feat: vendor gitea 1.16.2

package/gitea/source/cmd/actions.go

@@ -13,17 +13,18 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	// CmdActions represents the available actions sub-commands.
-	CmdActions = &cli.Command{
+func newActionsCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "actions",
 		Usage: "Manage Gitea Actions",
 		Commands: []*cli.Command{
-			subcmdActionsGenRunnerToken,
+			newActionsGenerateRunnerTokenCommand(),
 		},
 	}
+}
 
-	subcmdActionsGenRunnerToken = &cli.Command{
+func newActionsGenerateRunnerTokenCommand() *cli.Command {
+	return &cli.Command{
 		Name:    "generate-runner-token",
 		Usage:   "Generate a new token for a runner to use to register with the server",
 		Action:  runGenerateActionsRunnerToken,
@@ -37,7 +38,7 @@ var (
 			},
 		},
 	}
-)
+}
 
 func runGenerateActionsRunnerToken(ctx context.Context, c *cli.Command) error {
 	setting.MustInstalled()

package/gitea/source/cmd/admin.go

@@ -18,36 +18,41 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	// CmdAdmin represents the available admin sub-command.
-	CmdAdmin = &cli.Command{
+func newAdminCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "admin",
 		Usage: "Perform common administrative operations",
 		Commands: []*cli.Command{
-			subcmdUser,
-			subcmdRepoSyncReleases,
-			subcmdRegenerate,
-			subcmdAuth,
-			subcmdSendMail,
+			newUserCommand(),
+			newRepoSyncReleasesCommand(),
+			newRegenerateCommand(),
+			newAuthCommand(),
+			newSendMailCommand(),
 		},
 	}
+}
 
-	subcmdRepoSyncReleases = &cli.Command{
+func newRepoSyncReleasesCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "repo-sync-releases",
 		Usage:  "Synchronize repository releases with tags",
 		Action: runRepoSyncReleases,
 	}
+}
 
-	subcmdRegenerate = &cli.Command{
+func newRegenerateCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "regenerate",
 		Usage: "Regenerate specific files",
 		Commands: []*cli.Command{
-			microcmdRegenHooks,
-			microcmdRegenKeys,
+			newRegenerateHooksCommand(),
+			newRegenerateKeysCommand(),
 		},
 	}
+}
 
-	subcmdAuth = &cli.Command{
+func newAuthCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "auth",
 		Usage: "Modify external auth providers",
 		Commands: []*cli.Command{
@@ -59,12 +64,14 @@ var (
 			microcmdAuthUpdateLdapSimpleAuth(),
 			microcmdAuthAddSMTP(),
 			microcmdAuthUpdateSMTP(),
-			microcmdAuthList,
-			microcmdAuthDelete,
+			newAuthListCommand(),
+			newAuthDeleteCommand(),
 		},
 	}
+}
 
-	subcmdSendMail = &cli.Command{
+func newSendMailCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "sendmail",
 		Usage:  "Send a message to all users",
 		Action: runSendMail,
@@ -86,7 +93,7 @@ var (
 			},
 		},
 	}
-)
+}
 
 func idFlag() *cli.Int64Flag {
 	return &cli.Int64Flag{
@@ -121,7 +128,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 		}
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
-			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RepoPath())
+			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RelativePath())
 			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
@@ -134,7 +141,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 			}
 			log.Trace(" currentNumReleases is %d, running SyncReleasesWithTags", oldnum)
 
-			if err = repo_module.SyncReleasesWithTags(ctx, repo, gitRepo); err != nil {
+			if _, err = repo_module.SyncReleasesWithTags(ctx, repo, gitRepo); err != nil {
 				log.Warn(" SyncReleasesWithTags: %v", err)
 				gitRepo.Close()
 				continue
@@ -147,7 +154,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 				continue
 			}
 
-			log.Trace(" repo %s releases synchronized to tags: from %d to %d",
+			log.Trace("repo %s releases synchronized to tags: from %d to %d",
 				repo.FullName(), oldnum, count)
 			gitRepo.Close()
 		}

package/gitea/source/cmd/admin_auth.go

@@ -17,14 +17,17 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	microcmdAuthDelete = &cli.Command{
+func newAuthDeleteCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "delete",
 		Usage:  "Delete specific auth source",
 		Flags:  []cli.Flag{idFlag()},
 		Action: runDeleteAuth,
 	}
-	microcmdAuthList = &cli.Command{
+}
+
+func newAuthListCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "list",
 		Usage:  "List auth sources",
 		Action: runListAuth,
@@ -55,7 +58,7 @@ var (
 			},
 		},
 	}
-)
+}
 
 func runListAuth(ctx context.Context, c *cli.Command) error {
 	if err := initDB(ctx); err != nil {

package/gitea/source/cmd/admin_auth_ldap.go

@@ -94,6 +94,10 @@ func commonLdapCLIFlags() []cli.Flag {
 			Name:  "public-ssh-key-attribute",
 			Usage: "The attribute of the user’s LDAP record containing the user’s public ssh key.",
 		},
+		&cli.BoolFlag{
+			Name:  "ssh-keys-are-verified",
+			Usage: "Set to true to automatically flag SSH keys in LDAP as verified.",
+		},
 		&cli.BoolFlag{
 			Name:  "skip-local-2fa",
 			Usage: "Set to true to skip local 2fa for users authenticated by this source",
@@ -294,6 +298,9 @@ func parseLdapConfig(c *cli.Command, config *ldap.Source) error {
 	if c.IsSet("public-ssh-key-attribute") {
 		config.AttributeSSHPublicKey = c.String("public-ssh-key-attribute")
 	}
+	if c.IsSet("ssh-keys-are-verified") {
+		config.SSHKeysAreVerified = c.Bool("ssh-keys-are-verified")
+	}
 	if c.IsSet("avatar-attribute") {
 		config.AttributeAvatar = c.String("avatar-attribute")
 	}

package/gitea/source/cmd/admin_auth_ldap_test.go

@@ -233,7 +233,7 @@ func TestAddLdapBindDn(t *testing.T) {
 			},
 			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
 				assert.FailNow(t, "getAuthSourceByID called", "case %d: should not call getAuthSourceByID", n)
-				return nil, nil
+				return nil, nil //nolint:nilnil // mock function covering improper behavior
 			},
 		}
 
@@ -463,7 +463,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 			},
 			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
 				assert.FailNow(t, "getAuthSourceById called", "case %d: should not call getAuthSourceByID", n)
-				return nil, nil
+				return nil, nil //nolint:nilnil // mock function covering improper behavior
 			},
 		}
 

package/gitea/source/cmd/admin_regenerate.go

@@ -13,19 +13,21 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	microcmdRegenHooks = &cli.Command{
+func newRegenerateHooksCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "hooks",
 		Usage:  "Regenerate git-hooks",
 		Action: runRegenerateHooks,
 	}
+}
 
-	microcmdRegenKeys = &cli.Command{
+func newRegenerateKeysCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "keys",
 		Usage:  "Regenerate authorized_keys file",
 		Action: runRegenerateKeys,
 	}
-)
+}
 
 func runRegenerateHooks(ctx context.Context, _ *cli.Command) error {
 	if err := initDB(ctx); err != nil {

package/gitea/source/cmd/admin_user.go

@@ -7,15 +7,17 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var subcmdUser = &cli.Command{
-	Name:  "user",
-	Usage: "Modify users",
-	Commands: []*cli.Command{
-		microcmdUserCreate(),
-		microcmdUserList,
-		microcmdUserChangePassword(),
-		microcmdUserDelete(),
-		microcmdUserGenerateAccessToken,
-		microcmdUserMustChangePassword(),
-	},
+func newUserCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "user",
+		Usage: "Modify users",
+		Commands: []*cli.Command{
+			microcmdUserCreate(),
+			newUserListCommand(),
+			microcmdUserChangePassword(),
+			microcmdUserDelete(),
+			newUserGenerateAccessTokenCommand(),
+			microcmdUserMustChangePassword(),
+		},
+	}
 }

package/gitea/source/cmd/admin_user_create.go

@@ -151,6 +151,7 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 		if err != nil {
 			return err
 		}
+		// codeql[disable-next-line=go/clear-text-logging]
 		fmt.Printf("generated random password is '%s'\n", password)
 	} else if userType == user_model.UserTypeIndividual {
 		return errors.New("must set either password or random-password flag")

