Merge remote-tracking branch 'origin/main' into acticons

* origin/main: (41 commits)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin
  refactor: use modernc sqlite driver as default (go-gitea#37562)
  refactor(templates): remove ctxData from tmpl files, use ctx.RootData instead (go-gitea#37567)
  ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (go-gitea#37565)
  fix(deps): update go dependencies (go-gitea#37541)
  refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (go-gitea#37557)
  ci: lint PR titles with commitlint (go-gitea#37498)
  Make ServeSetHeaders default to download attachment if filename exists (go-gitea#37552)
  fix(actions): validate workflow param to prevent 500 error (go-gitea#37546)
  Fix various problems (go-gitea#37547)
  docs: fix 4 typos in CHANGELOG.md (go-gitea#37549)
  ...

# Conflicts:
#	templates/repo/actions/runs_list.tmpl
#	templates/repo/issue/view_content/pull_merge_box.tmpl
#	templates/repo/pulls/status.tmpl

Author: silverwind

.github/pull_request_template.md

@@ -1,10 +1,11 @@
 <!-- start tips -->
 Please check the following:
 1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for backports.
-2. Make sure you have read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md .
-3. For documentations contribution, please go to https://gitea.com/gitea/docs
-4. Describe what your pull request does and which issue you're targeting (if any).
-5. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
-6. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
-7. Delete all these tips before posting.
+2. Use a Conventional Commits PR title, for example `fix(repo): handle empty branch names`.
+3. Make sure you have read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md .
+4. For documentations contribution, please go to https://gitea.com/gitea/docs
+5. Describe what your pull request does and which issue you're targeting (if any).
+6. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
+7. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
+8. Delete all these tips before posting.
 <!-- end tips -->

.github/workflows/cache-seeder.yml

@@ -45,18 +45,17 @@ jobs:
           cache-name: seed
       - run: make deps-backend
       - run: TAGS="bindata" make backend
-      - run: TAGS="bindata sqlite sqlite_unlock_notify" make backend
-      - run: TAGS="bindata gogit sqlite sqlite_unlock_notify" GOEXPERIMENT="" make backend
+      - run: TAGS="bindata gogit" GOEXPERIMENT="" make backend
 
   lint:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         include:
-          - { job: lint-backend, tags: "bindata sqlite sqlite_unlock_notify", target: "lint-backend" }
-          - { job: lint-go-windows, tags: "bindata sqlite sqlite_unlock_notify", target: "lint-go-windows" }
-          - { job: lint-go-gogit, tags: "bindata gogit sqlite sqlite_unlock_notify", target: "lint-go" }
+          - { job: lint-backend, tags: "bindata", target: "lint-backend" }
+          - { job: lint-go-windows, tags: "bindata", target: "lint-go-windows" }
+          - { job: lint-go-gogit, tags: "bindata gogit", target: "lint-go" }
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

.github/workflows/cron-renovate.yml

@@ -2,7 +2,7 @@ name: cron-renovate
 
 on:
   schedule:
-    - cron: "0 1 * * *" # daily at 01:00 UTC
+    - cron: "23 * * * *" # hourly at :23
   workflow_dispatch:
 
 concurrency:
@@ -21,12 +21,12 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
+      - uses: renovatebot/github-action@f66d8679fcfcfa051abde6e7a623007173bf5164 # v46.1.12
         with:
           renovate-version: ${{ env.RENOVATE_VERSION }}
           configurationFile: renovate.json5
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
           RENOVATE_BINARY_SOURCE: install # auto-install go/node toolchains needed by post-upgrade tasks.
-          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg)$"]'
+          RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '["^make (tidy|svg nolyfill)$"]'
           RENOVATE_REPOSITORIES: '["go-gitea/gitea"]'

.github/workflows/pull-compliance.yml

@@ -32,7 +32,7 @@ jobs:
       - run: make deps-backend deps-tools
       - run: make lint-backend
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
 
   lint-on-demand:
     needs: files-changed
@@ -82,7 +82,7 @@ jobs:
       - run: make deps-backend deps-tools
       - run: make lint-go-windows
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
           GOOS: windows
           GOARCH: amd64
 
