feat: update gitea vendor

package/gitea/source/modules/actions/artifacts.go

@@ -1,4 +1,4 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
+// Copyright 2026 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
 package actions
@@ -8,15 +8,8 @@ import (
 	"crypto/sha256"
 	"encoding/binary"
 	"io"
-	"net/http"
-	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
 )
 
 type tagType string
@@ -34,52 +27,3 @@ func BuildSignature(tag tagType, vals ...string) []byte {
 	}
 	return m.Sum(nil)
 }
-
-// IsArtifactV4 detects whether the artifact is likely from v4.
-// V4 backend stores the files as a single combined zip file per artifact, and ensures ContentEncoding contains a slash
-// (otherwise this uses application/zip instead of the custom mime type), which is not the case for the old backend.
-func IsArtifactV4(art *actions_model.ActionArtifact) bool {
-	return strings.Contains(art.ContentEncodingOrType, "/")
-}
-
-func GetArtifactV4ServeDirectURL(art *actions_model.ActionArtifact, method string) (string, error) {
-	contentType := art.ContentEncodingOrType
-	u, err := storage.ActionsArtifacts.ServeDirectURL(art.StoragePath, art.ArtifactPath, method, &storage.ServeDirectOptions{ContentType: contentType})
-	if err != nil {
-		return "", err
-	}
-	return u.String(), nil
-}
-
-func DownloadArtifactV4ServeDirect(ctx *context.Base, art *actions_model.ActionArtifact) bool {
-	if !setting.Actions.ArtifactStorage.ServeDirect() {
-		return false
-	}
-	u, err := GetArtifactV4ServeDirectURL(art, ctx.Req.Method)
-	if err != nil {
-		log.Error("GetArtifactV4ServeDirectURL: %v", err)
-		return false
-	}
-	ctx.Redirect(u, http.StatusFound)
-	return true
-}
-
-func DownloadArtifactV4ReadStorage(ctx *context.Base, art *actions_model.ActionArtifact) error {
-	f, err := storage.ActionsArtifacts.Open(art.StoragePath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	httplib.ServeUserContentByFile(ctx.Req, ctx.Resp, f, httplib.ServeHeaderOptions{
-		Filename:    art.ArtifactPath,
-		ContentType: art.ContentEncodingOrType, // v4 guarantees that the field is Content-Type
-	})
-	return nil
-}
-
-func DownloadArtifactV4(ctx *context.Base, art *actions_model.ActionArtifact) error {
-	if DownloadArtifactV4ServeDirect(ctx, art) {
-		return nil
-	}
-	return DownloadArtifactV4ReadStorage(ctx, art)
-}

package/gitea/source/modules/actions/commit_status_info.go

@@ -0,0 +1,70 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"maps"
+	"slices"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+)
+
+// CommitActionsStatusMap maps CommitStatus.ID to the live ActionRunJob status
+// for Gitea Actions rows.
+type CommitActionsStatusMap map[int64]actions_model.Status
+
+// IconStatus returns the action status name to route the icon through
+// repo/icons/action_status, or "" when the row isn't from Gitea Actions.
+func (m CommitActionsStatusMap) IconStatus(s *git_model.CommitStatus) string {
+	if status, ok := m[s.ID]; ok {
+		return status.String()
+	}
+	return ""
+}
+
+// GetCommitActionsStatusMap resolves the live ActionRunJob.Status for every
+// CommitStatus row backed by Gitea Actions. Rows from other sources (external
+// CIs, API) are left untouched and rendered from their stored State.
+func GetCommitActionsStatusMap(ctx context.Context, statuses []*git_model.CommitStatus) CommitActionsStatusMap {
+	if len(statuses) == 0 {
+		return nil
+	}
+	statusByJobID := make(map[int64]*git_model.CommitStatus)
+	repoByID := make(map[int64]*repo_model.Repository)
+	for _, status := range statuses {
+		if status == nil || status.TargetURL == "" {
+			continue
+		}
+		if status.Repo == nil {
+			status.Repo = repoByID[status.RepoID]
+		}
+		// ParseGiteaActionsTargetURL lazy-loads status.Repo on miss; cache the
+		// outcome so later entries with the same RepoID skip that load.
+		_, jobID, ok := status.ParseGiteaActionsTargetURL(ctx)
+		repoByID[status.RepoID] = status.Repo
+		if ok {
+			statusByJobID[jobID] = status
+		}
+	}
+	if len(statusByJobID) == 0 {
+		return nil
+	}
+	jobs := make(map[int64]*actions_model.ActionRunJob, len(statusByJobID))
+	if err := db.GetEngine(ctx).In("id", slices.Collect(maps.Keys(statusByJobID))).Cols("id", "status").Find(&jobs); err != nil {
+		log.Error("db.Find: failed to find action run jobs: %v", err)
+		return nil
+	}
+	info := make(CommitActionsStatusMap, len(jobs))
+	for jobID, status := range statusByJobID {
+		if job, ok := jobs[jobID]; ok {
+			info[status.ID] = job.Status
+		}
+	}
+	return info
+}

