Skip to content

fix: prevent panic when GitLab release has more links than sources#36295

Merged
wxiaoguang merged 4 commits intogo-gitea:mainfrom
argoyle:main
Jan 5, 2026
Merged

fix: prevent panic when GitLab release has more links than sources#36295
wxiaoguang merged 4 commits intogo-gitea:mainfrom
argoyle:main

Conversation

@argoyle
Copy link
Copy Markdown
Contributor

@argoyle argoyle commented Jan 4, 2026 •
edited by wxiaoguang
Loading

The code incorrectly assumed rel.Assets.Links and rel.Assets.Sources arrays have equal length. This causes index out of bounds panic when migrating GitLab releases with more links than sources, which is common with GoReleaser-generated releases.

The fix sets ContentType to nil instead of using Sources[k].Format. This is safe because ContentType is not actually used when uploading release assets - the repo_model.Attachment struct has no ContentType field, so the value was being discarded anyway.

Fixes #36292

@argoyle @claude
fix(migrations): prevent panic when GitLab release has more links tha…
94360c3 
…n sources

The code incorrectly assumed rel.Assets.Links and rel.Assets.Sources
arrays have equal length. This causes index out of bounds panic when
migrating GitLab releases with more links than sources, which is common
with GoReleaser-generated releases.

The fix sets ContentType to nil instead of using Sources[k].Format.
This is safe because ContentType is not actually used when uploading
release assets - the repo_model.Attachment struct has no ContentType
field, so the value was being discarded anyway.

Fixes go-gitea#36292

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jan 4, 2026
@github-actions github-actions bot added the modifies/go Pull requests that update Go code label Jan 4, 2026
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jan 4, 2026
wxiaoguang
wxiaoguang reviewed Jan 4, 2026
View reviewed changes
services/migrations/gitlab.go Outdated
ID: int64(asset.ID),
Name: asset.Name,
ContentType: &rel.Assets.Sources[k].Format,
ContentType: nil, // GitLab Links don't provide content type
Copy link
Copy Markdown
Contributor

@wxiaoguang wxiaoguang Jan 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GitLab never provides the content type? Or it just sometimes doesn't provide the content type?

Any document?

Copy link
Copy Markdown
Contributor Author

@argoyle argoyle Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does for Sources but not for Links. The thing is that the content type is not used at all later in the flow (as far as Claude could find at least) and hence there is no reason for setting it.

Copy link
Copy Markdown
Contributor

@wxiaoguang wxiaoguang Jan 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's sure that "content type is not used", is it better to completely remove this field? From the ReleaseAsset struct?

Copy link
Copy Markdown
Contributor Author

@argoyle argoyle Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can agree on that. Would you like me to do that change in this PR or as a followup PR?

Copy link
Copy Markdown
Contributor

@wxiaoguang wxiaoguang Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's better to take the best approach in one PR as long as we found one.

Copy link
Copy Markdown
Contributor Author

@argoyle argoyle Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed another commit

Copy link
Copy Markdown
Contributor

@wxiaoguang wxiaoguang Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the field has been removed, the test is not needed anymore.

I added some comments for the removal. If we need the content type in the future, the tests should be redesigned.

@wxiaoguang wxiaoguang marked this pull request as draft January 4, 2026 23:01
argoyle and others added 2 commits January 5, 2026 09:30
@argoyle @claude
refactor(migrations): remove unused ContentType field from ReleaseAsset
4b74878 
The ContentType field was never used during release asset upload since
repo_model.Attachment has no ContentType field. Remove it from the
struct and all migration downloaders.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@wxiaoguang
fix
95764de
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jan 5, 2026
@wxiaoguang wxiaoguang marked this pull request as ready for review January 5, 2026 10:28
@wxiaoguang wxiaoguang changed the title fix(migrations): prevent panic when GitLab release has more links tha… fix(migrations): prevent panic when GitLab release has more links Jan 5, 2026
@wxiaoguang wxiaoguang changed the title fix(migrations): prevent panic when GitLab release has more links fix: prevent panic when GitLab release has more links than sources Jan 5, 2026
@wxiaoguang wxiaoguang added the topic/repo-migration Migrate repos from other platforms to Gitea, or from Gitea to them label Jan 5, 2026
@wxiaoguang wxiaoguang added this to the 1.26.0 milestone Jan 5, 2026
@wxiaoguang wxiaoguang added backport/v1.25 This PR should be backported to Gitea 1.25 type/bug labels Jan 5, 2026
@wxiaoguang wxiaoguang merged commit 1ee7f8e into go-gitea:main Jan 5, 2026
24 checks passed
GiteaBot pushed a commit to GiteaBot/gitea that referenced this pull request Jan 5, 2026
@argoyle @wxiaoguang @GiteaBot
fix: prevent panic when GitLab release has more links than sources (g…
fcf8d9f 
…o-gitea#36295)

The code incorrectly assumed rel.Assets.Links and rel.Assets.Sources
arrays have equal length. This causes index out of bounds panic when
migrating GitLab releases with more links than sources, which is common
with GoReleaser-generated releases.

