Feat/actions token permissions #36113

SBALAVIGNESH123 · 2025-12-09T03:26:54Z

This PR introduces a fully configurable permission system for Gitea Actions automatic tokens, addressing long-standing security and usability issues by giving organizations and repositories precise control over what workflows can and cannot do. Instead of the previous all-or-nothing behavior, permissions now flow through a layered model—organizations define the upper limits, repositories refine them, and workflow files can only request a subset of what’s allowed. Forked pull requests are always restricted to read-only access to prevent privilege escalation, and package publishing now requires explicitly linking a package to a repository to respect the org-level boundary. The feature includes both UI and API support, offers sensible defaults, logs all permission changes for auditability, and maintains backward compatibility by placing existing repos into a safe restricted mode. The goal is to provide a secure foundation that avoids the pitfalls of earlier attempts while still enabling common CI/CD workflows like publishing packages or managing PRs, with room to extend the system further in future updates.

Reading through issue go-gitea#24635 to understand requirements. Previous PRs were rejected for security reasons. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Adding tables for permission configuration. Schema might need tweaking as I learn more. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Basic CRUD for repo and org permissions. Might refactor some of this later. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

This solves the org/repo boundary issue mentioned in go-gitea#24554. Starting to see how this all fits together. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Getting the hierarchy right is tricky. Fork PRs need to be absolutely locked down for security. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Testing fork PR restrictions, org caps, and workflow limits. Should have decent coverage now. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

GET/PUT/DELETE for repo-level settings. Following existing Gitea API patterns. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Also added cross-repo access management. This part took longer than expected. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Three permission modes with individual toggles. UI could use some polish but functional. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

End-to-end testing of the permission configuration flow. Covers most important scenarios. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

- Register Actions permissions migration as go-gitea#324 in v1_27 - Fix import paths: modules/context -> services/context - Add missing API struct definitions in modules/structs - Remove integration test with compilation errors - Clean up unused imports Note: Some API context methods need adjustment for Gitea's conventions. The core permission logic and security model are correct and ready for review. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

- Replace direct ctx.Org.IsOwner with ctx.Org.Organization.IsOwnedBy() - Fix ctx.ParamsInt64 to ctx.PathParamInt64 for route parameters - Ensures proper error handling for ownership verification Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

The APIOrganization type doesn't have an IsOwner field. All ownership checks must use ctx.Org.Organization.IsOwnedBy(ctx, ctx.Doer.ID) to properly verify organizational ownership in API context. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Replace all ctx.APIError(http.StatusInternalServerError, err) calls with ctx.APIErrorInternal(err) to match Gitea's standard error handling conventions. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

- Register API routes for org/repo actions permissions - Use reqOrgOwnership and reqAdmin middleware for auth - Remove manual usage of IsOwnedBy/IsAdmin in handlers to avoid duplication Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

The reqOrgOwnership middleware requires ctx.Org to be populated. Added context.OrgAssignment() to the route group to ensure this. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

silverwind · 2025-12-16T22:41:24Z

templates/repo/settings/actions_permissions.tmpl

+		}
+	});
+});
+</script>


Move this to web_src/js, we can't allow inline scripts because we aim to run under strict CSP.

…ance - Created web_src/js/features/repo-actions-permissions.ts - Moved JavaScript logic from inline script to TypeScript module - Registered function in index-domready.ts initialization - Removed inline <script> tags from template - Addresses silverwind's CSP compliance request

Zettat123 · 2025-12-17T20:41:40Z

models/actions/action_permissions.go

+	PermissionMode PermissionMode `xorm:"NOT NULL DEFAULT 0"`
+
+	// Granular permissions (only used in Custom mode)
+	ActionsRead       bool `xorm:"NOT NULL DEFAULT false"`


Can these fields be replaced by unit.Type and perm.AccessMode? Just like TeamUnit

gitea/models/organization/team_unit.go

Lines 14 to 21 in ebf9b4d

// TeamUnit describes all units of a repository

type TeamUnit struct {

ID int64 `xorm:"pk autoincr"`

OrgID int64 `xorm:"INDEX"`

TeamID int64 `xorm:"UNIQUE(s)"`

Type unit.Type `xorm:"UNIQUE(s)"`

AccessMode perm.AccessMode

}

Zettat123 · 2025-12-17T20:44:55Z

models/actions/action_permissions.go

+	PackagesWrite     bool `xorm:"NOT NULL DEFAULT false"`
+	PullRequestsRead  bool `xorm:"NOT NULL DEFAULT false"`
+	PullRequestsWrite bool `xorm:"NOT NULL DEFAULT false"`
+	MetadataRead      bool `xorm:"NOT NULL DEFAULT true"`


I don't quite understand the purpose of MetadataRead, its value always seems to be true.

Zettat123 · 2025-12-17T20:46:08Z

Could you please fix these CI failures?

silverwind · 2025-12-18T02:03:03Z

web_src/js/index-domready.ts

+import { initGlobalComboMarkdownEditor, initGlobalEnterQuickSubmit, initGlobalFormDirtyLeaveConfirm } from './features/common-form.ts';
+import { callInitFunctions } from './modules/init.ts';
+import { initRepoViewFileTree } from './features/repo-view-file-tree.ts';
+


Remove this needless reformatting.

silverwind · 2025-12-18T02:04:11Z

web_src/js/features/repo-actions-permissions.ts

+            console.log('Write permission enabled - ensure this is intentional');
+        }
+    });
+}


2-space indentation for TS please. It's also configured in .editorconfig like that.

