr)
-	}
-	return locale.Tr("repo.issues.review.add_review_request", teamName, createdStr)
-}
-
 // CreateComment creates comment with context
 func CreateComment(ctx context.Context, opts *CreateCommentOptions) (_ *Comment, err error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
@@ -818,11 +780,6 @@ func CreateComment(ctx context.Context, opts *CreateCommentOptions) (_ *Comment,
 				ProjectTitle:       opts.ProjectTitle,
 			}
 		}
-		if opts.SpecialDoerName != "" {
-			commentMetaData = &CommentMetaData{
-				SpecialDoerName: opts.SpecialDoerName,
-			}
-		}

 		comment := &Comment{
 			Type:             opts.Type,
@@ -1019,7 +976,6 @@ type CreateCommentOptions struct {
 	RefIsPull          bool
 	IsForcePush        bool
 	Invalidated        bool
-	SpecialDoerName    SpecialDoerNameType // e.g. "CODEOWNERS" for CODEOWNERS-triggered review requests
 }

 // GetCommentByID returns the comment by given ID.
@@ -1034,20 +990,6 @@ func GetCommentByID(ctx context.Context, id int64) (*Comment, error) {
 	return c, nil
 }

-func GetCommentWithRepoID(ctx context.Context, repoID, commentID int64) (*Comment, error) {
-	c, err := GetCommentByID(ctx, commentID)
-	if err != nil {
-		return nil, err
-	}
-	if err := c.LoadIssue(ctx); err != nil {
-		return nil, err
-	}
-	if c.Issue.RepoID != repoID {
-		return nil, ErrCommentNotExist{commentID, 0}
-	}
-	return c, nil
-}
-
 // FindCommentsOptions describes the conditions to Find comments
 type FindCommentsOptions struct {
 	db.ListOptions
@@ -102,7 +102,6 @@ func findCodeComments(ctx context.Context, opts FindCommentsOptions, issue *Issu
 				continue
 			}
 			comment.Review = re
-			comment.Issue = issue
 		}
 		comments[n] = comment
 		n++
@@ -75,8 +75,6 @@ func init() {
 func (m *Milestone) BeforeUpdate() {
 	if m.NumIssues > 0 {
 		m.Completeness = m.NumClosedIssues * 100 / m.NumIssues
-	} else if m.IsClosed {
-		m.Completeness = 100
 	} else {
 		m.Completeness = 0
 	}
@@ -197,8 +195,8 @@ func UpdateMilestoneCounters(ctx context.Context, id int64) error {
 	if err != nil {
 		return err
 	}
-	_, err = e.Exec("UPDATE `milestone` SET completeness=(CASE WHEN is_closed = ? AND num_issues = 0 THEN 100 ELSE 100*num_closed_issues/(CASE WHEN num_issues > 0 THEN num_issues ELSE 1 END) END) WHERE id=?",
-		true, id,
+	_, err = e.Exec("UPDATE `milestone` SET completeness=100*num_closed_issues/(CASE WHEN num_issues > 0 THEN num_issues ELSE 1 END) WHERE id=?",
+		id,
 	)
 	return err
 }
@@ -242,11 +240,6 @@ func changeMilestoneStatus(ctx context.Context, m *Milestone, isClosed bool) err
 	if count < 1 {
 		return nil
 	}
-
-	if err := UpdateMilestoneCounters(ctx, m.ID); err != nil {
-		return err
-	}
-
 	return updateRepoMilestoneNum(ctx, m.RepoID)
 }

@@ -417,6 +417,10 @@ func (pr *PullRequest) GetGitHeadRefName() string {
 	return fmt.Sprintf("%s%d/head", git.PullPrefix, pr.Index)
 }

+func (pr *PullRequest) GetGitHeadBranchRefName() string {
+	return fmt.Sprintf("%s%s", git.BranchPrefix, pr.HeadBranch)
+}
+
 // GetReviewCommentsCount returns the number of review comments made on the diff of a PR review (not including comments on commits or issues in a PR)
 func (pr *PullRequest) GetReviewCommentsCount(ctx context.Context) int {
 	opts := FindCommentsOptions{
@@ -642,8 +646,9 @@ func (pr *PullRequest) UpdateCols(ctx context.Context, cols ...string) error {
 }

 // UpdateColsIfNotMerged updates specific fields of a pull request if it has not been merged
-func (pr *PullRequest) UpdateColsIfNotMerged(ctx context.Context, cols ...string) (int64, error) {
-	return db.GetEngine(ctx).Where("id = ? AND has_merged = ?", pr.ID, false).Cols(cols...).Update(pr)
+func (pr *PullRequest) UpdateColsIfNotMerged(ctx context.Context, cols ...string) error {
+	_, err := db.GetEngine(ctx).Where("id = ? AND has_merged = ?", pr.ID, false).Cols(cols...).Update(pr)
+	return err
 }