@@ -104,7 +104,7 @@ jobs:
       - run: make deps-backend deps-tools
       - run: make lint-go
         env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
+          TAGS: bindata gogit
 
   checks-backend:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'

.github/workflows/pull-db-tests.yml

@@ -34,7 +34,7 @@ jobs:
       minio:
         # as github actions doesn't support "entrypoint", we need to use a non-official image
         # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2023.8.31
+        image: bitnamilegacy/minio:2023.12.23
         env:
           MINIO_ROOT_USER: 123456
           MINIO_ROOT_PASSWORD: 12345678
@@ -62,6 +62,8 @@ jobs:
         run: GITEA_TEST_DATABASE=pgsql make test-integration
         timeout-minutes: 50
         env:
+          # pgsql is chosen to be the unlucky one to run with the slow "race detector", it is about 60% slower.
+          GOTEST_FLAGS: -race -timeout=40m
           TAGS: bindata gogit
           TEST_LDAP: 1
 
@@ -82,7 +84,7 @@ jobs:
       - run: make deps-backend
       - run: make backend
         env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
+          TAGS: bindata gogit
           GOEXPERIMENT:
       - name: run migration tests
         run: GITEA_TEST_DATABASE=sqlite make test-migration
@@ -92,19 +94,21 @@ jobs:
         run: GITEA_TEST_DATABASE=sqlite make test-integration
         timeout-minutes: 50
         env:
+          # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
+          GOTEST_FLAGS: -timeout=40m
           TAGS: bindata gogit
           GOEXPERIMENT:
-          GOTEST_FLAGS: -race -timeout=40m
 
   test-unit:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
     services:
       elasticsearch:
-        image: elasticsearch:7.5.0
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.14
         env:
           discovery.type: single-node
+          xpack.security.enabled: false
         ports:
           - "9200:9200"
       meilisearch:
@@ -123,7 +127,7 @@ jobs:
         ports:
           - 6379:6379
       minio:
-        image: bitnamilegacy/minio:2021.3.17
+        image: bitnamilegacy/minio:2021.12.29
         env:
           MINIO_ACCESS_KEY: 123456
           MINIO_SECRET_KEY: 12345678
@@ -153,15 +157,15 @@ jobs:
       - name: unit-tests
         run: make test-backend test-check
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
           GOTEST_FLAGS: -race -timeout=20m
+          TAGS: bindata
           GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
       - name: unit-tests-gogit
         run: make test-backend test-check
         env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
-          GOEXPERIMENT:
           GOTEST_FLAGS: -race -timeout=20m
+          TAGS: bindata gogit
+          GOEXPERIMENT:
           GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
 
   test-mysql:
@@ -171,7 +175,7 @@ jobs:
     services:
       mysql:
         # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnamilegacy/mysql:8.0
+        image: bitnamilegacy/mysql:8.4
         env:
           ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: testgitea
@@ -180,9 +184,10 @@ jobs:
         options: >-
           --mount type=tmpfs,destination=/bitnami/mysql/data
       elasticsearch:
-        image: elasticsearch:7.5.0
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.14
         env:
           discovery.type: single-node
+          xpack.security.enabled: false
         ports:
           - "9200:9200"
       smtpimap:

.github/workflows/pull-e2e-tests.yml

@@ -40,11 +40,11 @@ jobs:
       - run: make deps-backend
       - run: make backend
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - run: make playwright
       - run: make test-e2e
         timeout-minutes: 10
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
           FORCE_COLOR: 1
           GITEA_TEST_E2E_DEBUG: 1

.github/workflows/pull-pr-title.yml

@@ -0,0 +1,28 @@
+name: pr-title
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+      - ready_for_review
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint-pr-title:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - run: make lint-pr-title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}

.github/workflows/release-nightly.yml

@@ -32,7 +32,7 @@ jobs:
       # xgo build
       - run: make release
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0

.github/workflows/release-tag-rc.yml

@@ -33,7 +33,7 @@ jobs:
       # xgo build
       - run: make release
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0

.github/workflows/release-tag-version.yml

@@ -36,7 +36,7 @@ jobs:
       # xgo build
       - run: make release
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0