mirror of
https://github.com/go-gitea/gitea.git
synced 2026-06-30 06:41:26 +00:00
## Summary This PR adds **scoped workflows** to Gitea Actions. Workflows defined centrally in a "source" repository that automatically run on every repository in scope: an organization's repositories, or (for instance admins) every repository on the instance. Each scoped run executes in the consuming repository's own context (its runners, secrets, and branch) while its content is read from the source repository, so an org or instance can mandate shared CI across many repositories without copying workflow files into each one. An owner or instance admin registers source repositories on a settings page and can mark individual workflows as **required**. A required scoped workflow cannot be opted out by a consuming repository and gates its pull-request merges; an optional one can be disabled per repository. Scoped workflows live under a dedicated `SCOPED_WORKFLOW_DIRS` (default `.gitea/scoped_workflows`), kept separate from regular `WORKFLOW_DIRS`. ## Main changes ### Configuration New `SCOPED_WORKFLOW_DIRS` setting, validated to not overlap with `WORKFLOW_DIRS`. Default: `.gitea/scoped_workflows` ### Data model & migration - New `action_scoped_workflow_source` table mapping a registering owner (`owner_id`, where `0` = instance-level) to a source repository, with a per-workflow `WorkflowConfigs` map. - `ActionRun` gains `WorkflowRepoID` / `WorkflowCommitSHA` (the pinned content source) and an `IsScopedRun` flag. ### Detection & run creation On consumer events, scoped workflows from the effective sources (the owner's own sources plus instance-level ones) are matched and turned into runs that execute in the consumer's context, with content pinned to the source repo's default-branch commit. `on: workflow_run` and `on: schedule` are currently not supported. ### Opt-out A consuming repository can disable an optional scoped workflow (tracked separately from regular `DisabledWorkflows`); required scoped workflows can never be disabled, opted out, or bypassed. ### Commit status A scoped run's status context format is `"<source repo full name>: <workflow display name> / <job> (<event>)"` (for example: `my-org/scoped-workflows: db-tests / test-sqlite (pull_request)`), keeping it distinct from a same-named repo-level workflow and from other sources. ### Required status checks Admins mark workflows required and supply status-check patterns. `EffectiveRequiredContexts` appends those patterns to the branch protection's required contexts and they are matched must-present-and-pass. If the status checks from scoped workflows fail, the PR cannot be merged. NOTE: scoped workflows' required status checks patterns can protect any target branch that has a protection rule, even though the rule's "Status Check" is disabled. A target branch with no protection rule cannot be protected. <details> <summary>Screenshots</summary> <img width="1400" alt="image" src="https://github.com/user-attachments/assets/a5d1db33-15ec-487e-93be-2bc04b4e6643" /> </details> ### Reusable workflows (`uses:`) A scoped workflow's local `uses: ./...` resolves against the source repository. `uses:` directory validation honors the instance-configurable `WORKFLOW_DIRS` and `SCOPED_WORKFLOW_DIRS` (previously hardcoded to `.gitea`/`.github/workflows`). ### Manual dispatch `workflow_dispatch` is supported for scoped workflows (web and API), resolving inputs/content from the source repo. ### Performance A process-local LRU cache keyed by source repo ID for the per-source workflow parse, so instance-level and owner-level sources don't open the source repo and parse workflow files on every event. ### UI Org / user / admin pages to register and remove sources, search repositories, and mark workflows required with their status-check patterns. The repository Actions sidebar groups scoped workflows by source with owner/instance labels and required/disabled badges. <details> <summary>Screenshots</summary> Scoped workflows setting page: <img width="1600" alt="image" src="https://github.com/user-attachments/assets/9d19f667-97a5-4935-92b2-e53f105e3642" /> Consumer repo's Actions runs list: <img width="1600" alt="image" src="https://github.com/user-attachments/assets/a77241f9-0aa9-41aa-ba73-12a9a688cb64" /> - `Owner`: this is a owner-level scoped workflows source repo - `Global`: this is a global scoped workflows source repo - `Required`: this scoped workflow is required, repo admin cannot disable it </details> --- Docs: https://gitea.com/gitea/docs/pulls/447 --------- Co-authored-by: bircni <bircni@icloud.com>
173 lines
