Merge branch 'main' into renovate/major-workflow-dependencies

.gitea/workflows/release-nightly.yml

@@ -12,19 +12,7 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      # Custom publishers (the R2 mirror below) run as the very last
+      - uses: actions/setup-go@v7
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
       - name: import gpg
@@ -40,7 +28,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v7
         with:
             distribution: goreleaser-pro
-            version: "~> v2"
+            version: "~> v1"
             args: release --nightly
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
@@ -50,10 +38,6 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: 'gitea'
           GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.gitea/workflows/release-tag.yml

@@ -13,19 +13,7 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      # Custom publishers (the R2 mirror below) run as the very last
+      - uses: actions/setup-go@v7
-      # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
-      # to S3. Fail here instead, before anything is built or
-      # published, if the R2 secrets are missing.
-      - name: check R2 configuration
-        run: sh scripts/upload-r2.sh --check-config
-        env:
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-      - uses: actions/setup-go@v6
         with:
           go-version-file: 'go.mod'
       - name: import gpg
@@ -41,7 +29,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v7
         with:
             distribution: goreleaser-pro
-            version: "~> v2"
+            version: "~> v1"
             args: release
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
@@ -51,10 +39,6 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ secrets.R2_BUCKET }}
-          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: 'gitea'
           GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.gitea/workflows/test-pr.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - name: lint and build
@@ -42,7 +42,7 @@ jobs:
       GITEA_TEA_TEST_PASSWORD: "test01"
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
       - name: wait for the gitea instance to be ready

.goreleaser.yaml

@@ -1,5 +1,3 @@
-version: 2
-
 before:
   hooks:
     - go mod tidy
@@ -81,50 +79,11 @@ blobs:
     provider: s3
     bucket: "{{ .Env.S3_BUCKET }}"
     region: "{{ .Env.S3_REGION }}"
-    directory: "tea/{{.Version}}"
+    folder: "tea/{{.Version}}"
     extra_files:
       - glob: ./**.xz
       - glob: ./**.sha256
 
-# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
-# parallel S3+R2 period (S3 will be removed once migration completes).
-# A second `blobs:` entry is impossible here since the blob pipe
-# authenticates from the global AWS_* env with no per-entry
-# credentials; `publishers:` supports per-entry `env:` instead, so
-# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
-# publishers inherit almost nothing from the environment, hence the
-# explicit R2_* forwarding below.
-#
-# This publisher fires more than once per distinct key because
-# goreleaser's release pipe already registers `release.extra_files`
-# (./**.xz and ./**.xz.sha256, see the `release:` block below) as
-# UploadableFile artifacts, and `internal/exec`'s filterArtifacts
-# appends this block's own extra_files with no de-duplication. It
-# can't be globbed away, since gobwas/glob (via goreleaser/fileglob)
-# has no substring-exclusion matcher. It's harmless: PUT is
-# idempotent, and the `./**.xz` glob below is kept deliberately so
-# this publisher declares its own complete file set rather than
-# implicitly depending on the `release:` block's globs.
-#
-# checksum: true mirrors goreleaser's generated checksums.txt;
-# signature: true additionally mirrors checksums.txt.sig, which the
-# `signs:` block below produces by GPG-signing that checksum file.
-# Without signature: true, artifacts downloaded from the R2 mirror
-# would have no signature file to verify against.
-publishers:
-  - name: cloudflare-r2
-    checksum: true
-    signature: true
-    extra_files:
-      - glob: ./**.xz
-      - glob: ./**.sha256
-    cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} tea/{{ .Version }}/{{ .ArtifactName }}
-    env:
-      - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }}
-      - R2_BUCKET={{ index .Env "R2_BUCKET" }}
-      - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }}
-      - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
-
 archives:
   - format: binary
     name_template: "{{ .Binary }}"
@@ -145,10 +104,10 @@ signs:
     args: ["--batch", "-u", "{{ .Env.GPG_FINGERPRINT }}", "--output", "${signature}", "--detach-sign", "${artifact}"]
 
 snapshot:
-  version_template: "{{ .Branch }}-devel"
+  name_template: "{{ .Branch }}-devel"
 
 nightly:
-  version_template: "{{ .Branch }}"
+  name_template: "{{ .Branch }}"
 
 gitea_urls:
   api: https://gitea.com/api/v1

cmd/notifications/list.go

@@ -63,12 +63,12 @@ func listNotifications(requestCtx stdctx.Context, cmd *cli.Command, status []git
 	var news []*gitea.NotificationThread
 	var err error
 