package/gitea/source/cmd/admin_user_generate_access_token.go

@@ -14,32 +14,34 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var microcmdUserGenerateAccessToken = &cli.Command{
-	Name:  "generate-access-token",
-	Usage: "Generate an access token for a specific user",
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:    "username",
-			Aliases: []string{"u"},
-			Usage:   "Username",
+func newUserGenerateAccessTokenCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "generate-access-token",
+		Usage: "Generate an access token for a specific user",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "username",
+				Aliases: []string{"u"},
+				Usage:   "Username",
+			},
+			&cli.StringFlag{
+				Name:    "token-name",
+				Aliases: []string{"t"},
+				Usage:   "Token name",
+				Value:   "gitea-admin",
+			},
+			&cli.BoolFlag{
+				Name:  "raw",
+				Usage: "Display only the token value",
+			},
+			&cli.StringFlag{
+				Name:  "scopes",
+				Value: "all",
+				Usage: `Comma separated list of scopes to apply to access token, examples: "all", "public-only,read:issue", "write:repository,write:user"`,
+			},
 		},
-		&cli.StringFlag{
-			Name:    "token-name",
-			Aliases: []string{"t"},
-			Usage:   "Token name",
-			Value:   "gitea-admin",
-		},
-		&cli.BoolFlag{
-			Name:  "raw",
-			Usage: "Display only the token value",
-		},
-		&cli.StringFlag{
-			Name:  "scopes",
-			Value: "all",
-			Usage: `Comma separated list of scopes to apply to access token, examples: "all", "public-only,read:issue", "write:repository,write:user"`,
-		},
-	},
-	Action: runGenerateAccessToken,
+		Action: runGenerateAccessToken,
+	}
 }
 
 func runGenerateAccessToken(ctx context.Context, c *cli.Command) error {

package/gitea/source/cmd/admin_user_list.go

@@ -14,16 +14,18 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var microcmdUserList = &cli.Command{
-	Name:   "list",
-	Usage:  "List users",
-	Action: runListUsers,
-	Flags: []cli.Flag{
-		&cli.BoolFlag{
-			Name:  "admin",
-			Usage: "List only admin users",
+func newUserListCommand() *cli.Command {
+	return &cli.Command{
+		Name:   "list",
+		Usage:  "List users",
+		Action: runListUsers,
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:  "admin",
+				Usage: "List only admin users",
+			},
 		},
-	},
+	}
 }
 
 func runListUsers(ctx context.Context, c *cli.Command) error {

package/gitea/source/cmd/admin_user_must_change_password.go

@@ -58,6 +58,7 @@ func runMustChangePassword(ctx context.Context, c *cli.Command) error {
 		return err
 	}
 
+	// codeql[disable-next-line=go/clear-text-logging]
 	fmt.Printf("Updated %d users setting MustChangePassword to %t\n", n, mustChangePassword)
 	return nil
 }

package/gitea/source/cmd/config.go

@@ -0,0 +1,156 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+
+	"code.gitea.io/gitea/modules/setting"
+
+	"github.com/urfave/cli/v3"
+)
+
+func cmdConfig() *cli.Command {
+	subcmdConfigEditIni := &cli.Command{
+		Name:  "edit-ini",
+		Usage: "Load an existing INI file, apply environment variables, keep specified keys, and output to a new INI file.",
+		Description: `
+Help users to edit the Gitea configuration INI file.
+
+# Keep Specified Keys
+
+If you need to re-create the configuration file with only a subset of keys,
+you can provide an INI template file for the kept keys and use the "--config-keep-keys" flag.
+For example, if a helm chart needs to reset the settings and only keep SECRET_KEY,
+it can use a template file (only keys take effect, values are ignored):
+
+  [security]
+  SECRET_KEY=
+
+$ ./gitea config edit-ini --config app-old.ini --config-keep-keys app-keys.ini --out app-new.ini
+
+# Map Environment Variables to INI Configuration
+
+Environment variables of the form "GITEA__section_name__KEY_NAME"
+will be mapped to the ini section "[section_name]" and the key
+"KEY_NAME" with the value as provided.
+
+Environment variables of the form "GITEA__section_name__KEY_NAME__FILE"
+will be mapped to the ini section "[section_name]" and the key
+"KEY_NAME" with the value loaded from the specified file.
+
+Environment variable keys can only contain characters "0-9A-Z_",
+if a section or key name contains dot ".", it needs to be escaped as _0x2E_.
+For example, to apply this config:
+
+	[git.config]
+	foo.bar=val
+
+$ export GITEA__git_0x2E_config__foo_0x2E_bar=val
+
+# Put All Together
+
+$ ./gitea config edit-ini --config app.ini --config-keep-keys app-keys.ini --apply-env {--in-place|--out app-new.ini}
+`,
+		Flags: []cli.Flag{
+			// "--config" flag is provided by global flags, and this flag is also used by "environment-to-ini" script wrapper
+			// "--in-place" is also used by "environment-to-ini" script wrapper for its old behavior: always overwrite the existing config file
+			&cli.BoolFlag{
+				Name:  "in-place",
+				Usage: "Output to the same config file as input. This flag will be ignored if --out is set.",
+			},
+			&cli.StringFlag{
+				Name:  "config-keep-keys",
+				Usage: "An INI template file containing keys for keeping. Only the keys defined in the INI template will be kept from old config. If not set, all keys will be kept.",
+			},
+			&cli.BoolFlag{
+				Name:  "apply-env",
+				Usage: "Apply all GITEA__* variables from the environment to the config.",
+			},
+			&cli.StringFlag{
+				Name:  "out",
+				Usage: "Destination config file to write to.",
+			},
+		},
+		Action: runConfigEditIni,
+	}
+
+	return &cli.Command{
+		Name:  "config",
+		Usage: "Manage Gitea configuration",
+		Commands: []*cli.Command{
+			subcmdConfigEditIni,
+		},
+	}
+}
+
+func runConfigEditIni(_ context.Context, c *cli.Command) error {
+	// the config system may change the environment variables, so get a copy first, to be used later
+	env := append([]string{}, os.Environ()...)
+
+	// don't use the guessed setting.CustomConf, instead, require the user to provide --config explicitly
+	if !c.IsSet("config") {
+		return errors.New("flag is required but not set: --config")
+	}
+	configFileIn := c.String("config")
+
+	cfgIn, err := setting.NewConfigProviderFromFile(configFileIn)
+	if err != nil {
+		return fmt.Errorf("failed to load config file %q: %v", configFileIn, err)
+	}
+
+	// determine output config file: use "--out" flag or use "--in-place" flag to overwrite input file
+	inPlace := c.Bool("in-place")
+	configFileOut := c.String("out")
+	if configFileOut == "" {
+		if !inPlace {
+			return errors.New("either --in-place or --out must be specified")
+		}
+		configFileOut = configFileIn // in-place edit
+	}
+
+	needWriteOut := configFileOut != configFileIn
+
+	cfgOut := cfgIn
+	configKeepKeys := c.String("config-keep-keys")
+	if configKeepKeys != "" {
+		needWriteOut = true
+		cfgOut, err = setting.NewConfigProviderFromFile(configKeepKeys)
+		if err != nil {
+			return fmt.Errorf("failed to load config-keep-keys template file %q: %v", configKeepKeys, err)
+		}
+
+		for _, secOut := range cfgOut.Sections() {
+			for _, keyOut := range secOut.Keys() {
+				secIn := cfgIn.Section(secOut.Name())
+				keyIn := setting.ConfigSectionKey(secIn, keyOut.Name())
+				if keyIn != nil {
+					keyOut.SetValue(keyIn.String())
+				} else {
+					secOut.DeleteKey(keyOut.Name())
+				}
+			}
+			if len(secOut.Keys()) == 0 {
+				cfgOut.DeleteSection(secOut.Name())
+			}
+		}
+	}
+
+	if c.Bool("apply-env") {
+		if setting.EnvironmentToConfig(cfgOut, env) {
+			needWriteOut = true
+		}
+	}
+
+	if needWriteOut {
+		err = cfgOut.SaveTo(configFileOut)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}

package/gitea/source/cmd/config_test.go

@@ -0,0 +1,85 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigEdit(t *testing.T) {
+	tmpDir := t.TempDir()
+	configOld := tmpDir + "/app-old.ini"
+	configTemplate := tmpDir + "/app-template.ini"
+	_ = os.WriteFile(configOld, []byte(`
+[sec]
+k1=v1
+k2=v2
+`), os.ModePerm)
+
+	_ = os.WriteFile(configTemplate, []byte(`
+[sec]
+k1=in-template
+
+[sec2]
+k3=v3
+`), os.ModePerm)
+
+	t.Setenv("GITEA__EnV__KeY", "val")
+
+	t.Run("OutputToNewWithEnv", func(t *testing.T) {
+		configNew := tmpDir + "/app-new.ini"
+		err := NewMainApp(AppVersion{}).Run(t.Context(), []string{
+			"./gitea", "--config", configOld,
+			"config", "edit-ini",
+			"--apply-env",
+			"--config-keep-keys", configTemplate,
+			"--out", configNew,
+		})
+		require.NoError(t, err)
+
+		// "k1" old value is kept because its key is in the template
+		// "k2" is removed because it isn't in the template
+		// "k3" isn't in new config because it isn't in the old config
+		// [env] is applied from environment variable
+		data, _ := os.ReadFile(configNew)
+		require.Equal(t, `[sec]
+k1 = v1
+
+[env]
+KeY = val
+`, string(data))
+	})
+
+	t.Run("OutputToExisting(environment-to-ini)", func(t *testing.T) {
+		// the legacy "environment-to-ini" (now a wrapper script) behavior:
+		// if no "--out", then "--in-place" must be used to overwrite the existing "--config" file
+		err := NewMainApp(AppVersion{}).Run(t.Context(), []string{
+			"./gitea", "config", "edit-ini",
+			"--apply-env",
+			"--config", configOld,
+		})
+		require.ErrorContains(t, err, "either --in-place or --out must be specified")
+
+		// simulate the "environment-to-ini" behavior with "--in-place"
+		err = NewMainApp(AppVersion{}).Run(t.Context(), []string{
+			"./gitea", "config", "edit-ini",
+			"--in-place",
+			"--apply-env",
+			"--config", configOld,
+		})
+		require.NoError(t, err)
+
+		data, _ := os.ReadFile(configOld)
+		require.Equal(t, `[sec]
+k1 = v1
+k2 = v2
+
+[env]
+KeY = val
+`, string(data))
+	})
+}