 // IsWorkInProgress determine if the Pull Request is a Work In Progress by its title
@@ -666,10 +671,9 @@ func HasWorkInProgressPrefix(title string) bool {
 	return false
 }

-// IsFilesConflicted determines if the Pull Request has changes conflicting with the target branch.
-// Sometimes a conflict may not list any files
+// IsFilesConflicted determines if the  Pull Request has changes conflicting with the target branch.
 func (pr *PullRequest) IsFilesConflicted() bool {
-	return pr.Status == PullRequestStatusConflict
+	return len(pr.ConflictedFiles) > 0
 }

 // GetWorkInProgressPrefix returns the prefix used to mark the pull request as a work in progress.
@@ -14,7 +14,6 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"

 	"xorm.io/builder"
@@ -325,26 +324,12 @@ func (prs PullRequestList) LoadReviews(ctx context.Context) (ReviewList, error)

 // HasMergedPullRequestInRepo returns whether the user(poster) has merged pull-request in the repo
 func HasMergedPullRequestInRepo(ctx context.Context, repoID, posterID int64) (bool, error) {
-	return HasMergedPullRequestInRepoBefore(ctx, repoID, posterID, 0, 0)
-}
-
-// HasMergedPullRequestInRepoBefore returns whether the user has a merged PR before a timestamp (0 = no limit)
-func HasMergedPullRequestInRepoBefore(ctx context.Context, repoID, posterID int64, beforeUnix timeutil.TimeStamp, excludePullID int64) (bool, error) {
-	sess := db.GetEngine(ctx).
+	return db.GetEngine(ctx).
 		Join("INNER", "pull_request", "pull_request.issue_id = issue.id").
 		Where("repo_id=?", repoID).
 		And("poster_id=?", posterID).
 		And("is_pull=?", true).
-		And("pull_request.has_merged=?", true)
-
-	if beforeUnix > 0 {
-		sess.And("pull_request.merged_unix < ?", beforeUnix)
-	}
-	if excludePullID > 0 {
-		sess.And("pull_request.id != ?", excludePullID)
-	}
-
-	return sess.
+		And("pull_request.has_merged=?", true).
 		Select("issue.id").
 		Limit(1).
 		Get(new(Issue))
@@ -130,7 +130,7 @@ func TestLoadRequestedReviewers(t *testing.T) {
 	user1, err := user_model.GetUserByID(t.Context(), 1)
 	assert.NoError(t, err)

-	comment, err := issues_model.AddReviewRequest(t.Context(), issue, user1, &user_model.User{}, false)
+	comment, err := issues_model.AddReviewRequest(t.Context(), issue, user1, &user_model.User{})
 	assert.NoError(t, err)
 	assert.NotNil(t, comment)

@@ -643,7 +643,7 @@ func InsertReviews(ctx context.Context, reviews []*Review) error {
 }

 // AddReviewRequest add a review request from one reviewer
-func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_model.User, isCodeOwners bool) (*Comment, error) {
+func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_model.User) (*Comment, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
 		sess := db.GetEngine(ctx)

@@ -702,7 +702,6 @@ func AddReviewRequest(ctx context.Context, issue *Issue, reviewer, doer *user_mo
 			RemovedAssignee: false,       // Use RemovedAssignee as !isRequest
 			AssigneeID:      reviewer.ID, // Use AssigneeID as reviewer ID
 			ReviewID:        review.ID,
-			SpecialDoerName: util.Iif(isCodeOwners, SpecialDoerNameCodeOwners, ""),
 		})
 		if err != nil {
 			return nil, err
@@ -768,7 +767,7 @@ func restoreLatestOfficialReview(ctx context.Context, issueID, reviewerID int64)
 }