-	all := cmd.Bool("mine")
+	ctx, err := context.InitCommand(cmd)
-	ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: all})
 	if err != nil {
 		return err
 	}
 	client := ctx.Login.Client()
+	all := ctx.Bool("mine")
 
 	// This enforces pagination (see https://github.com/go-gitea/gitea/issues/16733)
 	listOpts := flags.GetListOptions(cmd)

cmd/notifications/list_test.go

@@ -1,55 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package notifications
-
-import (
-	stdctx "context"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"gitea.dev/tea/modules/config"
-	"github.com/stretchr/testify/require"
-	"github.com/urfave/cli/v3"
-)
-
-func TestRunNotificationsListMineDoesNotProbeGitRepository(t *testing.T) {
-	gitPath := filepath.Join(t.TempDir(), "git")
-	gitScript := "#!/bin/sh\necho 'git should not be called' >&2\nexit 1\n"
-	if runtime.GOOS == "windows" {
-		gitPath += ".bat"
-		gitScript = "@echo git should not be called 1>&2\r\nexit /b 1\r\n"
-	}
-	require.NoError(t, os.WriteFile(gitPath, []byte(gitScript), 0o755))
-	t.Setenv("PATH", filepath.Dir(gitPath))
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		require.Equal(t, "/api/v1/notifications", r.URL.Path)
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`[]`))
-	}))
-	defer server.Close()
-
-	config.SetConfigForTesting(config.LocalConfig{
-		Logins: []config.Login{{
-			Name:    "default",
-			URL:     server.URL,
-			Token:   "token",
-			User:    "user",
-			Default: true,
-		}},
-	})
-
-	cmd := cli.Command{
-		Name:  CmdNotificationsList.Name,
-		Flags: CmdNotificationsList.Flags,
-	}
-	require.NoError(t, cmd.Set("mine", "true"))
-	require.NoError(t, cmd.Set("output", "json"))
-
-	require.NoError(t, RunNotificationsList(stdctx.Background(), &cmd))
-}

cmd/notifications/mark_as.go

@@ -24,7 +24,7 @@ var CmdNotificationsMarkRead = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
+		ctx, err := context.InitCommand(cmd)
 		if err != nil {
 			return err
 		}
@@ -48,7 +48,7 @@ var CmdNotificationsMarkUnread = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
+		ctx, err := context.InitCommand(cmd)
 		if err != nil {
 			return err
 		}
@@ -72,7 +72,7 @@ var CmdNotificationsMarkPinned = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
+		ctx, err := context.InitCommand(cmd)
 		if err != nil {
 			return err
 		}
@@ -95,7 +95,7 @@ var CmdNotificationsUnpin = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
+		ctx, err := context.InitCommand(cmd)
 		if err != nil {
 			return err
 		}

modules/context/context.go

@@ -37,12 +37,6 @@ type TeaContext struct {
 	LocalRepo *git.TeaRepo  // is set if flags specified a local repo via --repo, or if $PWD is a git repo
 }
 
-// InitOptions controls which optional sources InitCommand may inspect.
-type InitOptions struct {
-	// SkipLocalRepo avoids probing the current directory for a git repository.
-	SkipLocalRepo bool
-}
-
 // GetRemoteRepoHTMLURL returns the web-ui url of the remote repo,
 // after ensuring a remote repo is present in the context.
 func (ctx *TeaContext) GetRemoteRepoHTMLURL() (string, error) {
@@ -67,12 +61,6 @@ func shouldPromptFallbackLogin(login *config.Login, canPrompt bool) bool {
 // the remotes of the .git repo specified in repoFlag or $PWD, and using overrides from
 // command flags. If a local git repo can't be found, repo slug values are unset.
 func InitCommand(cmd *cli.Command) (*TeaContext, error) {
-	return InitCommandWithOptions(cmd, InitOptions{})
-}
-
-// InitCommandWithOptions resolves the application context like InitCommand, with
-// optional controls for commands that do not need repository context.
-func InitCommandWithOptions(cmd *cli.Command, opts InitOptions) (*TeaContext, error) {
 	// these flags are used as overrides to the context detection via local git repo
 	repoFlag := cmd.String("repo")
 	loginFlag := cmd.String("login")
@@ -88,7 +76,7 @@ func InitCommandWithOptions(cmd *cli.Command, opts InitOptions) (*TeaContext, er
 	)
 