package/gitea/source/cmd/docs.go

@@ -13,23 +13,24 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdDocs represents the available docs sub-command.
-var CmdDocs = &cli.Command{
-	Name:        "docs",
-	Usage:       "Output CLI documentation",
-	Description: "A command to output Gitea's CLI documentation, optionally to a file.",
-	Action:      runDocs,
-	Flags: []cli.Flag{
-		&cli.BoolFlag{
-			Name:  "man",
-			Usage: "Output man pages instead",
+func newDocsCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "docs",
+		Usage:       "Output CLI documentation",
+		Description: "A command to output Gitea's CLI documentation, optionally to a file.",
+		Action:      runDocs,
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:  "man",
+				Usage: "Output man pages instead",
+			},
+			&cli.StringFlag{
+				Name:    "output",
+				Aliases: []string{"o"},
+				Usage:   "Path to output to instead of stdout (will overwrite if exists)",
+			},
 		},
-		&cli.StringFlag{
-			Name:    "output",
-			Aliases: []string{"o"},
-			Usage:   "Path to output to instead of stdout (will overwrite if exists)",
-		},
-	},
+	}
 }
 
 func runDocs(_ context.Context, cmd *cli.Command) error {

package/gitea/source/cmd/doctor.go

@@ -24,73 +24,77 @@ import (
 	"xorm.io/xorm"
 )
 
-// CmdDoctor represents the available doctor sub-command.
-var CmdDoctor = &cli.Command{
-	Name:        "doctor",
-	Usage:       "Diagnose and optionally fix problems, convert or re-create database tables",
-	Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
-
-	Commands: []*cli.Command{
-		cmdDoctorCheck,
-		cmdRecreateTable,
-		cmdDoctorConvert,
-	},
+func newDoctorCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "doctor",
+		Usage:       "Diagnose and optionally fix problems, convert or re-create database tables",
+		Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
+		Commands: []*cli.Command{
+			newDoctorCheckCommand(),
+			newRecreateTableCommand(),
+			newDoctorConvertCommand(),
+		},
+	}
 }
 
-var cmdDoctorCheck = &cli.Command{
-	Name:        "check",
-	Usage:       "Diagnose and optionally fix problems",
-	Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
-	Action:      runDoctorCheck,
-	Flags: []cli.Flag{
-		&cli.BoolFlag{
-			Name:  "list",
-			Usage: "List the available checks",
+func newDoctorCheckCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "check",
+		Usage:       "Diagnose and optionally fix problems",
+		Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
+		Action:      runDoctorCheck,
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:  "list",
+				Usage: "List the available checks",
+			},
+			&cli.BoolFlag{
+				Name:  "default",
+				Usage: "Run the default checks (if neither --run or --all is set, this is the default behaviour)",
+			},
+			&cli.StringSliceFlag{
+				Name:  "run",
+				Usage: "Run the provided checks - (if --default is set, the default checks will also run)",
+			},
+			&cli.BoolFlag{
+				Name:  "all",
+				Usage: "Run all the available checks",
+			},
+			&cli.BoolFlag{
+				Name:  "fix",
+				Usage: "Automatically fix what we can",
+			},
+			&cli.StringFlag{
+				Name:  "log-file",
+				Usage: `Name of the log file (no verbose log output by default). Set to "-" to output to stdout`,
+			},
+			&cli.BoolFlag{
+				Name:    "color",
+				Aliases: []string{"H"},
+				Usage:   "Use color for outputted information",
+			},
 		},
-		&cli.BoolFlag{
-			Name:  "default",
-			Usage: "Run the default checks (if neither --run or --all is set, this is the default behaviour)",
-		},
-		&cli.StringSliceFlag{
-			Name:  "run",
-			Usage: "Run the provided checks - (if --default is set, the default checks will also run)",
-		},
-		&cli.BoolFlag{
-			Name:  "all",
-			Usage: "Run all the available checks",
-		},
-		&cli.BoolFlag{
-			Name:  "fix",
-			Usage: "Automatically fix what we can",
-		},
-		&cli.StringFlag{
-			Name:  "log-file",
-			Usage: `Name of the log file (no verbose log output by default). Set to "-" to output to stdout`,
-		},
-		&cli.BoolFlag{
-			Name:    "color",
-			Aliases: []string{"H"},
-			Usage:   "Use color for outputted information",
-		},
-	},
+	}
 }
 
-var cmdRecreateTable = &cli.Command{
-	Name:      "recreate-table",
-	Usage:     "Recreate tables from XORM definitions and copy the data.",
-	ArgsUsage: "[TABLE]... : (TABLEs to recreate - leave blank for all)",
-	Flags: []cli.Flag{
-		&cli.BoolFlag{
-			Name:  "debug",
-			Usage: "Print SQL commands sent",
+func newRecreateTableCommand() *cli.Command {
+	return &cli.Command{
+		Name:      "recreate-table",
+		Usage:     "Recreate tables from XORM definitions and copy the data.",
+		ArgsUsage: "[TABLE]... : (TABLEs to recreate - leave blank for all)",
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name:  "debug",
+				Usage: "Print SQL commands sent",
+			},
 		},
-	},
-	Description: `The database definitions Gitea uses change across versions, sometimes changing default values and leaving old unused columns.
+		Description: `The database definitions Gitea uses change across versions, sometimes changing default values and leaving old unused columns.
 
 This command will cause Xorm to recreate tables, copying over the data and deleting the old table.
 
 You should back-up your database before doing this and ensure that your database is up-to-date first.`,
-	Action: runRecreateTable,
+		Action: runRecreateTable,
+	}
 }
 
 func runRecreateTable(ctx context.Context, cmd *cli.Command) error {

package/gitea/source/cmd/doctor_convert.go

@@ -14,12 +14,13 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// cmdDoctorConvert represents the available convert sub-command.
-var cmdDoctorConvert = &cli.Command{
-	Name:        "convert",
-	Usage:       "Convert the database",
-	Description: "A command to convert an existing MySQL database from utf8 to utf8mb4 or MSSQL database from varchar to nvarchar",
-	Action:      runDoctorConvert,
+func newDoctorConvertCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "convert",
+		Usage:       "Convert the database",
+		Description: "A command to convert an existing MySQL database from utf8 to utf8mb4 or MSSQL database from varchar to nvarchar",
+		Action:      runDoctorConvert,
+	}
 }
 
 func runDoctorConvert(ctx context.Context, cmd *cli.Command) error {

package/gitea/source/cmd/doctor_test.go

@@ -23,7 +23,7 @@ func TestDoctorRun(t *testing.T) {
 		SkipDatabaseInitialization: true,
 	})
 	app := &cli.Command{
-		Commands: []*cli.Command{cmdDoctorCheck},
+		Commands: []*cli.Command{newDoctorCheckCommand()},
 	}
 	err := app.Run(t.Context(), []string{"./gitea", "check", "--run", "test-check"})
 	assert.NoError(t, err)