 // AddTeamReviewRequest add a review request from one team
-func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organization.Team, doer *user_model.User, isCodeOwners bool) (*Comment, error) {
+func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organization.Team, doer *user_model.User) (*Comment, error) {
 	return db.WithTx2(ctx, func(ctx context.Context) (*Comment, error) {
 		review, err := GetTeamReviewerByIssueIDAndTeamID(ctx, issue.ID, reviewer.ID)
 		if err != nil && !IsErrReviewNotExist(err) {
@@ -813,7 +812,6 @@ func AddTeamReviewRequest(ctx context.Context, issue *Issue, reviewer *organizat
 			RemovedAssignee: false,       // Use RemovedAssignee as !isRequest
 			AssigneeTeamID:  reviewer.ID, // Use AssigneeTeamID as reviewer team ID
 			ReviewID:        review.ID,
-			SpecialDoerName: util.Iif(isCodeOwners, SpecialDoerNameCodeOwners, ""),
 		})
 		if err != nil {
 			return nil, fmt.Errorf("CreateComment(): %w", err)
@@ -321,28 +321,14 @@ func TestAddReviewRequest(t *testing.T) {
 	pull.HasMerged = false
 	assert.NoError(t, pull.UpdateCols(t.Context(), "has_merged"))
 	issue.IsClosed = true
-	_, err = issues_model.AddReviewRequest(t.Context(), issue, reviewer, &user_model.User{}, false)
+	_, err = issues_model.AddReviewRequest(t.Context(), issue, reviewer, &user_model.User{})
 	assert.Error(t, err)
 	assert.True(t, issues_model.IsErrReviewRequestOnClosedPR(err))

 	pull.HasMerged = true
 	assert.NoError(t, pull.UpdateCols(t.Context(), "has_merged"))
 	issue.IsClosed = false
-	_, err = issues_model.AddReviewRequest(t.Context(), issue, reviewer, &user_model.User{}, false)
+	_, err = issues_model.AddReviewRequest(t.Context(), issue, reviewer, &user_model.User{})
 	assert.Error(t, err)
 	assert.True(t, issues_model.IsErrReviewRequestOnClosedPR(err))
-
-	// Test CODEOWNERS review request stores metadata correctly
-	pull2 := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 2})
-	assert.NoError(t, pull2.LoadIssue(t.Context()))
-	issue2 := pull2.Issue
-	assert.NoError(t, issue2.LoadRepo(t.Context()))
-	reviewer2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 7})
-	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
-
-	comment, err := issues_model.AddReviewRequest(t.Context(), issue2, reviewer2, doer, true)
-	assert.NoError(t, err)
-	assert.NotNil(t, comment)
-	assert.NotNil(t, comment.CommentMetaData)
-	assert.Equal(t, issues_model.SpecialDoerNameCodeOwners, comment.CommentMetaData.SpecialDoerName)
 }
@@ -5,14 +5,21 @@ package base

 import (
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
+	"os"
+	"path"
 	"reflect"
 	"regexp"
 	"strings"
+	"time"

+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"

 	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
@@ -508,3 +515,114 @@ func ModifyColumn(x *xorm.Engine, tableName string, col *schemas.Column) error {
 	}
 	return nil
 }
+
+func removeAllWithRetry(dir string) error {
+	var err error
+	for range 20 {
+		err = os.RemoveAll(dir)
+		if err == nil {
+			break
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	return err
+}
+
+func newXORMEngine() (*xorm.Engine, error) {
+	if err := db.InitEngine(context.Background()); err != nil {
+		return nil, err
+	}
+	x := unittest.GetXORMEngine()
+	return x, nil
+}
+
+func deleteDB() error {
+	switch {
+	case setting.Database.Type.IsSQLite3():
+		if err := util.Remove(setting.Database.Path); err != nil {
+			return err
+		}
+		return os.MkdirAll(path.Dir(setting.Database.Path), os.ModePerm)
+
+	case setting.Database.Type.IsMySQL():
+		db, err := sql.Open("mysql", fmt.Sprintf("%s:%s@tcp(%s)/",
+			setting.Database.User, setting.Database.Passwd, setting.Database.Host))
+		if err != nil {
+			return err
+		}
+		defer db.Close()
+
+		if _, err = db.Exec("DROP DATABASE IF EXISTS " + setting.Database.Name); err != nil {
+			return err
+		}
+
+		if _, err = db.Exec("CREATE DATABASE IF NOT EXISTS " + setting.Database.Name); err != nil {
+			return err
+		}
+		return nil
+	case setting.Database.Type.IsPostgreSQL():
+		db, err := sql.Open("postgres", fmt.Sprintf("postgres://%s:%s@%s/?sslmode=%s",
+			setting.Database.User, setting.Database.Passwd, setting.Database.Host, setting.Database.SSLMode))
+		if err != nil {
+			return err
+		}
+		defer db.Close()
+
+		if _, err = db.Exec("DROP DATABASE IF EXISTS " + setting.Database.Name); err != nil {
+			return err
+		}
+
+		if _, err = db.Exec("CREATE DATABASE " + setting.Database.Name); err != nil {
+			return err
+		}
+		db.Close()
+
+		// Check if we need to setup a specific schema
+		if len(setting.Database.Schema) != 0 {
+			db, err = sql.Open("postgres", fmt.Sprintf("postgres://%s:%s@%s/%s?sslmode=%s",
+				setting.Database.User, setting.Database.Passwd, setting.Database.Host, setting.Database.Name, setting.Database.SSLMode))
+			if err != nil {
+				return err
+			}
+			defer db.Close()
+
+			schrows, err := db.Query(fmt.Sprintf("SELECT 1 FROM information_schema.schemata WHERE schema_name = '%s'", setting.Database.Schema))
+			if err != nil {
+				return err
+			}
+			defer schrows.Close()
+
+			if !schrows.Next() {
+				// Create and setup a DB schema
+				_, err = db.Exec("CREATE SCHEMA " + setting.Database.Schema)
+				if err != nil {
+					return err
+				}
+			}
+
+			// Make the user's default search path the created schema; this will affect new connections
+			_, err = db.Exec(fmt.Sprintf(`ALTER USER "%s" SET search_path = %s`, setting.Database.User, setting.Database.Schema))
+			if err != nil {
+				return err
+			}
+			return nil
+		}
+	case setting.Database.Type.IsMSSQL():
+		host, port := setting.ParseMSSQLHostPort(setting.Database.Host)
+		db, err := sql.Open("mssql", fmt.Sprintf("server=%s; port=%s; database=%s; user id=%s; password=%s;",
+			host, port, "master", setting.Database.User, setting.Database.Passwd))
+		if err != nil {
+			return err
+		}
+		defer db.Close()
+
+		if _, err = db.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS [%s]", setting.Database.Name)); err != nil {
+			return err
+		}
+		if _, err = db.Exec(fmt.Sprintf("CREATE DATABASE [%s]", setting.Database.Name)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
@@ -11,10 +11,6 @@ import (
 	"xorm.io/xorm/names"
 )

