Support actions and reusable workflows from private repos

[Zettat123]

Resolve https://gitea.com/gitea/act_runner/issues/102

This PR allows administrators of a private repository to specify some collaborative owners. The repositories of collaborative owners will be allowed to access this repository's actions and workflows.

Settings for private repos:

---

This PR also moves "Enable Actions" setting to Actions > General page

[Zettat123]

To support this feature, act_runner also needs some improvements, which I am working on.

For changes in act_runner, see https://gitea.com/gitea/act/pulls/123

[Zettat123]

Docs: https://gitea.com/gitea/docs/pulls/107

[lunny]

Is this related to #24635 ?

[SamuNatsu]

Any progress for it?

[IBims1ckoky]

Any progress there?

[codeguy]

Any movement here? This would really really help us in our Gitea Cloud account.

[lunny]

Any movement here? This would really really help us in our Gitea Cloud account.

I will take the task.

[ChristopherHX]

Found duplicated permission checks in

gitea/routers/api/v1/api.go

Lines 191 to 214 in ebd88af

	if ctx.Doer != nil && ctx.Doer.ID == user_model.ActionsUserID {
	taskID := ctx.Data["ActionsTaskID"].(int64)
	task, err := actions_model.GetTaskByID(ctx, taskID)
	if err != nil {
	ctx.APIErrorInternal(err)
	return
	}
	if task.RepoID != repo.ID {
	ctx.APIErrorNotFound()
	return
	}
	if task.IsForkPullRequest {
	ctx.Repo.Permission.AccessMode = perm.AccessModeRead
	} else {
	ctx.Repo.Permission.AccessMode = perm.AccessModeWrite
	}
	if err := ctx.Repo.Repository.LoadUnits(ctx); err != nil {
	ctx.APIErrorInternal(err)
	return
	}
	ctx.Repo.Permission.SetUnitsWithDefaultAccessMode(ctx.Repo.Repository.Units, ctx.Repo.Permission.AccessMode)
	} else {

Maybe those should use a common function, githttp access and no api access is odd.

[ChristopherHX]

Then lfs again, 3 times same code

gitea/services/lfs/server.go

Lines 523 to 537 in ebd88af

	taskID := ctx.Data["ActionsTaskID"].(int64)
	task, err := actions_model.GetTaskByID(ctx, taskID)
	if err != nil {
	log.Error("Unable to GetTaskByID for task[%d] Error: %v", taskID, err)
	return false
	}
	if task.RepoID != repository.ID {
	return false
	}
	if task.IsForkPullRequest {
	return accessMode <= perm_model.AccessModeRead
	}
	return accessMode <= perm_model.AccessModeWrite
	}

See here for my proposal: #35688, then only a single method decides wether and what level you can access an repository via an actions token

[Zettat123]

See here for my proposal: #35688, then only a single method decides wether and what level you can access an repository via an actions token

I convert this PR to Draft and will improve the permission check after #35688 is merged.

[ChristopherHX]

EDIT My fault test-repo was public instead of private

Could it be a private org is broken? Or is this nightly act_runner from https://dl.gitea.com/ not up to date.

test-runner(version:v0.2.13-3-g3b11bac) received task 6 of job test, be triggered by event: push
workflow prepared
evaluating expression 'success()'
expression 'success()' evaluated to 'true'
☁ git clone 'http://localhost:3005/private-actions/actions' # ref=main
cloning http://localhost:3005/private-actions/actions to /Users/christopher/.cache/act/5eac0f0b31fdc5958b4a6e5102b8d6235e0c4c726cc6a1300814391765f96d54
Unable to clone http://localhost:3005/private-actions/actions refs/heads/main: repository not found: Repository not found
repository not found: Repository not found
skipping post step for 'Checkout code'; step was not executed
Cleaning up container for job test
🏁 Job failed
repository not found: Repository not found

Or the server_url is incorrect etc.

[Zettat123]

Could it be a private org is broken? Or is this nightly act_runner from https://dl.gitea.com/ not up to date.

I can't reproduce this issue. Can you make test01/test-repo private and try again?

[ChristopherHX]

well good point, missed my own repo visibility.

[ChristopherHX]

Looks good to me, we could later enhance troubleshooting

• by log more information around repository not found
• if act_runner did an authenticated pull

[ChristopherHX]

act could check own repo visibility in it's payload when getting repository not found with token and log an actionable message