package/gitea/source/cmd/dump.go

@@ -23,78 +23,79 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdDump represents the available dump sub-command.
-var CmdDump = &cli.Command{
-	Name:        "dump",
-	Usage:       "Dump Gitea files and database",
-	Description: `Dump compresses all related files and database into zip file. It can be used for backup and capture Gitea server image to send to maintainer`,
-	Action:      runDump,
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:    "file",
-			Aliases: []string{"f"},
-			Usage:   `Name of the dump file which will be created, default to "gitea-dump-{time}.zip". Supply '-' for stdout. See type for available types.`,
+func newDumpCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "dump",
+		Usage:       "Dump Gitea files and database",
+		Description: `Dump compresses all related files and database into zip file. It can be used for backup and capture Gitea server image to send to maintainer`,
+		Action:      runDump,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "file",
+				Aliases: []string{"f"},
+				Usage:   `Name of the dump file which will be created, default to "gitea-dump-{time}.zip". Supply '-' for stdout. See type for available types.`,
+			},
+			&cli.BoolFlag{
+				Name:    "verbose",
+				Aliases: []string{"V"},
+				Usage:   "Show process details",
+			},
+			&cli.BoolFlag{
+				Name:    "quiet",
+				Aliases: []string{"q"},
+				Usage:   "Only display warnings and errors",
+			},
+			&cli.StringFlag{
+				Name:    "tempdir",
+				Aliases: []string{"t"},
+				Value:   os.TempDir(),
+				Usage:   "Temporary dir path",
+			},
+			&cli.StringFlag{
+				Name:    "database",
+				Aliases: []string{"d"},
+				Usage:   "Specify the database SQL syntax: sqlite3, mysql, mssql, postgres",
+			},
+			&cli.BoolFlag{
+				Name:    "skip-repository",
+				Aliases: []string{"R"},
+				Usage:   "Skip the repository dumping",
+			},
+			&cli.BoolFlag{
+				Name:    "skip-log",
+				Aliases: []string{"L"},
+				Usage:   "Skip the log dumping",
+			},
+			&cli.BoolFlag{
+				Name:  "skip-custom-dir",
+				Usage: "Skip custom directory",
+			},
+			&cli.BoolFlag{
+				Name:  "skip-lfs-data",
+				Usage: "Skip LFS data",
+			},
+			&cli.BoolFlag{
+				Name:  "skip-attachment-data",
+				Usage: "Skip attachment data",
+			},
+			&cli.BoolFlag{
+				Name:  "skip-package-data",
+				Usage: "Skip package data",
+			},
+			&cli.BoolFlag{
+				Name:  "skip-index",
+				Usage: "Skip bleve index data",
+			},
+			&cli.BoolFlag{
+				Name:  "skip-db",
+				Usage: "Skip database",
+			},
+			&cli.StringFlag{
+				Name:  "type",
+				Usage: `Dump output format, default to "zip", supported types: ` + strings.Join(dump.SupportedOutputTypes, ", "),
+			},
 		},
-		&cli.BoolFlag{
-			Name:    "verbose",
-			Aliases: []string{"V"},
-			Usage:   "Show process details",
-		},
-		&cli.BoolFlag{
-			Name:    "quiet",
-			Aliases: []string{"q"},
-			Usage:   "Only display warnings and errors",
-		},
-		&cli.StringFlag{
-			Name:    "tempdir",
-			Aliases: []string{"t"},
-			Value:   os.TempDir(),
-			Usage:   "Temporary dir path",
-		},
-		&cli.StringFlag{
-			Name:    "database",
-			Aliases: []string{"d"},
-			Usage:   "Specify the database SQL syntax: sqlite3, mysql, mssql, postgres",
-		},
-		&cli.BoolFlag{
-			Name:    "skip-repository",
-			Aliases: []string{"R"},
-			Usage:   "Skip the repository dumping",
-		},
-		&cli.BoolFlag{
-			Name:    "skip-log",
-			Aliases: []string{"L"},
-			Usage:   "Skip the log dumping",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-custom-dir",
-			Usage: "Skip custom directory",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-lfs-data",
-			Usage: "Skip LFS data",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-attachment-data",
-			Usage: "Skip attachment data",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-package-data",
-			Usage: "Skip package data",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-index",
-			Usage: "Skip bleve index data",
-		},
-		&cli.BoolFlag{
-			Name:  "skip-db",
-			Usage: "Skip database",
-		},
-		&cli.StringFlag{
-			Name:  "type",
-			Usage: `Dump output format, default to "zip", supported types: ` + strings.Join(dump.SupportedOutputTypes, ", "),
-		},
-	},
+	}
 }
 
 func fatal(format string, args ...any) {

package/gitea/source/cmd/dump_repo.go

@@ -22,61 +22,62 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdDumpRepository represents the available dump repository sub-command.
-var CmdDumpRepository = &cli.Command{
-	Name:        "dump-repo",
-	Usage:       "Dump the repository from git/github/gitea/gitlab",
-	Description: "This is a command for dumping the repository data.",
-	Action:      runDumpRepository,
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:  "git_service",
-			Value: "",
-			Usage: "Git service, git, github, gitea, gitlab. If clone_addr could be recognized, this could be ignored.",
-		},
-		&cli.StringFlag{
-			Name:    "repo_dir",
-			Aliases: []string{"r"},
-			Value:   "./data",
-			Usage:   "Repository dir path to store the data",
-		},
-		&cli.StringFlag{
-			Name:  "clone_addr",
-			Value: "",
-			Usage: "The URL will be clone, currently could be a git/github/gitea/gitlab http/https URL",
-		},
-		&cli.StringFlag{
-			Name:  "auth_username",
-			Value: "",
-			Usage: "The username to visit the clone_addr",
-		},
-		&cli.StringFlag{
-			Name:  "auth_password",
-			Value: "",
-			Usage: "The password to visit the clone_addr",
-		},
-		&cli.StringFlag{
-			Name:  "auth_token",
-			Value: "",
-			Usage: "The personal token to visit the clone_addr",
-		},
-		&cli.StringFlag{
-			Name:  "owner_name",
-			Value: "",
-			Usage: "The data will be stored on a directory with owner name if not empty",
-		},
-		&cli.StringFlag{
-			Name:  "repo_name",
-			Value: "",
-			Usage: "The data will be stored on a directory with repository name if not empty",
-		},
-		&cli.StringFlag{
-			Name:  "units",
-			Value: "",
-			Usage: `Which items will be migrated, one or more units should be separated as comma.
+func newDumpRepositoryCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "dump-repo",
+		Usage:       "Dump the repository from git/github/gitea/gitlab",
+		Description: "This is a command for dumping the repository data.",
+		Action:      runDumpRepository,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:  "git_service",
+				Value: "",
+				Usage: "Git service, git, github, gitea, gitlab. If clone_addr could be recognized, this could be ignored.",
+			},
+			&cli.StringFlag{
+				Name:    "repo_dir",
+				Aliases: []string{"r"},
+				Value:   "./data",
+				Usage:   "Repository dir path to store the data",
+			},
+			&cli.StringFlag{
+				Name:  "clone_addr",
+				Value: "",
+				Usage: "The URL will be clone, currently could be a git/github/gitea/gitlab http/https URL",
+			},
+			&cli.StringFlag{
+				Name:  "auth_username",
+				Value: "",
+				Usage: "The username to visit the clone_addr",
+			},
+			&cli.StringFlag{
+				Name:  "auth_password",
+				Value: "",
+				Usage: "The password to visit the clone_addr",
+			},
+			&cli.StringFlag{
+				Name:  "auth_token",
+				Value: "",
+				Usage: "The personal token to visit the clone_addr",
+			},
+			&cli.StringFlag{
+				Name:  "owner_name",
+				Value: "",
+				Usage: "The data will be stored on a directory with owner name if not empty",
+			},
+			&cli.StringFlag{
+				Name:  "repo_name",
+				Value: "",
+				Usage: "The data will be stored on a directory with repository name if not empty",
+			},
+			&cli.StringFlag{
+				Name:  "units",
+				Value: "",
+				Usage: `Which items will be migrated, one or more units should be separated as comma.
 wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
+			},
 		},
-	},
+	}
 }
 
 func runDumpRepository(ctx context.Context, cmd *cli.Command) error {

package/gitea/source/cmd/embedded.go

@@ -23,20 +23,23 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdEmbedded represents the available extract sub-command.
-var (
-	CmdEmbedded = &cli.Command{
+var matchedAssetFiles []assetFile
+
+func newEmbeddedCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "embedded",
 		Usage:       "Extract embedded resources",
 		Description: "A command for extracting embedded resources, like templates and images",
 		Commands: []*cli.Command{
-			subcmdList,
-			subcmdView,
-			subcmdExtract,
+			newEmbeddedListCommand(),
+			newEmbeddedViewCommand(),
+			newEmbeddedExtractCommand(),
 		},
 	}
+}
 
-	subcmdList = &cli.Command{
+func newEmbeddedListCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "list",
 		Usage:  "List files matching the given pattern",
 		Action: runList,
@@ -48,8 +51,10 @@ var (
 			},
 		},
 	}
+}
 
-	subcmdView = &cli.Command{
+func newEmbeddedViewCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "view",
 		Usage:  "View a file matching the given pattern",
 		Action: runView,
@@ -61,8 +66,10 @@ var (
 			},
 		},
 	}
+}
 
-	subcmdExtract = &cli.Command{
+func newEmbeddedExtractCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "extract",
 		Usage:  "Extract resources",
 		Action: runExtract,
@@ -91,9 +98,7 @@ var (
 			},
 		},
 	}
-
-	matchedAssetFiles []assetFile
-)
+}
 
 type assetFile struct {
 	fs   *assetfs.LayeredFS

package/gitea/source/cmd/generate.go

@@ -15,45 +15,52 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	// CmdGenerate represents the available generate sub-command.
-	CmdGenerate = &cli.Command{
+func newGenerateCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "generate",
 		Usage: "Generate Gitea's secrets/keys/tokens",
 		Commands: []*cli.Command{
-			subcmdSecret,
+			newGenerateSecretCommand(),
 		},
 	}
+}
 