-func TestMain(m *testing.M) {
-	MainTest(m)
-}
-
 func Test_DropTableColumns(t *testing.T) {
 	x, deferable := PrepareTestEnv(t, 0)
 	if x == nil || t.Failed() {
@@ -0,0 +1,12 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package base
+
+import (
+	"testing"
+)
+
+func TestMain(m *testing.M) {
+	MainTest(m)
+}
@@ -4,140 +4,25 @@
 package base

 import (
-	"database/sql"
 	"fmt"
 	"os"
-	"path"
 	"path/filepath"
+	"runtime"
 	"testing"
-	"time"

-	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/unittest"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/tempdir"
+	"code.gitea.io/gitea/modules/test"
 	"code.gitea.io/gitea/modules/testlogger"
-	"code.gitea.io/gitea/modules/util"

 	"github.com/stretchr/testify/require"
 	"xorm.io/xorm"
-	"xorm.io/xorm/schemas"
 )

 // FIXME: this file shouldn't be in a normal package, it should only be compiled for tests

-func removeAllWithRetry(dir string) error {
-	var err error
-	for range 20 {
-		err = os.RemoveAll(dir)
-		if err == nil {
-			break
-		}
-		time.Sleep(100 * time.Millisecond)
-	}
-	return err
-}
-
-func newXORMEngine(t *testing.T) (*xorm.Engine, error) {
-	if err := db.InitEngine(t.Context()); err != nil {
-		return nil, err
-	}
-	x := unittest.GetXORMEngine()
-	return x, nil
-}
-
-func deleteDB() error {
-	switch {
-	case setting.Database.Type.IsSQLite3():
-		if err := util.Remove(setting.Database.Path); err != nil {
-			return err
-		}
-		return os.MkdirAll(path.Dir(setting.Database.Path), os.ModePerm)
-
-	case setting.Database.Type.IsMySQL():
-		db, err := sql.Open("mysql", fmt.Sprintf("%s:%s@tcp(%s)/",
-			setting.Database.User, setting.Database.Passwd, setting.Database.Host))
-		if err != nil {
-			return err
-		}
-		defer db.Close()
-
-		if _, err = db.Exec("DROP DATABASE IF EXISTS " + setting.Database.Name); err != nil {
-			return err
-		}
-
-		if _, err = db.Exec("CREATE DATABASE IF NOT EXISTS " + setting.Database.Name); err != nil {
-			return err
-		}
-		return nil
-	case setting.Database.Type.IsPostgreSQL():
-		db, err := sql.Open("postgres", fmt.Sprintf("postgres://%s:%s@%s/?sslmode=%s",
-			setting.Database.User, setting.Database.Passwd, setting.Database.Host, setting.Database.SSLMode))
-		if err != nil {
-			return err
-		}
-		defer db.Close()
-
-		if _, err = db.Exec("DROP DATABASE IF EXISTS " + setting.Database.Name); err != nil {
-			return err
-		}
-
-		if _, err = db.Exec("CREATE DATABASE " + setting.Database.Name); err != nil {
-			return err
-		}
-		db.Close()
-
-		// Check if we need to setup a specific schema
-		if len(setting.Database.Schema) != 0 {
-			db, err = sql.Open("postgres", fmt.Sprintf("postgres://%s:%s@%s/%s?sslmode=%s",
-				setting.Database.User, setting.Database.Passwd, setting.Database.Host, setting.Database.Name, setting.Database.SSLMode))
-			if err != nil {
-				return err
-			}
-			defer db.Close()
-
-			schrows, err := db.Query(fmt.Sprintf("SELECT 1 FROM information_schema.schemata WHERE schema_name = '%s'", setting.Database.Schema))