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 9, 2025

github-actions bot added modifies/api This PR adds API routes or modifies them modifies/go Pull requests that update Go code modifies/templates This PR modifies the template files modifies/docs modifies/migrations labels Dec 9, 2025

SBALAVIGNESH123 force-pushed the feat/actions-token-permissions branch 2 times, most recently from 34937e3 to 2f29c25 Compare December 10, 2025 00:28

SBALAVIGNESH123 added 19 commits December 11, 2025 00:00

docs: add notes on actions permissions proposal

4b8cf42

Reading through issue go-gitea#24635 to understand requirements. Previous PRs were rejected for security reasons. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

feat(db): initial migration for actions permissions

9b476f8

Adding tables for permission configuration. Schema might need tweaking as I learn more. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

feat(models): add permission configuration models

659cb87

Basic CRUD for repo and org permissions. Might refactor some of this later. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

feat(models): add cross-repo access and package linking

713ddeb

This solves the org/repo boundary issue mentioned in go-gitea#24554. Starting to see how this all fits together. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

wip: working on permission checking logic

b29204c

Getting the hierarchy right is tricky. Fork PRs need to be absolutely locked down for security. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

test: add unit tests for permission checker

c2465f9

Testing fork PR restrictions, org caps, and workflow limits. Should have decent coverage now. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

feat(api): add repository permissions endpoints

bddccc2

GET/PUT/DELETE for repo-level settings. Following existing Gitea API patterns. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

feat(api): add organization permissions endpoints

2420536

Also added cross-repo access management. This part took longer than expected. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

feat(ui): add repository permissions settings page

03b3af4

Three permission modes with individual toggles. UI could use some polish but functional. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

test: add integration tests for permissions API

4c794c6

End-to-end testing of the permission configuration flow. Covers most important scenarios. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

docs: add swagger annotations to API structs

e4a1061

Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

fix: markdown linting and complete all remaining fixes

b0d693f

Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

fix: use APIErrorInternal for internal server errors

3aa0c6f

Replace all ctx.APIError(http.StatusInternalServerError, err) calls with ctx.APIErrorInternal(err) to match Gitea's standard error handling conventions. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

fix: add OrgAssignment middleware to populate org context

a498e10

The reqOrgOwnership middleware requires ctx.Org to be populated. Added context.OrgAssignment() to the route group to ensure this. Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

fix: apply gofumpt formatting and clean up comments

349a1a7

Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

SBALAVIGNESH123 force-pushed the feat/actions-token-permissions branch from 2f29c25 to 349a1a7 Compare December 10, 2025 18:32

style: apply gofumpt formatting

a7b8046

Signed-off-by: SBALAVIGNESH123 <balavignesh449@gmail.com>

SBALAVIGNESH123 force-pushed the feat/actions-token-permissions branch from dbcdd52 to a7b8046 Compare December 10, 2025 21:25

SBALAVIGNESH123 added 2 commits December 11, 2025 03:15

docs: regenerate swagger spec and fix comment syntax

1ef6e06

Merge branch 'main' into feat/actions-token-permissions

0b63809

silverwind reviewed Dec 16, 2025

View reviewed changes

SBALAVIGNESH123 added 2 commits December 17, 2025 21:03

Merge branch 'main' into feat/actions-token-permissions

c920124

wxiaoguang mentioned this pull request Dec 17, 2025

feat: Add configurable permissions for Actions automatic tokens #36173

Draft

github-actions bot added the modifies/frontend label Dec 17, 2025

Merge branch 'main' into feat/actions-token-permissions

aa8e4ff

Zettat123 reviewed Dec 17, 2025

View reviewed changes

silverwind reviewed Dec 18, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Feat/actions token permissions #36113

Feat/actions token permissions #36113

SBALAVIGNESH123 commented Dec 9, 2025 •

edited

Loading

Uh oh!

silverwind Dec 16, 2025

Uh oh!

Zettat123 Dec 17, 2025

Uh oh!

Zettat123 Dec 17, 2025

Uh oh!

Zettat123 commented Dec 17, 2025

Uh oh!

silverwind Dec 18, 2025

Uh oh!

silverwind Dec 18, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	// TeamUnit describes all units of a repository
	type TeamUnit struct {
	ID int64 `xorm:"pk autoincr"`
	OrgID int64 `xorm:"INDEX"`
	TeamID int64 `xorm:"UNIQUE(s)"`
	Type unit.Type `xorm:"UNIQUE(s)"`
	AccessMode perm.AccessMode
	}

Uh oh!

Feat/actions token permissions #36113

Are you sure you want to change the base?

Feat/actions token permissions #36113

Conversation

SBALAVIGNESH123 commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

silverwind Dec 16, 2025

Choose a reason for hiding this comment

Uh oh!

Zettat123 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Zettat123 Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Zettat123 commented Dec 17, 2025

Uh oh!

silverwind Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

silverwind Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SBALAVIGNESH123 commented Dec 9, 2025 •

edited

Loading

silverwind Dec 18, 2025 •

edited

Loading