-	subcmdSecret = &cli.Command{
+func newGenerateSecretCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "secret",
 		Usage: "Generate a secret token",
 		Commands: []*cli.Command{
-			microcmdGenerateInternalToken,
-			microcmdGenerateLfsJwtSecret,
-			microcmdGenerateSecretKey,
+			newGenerateInternalTokenCommand(),
+			newGenerateLfsJWTSecretCommand(),
+			newGenerateSecretKeyCommand(),
 		},
 	}
+}
 
-	microcmdGenerateInternalToken = &cli.Command{
+func newGenerateInternalTokenCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "INTERNAL_TOKEN",
 		Usage:  "Generate a new INTERNAL_TOKEN",
 		Action: runGenerateInternalToken,
 	}
+}
 
-	microcmdGenerateLfsJwtSecret = &cli.Command{
+func newGenerateLfsJWTSecretCommand() *cli.Command {
+	return &cli.Command{
 		Name:    "JWT_SECRET",
 		Aliases: []string{"LFS_JWT_SECRET"},
 		Usage:   "Generate a new JWT_SECRET",
 		Action:  runGenerateLfsJwtSecret,
 	}
+}
 
-	microcmdGenerateSecretKey = &cli.Command{
+func newGenerateSecretKeyCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "SECRET_KEY",
 		Usage:  "Generate a new SECRET_KEY",
 		Action: runGenerateSecretKey,
 	}
-)
+}
 
 func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 	internalToken, err := generate.NewInternalToken()
@@ -71,11 +78,7 @@ func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 }
 
 func runGenerateLfsJwtSecret(_ context.Context, c *cli.Command) error {
-	_, jwtSecretBase64, err := generate.NewJwtSecretWithBase64()
-	if err != nil {
-		return err
-	}
-
+	_, jwtSecretBase64 := generate.NewJwtSecretWithBase64()
 	fmt.Printf("%s", jwtSecretBase64)
 
 	if isatty.IsTerminal(os.Stdout.Fd()) {
@@ -91,6 +94,7 @@ func runGenerateSecretKey(_ context.Context, c *cli.Command) error {
 		return err
 	}
 
+	// codeql[disable-next-line=go/clear-text-logging]
 	fmt.Printf("%s", secretKey)
 
 	if isatty.IsTerminal(os.Stdout.Fd()) {

package/gitea/source/cmd/hook.go

@@ -28,23 +28,24 @@ const (
 	hookBatchSize = 500
 )
 
-var (
-	// CmdHook represents the available hooks sub-command.
-	CmdHook = &cli.Command{
+func newHookCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "hook",
 		Usage:       "(internal) Should only be called by Git",
 		Hidden:      true, // internal commands shouldn't be visible
 		Description: "Delegate commands to corresponding Git hooks",
 		Before:      PrepareConsoleLoggerLevel(log.FATAL),
 		Commands: []*cli.Command{
-			subcmdHookPreReceive,
-			subcmdHookUpdate,
-			subcmdHookPostReceive,
-			subcmdHookProcReceive,
+			newHookPreReceiveCommand(),
+			newHookUpdateCommand(),
+			newHookPostReceiveCommand(),
+			newHookProcReceiveCommand(),
 		},
 	}
+}
 
-	subcmdHookPreReceive = &cli.Command{
+func newHookPreReceiveCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "pre-receive",
 		Usage:       "Delegate pre-receive Git hook",
 		Description: "This command should only be called by Git",
@@ -55,7 +56,10 @@ var (
 			},
 		},
 	}
-	subcmdHookUpdate = &cli.Command{
+}
+
+func newHookUpdateCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "update",
 		Usage:       "Delegate update Git hook",
 		Description: "This command should only be called by Git",
@@ -66,7 +70,10 @@ var (
 			},
 		},
 	}
-	subcmdHookPostReceive = &cli.Command{
+}
+
+func newHookPostReceiveCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "post-receive",
 		Usage:       "Delegate post-receive Git hook",
 		Description: "This command should only be called by Git",
@@ -77,8 +84,11 @@ var (
 			},
 		},
 	}
-	// Note: new hook since git 2.29
-	subcmdHookProcReceive = &cli.Command{
+}
+
+// Note: new hook since git 2.29
+func newHookProcReceiveCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "proc-receive",
 		Usage:       "Delegate proc-receive Git hook",
 		Description: "This command should only be called by Git",
@@ -89,7 +99,7 @@ var (
 			},
 		},
 	}
-)
+}
 
 type delayWriter struct {
 	internal io.Writer
@@ -194,7 +204,7 @@ Gitea or set your environment appropriately.`, "")
 	userID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	prID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPRID), 10, 64)
 	deployKeyID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvDeployKeyID), 10, 64)
-	actionPerm, _ := strconv.ParseInt(os.Getenv(repo_module.EnvActionPerm), 10, 64)
+	actionsTaskID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvActionsTaskID), 10, 64)
 
 	hookOptions := private.HookOptions{
 		UserID:                          userID,
@@ -204,7 +214,8 @@ Gitea or set your environment appropriately.`, "")
 		GitPushOptions:                  pushOptions(),
 		PullRequestID:                   prID,
 		DeployKeyID:                     deployKeyID,
-		ActionPerm:                      int(actionPerm),
+		ActionsTaskID:                   actionsTaskID,
+		IsWiki:                          isWiki,
 	}
 
 	scanner := bufio.NewScanner(os.Stdin)
@@ -275,6 +286,9 @@ Gitea or set your environment appropriately.`, "")
 			lastline = 0
 		}
 	}
+	if err := scanner.Err(); err != nil {
+		return fail(ctx, "Hook failed: stdin read error", "scanner error: %v", err)
+	}
 
 	if count > 0 {
 		hookOptions.OldCommitIDs = oldCommitIDs[:count]
@@ -318,7 +332,7 @@ func runHookPostReceive(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))
 
 	// First of all run update-server-info no matter what
-	if _, _, err := gitcmd.NewCommand("update-server-info").RunStdString(ctx, nil); err != nil {
+	if err := gitcmd.NewCommand("update-server-info").RunWithStderr(ctx); err != nil {
 		return fmt.Errorf("failed to call 'git update-server-info': %w", err)
 	}
 
@@ -366,6 +380,7 @@ Gitea or set your environment appropriately.`, "")
 		GitPushOptions:                  pushOptions(),
 		PullRequestID:                   prID,
 		PushTrigger:                     repo_module.PushTrigger(os.Getenv(repo_module.EnvPushTrigger)),
+		IsWiki:                          isWiki,
 	}
 	oldCommitIDs := make([]string, hookBatchSize)
 	newCommitIDs := make([]string, hookBatchSize)
@@ -413,6 +428,11 @@ Gitea or set your environment appropriately.`, "")
 			count = 0
 		}
 	}
+	if err := scanner.Err(); err != nil {
+		_ = dWriter.Close()
+		hookPrintResults(results)
+		return fail(ctx, "Hook failed: stdin read error", "scanner error: %v", err)
+	}
 
 	if count == 0 {
 		if wasEmpty && masterPushed {
@@ -513,6 +533,7 @@ Gitea or set your environment appropriately.`, "")
 
 	reader := bufio.NewReader(os.Stdin)
 	repoUser := os.Getenv(repo_module.EnvRepoUsername)
+	isWiki, _ := strconv.ParseBool(os.Getenv(repo_module.EnvRepoIsWiki))
 	repoName := os.Getenv(repo_module.EnvRepoName)
 	pusherID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	pusherName := os.Getenv(repo_module.EnvPusherName)
@@ -590,14 +611,15 @@ Gitea or set your environment appropriately.`, "")
 		UserName:       pusherName,
 		UserID:         pusherID,
 		GitPushOptions: make(map[string]string),
+		IsWiki:         isWiki,
 	}
 	hookOptions.OldCommitIDs = make([]string, 0, hookBatchSize)
 	hookOptions.NewCommitIDs = make([]string, 0, hookBatchSize)
 	hookOptions.RefFullNames = make([]git.RefName, 0, hookBatchSize)
 
 	for {
-		// note: pktLineTypeUnknow means pktLineTypeFlush and pktLineTypeData all allowed
-		rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
+		// note: pktLineTypeUnknown means pktLineTypeFlush and pktLineTypeData all allowed
+		rs, err = readPktLine(ctx, reader, pktLineTypeUnknown)
 		if err != nil {
 			return err
 		}
@@ -616,7 +638,7 @@ Gitea or set your environment appropriately.`, "")
 
 	if hasPushOptions {
 		for {
-			rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
+			rs, err = readPktLine(ctx, reader, pktLineTypeUnknown)
 			if err != nil {
 				return err
 			}
@@ -713,8 +735,8 @@ Gitea or set your environment appropriately.`, "")
 type pktLineType int64
 
 const (
-	// UnKnow type
-	pktLineTypeUnknow pktLineType = 0
+	// Unknown type
+	pktLineTypeUnknown pktLineType = 0
 	// flush-pkt "0000"
 	pktLineTypeFlush pktLineType = iota
 	// data line