-			if err != nil {
-				return err
-			}
-			defer schrows.Close()
-
-			if !schrows.Next() {
-				// Create and setup a DB schema
-				_, err = db.Exec("CREATE SCHEMA " + setting.Database.Schema)
-				if err != nil {
-					return err
-				}
-			}
-
-			// Make the user's default search path the created schema; this will affect new connections
-			_, err = db.Exec(fmt.Sprintf(`ALTER USER "%s" SET search_path = %s`, setting.Database.User, setting.Database.Schema))
-			if err != nil {
-				return err
-			}
-			return nil
-		}
-	case setting.Database.Type.IsMSSQL():
-		host, port := setting.ParseMSSQLHostPort(setting.Database.Host)
-		db, err := sql.Open("mssql", fmt.Sprintf("server=%s; port=%s; database=%s; user id=%s; password=%s;",
-			host, port, "master", setting.Database.User, setting.Database.Passwd))
-		if err != nil {
-			return err
-		}
-		defer db.Close()
-
-		if _, err = db.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS [%s]", setting.Database.Name)); err != nil {
-			return err
-		}
-		if _, err = db.Exec(fmt.Sprintf("CREATE DATABASE [%s]", setting.Database.Name)); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
 // PrepareTestEnv prepares the test environment and reset the database. The skip parameter should usually be 0.
 // Provide models to be sync'd with the database - in particular any models you expect fixtures to be loaded from.
 //
@@ -154,7 +39,7 @@ func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, fu
 		return nil, deferFn
 	}

-	x, err := newXORMEngine(t)
+	x, err := newXORMEngine()
 	require.NoError(t, err)
 	if x != nil {
 		oldDefer := deferFn
@@ -203,19 +88,30 @@ func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, fu
 	return x, deferFn
 }

-func LoadTableSchemasMap(t *testing.T, x *xorm.Engine) map[string]*schemas.Table {
-	tables, err := x.DBMetas()
-	require.NoError(t, err)
-	tableMap := make(map[string]*schemas.Table)
-	for _, table := range tables {
-		tableMap[table.Name] = table
-	}
-	return tableMap
-}
-
 func MainTest(m *testing.M) {
 	testlogger.Init()
-	setting.SetupGiteaTestEnv()
+
+	giteaRoot := test.SetupGiteaRoot()
+	giteaBinary := "gitea"
+	if runtime.GOOS == "windows" {
+		giteaBinary += ".exe"
+	}
+	setting.AppPath = filepath.Join(giteaRoot, giteaBinary)
+	if _, err := os.Stat(setting.AppPath); err != nil {
+		testlogger.Fatalf("Could not find gitea binary at %s\n", setting.AppPath)
+	}
+
+	giteaConf := os.Getenv("GITEA_CONF")
+	if giteaConf == "" {
+		giteaConf = filepath.Join(filepath.Dir(setting.AppPath), "tests/sqlite.ini")
+		_, _ = fmt.Fprintf(os.Stderr, "Environment variable $GITEA_CONF not set - defaulting to %s\n", giteaConf)
+	}
+
+	if !filepath.IsAbs(giteaConf) {
+		setting.CustomConf = filepath.Join(giteaRoot, giteaConf)
+	} else {
+		setting.CustomConf = giteaConf
+	}

 	tmpDataPath, cleanup, err := tempdir.OsTempDir("gitea-test").MkdirTempRandom("data")
 	if err != nil {
@@ -223,6 +119,7 @@ func MainTest(m *testing.M) {
 	}
 	defer cleanup()

