feat: Add configurable permissions for Actions automatic tokens by Excellencedev · Pull Request #36173 · go-gitea/gitea

Excellencedev · 2025-12-17T06:20:07Z

Overview

This PR introduces granular permission controls for Gitea Actions tokens (GITEA_TOKEN), aligning Gitea's security model with GitHub Actions standards while maintaining compatibility with Gitea's unique repository unit system.

It addresses the need for finer access control by allowing administrators and repository owners to define default token permissions, set maximum permission ceilings, and control cross-repository access within organizations.

Key Features

1. Granular Token Permissions

Standard Keyword Support: Implements support for the permissions: keyword in workflow and job YAML files (e.g., contents: read, issues: write).
Permission Modes:
- Permissive: Default write access for most units (backwards compatible).
- Restricted: Default read-only access for contents and packages, with no access to other units.
- Custom: Allows defining specific default levels for each unit type (Code, Issues, PRs, Packages, etc.).EDIT removed UI was confusing
Clamping Logic: Workflow-defined permissions are automatically "clamped" by repository or organization-level maximum settings. Workflows cannot escalate their own permissions beyond these limits.

2. Organization & Repository Settings

Settings UI: Added new settings pages at both Organization and Repository levels to manage Actions token defaults and maximums.
Inheritance: Repositories can be configured to "Follow organization-level configuration," simplifying management across large organizations.
Cross-Repository Access: Added a policy to control whether Actions workflows can access other repositories or packages within the same organization. This can be set to "None," "All," or restricted to a "Selected" list of repositories.

3. Security Hardening

Fork Pull Request Protection: Tokens for workflows triggered by pull requests from forks are strictly enforced as read-only, regardless of repository settings.
Package Access: Actions tokens can now only access packages explicitly linked to a repository, with cross-repo access governed by the organization's security policy. EDIT removed feat: Add configurable permissions for Actions automatic tokens #36173 (comment)
Git Hook Integration: Propagates Actions Task IDs to git hooks to ensure that pushes performed by Actions tokens respect the specific permissions granted at runtime.

4. Technical Implementation

Permission Persistence: Parsed permissions are calculated at job creation and stored in the action_run_job table. This ensures the token's authority is deterministic throughout the job's lifecycle.
Parsing Priority: Implemented a priority system in the YAML parser where the broad contents scope is applied first, allowing granular scopes like code or releases to override it for precise control.
Re-runs: Permissions are re-evaluated during a job re-run to incorporate any changes made to repository settings in the interim.

How to Test

Unit Tests: Run go test ./services/actions/... and go test ./models/repo/... to verify parsing logic and permission clamping.
Integration Tests: Comprehensive tests have been added to tests/integration/actions_job_token_test.go covering:
- Permissive vs. Restricted mode behavior.
- YAML permissions: keyword evaluation.
- Organization cross-repo access policies.
- Resource access (Git, API, and Packages) under various permission configs.
Manual Verification:
- Navigate to Site/Org/Repo Settings -> Actions -> General.
- Change "Default Token Permissions" and verify that newly triggered workflows reflect these changes in their GITEA_TOKEN capabilities.
- Attempt a cross-repo API call from an Action and verify the Org policy is enforced.

Documentation

Added a PR in gitea's docs for this : https://gitea.com/gitea/docs/pulls/366

UI:

/fixes #24635
/claim #24635

Excellencedev · 2025-12-17T11:31:19Z

@lunny @wxiaoguang Please review this

wxiaoguang · 2025-12-17T12:30:54Z

Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review.

Excellencedev · 2025-12-17T14:29:21Z

Thank you for asking me to review, but I don't use Actions. You can invite the maintainers from the original issue to review.

@silverwind Please review

silverwind · 2025-12-17T17:14:54Z

I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly.

Excellencedev · 2025-12-17T17:30:04Z

I review mostly frontend stuff and am not much of an actions user myself, so please be patient until someone finds time to review it properly.

No problem

routers/web/repo/setting/actions.go

tests/integration/actions_job_token_test.go

wxiaoguang · 2025-12-17T19:01:16Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.

What are the differences? Which PR would win ....... @Zettat123

Zettat123 · 2025-12-17T20:53:54Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.

What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)

It seems that #36113 implemented these features, but I think its code needs improvement.

templates/repo/settings/actions_general.tmpl

silverwind · 2025-12-18T01:47:54Z

Issues I see on this screenshot:

Header text is black on dark theme
Contrast on light text is too low

I can probably help fix those, the first one may be a missing override of the fomantic CSS.