Fixes go-gitea#36292

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
@GiteaBot GiteaBot mentioned this pull request Jan 5, 2026
Merged
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label Jan 5, 2026
wxiaoguang added a commit that referenced this pull request Jan 5, 2026
@GiteaBot @argoyle @wxiaoguang
fix: prevent panic when GitLab release has more links than sources (#…
c2f9edd 
…36295) (#36305)

Backport #36295 by argoyle

Fixes #36292

Co-authored-by: Joakim Olsson <joakim@unbound.se>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
zjjhot added a commit to zjjhot/gitea that referenced this pull request Jan 7, 2026
@zjjhot
Merge remote-tracking branch 'giteaofficial/main'
15aa81e 
* giteaofficial/main:
  fix: generate IDs for HTML headings without id attribute (go-gitea#36233)
  Add 'allow_maintainer_edit' API option for creating a pull request (go-gitea#36283)
  fix: prevent panic when GitLab release has more links than sources (go-gitea#36295)
saschazepter pushed a commit to saschazepter/forgejo that referenced this pull request Mar 3, 2026
@oliverpool @argoyle @mahlzahn
fix: prevent panic on gitlab import (releases/issues) (#11282)
a0d6970 
It is unfortunately all mixed up, because refreshing the data, means breaking the tests. And changing the code means needing fresh data.

- tests: ignore some more headers and sort the rest when dumping http responses
- code: fixed #10234 by requesting the latest issues first.
- tests: created a new repo to replace the disappeared repo, needed for the skip-numbers test
- refreshed the testdata.
- follow-up fixes to get the tests green.
- including a cherry-pick of go-gitea/gitea#36295 and #11272

Co-authored-by: Joakim Olsson <joakim@unbound.se>
Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11282
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: patdyn <patdyn@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>
saschazepter pushed a commit to saschazepter/forgejo that referenced this pull request Mar 3, 2026
@oliverpool @argoyle @mahlzahn
fix: prevent panic on gitlab import (releases/issues) (#11282)
6ba4e1e 
It is unfortunately all mixed up, because refreshing the data, means breaking the tests. And changing the code means needing fresh data.

- tests: ignore some more headers and sort the rest when dumping http responses
- code: fixed #10234 by requesting the latest issues first.
- tests: created a new repo to replace the disappeared repo, needed for the skip-numbers test
- refreshed the testdata.
- follow-up fixes to get the tests green.
- including a cherry-pick of go-gitea/gitea#36295 and #11272

Co-authored-by: Joakim Olsson <joakim@unbound.se>
Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11282
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: patdyn <patdyn@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>
(cherry picked from commit a0d6970)
rohitkumarankam pushed a commit to rohitkumarankam/forgejo that referenced this pull request Mar 5, 2026
@oliverpool
[v14.0/forgejo] fix: prevent panic on gitlab import (releases/issues)…
6ee6dc2 
… (#11484)

**Backport:** https://codeberg.org/forgejo/forgejo/pulls/11282

It is unfortunately all mixed up, because refreshing the data, means breaking the tests. And changing the code means needing fresh data.

- tests: ignore some more headers and sort the rest when dumping http responses
- code: fixed #10234 by requesting the latest issues first.
- tests: created a new repo to replace the disappeared repo, needed for the skip-numbers test
- refreshed the testdata.
- follow-up fixes to get the tests green.
- including a cherry-pick of go-gitea/gitea#36295 and #11272

Co-authored-by: oliverpool <git@olivier.pfad.fr>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11484
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
chudnyi pushed a commit to integratop/helm-gitea-mirror that referenced this pull request Mar 25, 2026
@lunny
chore(deps): update dependency go-gitea/gitea to v1.25.4 (#1012)
19bc25f 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [go-gitea/gitea](https://github.com/go-gitea/gitea) | patch | `1.25.3` -> `1.25.4` |

---

### Release Notes

<details>
<summary>go-gitea/gitea (go-gitea/gitea)</summary>

### [`v1.25.4`](https://github.com/go-gitea/gitea/releases/tag/v1.25.4)

[Compare Source](go-gitea/gitea@v1.25.3...v1.25.4)