+	setting.CustomPath = filepath.Join(setting.AppWorkPath, "custom")
 	setting.AppDataPath = tmpDataPath

 	unittest.InitSettingsForTesting()
@@ -25,7 +25,6 @@ import (
 	"code.gitea.io/gitea/models/migrations/v1_23"
 	"code.gitea.io/gitea/models/migrations/v1_24"
 	"code.gitea.io/gitea/models/migrations/v1_25"
-	"code.gitea.io/gitea/models/migrations/v1_26"
 	"code.gitea.io/gitea/models/migrations/v1_6"
 	"code.gitea.io/gitea/models/migrations/v1_7"
 	"code.gitea.io/gitea/models/migrations/v1_8"
@@ -380,8 +379,8 @@ func prepareMigrationTasks() []*migration {
 		newMigration(309, "Improve Notification table indices", v1_23.ImproveNotificationTableIndices),
 		newMigration(310, "Add Priority to ProtectedBranch", v1_23.AddPriorityToProtectedBranch),
 		newMigration(311, "Add TimeEstimate to Issue table", v1_23.AddTimeEstimateColumnToIssueTable),
-		// Gitea 1.23.0-rc0 ends at migration ID number 311 (database version 312)

+		// Gitea 1.23.0-rc0 ends at migration ID number 311 (database version 312)
 		newMigration(312, "Add DeleteBranchAfterMerge to AutoMerge", v1_24.AddDeleteBranchAfterMergeForAutoMerge),
 		newMigration(313, "Move PinOrder from issue table to a new table issue_pin", v1_24.MovePinOrderToTableIssuePin),
 		newMigration(314, "Update OwnerID as zero for repository level action tables", v1_24.UpdateOwnerIDOfRepoLevelActionsTables),
@@ -391,15 +390,10 @@ func prepareMigrationTasks() []*migration {
 		newMigration(318, "Add anonymous_access_mode for repo_unit", v1_24.AddRepoUnitAnonymousAccessMode),
 		newMigration(319, "Add ExclusiveOrder to Label table", v1_24.AddExclusiveOrderColumnToLabelTable),
 		newMigration(320, "Migrate two_factor_policy to login_source table", v1_24.MigrateSkipTwoFactor),
-		// Gitea 1.24.0 ends at migration ID number 320 (database version 321)

+		// Gitea 1.24.0 ends at database version 321
 		newMigration(321, "Use LONGTEXT for some columns and fix review_state.updated_files column", v1_25.UseLongTextInSomeColumnsAndFixBugs),
 		newMigration(322, "Extend comment tree_path length limit", v1_25.ExtendCommentTreePathLength),
-		// Gitea 1.25.0 ends at migration ID number 322 (database version 323)
-
-		newMigration(323, "Add support for actions concurrency", v1_26.AddActionsConcurrency),
-		newMigration(324, "Fix closed milestone completeness for milestones with no issues", v1_26.FixClosedMilestoneCompleteness),
-		newMigration(325, "Fix missed repo_id when migrate attachments", v1_26.FixMissedRepoIDWhenMigrateAttachments),
 	}
 	return preparedMigrations
 }
@@ -84,17 +84,17 @@ func FixMergeBase(ctx context.Context, x *xorm.Engine) error {

 			if !pr.HasMerged {
 				var err error
-				pr.MergeBase, _, err = gitcmd.NewCommand("merge-base").AddDashesAndList(pr.BaseBranch, gitRefName).WithDir(repoPath).RunStdString(ctx)
+				pr.MergeBase, _, err = gitcmd.NewCommand("merge-base").AddDashesAndList(pr.BaseBranch, gitRefName).RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
 				if err != nil {
 					var err2 error
-					pr.MergeBase, _, err2 = gitcmd.NewCommand("rev-parse").AddDynamicArguments(git.BranchPrefix + pr.BaseBranch).WithDir(repoPath).RunStdString(ctx)
+					pr.MergeBase, _, err2 = gitcmd.NewCommand("rev-parse").AddDynamicArguments(git.BranchPrefix+pr.BaseBranch).RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
 					if err2 != nil {
 						log.Error("Unable to get merge base for PR ID %d, Index %d in %s/%s. Error: %v & %v", pr.ID, pr.Index, baseRepo.OwnerName, baseRepo.Name, err, err2)
 						continue
 					}
 				}
 			} else {
-				parentsString, _, err := gitcmd.NewCommand("rev-list", "--parents", "-n", "1").AddDynamicArguments(pr.MergedCommitID).WithDir(repoPath).RunStdString(ctx)
+				parentsString, _, err := gitcmd.NewCommand("rev-list", "--parents", "-n", "1").AddDynamicArguments(pr.MergedCommitID).RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
 				if err != nil {
 					log.Error("Unable to get parents for merged PR ID %d, Index %d in %s/%s. Error: %v", pr.ID, pr.Index, baseRepo.OwnerName, baseRepo.Name, err)
 					continue
@@ -108,7 +108,7 @@ func FixMergeBase(ctx context.Context, x *xorm.Engine) error {
 				refs = append(refs, gitRefName)
 				cmd := gitcmd.NewCommand("merge-base").AddDashesAndList(refs...)

