Skip to content

Commit c9beb0b

Browse files
Zettat123ChristopherHX
Zettat123
and
ChristopherHX
authored
Support actions and reusable workflows from private repos (go-gitea#32562)
Resolve https://gitea.com/gitea/act_runner/issues/102 This PR allows administrators of a private repository to specify some collaborative owners. The repositories of collaborative owners will be allowed to access this repository's actions and workflows. Settings for private repos: ![image](https://github.com/user-attachments/assets/e591c877-f94d-48fb-82f3-3b051f21557e) --- This PR also moves "Enable Actions" setting to `Actions > General` page <img width="960" alt="image" src="https://github.com/user-attachments/assets/49337ec2-afb1-4a67-8516-5c9ef0ce05d4" /> <img width="960" alt="image" src="https://github.com/user-attachments/assets/f58ee6d5-17f9-4180-8760-a78e859f1c37" /> --------- Signed-off-by: Zettat123 <[email protected]> Co-authored-by: ChristopherHX <[email protected]>
1 parent 5454fda commit c9beb0b

File tree

30 files changed

+408
-45
lines changed

30 files changed

+408
-45
lines changed

‎models/fixtures/action_run.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,3 +139,23 @@
139139
updated: 1683636626
140140
need_approval: 0
141141
approved_by: 0
142+
-
143+
id: 804
144+
title: "use a private action"
145+
repo_id: 60
146+
owner_id: 40
147+
workflow_id: "run.yaml"
148+
index: 189
149+
trigger_user_id: 40
150+
ref: "refs/heads/master"
151+
commit_sha: "6e64b26de7ba966d01d90ecfaf5c7f14ef203e86"
152+
event: "push"
153+
trigger_event: "push"
154+
is_fork_pull_request: 0
155+
status: 1
156+
started: 1683636528
157+
stopped: 1683636626
158+
created: 1683636108
159+
updated: 1683636626
160+
need_approval: 0
161+
approved_by: 0

‎models/fixtures/action_run_job.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,3 +129,17 @@
129129
status: 5
130130
started: 1683636528
131131
stopped: 1683636626
132+
-
133+
id: 205
134+
run_id: 804
135+
repo_id: 6
136+
owner_id: 10
137+
commit_sha: 6e64b26de7ba966d01d90ecfaf5c7f14ef203e86
138+
is_fork_pull_request: 0
139+
name: job_2
140+
attempt: 1
141+
job_id: job_2
142+
task_id: 48
143+
status: 1
144+
started: 1683636528
145+
stopped: 1683636626

‎models/fixtures/action_task.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,3 +177,23 @@
177177
log_length: 0
178178
log_size: 0
179179
log_expired: 0
180+
-
181+
id: 55
182+
job_id: 205
183+
attempt: 1
184+
runner_id: 1
185+
status: 6 # 6 is the status code for "running"
186+
started: 1683636528
187+
stopped: 1683636626
188+
repo_id: 6
189+
owner_id: 10
190+
commit_sha: 6e64b26de7ba966d01d90ecfaf5c7f14ef203e86
191+
is_fork_pull_request: 0
192+
token_hash: b8d3962425466b6709b9ac51446f93260c54afe8e7b6d3686e34f991fb8a8953822b0deed86fe41a103f34bc48dbc478422b
193+
token_salt: ERxJGHvg3I
194+
token_last_eight: 182199eb
195+
log_filename: collaborative-owner-test/1a/49.log
196+
log_in_storage: 1
197+
log_length: 707
198+
log_size: 90179
199+
log_expired: 0

‎models/fixtures/repo_unit.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -733,3 +733,10 @@
733733
type: 3
734734
config: "{\"IgnoreWhitespaceConflicts\":false,\"AllowMerge\":true,\"AllowRebase\":true,\"AllowRebaseMerge\":true,\"AllowSquash\":true}"
735735
created_unix: 946684810
736+
737+
-
738+
id: 111
739+
repo_id: 3
740+
type: 10
741+
config: "{}"
742+
created_unix: 946684810

‎models/perm/access/repo_permission.go‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -264,13 +264,22 @@ func GetActionsUserRepoPermission(ctx context.Context, repo *repo_model.Reposito
264264
if err != nil {
265265
return perm, err
266266
}
267-
if task.RepoID != repo.ID {
268-
// FIXME allow public repo read access if tokenless pull is enabled
269-
return perm, nil
270-
}
271267

272268
var accessMode perm_model.AccessMode
273-
if task.IsForkPullRequest {
269+
if task.RepoID != repo.ID {
270+
taskRepo, exist, err := db.GetByID[repo_model.Repository](ctx, task.RepoID)
271+
if err != nil || !exist {
272+
return perm, err
273+
}
274+
actionsCfg := repo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
275+
if !actionsCfg.IsCollaborativeOwner(taskRepo.OwnerID) || !taskRepo.IsPrivate {
276+
// The task repo can access the current repo only if the task repo is private and
277+
// the owner of the task repo is a collaborative owner of the current repo.
278+
// FIXME allow public repo read access if tokenless pull is enabled
279+
return perm, nil
280+
}
281+
accessMode = perm_model.AccessModeRead
282+
} else if task.IsForkPullRequest {
274283
accessMode = perm_model.AccessModeRead
275284
} else {
276285
accessMode = perm_model.AccessModeWrite

‎models/repo/repo_unit.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,9 @@ func (cfg *PullRequestsConfig) GetDefaultMergeStyle() MergeStyle {
170170