Excellencedev · 2025-12-18T01:53:03Z

@Zettat123 @silverwind Pls give me a few hours(15-20 hours) and this PR will be ready to go
I will make sure to address all your comments and make sure I do everything from the issue
Drafting until then
When it is done, I will undraft it and notify you

wxiaoguang · 2025-12-18T01:57:15Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)

It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

Excellencedev · 2025-12-18T01:59:50Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

@wxiaoguang should i close my pr ?

wxiaoguang · 2025-12-18T02:07:38Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

@wxiaoguang should i close my pr ?

I don't know. Reviewers decide.

Zettat123 · 2025-12-18T02:09:57Z

By the way, I see another (older) PR: Feat/actions token permissions #36113 , it added more than 2000 lines of code.
What are the differences? Which PR would win ....... @Zettat123

This PR doesn't fully implement the proposal in #24635. (For example, it doesn't support configuring actions access between repositories in the same organization)
It seems that #36113 implemented these features, but I think its code needs improvement.

But "PR: Feat/actions token permissions #36113" came first, and it is more complete, why not respect the first author, but only review this second one?

I reviewed both PRs, but did not receive responses to my comments in #36113. If @Excellencedev will address the review comments, I think we should keep this PR.

silverwind · 2025-12-18T02:12:59Z

Imho, the only sensible thing we can do is race these 2 PRs.

Excellencedev · 2025-12-18T03:03:36Z

Adressed most your comments in my latest commit, now i just need to make sure i fully implement the proposal in #24635

models/repo/repo_unit.go

Zettat123 · 2025-12-18T03:26:52Z

According to the solution in #24635, I think this PR does not implement:

Support configuring the permissions
Support configuring access between repositories
Private packages can be accessed by Actions only when they have been linked to repositories

Excellencedev · 2025-12-18T03:27:58Z

According to the solution in #24635, I think this PR does not implement:

Support configuring the permissions

Support configuring access between repositories

Private packages can be accessed by Actions only when they have been linked to repositories

Ok no problem. I'm working on it

Excellencedev · 2025-12-18T15:35:51Z

@Zettat123 My PR is now ready for review !
It implements ALL the features in the issue description
Just need t make sure tests pass though

Excellencedev · 2026-03-14T16:24:54Z

Made some changes to the help texts.

I am not a native speaker, not sure whether the changed texts are good enough.

the grammar looks good

…to fix-24635

Excellencedev · 2026-03-14T16:43:56Z

Are you sure your fix is right? You added exclusive=true to all the repo search boxes, won't it break others?

see b10db5d

wxiaoguang · 2026-03-14T17:40:48Z

Are you sure your fix is right? You added exclusive=true to all the repo search boxes, won't it break others?

see b10db5d

What does this do?

Excellencedev · 2026-03-14T17:49:46Z

What does this do?

It checks if the HTML has a data-collaborate attribute and, if so, adds it to the search URL as a filter. This allows the search to either include or exclude repositories where the user is only a collaborator

wxiaoguang · 2026-03-14T18:14:24Z

What does this do?

It checks if the HTML has a data-collaborate attribute and, if so, adds it to the search URL as a filter. This allows the search to either include or exclude repositories where the user is only a collaborator

Is it your guess? Or your AI's answer? Where is collaborate used in backend code?

models/migrations/v1_26/v327.go

ChristopherHX

I confirm

the user and org cross-repo setting no longer shows (also does not allow to add) repositories of a different owner
a deleted repository disappears from the cross-repo list (user settings page)
changing settings does save if UI matches backend revision

Some things that didn't feel right to me

you can press add repo without having any selected (more or less just does a reload)
Non Issue so far ~~having an previous settings page js in the cache did clear cross-repo setting and shows broken form for me (idk what pr revision that was based on before)~~

wxiaoguang · 2026-03-16T00:38:17Z

you can press add repo without having any selected (more or less just does a reload)

Fixed in e1d11ae

# Conflicts: # models/migrations/migrations.go # models/migrations/v1_26/v327.go # routers/web/shared/actions/runners.go

Excellencedev · 2026-03-18T16:28:04Z

should i do a pr to gitea docs ?

lunny · 2026-03-18T18:59:37Z

should i do a pr to gitea docs ?

I think yes. We need a PR to gitea docs.