-				pr.MergeBase, _, err = cmd.WithDir(repoPath).RunStdString(ctx)
+				pr.MergeBase, _, err = cmd.RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
 				if err != nil {
 					log.Error("Unable to get merge base for merged PR ID %d, Index %d in %s/%s. Error: %v", pr.ID, pr.Index, baseRepo.OwnerName, baseRepo.Name, err)
 					continue
@@ -80,7 +80,7 @@ func RefixMergeBase(ctx context.Context, x *xorm.Engine) error {

 			gitRefName := fmt.Sprintf("refs/pull/%d/head", pr.Index)

-			parentsString, _, err := gitcmd.NewCommand("rev-list", "--parents", "-n", "1").AddDynamicArguments(pr.MergedCommitID).WithDir(repoPath).RunStdString(ctx)
+			parentsString, _, err := gitcmd.NewCommand("rev-list", "--parents", "-n", "1").AddDynamicArguments(pr.MergedCommitID).RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
 			if err != nil {
 				log.Error("Unable to get parents for merged PR ID %d, Index %d in %s/%s. Error: %v", pr.ID, pr.Index, baseRepo.OwnerName, baseRepo.Name, err)
 				continue
@@ -95,7 +95,7 @@ func RefixMergeBase(ctx context.Context, x *xorm.Engine) error {
 			refs = append(refs, gitRefName)
 			cmd := gitcmd.NewCommand("merge-base").AddDashesAndList(refs...)

-			pr.MergeBase, _, err = cmd.WithDir(repoPath).RunStdString(ctx)
+			pr.MergeBase, _, err = cmd.RunStdString(ctx, &gitcmd.RunOpts{Dir: repoPath})
 			if err != nil {
 				log.Error("Unable to get merge base for merged PR ID %d, Index %d in %s/%s. Error: %v", pr.ID, pr.Index, baseRepo.OwnerName, baseRepo.Name, err)
 				continue
@@ -6,10 +6,11 @@ package v1_12
 import (
 	"fmt"
 	"math"
+	"path/filepath"
+	"strings"
 	"time"

-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
+	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -84,9 +85,12 @@ func AddCommitDivergenceToPulls(x *xorm.Engine) error {
 				log.Error("Missing base repo with id %d for PR ID %d", pr.BaseRepoID, pr.ID)
 				continue
 			}
-			repoStore := repo_model.StorageRepo(repo_model.RelativePath(baseRepo.OwnerName, baseRepo.Name))
+			userPath := filepath.Join(setting.RepoRootPath, strings.ToLower(baseRepo.OwnerName))
+			repoPath := filepath.Join(userPath, strings.ToLower(baseRepo.Name)+".git")
+
 			gitRefName := fmt.Sprintf("refs/pull/%d/head", pr.Index)
-			divergence, err := gitrepo.GetDivergingCommits(graceful.GetManager().HammerContext(), repoStore, pr.BaseBranch, gitRefName)
+
+			divergence, err := git.GetDivergingCommits(graceful.GetManager().HammerContext(), repoPath, pr.BaseBranch, gitRefName)
 			if err != nil {
 				log.Warn("Could not recalculate Divergence for pull: %d", pr.ID)
 				pr.CommitsAhead = 0
@@ -5,10 +5,14 @@ package v1_21

 import (
 	"context"
+	"fmt"
+	"path/filepath"
+	"strings"

-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
+	"code.gitea.io/gitea/modules/git"
+	giturl "code.gitea.io/gitea/modules/git/url"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"

 	"xorm.io/xorm"
 )
@@ -159,13 +163,16 @@ func migratePushMirrors(x *xorm.Engine) error {
 }

 func getRemoteAddress(ownerName, repoName, remoteName string) (string, error) {
-	ctx := context.Background()
-	relativePath := repo_model.RelativePath(ownerName, repoName)
-	if exist, _ := gitrepo.IsRepositoryExist(ctx, repo_model.StorageRepo(relativePath)); !exist {
+	repoPath := filepath.Join(setting.RepoRootPath, strings.ToLower(ownerName), strings.ToLower(repoName)+".git")
+	if exist, _ := util.IsExist(repoPath); !exist {
 		return "", nil
 	}
+	remoteURL, err := git.GetRemoteAddress(context.Background(), repoPath, remoteName)
+	if err != nil {
+		return "", fmt.Errorf("get remote %s's address of %s/%s failed: %v", remoteName, ownerName, repoName, err)
+	}