package/gitea/source/cmd/keys.go

@@ -15,40 +15,42 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdKeys represents the available keys sub-command
-var CmdKeys = &cli.Command{
-	Name:        "keys",
-	Usage:       "(internal) Should only be called by SSH server",
-	Hidden:      true, // internal commands shouldn't be visible
-	Description: "Queries the Gitea database to get the authorized command for a given ssh key fingerprint",
-	Before:      PrepareConsoleLoggerLevel(log.FATAL),
-	Action:      runKeys,
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:    "expected",
-			Aliases: []string{"e"},
-			Value:   "git",
-			Usage:   "Expected user for whom provide key commands",
+// NewKeysCommand returns the internal SSH key lookup sub-command.
+func NewKeysCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "keys",
+		Usage:       "(internal) Should only be called by SSH server",
+		Hidden:      true, // internal commands shouldn't be visible
+		Description: "Queries the Gitea database to get the authorized command for a given ssh key fingerprint",
+		Before:      PrepareConsoleLoggerLevel(log.FATAL),
+		Action:      runKeys,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "expected",
+				Aliases: []string{"e"},
+				Value:   "git",
+				Usage:   "Expected user for whom provide key commands",
+			},
+			&cli.StringFlag{
+				Name:    "username",
+				Aliases: []string{"u"},
+				Value:   "",
+				Usage:   "Username trying to log in by SSH",
+			},
+			&cli.StringFlag{
+				Name:    "type",
+				Aliases: []string{"t"},
+				Value:   "",
+				Usage:   "Type of the SSH key provided to the SSH Server (requires content to be provided too)",
+			},
+			&cli.StringFlag{
+				Name:    "content",
+				Aliases: []string{"k"},
+				Value:   "",
+				Usage:   "Base64 encoded content of the SSH key provided to the SSH Server (requires type to be provided too)",
+			},
 		},
-		&cli.StringFlag{
-			Name:    "username",
-			Aliases: []string{"u"},
-			Value:   "",
-			Usage:   "Username trying to log in by SSH",
-		},
-		&cli.StringFlag{
-			Name:    "type",
-			Aliases: []string{"t"},
-			Value:   "",
-			Usage:   "Type of the SSH key provided to the SSH Server (requires content to be provided too)",
-		},
-		&cli.StringFlag{
-			Name:    "content",
-			Aliases: []string{"k"},
-			Value:   "",
-			Usage:   "Base64 encoded content of the SSH key provided to the SSH Server (requires type to be provided too)",
-		},
-	},
+	}
 }
 
 func runKeys(ctx context.Context, c *cli.Command) error {

package/gitea/source/cmd/mailer.go

@@ -17,10 +17,10 @@ func runSendMail(ctx context.Context, c *cli.Command) error {
 	setting.MustInstalled()
 
 	subject := c.String("title")
-	confirmSkiped := c.Bool("force")
+	confirmSkipped := c.Bool("force")
 	body := c.String("content")
 
-	if !confirmSkiped {
+	if !confirmSkipped {
 		if len(body) == 0 {
 			fmt.Print("warning: Content is empty")
 		}

package/gitea/source/cmd/main.go

@@ -112,34 +112,36 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 			Usage:     "Set custom path (defaults to '{WorkPath}/custom')",
 		},
 	}
+	webCmd := newWebCommand()
 	// these sub-commands need to use a config file
 	subCmdWithConfig := []*cli.Command{
-		CmdWeb,
-		CmdServ,
-		CmdHook,
-		CmdKeys,
-		CmdDump,
-		CmdAdmin,
-		CmdMigrate,
-		CmdDoctor,
-		CmdManager,
-		CmdEmbedded,
-		CmdMigrateStorage,
-		CmdDumpRepository,
-		CmdRestoreRepository,
-		CmdActions,
+		webCmd,
+		newServCommand(),
+		newHookCommand(),
+		NewKeysCommand(),
+		newDumpCommand(),
+		newAdminCommand(),
+		newMigrateCommand(),
+		newDoctorCommand(),
+		newManagerCommand(),
+		newEmbeddedCommand(),
+		newMigrateStorageCommand(),
+		newDumpRepositoryCommand(),
+		newRestoreRepositoryCommand(),
+		newActionsCommand(),
 	}
 
 	// these sub-commands do not need the config file, and they do not depend on any path or environment variable.
 	subCmdStandalone := []*cli.Command{
+		cmdConfig(),
 		cmdCert(),
-		CmdGenerate,
-		CmdDocs,
+		newGenerateCommand(),
+		newDocsCommand(),
 	}
 
 	// TODO: we should eventually drop the default command,
 	// but not sure whether it would break Windows users who used to double-click the EXE to run.
-	app.DefaultCommand = CmdWeb.Name
+	app.DefaultCommand = webCmd.Name
 
 	app.Before = PrepareConsoleLoggerLevel(log.INFO)
 	for i := range subCmdWithConfig {
@@ -148,7 +150,7 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 	app.Commands = append(app.Commands, subCmdWithConfig...)
 	app.Commands = append(app.Commands, subCmdStandalone...)
 
-	setting.InitGiteaEnvVars()
+	setting.UnsetUnnecessaryEnvVars()
 	return app
 }
 

package/gitea/source/cmd/main_test.go

@@ -157,6 +157,7 @@ func TestCliCmd(t *testing.T) {
 
 	for _, c := range cases {
 		t.Run(c.cmd, func(t *testing.T) {
+			defer test.MockVariableValue(&setting.InstallLock, false)()
 			app := newTestApp(cli.Command{
 				Action: func(ctx context.Context, cmd *cli.Command) error {
 					_, _ = fmt.Fprint(cmd.Root().Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
@@ -170,7 +171,10 @@ func TestCliCmd(t *testing.T) {
 			r, err := runTestApp(app, args...)
 			assert.NoError(t, err, c.cmd)
 			assert.NotEmpty(t, c.exp, c.cmd)
-			assert.Contains(t, r.Stdout, c.exp, c.cmd)
+			if !assert.Contains(t, r.Stdout, c.exp, c.cmd) {
+				t.Log("Full output:\n" + r.Stdout)
+				t.Log("Expected:\n" + c.exp)
+			}
 		})
 	}
 }

package/gitea/source/cmd/manager.go

@@ -13,22 +13,24 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	// CmdManager represents the manager command
-	CmdManager = &cli.Command{
+func newManagerCommand() *cli.Command {
+	return &cli.Command{
 		Name:        "manager",
 		Usage:       "Manage the running gitea process",
 		Description: "This is a command for managing the running gitea process",
 		Commands: []*cli.Command{
-			subcmdShutdown,
-			subcmdRestart,
-			subcmdReloadTemplates,
-			subcmdFlushQueues,
-			subcmdLogging,
-			subCmdProcesses,
+			newShutdownCommand(),
+			newRestartCommand(),
+			newReloadTemplatesCommand(),
+			newFlushQueuesCommand(),
+			newLoggingCommand(),
+			newProcessesCommand(),
 		},
 	}
-	subcmdShutdown = &cli.Command{
+}
+
+func newShutdownCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "shutdown",
 		Usage: "Gracefully shutdown the running process",
 		Flags: []cli.Flag{
@@ -38,7 +40,10 @@ var (
 		},
 		Action: runShutdown,
 	}
-	subcmdRestart = &cli.Command{
+}
+
+func newRestartCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "restart",
 		Usage: "Gracefully restart the running process - (not implemented for windows servers)",
 		Flags: []cli.Flag{
@@ -48,7 +53,10 @@ var (
 		},
 		Action: runRestart,
 	}
-	subcmdReloadTemplates = &cli.Command{
+}
+
+func newReloadTemplatesCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "reload-templates",
 		Usage: "Reload template files in the running process",
 		Flags: []cli.Flag{
@@ -58,7 +66,10 @@ var (
 		},
 		Action: runReloadTemplates,
 	}
-	subcmdFlushQueues = &cli.Command{
+}
+
+func newFlushQueuesCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "flush-queues",
 		Usage:  "Flush queues in the running process",
 		Action: runFlushQueues,
@@ -77,7 +88,10 @@ var (
 			},
 		},
 	}
-	subCmdProcesses = &cli.Command{
+}
+
+func newProcessesCommand() *cli.Command {
+	return &cli.Command{
 		Name:   "processes",
 		Usage:  "Display running processes within the current process",
 		Action: runProcesses,
@@ -107,7 +121,7 @@ var (
 			},
 		},
 	}
-)
+}
 
 func runShutdown(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))

package/gitea/source/cmd/manager_logging.go

@@ -15,8 +15,8 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-var (
-	defaultLoggingFlags = []cli.Flag{
+func defaultLoggingFlags() []cli.Flag {
+	return []cli.Flag{
 		&cli.StringFlag{
 			Name:  "logger",
 			Usage: `Logger name - will default to "default"`,
@@ -57,8 +57,10 @@ var (
 			Name: "debug",
 		},
 	}
+}
 