package/gitea/source/modules/actions/github.go

@@ -4,7 +4,7 @@
 package actions
 
 import (
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 const (

package/gitea/source/modules/actions/github_test.go

@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/actions/jobparser/aliases.go

@@ -0,0 +1,120 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"errors"
+	"io"
+
+	"gitea.com/gitea/runner/act/model"
+	"go.yaml.in/yaml/v4"
+)
+
+// maxExpandedNodes bounds how many nodes alias expansion may create. go-yaml's own alias guard does
+// not cover us: it only counts while decoding into values, and a workflow is kept as raw yaml.Nodes.
+const maxExpandedNodes = 50000
+
+var errTooManyYamlNodes = errors.New("maximum YAML nodes exceeded")
+
+// ReadWorkflow decodes a workflow file with its aliases expanded. Callers inspect the workflow's
+// raw nodes by kind, and an alias is a kind none of them expect.
+func ReadWorkflow(content []byte) (*model.Workflow, error) {
+	doc, err := resolveYamlAliases(content)
+	if err != nil {
+		return nil, err
+	}
+	return readWorkflowDoc(doc)
+}
+
+func readWorkflowDoc(doc *yaml.Node) (*model.Workflow, error) {
+	if doc.Kind == 0 {
+		return nil, io.EOF // what a yaml decoder reports for an empty file
+	}
+	w := new(model.Workflow)
+	return w, doc.Decode(w)
+}
+
+// decodeResolved is yaml.Unmarshal with aliases expanded first.
+func decodeResolved(content []byte, out any) error {
+	doc, err := resolveYamlAliases(content)
+	if err != nil {
+		return err
+	}
+	return decodeYamlDoc(doc, out)
+}
+
+func decodeYamlDoc(doc *yaml.Node, out any) error {
+	if doc.Kind == 0 {
+		return nil // an empty document, as yaml.Unmarshal treats it
+	}
+	return doc.Decode(out)
+}
+
+// resolveYamlAliases parses content and replaces every alias with a copy of the node its anchor names.
+func resolveYamlAliases(content []byte) (*yaml.Node, error) {
+	doc := &yaml.Node{}
+	if err := yaml.Unmarshal(content, doc); err != nil {
+		return nil, err
+	}
+	budget := maxExpandedNodes
+	return doc, expandAliases(doc, &budget)
+}
+
+// expandAliases replaces node's alias descendants in place.
+func expandAliases(node *yaml.Node, budget *int) error {
+	node.Anchor = "" // a name for a node, not part of the workflow: keep it out of the payloads
+	if err := rejectMergeKeys(node); err != nil {
+		return err
+	}
+	for i, child := range node.Content {
+		if child.Kind != yaml.AliasNode {
+			if err := expandAliases(child, budget); err != nil {
+				return err
+			}
+			continue
+		}
+		copied, err := copyExpanded(child.Alias, budget)
+		if err != nil {
+			return err
+		}
+		node.Content[i] = copied
+	}
+	return nil
+}
+
+// copyExpanded deep copies a node expandAliases already expanded and validated, since an anchor is
+// declared before the alias naming it. An anchor aliased from inside itself is the exception, and
+// recurses here until it exhausts budget.
+func copyExpanded(node *yaml.Node, budget *int) (*yaml.Node, error) {
+	if *budget--; *budget < 0 {
+		return nil, errTooManyYamlNodes
+	}
+	if node.Kind == yaml.AliasNode {
+		return copyExpanded(node.Alias, budget)
+	}
+
+	copied := *node
+	copied.Content = make([]*yaml.Node, len(node.Content))
+	for i, child := range node.Content {
+		child, err := copyExpanded(child, budget)
+		if err != nil {
+			return nil, err
+		}
+		copied.Content[i] = child
+	}
+	return &copied, nil
+}
+
+// rejectMergeKeys refuses `<<: *anchor`, same as GitHub does
+func rejectMergeKeys(node *yaml.Node) error {
+	if node.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i < len(node.Content)-1; i += 2 {
+		if node.Content[i].Tag == "!!merge" {
+			return errors.New("merge keys (`<<`) are not supported, alias the whole value instead")
+		}
+	}
+	return nil
+}