7.9 KiB
TypeScript
173 lines
7.9 KiB
TypeScript
import {GET, POST} from '../modules/fetch.ts';
|
|
import {showGlobalErrorMessage} from '../modules/errors.ts';
|
|
import {fomanticQuery} from '../modules/fomantic/base.ts';
|
|
import {initTabSwitcher} from '../modules/fomantic/tab.ts';
|
|
import {addDelegatedEventListener, queryElems} from '../utils/dom.ts';
|
|
import {registerGlobalInitFunc, registerGlobalSelectorFunc} from '../modules/observer.ts';
|
|
import {initAvatarUploaderWithCropper} from './comp/Cropper.ts';
|
|
import {initCompSearchRepoBox} from './comp/SearchRepoBox.ts';
|
|
import {initScopedWorkflowRequired} from './comp/ScopedWorkflows.ts';
|
|
|
|
const {appUrl, appSubUrl} = window.config;
|
|
|
|
function initHeadNavbarContentToggle() {
|
|
const navbar = document.querySelector('#navbar');
|
|
const btn = document.querySelector('#navbar-expand-toggle');
|
|
if (!navbar || !btn) return;
|
|
|
|
btn.addEventListener('click', () => {
|
|
const isExpanded = btn.classList.contains('active');
|
|
navbar.classList.toggle('navbar-menu-open', !isExpanded);
|
|
btn.classList.toggle('active', !isExpanded);
|
|
});
|
|
}
|
|
|
|
function initFooterLanguageMenu() {
|
|
document.querySelector('.ui.dropdown .menu.language-menu')?.addEventListener('click', async (e) => {
|
|
const item = (e.target as HTMLElement).closest('.item');
|
|
if (!item) return;
|
|
e.preventDefault();
|
|
await GET(item.getAttribute('data-url')!);
|
|
window.location.reload();
|
|
});
|
|
}
|
|
|
|
function initFooterThemeSelector() {
|
|
const elDropdown = document.querySelector('#footer-theme-selector');
|
|
if (!elDropdown) return; // some pages don't have footer, for example: 500.tmpl
|
|
const $dropdown = fomanticQuery(elDropdown);
|
|
$dropdown.dropdown({
|
|
direction: 'upward',
|
|
apiSettings: {url: `${appSubUrl}/-/web-theme/list`, cache: false},
|
|
});
|
|
addDelegatedEventListener(elDropdown, 'click', '.menu > .item', async (el) => {
|
|
const themeName = el.getAttribute('data-value')!;
|
|
await POST(`${appSubUrl}/-/web-theme/apply?theme=${encodeURIComponent(themeName)}`);
|
|
window.location.reload();
|
|
});
|
|
}
|
|
|
|
export function initCommmPageComponents() {
|
|
initHeadNavbarContentToggle();
|
|
initFooterLanguageMenu();
|
|
initFooterThemeSelector();
|
|
}
|
|
|
|
export function initGlobalDropdown() {
|
|
// do not init "custom" dropdowns, "custom" dropdowns are managed by their own code.
|
|
registerGlobalSelectorFunc('.ui.dropdown:not(.custom)', (el) => {
|
|
const $dropdown = fomanticQuery(el);
|
|
if ($dropdown.data('module-dropdown')) return; // do not re-init if other code has already initialized it.
|
|
|
|
$dropdown.dropdown('setting', {hideDividers: 'empty'});
|
|
|
|
if (el.classList.contains('jump')) {
|
|
// The "jump" means this dropdown is mainly used for "menu" purpose,
|
|
// clicking an item will jump to somewhere else or trigger an action/function.
|
|
// When a dropdown is used for non-refresh actions with tippy,
|
|
// it must have this "jump" class to hide the tippy when dropdown is closed.
|
|
$dropdown.dropdown('setting', {
|
|
action: 'hide',
|
|
onShow() {
|
|
// hide associated tooltip while dropdown is open
|
|
this._tippy?.hide();
|
|
this._tippy?.disable();
|
|
},
|
|
onHide() {
|
|
this._tippy?.enable();
|
|
// eslint-disable-next-line unicorn/no-this-assignment
|
|
const elDropdown = this;
|
|
|
|
// hide all tippy elements of items after a while. eg: use Enter to click "Copy Link" in the Issue Context Menu
|
|
setTimeout(() => {
|
|
const $dropdown = fomanticQuery(elDropdown);
|
|
if ($dropdown.dropdown('is hidden')) {
|
|
queryElems(elDropdown, '.menu > .item', (el) => el._tippy?.hide());
|
|
}
|
|
}, 2000);
|
|
},
|
|
});
|
|
}
|
|
|
|
// Special popup-directions, prevent Fomantic from guessing the popup direction.
|
|
// With default "direction: auto", if the viewport height is small, Fomantic would show the popup upward,
|
|
// if the dropdown is at the beginning of the page, then the top part would be clipped by the window view.
|
|
// eg: Issue List "Sort" dropdown
|
|
// But we can not set "direction: downward" for all dropdowns, because there is a bug in dropdown menu positioning when calculating the "left" position,
|
|
// which would make some dropdown popups slightly shift out of the right viewport edge in some cases.