-	subcmdLogging = &cli.Command{
+func newLoggingCommand() *cli.Command {
+	return &cli.Command{
 		Name:  "logging",
 		Usage: "Adjust logging commands",
 		Commands: []*cli.Command{
@@ -109,7 +111,7 @@ var (
 					{
 						Name:  "file",
 						Usage: "Add a file logger",
-						Flags: append(defaultLoggingFlags, []cli.Flag{
+						Flags: append(defaultLoggingFlags(), []cli.Flag{
 							&cli.StringFlag{
 								Name:    "filename",
 								Aliases: []string{"f"},
@@ -150,7 +152,7 @@ var (
 					}, {
 						Name:  "conn",
 						Usage: "Add a net conn logger",
-						Flags: append(defaultLoggingFlags, []cli.Flag{
+						Flags: append(defaultLoggingFlags(), []cli.Flag{
 							&cli.BoolFlag{
 								Name:    "reconnect-on-message",
 								Aliases: []string{"R"},
@@ -191,7 +193,7 @@ var (
 			},
 		},
 	}
-)
+}
 
 func runRemoveLogger(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))

package/gitea/source/cmd/migrate.go

@@ -14,12 +14,13 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdMigrate represents the available migrate sub-command.
-var CmdMigrate = &cli.Command{
-	Name:        "migrate",
-	Usage:       "Migrate the database",
-	Description: `This is a command for migrating the database, so that you can run "gitea admin create user" before starting the server.`,
-	Action:      runMigrate,
+func newMigrateCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "migrate",
+		Usage:       "Migrate the database",
+		Description: `This is a command for migrating the database, so that you can run "gitea admin create user" before starting the server.`,
+		Action:      runMigrate,
+	}
 }
 
 func runMigrate(ctx context.Context, c *cli.Command) error {

package/gitea/source/cmd/migrate_storage.go

@@ -25,107 +25,108 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdMigrateStorage represents the available migrate storage sub-command.
-var CmdMigrateStorage = &cli.Command{
-	Name:        "migrate-storage",
-	Usage:       "Migrate the storage",
-	Description: "Copies stored files from storage configured in app.ini to parameter-configured storage",
-	Action:      runMigrateStorage,
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:    "type",
-			Aliases: []string{"t"},
-			Value:   "",
-			Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts",
+func newMigrateStorageCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "migrate-storage",
+		Usage:       "Migrate the storage",
+		Description: "Copies stored files from storage configured in app.ini to parameter-configured storage",
+		Action:      runMigrateStorage,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "type",
+				Aliases: []string{"t"},
+				Value:   "",
+				Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts'",
+			},
+			&cli.StringFlag{
+				Name:    "storage",
+				Aliases: []string{"s"},
+				Value:   "",
+				Usage:   "New storage type: local (default), minio or azureblob",
+			},
+			&cli.StringFlag{
+				Name:    "path",
+				Aliases: []string{"p"},
+				Value:   "",
+				Usage:   "New storage placement if store is local (leave blank for default)",
+			},
+			// Minio Storage special configurations
+			&cli.StringFlag{
+				Name:  "minio-endpoint",
+				Value: "",
+				Usage: "Minio storage endpoint",
+			},
+			&cli.StringFlag{
+				Name:  "minio-access-key-id",
+				Value: "",
+				Usage: "Minio storage accessKeyID",
+			},
+			&cli.StringFlag{
+				Name:  "minio-secret-access-key",
+				Value: "",
+				Usage: "Minio storage secretAccessKey",
+			},
+			&cli.StringFlag{
+				Name:  "minio-bucket",
+				Value: "",
+				Usage: "Minio storage bucket",
+			},
+			&cli.StringFlag{
+				Name:  "minio-location",
+				Value: "",
+				Usage: "Minio storage location to create bucket",
+			},
+			&cli.StringFlag{
+				Name:  "minio-base-path",
+				Value: "",
+				Usage: "Minio storage base path on the bucket",
+			},
+			&cli.BoolFlag{
+				Name:  "minio-use-ssl",
+				Usage: "Enable SSL for minio",
+			},
+			&cli.BoolFlag{
+				Name:  "minio-insecure-skip-verify",
+				Usage: "Skip SSL verification",
+			},
+			&cli.StringFlag{
+				Name:  "minio-checksum-algorithm",
+				Value: "",
+				Usage: "Minio checksum algorithm (default/md5)",
+			},
+			&cli.StringFlag{
+				Name:  "minio-bucket-lookup-type",
+				Value: "",
+				Usage: "Minio bucket lookup type",
+			},
+			// Azure Blob Storage special configurations
+			&cli.StringFlag{
+				Name:  "azureblob-endpoint",
+				Value: "",
+				Usage: "Azure Blob storage endpoint",
+			},
+			&cli.StringFlag{
+				Name:  "azureblob-account-name",
+				Value: "",
+				Usage: "Azure Blob storage account name",
+			},
+			&cli.StringFlag{
+				Name:  "azureblob-account-key",
+				Value: "",
+				Usage: "Azure Blob storage account key",
+			},
+			&cli.StringFlag{
+				Name:  "azureblob-container",
+				Value: "",
+				Usage: "Azure Blob storage container",
+			},
+			&cli.StringFlag{
+				Name:  "azureblob-base-path",
+				Value: "",
+				Usage: "Azure Blob storage base path",
+			},
 		},
-		&cli.StringFlag{
-			Name:    "storage",
-			Aliases: []string{"s"},
-			Value:   "",
-			Usage:   "New storage type: local (default), minio or azureblob",
-		},
-		&cli.StringFlag{
-			Name:    "path",
-			Aliases: []string{"p"},
-			Value:   "",
-			Usage:   "New storage placement if store is local (leave blank for default)",
-		},
-		// Minio Storage special configurations
-		&cli.StringFlag{
-			Name:  "minio-endpoint",
-			Value: "",
-			Usage: "Minio storage endpoint",
-		},
-		&cli.StringFlag{
-			Name:  "minio-access-key-id",
-			Value: "",
-			Usage: "Minio storage accessKeyID",
-		},
-		&cli.StringFlag{
-			Name:  "minio-secret-access-key",
-			Value: "",
-			Usage: "Minio storage secretAccessKey",
-		},
-		&cli.StringFlag{
-			Name:  "minio-bucket",
-			Value: "",
-			Usage: "Minio storage bucket",
-		},
-		&cli.StringFlag{
-			Name:  "minio-location",
-			Value: "",
-			Usage: "Minio storage location to create bucket",
-		},
-		&cli.StringFlag{
-			Name:  "minio-base-path",
-			Value: "",
-			Usage: "Minio storage base path on the bucket",
-		},
-		&cli.BoolFlag{
-			Name:  "minio-use-ssl",
-			Usage: "Enable SSL for minio",
-		},
-		&cli.BoolFlag{
-			Name:  "minio-insecure-skip-verify",
-			Usage: "Skip SSL verification",
-		},
-		&cli.StringFlag{
-			Name:  "minio-checksum-algorithm",
-			Value: "",
-			Usage: "Minio checksum algorithm (default/md5)",
-		},
-		&cli.StringFlag{
-			Name:  "minio-bucket-lookup-type",
-			Value: "",
-			Usage: "Minio bucket lookup type",
-		},
-		// Azure Blob Storage special configurations
-		&cli.StringFlag{
-			Name:  "azureblob-endpoint",
-			Value: "",
-			Usage: "Azure Blob storage endpoint",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-account-name",
-			Value: "",
-			Usage: "Azure Blob storage account name",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-account-key",
-			Value: "",
-			Usage: "Azure Blob storage account key",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-container",
-			Value: "",
-			Usage: "Azure Blob storage container",
-		},
-		&cli.StringFlag{
-			Name:  "azureblob-base-path",
-			Value: "",
-			Usage: "Azure Blob storage base path",
-		},
-	},
+	}
 }
 
 func migrateAttachments(ctx context.Context, dstStorage storage.ObjectStorage) error {

package/gitea/source/cmd/restore_repo.go

@@ -13,40 +13,41 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdRestoreRepository represents the available restore a repository sub-command.
-var CmdRestoreRepository = &cli.Command{
-	Name:        "restore-repo",
-	Usage:       "Restore the repository from disk",
-	Description: "This is a command for restoring the repository data.",
-	Action:      runRestoreRepository,
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:    "repo_dir",
-			Aliases: []string{"r"},
-			Value:   "./data",
-			Usage:   "Repository dir path to restore from",
-		},
-		&cli.StringFlag{
-			Name:  "owner_name",
-			Value: "",
-			Usage: "Restore destination owner name",
-		},
-		&cli.StringFlag{
-			Name:  "repo_name",
-			Value: "",
-			Usage: "Restore destination repository name",
-		},
-		&cli.StringFlag{
-			Name:  "units",
-			Value: "",
-			Usage: `Which items will be restored, one or more units should be separated as comma.
+func newRestoreRepositoryCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "restore-repo",
+		Usage:       "Restore the repository from disk",
+		Description: "This is a command for restoring the repository data.",
+		Action:      runRestoreRepository,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "repo_dir",
+				Aliases: []string{"r"},
+				Value:   "./data",
+				Usage:   "Repository dir path to restore from",
+			},
+			&cli.StringFlag{
+				Name:  "owner_name",
+				Value: "",
+				Usage: "Restore destination owner name",
+			},
+			&cli.StringFlag{
+				Name:  "repo_name",
+				Value: "",
+				Usage: "Restore destination repository name",
+			},
+			&cli.StringFlag{
+				Name:  "units",
+				Value: "",
+				Usage: `Which items will be restored, one or more units should be separated as comma.
 wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
+			},
+			&cli.BoolFlag{
+				Name:  "validation",
+				Usage: "Sanity check the content of the files before trying to load them",
+			},
 		},
-		&cli.BoolFlag{
-			Name:  "validation",
-			Usage: "Sanity check the content of the files before trying to load them",
-		},
-	},
+	}
 }
 
 func runRestoreRepository(ctx context.Context, c *cli.Command) error {

package/gitea/source/cmd/serv.go

@@ -35,22 +35,23 @@ import (
 	"github.com/urfave/cli/v3"
 )
 