-	u, err := gitrepo.GitRemoteGetURL(ctx, repo_model.StorageRepo(relativePath), remoteName)
+	u, err := giturl.ParseGitURL(remoteURL)
 	if err != nil {
 		return "", err
 	}
@@ -11,7 +11,6 @@ import (
 	"code.gitea.io/gitea/modules/timeutil"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func Test_UseLongTextInSomeColumnsAndFixBugs(t *testing.T) {
@@ -39,26 +38,33 @@ func Test_UseLongTextInSomeColumnsAndFixBugs(t *testing.T) {
 	type Notice struct {
 		ID          int64 `xorm:"pk autoincr"`
 		Type        int
-		Description string             `xorm:"TEXT"`
+		Description string             `xorm:"LONGTEXT"`
 		CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 	}

 	// Prepare and load the testing database
-	x, deferrable := base.PrepareTestEnv(t, 0, new(ReviewState), new(PackageProperty), new(Notice))
-	defer deferrable()
+	x, deferable := base.PrepareTestEnv(t, 0, new(ReviewState), new(PackageProperty), new(Notice))
+	defer deferable()

-	require.NoError(t, UseLongTextInSomeColumnsAndFixBugs(x))
+	assert.NoError(t, UseLongTextInSomeColumnsAndFixBugs(x))

-	tables := base.LoadTableSchemasMap(t, x)
-	table := tables["review_state"]
-	column := table.GetColumn("updated_files")
-	assert.Equal(t, "LONGTEXT", column.SQLType.Name)
+	tables, err := x.DBMetas()
+	assert.NoError(t, err)

-	table = tables["package_property"]
-	column = table.GetColumn("value")
-	assert.Equal(t, "LONGTEXT", column.SQLType.Name)
-
-	table = tables["notice"]
-	column = table.GetColumn("description")
-	assert.Equal(t, "LONGTEXT", column.SQLType.Name)
+	for _, table := range tables {
+		switch table.Name {
+		case "review_state":
+			column := table.GetColumn("updated_files")
+			assert.NotNil(t, column)
+			assert.Equal(t, "LONGTEXT", column.SQLType.Name)
+		case "package_property":
+			column := table.GetColumn("value")
+			assert.NotNil(t, column)
+			assert.Equal(t, "LONGTEXT", column.SQLType.Name)
+		case "notice":
+			column := table.GetColumn("description")
+			assert.NotNil(t, column)
+			assert.Equal(t, "LONGTEXT", column.SQLType.Name)
+		}
+	}
 }
@@ -1,34 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_25
-
-import (
-	"testing"
-
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/setting"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_ExtendCommentTreePathLength(t *testing.T) {
-	if setting.Database.Type.IsSQLite3() {
-		t.Skip("For SQLITE, varchar or char will always be represented as TEXT")
-	}
-
-	type Comment struct {
-		ID       int64  `xorm:"pk autoincr"`
-		TreePath string `xorm:"VARCHAR(255)"`
-	}
-
-	x, deferrable := base.PrepareTestEnv(t, 0, new(Comment))
-	defer deferrable()
-
-	require.NoError(t, ExtendCommentTreePathLength(x))
-	table := base.LoadTableSchemasMap(t, x)["comment"]
-	column := table.GetColumn("tree_path")
-	assert.Contains(t, []string{"NVARCHAR", "VARCHAR"}, column.SQLType.Name)
-	assert.EqualValues(t, 4000, column.Length)
-}
@@ -1,14 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_26
-
-import (
-	"testing"
-
-	"code.gitea.io/gitea/models/migrations/base"
-)
-
-func TestMain(m *testing.M) {
-	base.MainTest(m)
-}
@@ -1,43 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v1_26
-
-import (
-	"xorm.io/xorm"
-)
-
-func AddActionsConcurrency(x *xorm.Engine) error {
-	type ActionRun struct {
-		RepoID            int64 `xorm:"index(repo_concurrency)"`
-		RawConcurrency    string
-		ConcurrencyGroup  string `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"`
-		ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`
-	}
-
-	if _, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-	}, new(ActionRun)); err != nil {
-		return err
-	}
-
-	if err := x.Sync(new(ActionRun)); err != nil {
-		return err
-	}
-
-	type ActionRunJob struct {
-		RepoID                 int64 `xorm:"index(repo_concurrency)"`
-		RawConcurrency         string
-		IsConcurrencyEvaluated bool
-		ConcurrencyGroup       string `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"`
-		ConcurrencyCancel      bool   `xorm:"NOT NULL DEFAULT FALSE"`
-	}
-
-	if _, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-	}, new(ActionRunJob)); err != nil {
-		return err
-	}
-
-	return nil
-}
--- a/Show More
+++ b/Show More