 	// check if repoFlag can be interpreted as path to local repo.
-	if len(repoFlag) != 0 && !opts.SkipLocalRepo {
+	if len(repoFlag) != 0 {
 		if repoFlagPathExists, err = utils.DirExists(repoFlag); err != nil {
 			return nil, err
 		}
@@ -97,8 +85,6 @@ func InitCommandWithOptions(cmd *cli.Command, opts InitOptions) (*TeaContext, er
 		} else {
 			c.RepoSlug = repoFlag
 		}
-	} else if len(repoFlag) != 0 {
-		c.RepoSlug = repoFlag
 	}
 
 	if len(remoteFlag) == 0 {
@@ -115,27 +101,25 @@ func InitCommandWithOptions(cmd *cli.Command, opts InitOptions) (*TeaContext, er
 		extraLogins = append(extraLogins, *envLogin)
 	}
 
-	if !opts.SkipLocalRepo {
+	// try to read local git repo & extract context: if repoFlag specifies a valid path, read repo in that dir,
-		// try to read local git repo & extract context: if repoFlag specifies a valid path, read repo in that dir,
+	// otherwise attempt PWD. if no repo is found, continue with default login
-		// otherwise attempt PWD. if no repo is found, continue with default login
+	if repoPath == "" {
-		if repoPath == "" {
+		if repoPath, err = os.Getwd(); err != nil {
-			if repoPath, err = os.Getwd(); err != nil {
+			return nil, err
-				return nil, err
-			}
 		}
+	}
 
-		var localSlug string
+	var localSlug string
-		if c.LocalRepo, c.Login, localSlug, err = contextFromLocalRepo(repoPath, remoteFlag, extraLogins); err != nil {
+	if c.LocalRepo, c.Login, localSlug, err = contextFromLocalRepo(repoPath, remoteFlag, extraLogins); err != nil {
-			if err == errNotAGiteaRepo || err == git.ErrRepositoryNotExists {
+		if err == errNotAGiteaRepo || err == git.ErrRepositoryNotExists {
-				// we can deal with that, commands needing the optional values use ctx.Ensure()
+			// we can deal with that, commands needing the optional values use ctx.Ensure()
-			} else {
+		} else {
-				return nil, err
+			return nil, err
-			}
-		}
-		if c.RepoSlug == "" && localSlug != "" {
-			c.RepoSlug = localSlug
 		}
 	}
+	if c.RepoSlug == "" && localSlug != "" {
+		c.RepoSlug = localSlug
+	}
 
 	// If env vars are set, always use the env login (but repo slug was already
 	// resolved by contextFromLocalRepo with the env login in the match list)
@@ -166,7 +150,7 @@ and then run your command again`)
 		if shouldPromptFallbackLogin(c.Login, canPrompt) {
 			fallback := false
 			if err := huh.NewConfirm().
-				Title(fmt.Sprintf("NOTE: no login matched this repository. Fall back to login '%s'?", c.Login.Name)).
+				Title(fmt.Sprintf("NOTE: no gitea login detected, whether falling back to login '%s'?", c.Login.Name)).
 				Value(&fallback).
 				WithTheme(theme.GetTheme()).
 				Run(); err != nil {
@@ -176,7 +160,7 @@ and then run your command again`)
 				return nil, ErrCommandCanceled
 			}
 		} else if !c.Login.Default {
-			fmt.Fprintf(os.Stderr, "NOTE: no login matched this repository, falling back to login '%s' in non-interactive mode.\n", c.Login.Name)
+			fmt.Fprintf(os.Stderr, "NOTE: no gitea login detected, falling back to login '%s' in non-interactive mode.\n", c.Login.Name)
 		}
 	}
 