-// CmdServ represents the available serv sub-command.
-var CmdServ = &cli.Command{
-	Name:        "serv",
-	Usage:       "(internal) Should only be called by SSH shell",
-	Description: "Serv provides access auth for repositories",
-	Hidden:      true, // Internal commands shouldn't be visible in help
-	Before:      PrepareConsoleLoggerLevel(log.FATAL),
-	Action:      runServ,
-	Flags: []cli.Flag{
-		&cli.BoolFlag{
-			Name: "enable-pprof",
+func newServCommand() *cli.Command {
+	return &cli.Command{
+		Name:        "serv",
+		Usage:       "(internal) Should only be called by SSH shell",
+		Description: "Serv provides access auth for repositories",
+		Hidden:      true, // Internal commands shouldn't be visible in help
+		Before:      PrepareConsoleLoggerLevel(log.FATAL),
+		Action:      runServ,
+		Flags: []cli.Flag{
+			&cli.BoolFlag{
+				Name: "enable-pprof",
+			},
+			&cli.BoolFlag{
+				Name: "debug",
+			},
 		},
-		&cli.BoolFlag{
-			Name: "debug",
-		},
-	},
+	}
 }
 
 func setup(ctx context.Context, debug bool) {

package/gitea/source/cmd/web.go

@@ -8,14 +8,13 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/http/pprof"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
-	_ "net/http/pprof" // Used for debugging if enabled and a web server is running
-
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/gtprof"
@@ -23,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/process"
 	"code.gitea.io/gitea/modules/public"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/templates"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers"
 	"code.gitea.io/gitea/routers/install"
@@ -34,42 +34,43 @@ import (
 // PIDFile could be set from build tag
 var PIDFile = "/run/gitea.pid"
 
-// CmdWeb represents the available web sub-command.
-var CmdWeb = &cli.Command{
-	Name:  "web",
-	Usage: "Start Gitea web server",
-	Description: `Gitea web server is the only thing you need to run,
+func newWebCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "web",
+		Usage: "Start Gitea web server",
+		Description: `Gitea web server is the only thing you need to run,
 and it takes care of all the other things for you`,
-	Before: PrepareConsoleLoggerLevel(log.INFO),
-	Action: runWeb,
-	Flags: []cli.Flag{
-		&cli.StringFlag{
-			Name:    "port",
-			Aliases: []string{"p"},
-			Value:   "3000",
-			Usage:   "Temporary port number to prevent conflict",
+		Before: PrepareConsoleLoggerLevel(log.INFO),
+		Action: runWeb,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "port",
+				Aliases: []string{"p"},
+				Value:   "3000",
+				Usage:   "Temporary port number to prevent conflict",
+			},
+			&cli.StringFlag{
+				Name:  "install-port",
+				Value: "3000",
+				Usage: "Temporary port number to run the install page on to prevent conflict",
+			},
+			&cli.StringFlag{
+				Name:    "pid",
+				Aliases: []string{"P"},
+				Value:   PIDFile,
+				Usage:   "Custom pid file path",
+			},
+			&cli.BoolFlag{
+				Name:    "quiet",
+				Aliases: []string{"q"},
+				Usage:   "Only display Fatal logging errors until logging is set-up",
+			},
+			&cli.BoolFlag{
+				Name:  "verbose",
+				Usage: "Set initial logging to TRACE level until logging is properly set-up",
+			},
 		},
-		&cli.StringFlag{
-			Name:  "install-port",
-			Value: "3000",
-			Usage: "Temporary port number to run the install page on to prevent conflict",
-		},
-		&cli.StringFlag{
-			Name:    "pid",
-			Aliases: []string{"P"},
-			Value:   PIDFile,
-			Usage:   "Custom pid file path",
-		},
-		&cli.BoolFlag{
-			Name:    "quiet",
-			Aliases: []string{"q"},
-			Usage:   "Only display Fatal logging errors until logging is set-up",
-		},
-		&cli.BoolFlag{
-			Name:  "verbose",
-			Usage: "Set initial logging to TRACE level until logging is properly set-up",
-		},
-	},
+	}
 }
 
 func runHTTPRedirector() {
@@ -156,7 +157,6 @@ func serveInstall(cmd *cli.Command) error {
 	case <-graceful.GetManager().IsShutdown():
 		<-graceful.GetManager().Done()
 		log.Info("PID: %d Gitea Web Finished", os.Getpid())
-		log.GetManager().Close()
 		return err
 	default:
 	}
@@ -164,8 +164,6 @@ func serveInstall(cmd *cli.Command) error {
 }
 
 func serveInstalled(c *cli.Command) error {
-	setting.InitCfgProvider(setting.CustomConf)
-	setting.LoadCommonSettings()
 	setting.MustInstalled()
 
 	showWebStartupMessage("Prepare to run web server")
@@ -231,27 +229,26 @@ func serveInstalled(c *cli.Command) error {
 	err := listen(webRoutes, true)
 	<-graceful.GetManager().Done()
 	log.Info("PID: %d Gitea Web Finished", os.Getpid())
-	log.GetManager().Close()
 	return err
 }
 
 func servePprof() {
-	// FIXME: it shouldn't use the global DefaultServeMux, and it should use a proper context
-	http.DefaultServeMux.Handle("/debug/fgprof", fgprof.Handler())
+	mux := http.NewServeMux()
+	mux.HandleFunc("/debug/pprof/", pprof.Index)
+	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	mux.Handle("/debug/fgprof", fgprof.Handler())
+	// FIXME: it should use a proper context
 	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
 	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
-	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", nil))
+	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux))
 	finished()
 }
 
 func runWeb(ctx context.Context, cmd *cli.Command) error {
-	defer func() {
-		if panicked := recover(); panicked != nil {
-			log.Fatal("PANIC: %v\n%s", panicked, log.Stack(2))
-		}
-	}()
-
 	if subCmdName, valid := isValidDefaultSubCommand(cmd); !valid {
 		return fmt.Errorf("unknown command: %s", subCmdName)
 	}
@@ -271,6 +268,10 @@ func runWeb(ctx context.Context, cmd *cli.Command) error {
 		createPIDFile(cmd.String("pid"))
 	}
 
+	// init the HTML renderer and load templates, if error happens, it will report the error immediately and exit with error log
+	// in dev mode, it won't exit, but watch the template files for changes
+	_ = templates.PageRenderer()
+
 	if !setting.InstallLock {
 		if err := serveInstall(cmd); err != nil {
 			return err

package/gitea/source/cmd/web_acme.go

@@ -7,6 +7,7 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
+	"net"
 	"net/http"
 	"os"
 	"strconv"
@@ -124,8 +125,8 @@ func runACME(listenAddr string, m http.Handler) error {
 			defer finished()
 
 			log.Info("Running Let's Encrypt handler on %s", setting.HTTPAddr+":"+setting.PortToRedirect)
-			// all traffic coming into HTTP will be redirect to HTTPS automatically (LE HTTP-01 validation happens here)
-			err := runHTTP("tcp", setting.HTTPAddr+":"+setting.PortToRedirect, "Let's Encrypt HTTP Challenge", myACME.HTTPChallengeHandler(http.HandlerFunc(runLetsEncryptFallbackHandler)), setting.RedirectorUseProxyProtocol)
+			// all traffic coming into HTTP will be redirected to HTTPS automatically (LE HTTP-01 validation happens here)
+			err := runHTTP("tcp", net.JoinHostPort(setting.HTTPAddr, setting.PortToRedirect), "Let's Encrypt HTTP Challenge", myACME.HTTPChallengeHandler(http.HandlerFunc(runLetsEncryptFallbackHandler)), setting.RedirectorUseProxyProtocol)
 			if err != nil {
 				log.Fatal("Failed to start the Let's Encrypt handler on port %s: %v", setting.PortToRedirect, err)
 			}