Excellencedev · 2026-03-19T04:55:53Z

@lunny Added a PR: https://gitea.com/gitea/docs/pulls/366

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Dec 17, 2025

algora-pbc bot added the 🙋 Bounty claim label Dec 17, 2025

github-actions bot added modifies/translation modifies/go Pull requests that update Go code modifies/templates This PR modifies the template files labels Dec 17, 2025

lunny requested a review from Zettat123 December 17, 2025 16:53

Zettat123 reviewed Dec 17, 2025

View reviewed changes

routers/web/repo/setting/actions.go Outdated Show resolved Hide resolved

routers/web/repo/setting/actions.go Outdated Show resolved Hide resolved

tests/integration/actions_job_token_test.go Outdated Show resolved Hide resolved

silverwind reviewed Dec 18, 2025

View reviewed changes

templates/repo/settings/actions_general.tmpl Outdated Show resolved Hide resolved

Excellencedev marked this pull request as draft December 18, 2025 01:53

Zettat123 reviewed Dec 18, 2025

View reviewed changes

models/repo/repo_unit.go Outdated Show resolved Hide resolved

github-actions bot added the modifies/api This PR adds API routes or modifies them label Dec 18, 2025

Excellencedev marked this pull request as ready for review December 18, 2025 15:32

do not render Actions Token Permissions if Actions is disabled

0975485

Excellencedev added 2 commits March 14, 2026 17:41

change

b10db5d

Merge branch 'fix-24635' of https://github.com/Excellencedev/gitea in…

46f9ad1

…to fix-24635

remove useless attribute

eacdd04

lunny reviewed Mar 14, 2026

View reviewed changes

models/migrations/v1_26/v327.go Outdated Show resolved Hide resolved

Migration fix

bb64b07

ChristopherHX approved these changes Mar 15, 2026

View reviewed changes

fix form

e1d11ae

use explicit var name

ade5a6c

wxiaoguang mentioned this pull request Mar 16, 2026

Add configurable permissions for Actions job tokens #36452

Closed

11 tasks

wxiaoguang added 6 commits March 17, 2026 17:03

Merge branch 'main' into feature-actions-permission

09454d7

# Conflicts: # models/migrations/migrations.go # models/migrations/v1_26/v327.go # routers/web/shared/actions/runners.go

fix merge

f84981d

fix tests

eb4ead7

fix tests

9950752

fix tests

c556da0

fix tests

4ac9a9c

wxiaoguang approved these changes Mar 17, 2026

View reviewed changes

lunny and others added 2 commits March 21, 2026 14:01

Merge branch 'main' into fix-24635

319fb31

Merge branch 'main' into fix-24635

6aeda11

silverwind mentioned this pull request Mar 24, 2026

Panic when parseing actions workflow #36967

Closed

lunny mentioned this pull request Mar 24, 2026

OIDC provider #25664

Closed

Uh oh!

Conversation

Excellencedev commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Key Features

1. Granular Token Permissions

2. Organization & Repository Settings

3. Security Hardening

4. Technical Implementation

How to Test

Documentation

UI:

Uh oh!

Excellencedev commented Dec 17, 2025

Uh oh!

wxiaoguang commented Dec 17, 2025

Uh oh!

Excellencedev commented Dec 17, 2025

Uh oh!

silverwind commented Dec 17, 2025

Uh oh!

Excellencedev commented Dec 17, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wxiaoguang commented Dec 17, 2025

Uh oh!

Zettat123 commented Dec 17, 2025

Uh oh!

Uh oh!

silverwind commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Excellencedev commented Dec 18, 2025

Uh oh!

wxiaoguang commented Dec 18, 2025

Uh oh!

Excellencedev commented Dec 18, 2025

Uh oh!

wxiaoguang commented Dec 18, 2025

Uh oh!

Zettat123 commented Dec 18, 2025

Uh oh!

silverwind commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Excellencedev commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Zettat123 commented Dec 18, 2025

Uh oh!

Excellencedev commented Dec 18, 2025

Uh oh!

Excellencedev commented Dec 18, 2025

Uh oh!

Excellencedev commented Mar 14, 2026

Uh oh!

Excellencedev commented Mar 14, 2026

Uh oh!

wxiaoguang commented Mar 14, 2026

Uh oh!

Excellencedev commented Mar 14, 2026

Uh oh!

wxiaoguang commented Mar 14, 2026

Uh oh!

Uh oh!

ChristopherHX left a comment

Choose a reason for hiding this comment

Uh oh!

wxiaoguang commented Mar 16, 2026

Uh oh!

Excellencedev commented Mar 18, 2026

Uh oh!

lunny commented Mar 18, 2026

Uh oh!

Excellencedev commented Mar 19, 2026

Uh oh!

Excellencedev commented Dec 17, 2025 •

edited

Loading

silverwind commented Dec 18, 2025 •

edited

Loading

silverwind commented Dec 18, 2025 •

edited

Loading

Excellencedev commented Dec 18, 2025 •

edited

Loading