|
|
// eg: the "Create New Repo" menu on the navbar.
|
|
if (el.classList.contains('upward')) $dropdown.dropdown('setting', 'direction', 'upward');
|
|
if (el.classList.contains('downward')) $dropdown.dropdown('setting', 'direction', 'downward');
|
|
});
|
|
}
|
|
|
|
export function initGlobalComponent() {
|
|
registerGlobalInitFunc('initTabSwitcher', initTabSwitcher);
|
|
registerGlobalInitFunc('initAvatarUploader', initAvatarUploaderWithCropper);
|
|
registerGlobalInitFunc('initSearchRepoBox', initCompSearchRepoBox);
|
|
registerGlobalInitFunc('initScopedWorkflowRequired', initScopedWorkflowRequired);
|
|
}
|
|
|
|
// for performance considerations, it only uses performant syntax
|
|
function attachInputDirAuto(el: Partial<HTMLInputElement | HTMLTextAreaElement>) {
|
|
if (el.type !== 'hidden' &&
|
|
el.type !== 'checkbox' &&
|
|
el.type !== 'radio' &&
|
|
el.type !== 'range' &&
|
|
el.type !== 'color') {
|
|
el.dir = 'auto';
|
|
}
|
|
}
|
|
|
|
function autoFocusEnd(el: HTMLInputElement | HTMLTextAreaElement) {
|
|
el.focus();
|
|
el.setSelectionRange(el.value.length, el.value.length);
|
|
}
|
|
|
|
export function applyAutoFocus(container: Element) {
|
|
// https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/autofocus
|
|
// "autofocus" behavior is defined by the standard: when a container (e.g.: dialog) becomes visible, focus the element with "autofocus" attribute
|
|
// Fomantic UI already supports it for its modal dialog, we need to cover more cases (e.g.: ".show-panel" button)
|
|
// Here is just a simple support, we don't expect more than one element that need "autofocus" appearing in the same container
|
|
container.querySelector<HTMLElement>('[autofocus]')?.focus();
|
|
// Also, apply our autoFocusEnd behavior
|
|
// TODO: GLOBAL-INIT-MULTIPLE-FUNCTIONS: use "~=" operator in case we would extend the "data-global-init" to support more functions in the future.
|
|
const el = container.querySelector<HTMLInputElement>('[data-global-init~="autoFocusEnd"]');
|
|
if (el) autoFocusEnd(el);
|
|
}
|
|
|
|
export function initGlobalInput() {
|
|
registerGlobalSelectorFunc('input, textarea', attachInputDirAuto);
|
|
|
|
// autoFocusEnd is used for autofocus an input/textarea and move the cursor to the end of the text.
|
|
// It is useful for "New Issue"/"New PR" pages when the title is pre-filled with prefix text (e.g.: from template or commit message)
|
|
// The native "autofocus" isn't used because there is a delay between "focused (DOM rendering)" and "move cursor to end (our JS)", it causes flickers.
|
|
registerGlobalInitFunc('autoFocusEnd', autoFocusEnd);
|
|
}
|
|
|
|
/**
|
|
* Too many users set their ROOT_URL to wrong value, and it causes a lot of problems:
|
|
* * Cross-origin API request without correct cookie
|
|
* * Incorrect href in <a>
|
|
* * ...
|
|
* So we check whether current URL starts with AppUrl(ROOT_URL).
|
|
* If they don't match, show a warning to users.
|
|
*/
|
|
export function checkAppUrl() {
|
|
const curUrl = window.location.href;
|
|
// some users visit "https://domain/gitea" while appUrl is "https://domain/gitea/", there should be no warning
|
|
if (curUrl.startsWith(appUrl) || `${curUrl}/` === appUrl) {
|
|
return;
|
|
}
|
|
showGlobalErrorMessage(`The detected web site URL is "${appUrl}", it's unlikely matching the site config.
|
|
Mismatched app.ini ROOT_URL or reverse proxy "Host/X-Forwarded-Proto" config might cause wrong URL links for web UI/mail content/webhook notification/OAuth2 sign-in.`, 'warning');
|
|
}
|
|
|
|
export function checkAppUrlScheme() {
|
|
const curUrl = window.location.href;
|
|
// some users visit "http://domain" while appUrl is "https://domain", COOKIE_SECURE makes it impossible to sign in
|
|
if (curUrl.startsWith('http:') && appUrl.startsWith('https:')) {
|
|
showGlobalErrorMessage(`This instance is configured to run under HTTPS (by ROOT_URL config), you are accessing by HTTP. Mismatched scheme might cause problems for sign-in/sign-up.`, 'warning');
|
|
}
|
|
}
|