scripts/upload-r2.sh

@@ -1,112 +0,0 @@
-#!/bin/sh
-# Copyright 2026 The Gitea Authors. All rights reserved.
-# SPDX-License-Identifier: MIT
-#
-# upload-r2.sh uploads a single local file to a single object key in a
-# Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is
-# S3-API compatible).
-#
-# This is the R2 half of the release process's parallel S3+R2 upload
-# period: goreleaser's `blobs:` pipe still uploads every release
-# artifact to AWS S3, and this script is invoked once per artifact
-# (via a goreleaser `publishers:` entry) to mirror the same artifact
-# into R2. Once the migration away from S3 is complete, the `blobs:`
-# block and the AWS_* secrets can be dropped without touching this
-# script.
-#
-# Usage:
-#   upload-r2.sh <local-file> <remote-key>
-#   upload-r2.sh --check-config
-#
-# The second form only validates that the required environment
-# variables below are set (it does not touch the network or the
-# filesystem beyond that), and is meant to be run as an early
-# preflight step in CI: goreleaser custom publishers run as the very
-# last step of the publish pipeline, so without a preflight check a
-# missing R2_* secret would only be discovered after the Gitea release
-# has already been created and every artifact already uploaded to S3.
-#
-# Required environment variables:
-#   R2_ENDPOINT          Base URL of the R2 endpoint, e.g.
-#                        https://<account>.r2.cloudflarestorage.com
-#   R2_BUCKET            Destination bucket name.
-#   R2_ACCESS_KEY_ID     R2 access key id.
-#   R2_SECRET_ACCESS_KEY R2 secret access key.
-
-set -eu
-
-# check_env validates that all required R2_* environment variables are
-# set and non-empty, printing a single "missing required environment
-# variable(s): ..." message and exiting non-zero otherwise. Used by
-# both the normal upload mode and --check-config, so the validation
-# logic only exists in one place.
-check_env() {
-  missing=""
-
-  if [ -z "${R2_ENDPOINT:-}" ]; then
-    missing="$missing R2_ENDPOINT"
-  fi
-  if [ -z "${R2_BUCKET:-}" ]; then
-    missing="$missing R2_BUCKET"
-  fi
-  if [ -z "${R2_ACCESS_KEY_ID:-}" ]; then
-    missing="$missing R2_ACCESS_KEY_ID"
-  fi
-  if [ -z "${R2_SECRET_ACCESS_KEY:-}" ]; then
-    missing="$missing R2_SECRET_ACCESS_KEY"
-  fi
-
-  if [ -n "$missing" ]; then
-    echo "upload-r2.sh: missing required environment variable(s):$missing" >&2
-    exit 1
-  fi
-}
-
-if [ "$#" -eq 1 ] && [ "$1" = "--check-config" ]; then
-  check_env
-  echo "upload-r2.sh: R2 configuration OK"
-  exit 0
-fi
-
-if [ "$#" -ne 2 ]; then
-  echo "usage: upload-r2.sh <local-file> <remote-key>" >&2
-  echo "       upload-r2.sh --check-config" >&2
-  exit 1
-fi
-
-local_file="$1"
-remote_key="$2"
-
-if [ ! -f "$local_file" ]; then
-  echo "upload-r2.sh: local file not found: $local_file" >&2
-  exit 1
-fi
-
-check_env
-
-# Strip a single trailing slash from the endpoint, if present, so that
-# building the path-style URL below never produces a double slash.
-endpoint="${R2_ENDPOINT%/}"
-url="$endpoint/$R2_BUCKET/$remote_key"
-
-# Credentials are passed to curl through a config file read from
-# stdin rather than as a command-line argument, so they never show up
-# in `ps` output.
-#
-# --fail-with-body (instead of plain --fail) still exits non-zero on
-# HTTP errors, but also prints R2's XML error body, which is where the
-# actual error code lives (SignatureDoesNotMatch, NoSuchBucket,
-# AccessDenied, ...); with plain --fail that body is discarded and the
-# failure is silent. --retry 3 (without --retry-all-errors) still
-# retries the transient cases (5xx, 408, 429, connection failures);
-# --retry-all-errors would additionally retry permanent 4xx responses
-# three times with backoff, which only delays an inevitable failure.
-printf 'user = "%s:%s"\n' "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY" | curl \
-  --config - \
-  --fail-with-body \
-  --silent \
-  --show-error \
-  --retry 3 \
-  --aws-sigv4 "aws:amz:auto:s3" \
-  --upload-file "$local_file" \
-  "$url"