171171
type ActionsConfig struct {
172172
DisabledWorkflows []string
173+
// CollaborativeOwnerIDs is a list of owner IDs used to share actions from private repos.
174+
// Only workflows from the private repos whose owners are in CollaborativeOwnerIDs can access the current repo's actions.
175+
CollaborativeOwnerIDs []int64
173176
}
174177

175178
func (cfg *ActionsConfig) EnableWorkflow(file string) {
@@ -192,6 +195,20 @@ func (cfg *ActionsConfig) DisableWorkflow(file string) {
192195
cfg.DisabledWorkflows = append(cfg.DisabledWorkflows, file)
193196
}
194197

198+
func (cfg *ActionsConfig) AddCollaborativeOwner(ownerID int64) {
199+
if !slices.Contains(cfg.CollaborativeOwnerIDs, ownerID) {
200+
cfg.CollaborativeOwnerIDs = append(cfg.CollaborativeOwnerIDs, ownerID)
201+
}
202+
}
203+
204+
func (cfg *ActionsConfig) RemoveCollaborativeOwner(ownerID int64) {
205+
cfg.CollaborativeOwnerIDs = util.SliceRemoveAll(cfg.CollaborativeOwnerIDs, ownerID)
206+
}
207+
208+
func (cfg *ActionsConfig) IsCollaborativeOwner(ownerID int64) bool {
209+
return slices.Contains(cfg.CollaborativeOwnerIDs, ownerID)
210+
}
211+
195212
// FromDB fills up a ActionsConfig from serialized format.
196213
func (cfg *ActionsConfig) FromDB(bs []byte) error {
197214
return json.UnmarshalHandleDoubleEncode(bs, &cfg)

‎models/user/search.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package user
66
import (
77
"context"
88
"fmt"
9+
"slices"
910
"strings"
1011

1112
"code.gitea.io/gitea/models/db"
@@ -22,7 +23,7 @@ type SearchUserOptions struct {
2223
db.ListOptions
2324

2425
Keyword string
25-
Type UserType
26+
Types []UserType
2627
UID int64
2728
LoginName string // this option should be used only for admin user
2829
SourceID int64 // this option should be used only for admin user
@@ -43,16 +44,16 @@ type SearchUserOptions struct {
4344

4445
func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) *xorm.Session {
4546
var cond builder.Cond
46-
cond = builder.Eq{"type": opts.Type}
47+
cond = builder.In("type", opts.Types)
4748
if opts.IncludeReserved {
48-
switch opts.Type {
49-
case UserTypeIndividual:
49+
switch {
50+
case slices.Contains(opts.Types, UserTypeIndividual):
5051
cond = cond.Or(builder.Eq{"type": UserTypeUserReserved}).Or(
5152
builder.Eq{"type": UserTypeBot},
5253
).Or(
5354
builder.Eq{"type": UserTypeRemoteUser},
5455
)
55-
case UserTypeOrganization:
56+
case slices.Contains(opts.Types, UserTypeOrganization):
5657
cond = cond.Or(builder.Eq{"type": UserTypeOrganizationReserved})
5758
}
5859
}

‎models/user/user.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1449,3 +1449,15 @@ func DisabledFeaturesWithLoginType(user *User) *container.Set[string] {
14491449
}
14501450
return &setting.Admin.UserDisabledFeatures
14511451
}
1452+
1453+
// GetUserOrOrgIDByName returns the id for a user or an org by name
1454+
func GetUserOrOrgIDByName(ctx context.Context, name string) (int64, error) {
1455+
var id int64
1456+
has, err := db.GetEngine(ctx).Table("user").Where("name = ?", name).Cols("id").Get(&id)
1457+
if err != nil {
1458+
return 0, err
1459+
} else if !has {
1460+
return 0, fmt.Errorf("user or org with name %s: %w", name, util.ErrNotExist)
1461+
}
1462+
return id, nil
1463+
}

‎models/user/user_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ func TestSearchUsers(t *testing.T) {
126126

127127
// test orgs
128128
testOrgSuccess := func(opts user_model.SearchUserOptions, expectedOrgIDs []int64) {
129-
opts.Type = user_model.UserTypeOrganization
129+
opts.Types = []user_model.UserType{user_model.UserTypeOrganization}
130130
testSuccess(opts, expectedOrgIDs)
131131
}
132132

@@ -150,7 +150,7 @@ func TestSearchUsers(t *testing.T) {
150150

151151
// test users
152152
testUserSuccess := func(opts user_model.SearchUserOptions, expectedUserIDs []int64) {
153-
opts.Type = user_model.UserTypeIndividual
153+
opts.Types = []user_model.UserType{user_model.UserTypeIndividual}
154154
testSuccess(opts, expectedUserIDs)
155155
}
156156

‎options/locale/locale_en-US.ini‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3914,6 +3914,15 @@ variables.update.success = The variable has been edited.
39143914
logs.always_auto_scroll = Always auto scroll logs
39153915
logs.always_expand_running = Always expand running logs
39163916

3917+
general = General
3918+
general.enable_actions = Enable Actions
3919+
general.collaborative_owners_management = Collaborative Owners Management
3920+
general.collaborative_owners_management_help = A collaborative owner is a user or an organization whose private repository has access to the actions and workflows of this repository.
3921+
general.add_collaborative_owner = Add Collaborative Owner
3922+
general.collaborative_owner_not_exist = The collaborative owner does not exist.
3923+
general.remove_collaborative_owner = Remove Collaborative Owner
3924+
general.remove_collaborative_owner_desc = Removing a collaborative owner will prevent the repositories of the owner from accessing the actions in this repository. Continue?
3925+
39173926
[projects]
39183927
deleted.display_name = Deleted Project
39193928
type-1.display_name = Individual Project

0 commit comments

Comments
 (0)