- SECURITY
  - Release attachments must belong to the intended repo ([#&#8203;36347](go-gitea/gitea#36347)) ([#&#8203;36375](go-gitea/gitea#36375))
  - Fix permission check on org project operations ([#&#8203;36318](go-gitea/gitea#36318)) ([#&#8203;36373](go-gitea/gitea#36373))
  - Clean watches when make a repository private and check permission when send release emails ([#&#8203;36319](go-gitea/gitea#36319)) ([#&#8203;36370](go-gitea/gitea#36370))
  - Add more check for stopwatch read or list ([#&#8203;36340](go-gitea/gitea#36340)) ([#&#8203;36368](go-gitea/gitea#36368))
  - Fix openid setting check ([#&#8203;36346](go-gitea/gitea#36346)) ([#&#8203;36361](go-gitea/gitea#36361))
  - Fix cancel auto merge bug ([#&#8203;36341](go-gitea/gitea#36341)) ([#&#8203;36356](go-gitea/gitea#36356))
  - Fix delete attachment check ([#&#8203;36320](go-gitea/gitea#36320)) ([#&#8203;36355](go-gitea/gitea#36355))
  - LFS locks must belong to the intended repo ([#&#8203;36344](go-gitea/gitea#36344)) ([#&#8203;36349](go-gitea/gitea#36349))
  - Fix bug on notification read ([#&#8203;36339](go-gitea/gitea#36339)) [#&#8203;36387](go-gitea/gitea#36387)

- ENHANCEMENTS
  - Add more routes to the "expensive" list ([#&#8203;36290](go-gitea/gitea#36290))
  - Make "commit statuses" API accept slashes in "ref" ([#&#8203;36264](go-gitea/gitea#36264)) ([#&#8203;36275](go-gitea/gitea#36275))

- BUGFIXES
  - Fix markdown newline handling during IME composition ([#&#8203;36421](go-gitea/gitea#36421)) [#&#8203;36424](go-gitea/gitea#36424)
  - Fix missing repository id when migrating release attachments ([#&#8203;36389](go-gitea/gitea#36389))
  - Fix bug when compare in the pull request ([#&#8203;36363](go-gitea/gitea#36363)) ([#&#8203;36372](go-gitea/gitea#36372))
  - Fix incorrect text content detection ([#&#8203;36364](go-gitea/gitea#36364)) ([#&#8203;36369](go-gitea/gitea#36369))
  - Fill missing `has_code` in repository api ([#&#8203;36338](go-gitea/gitea#36338)) ([#&#8203;36359](go-gitea/gitea#36359))
  - Fix notifications pagination query parameters ([#&#8203;36351](go-gitea/gitea#36351)) ([#&#8203;36358](go-gitea/gitea#36358))
  - Fix some trivial problems ([#&#8203;36336](go-gitea/gitea#36336)) ([#&#8203;36337](go-gitea/gitea#36337))
  - Prevent panic when GitLab release has more links than sources ([#&#8203;36295](go-gitea/gitea#36295)) ([#&#8203;36305](go-gitea/gitea#36305))
  - Fix stats bug when syncing release ([#&#8203;36285](go-gitea/gitea#36285)) ([#&#8203;36294](go-gitea/gitea#36294))
  - Always honor user's choice for "delete branch after merge" ([#&#8203;36281](go-gitea/gitea#36281)) ([#&#8203;36286](go-gitea/gitea#36286))
  - Use the requested host for LFS links ([#&#8203;36242](go-gitea/gitea#36242)) ([#&#8203;36258](go-gitea/gitea#36258))
  - Fix panic when get editor config file ([#&#8203;36241](go-gitea/gitea#36241)) ([#&#8203;36247](go-gitea/gitea#36247))
  - Fix regression in writing authorized principals ([#&#8203;36213](go-gitea/gitea#36213)) ([#&#8203;36218](go-gitea/gitea#36218))
  - Fix WebAuthn error checking ([#&#8203;36219](go-gitea/gitea#36219)) ([#&#8203;36235](go-gitea/gitea#36235))

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

</details>

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xOC4xIiwidXBkYXRlZEluVmVyIjoiNDEuMTguMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsia2luZC9kZXBlbmRlbmN5Il19-->

Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1012
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>
Co-committed-by: Renovate Bot <renovate-bot@gitea.com>
@go-gitea go-gitea locked as resolved and limited conversation to collaborators Apr 5, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lunny lunny lunny approved these changes

@wxiaoguang wxiaoguang wxiaoguang approved these changes

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/v1.25 This PR should be backported to Gitea 1.25 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. modifies/go Pull requests that update Go code topic/repo-migration Migrate repos from other platforms to Gitea, or from Gitea to them type/bug

Projects

None yet

Milestone

1.26.0

Development

Successfully merging this pull request may close these issues.

Migrate from Gitlab fails on releases with different number of links and artifacts

4 participants

@argoyle @lunny @wxiaoguang @GiteaBot