package/gitea/source/modules/actions/jobparser/aliases_test.go

@@ -0,0 +1,85 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseResolvesAliases(t *testing.T) {
+	got, err := Parse([]byte(`on: push
+env: &common_env
+  SHARED: "1"
+jobs:
+  a:
+    runs-on: linux
+    env: *common_env
+    steps: &common_steps [{run: echo hi}]
+  b:
+    runs-on: linux
+    env: *common_env
+    steps: *common_steps
+`))
+	require.NoError(t, err)
+	require.Len(t, got, 2)
+
+	for _, workflow := range got {
+		_, job := workflow.Job()
+		var env map[string]string
+		require.NoError(t, job.Env.Decode(&env))
+		assert.Equal(t, map[string]string{"SHARED": "1"}, env)
+		require.Len(t, job.Steps, 1)
+
+		payload, err := workflow.Marshal()
+		require.NoError(t, err)
+		assert.NotContains(t, string(payload), "common_")
+	}
+}
+
+func TestParseRejectsAliases(t *testing.T) {
+	job := func(body string) []byte {
+		return []byte("on: push\njobs:\n  a:\n    runs-on: linux\n" + body)
+	}
+
+	for _, tt := range []struct {
+		name, wantErr string
+		content       []byte
+	}{
+		{
+			name: "nested aliases exceed the node limit",
+			content: []byte(`on: push
+x0: &x0 [1, 2, 3, 4, 5, 6, 7, 8, 9]
+x1: &x1 [*x0, *x0, *x0, *x0, *x0, *x0, *x0, *x0, *x0]
+x2: &x2 [*x1, *x1, *x1, *x1, *x1, *x1, *x1, *x1, *x1]
+x3: &x3 [*x2, *x2, *x2, *x2, *x2, *x2, *x2, *x2, *x2]
+x4: &x4 [*x3, *x3, *x3, *x3, *x3, *x3, *x3, *x3, *x3]
+jobs: {a: {runs-on: linux, steps: [{run: echo}]}}
+`),
+			wantErr: "maximum YAML nodes exceeded",
+		},
+		{
+			name:    "anchor aliased from inside itself",
+			content: job("    steps: &s [{run: echo}, *s]\n"),
+			wantErr: "maximum YAML nodes exceeded",
+		},
+		{
+			name:    "merge key",
+			content: job("    env: &e {X: \"1\"}\n    container:\n      image: alpine\n      env:\n        <<: *e\n"),
+			wantErr: "merge keys (`<<`) are not supported",
+		},
+		{
+			name:    "alias before its anchor",
+			content: job("    env: *e\n    container: {image: alpine, env: &e {X: \"1\"}}\n"),
+			wantErr: "unknown anchor 'e' referenced",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := Parse(tt.content)
+			require.ErrorContains(t, err, tt.wantErr)
+		})
+	}
+}

package/gitea/source/modules/actions/jobparser/evaluator.go

@@ -6,10 +6,13 @@ package jobparser
 import (
 	"errors"
 	"fmt"
+	"math"
+	"reflect"
 	"regexp"
+	"strconv"
 	"strings"
 
-	"github.com/nektos/act/pkg/exprparser"
+	"gitea.com/gitea/runner/act/exprparser"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -23,12 +26,6 @@ func NewExpressionEvaluator(interpreter exprparser.Interpreter) *ExpressionEvalu
 	return &ExpressionEvaluator{interpreter: interpreter}
 }
 
-func (ee ExpressionEvaluator) evaluate(in string, defaultStatusCheck exprparser.DefaultStatusCheck) (any, error) {
-	evaluated, err := ee.interpreter.Evaluate(in, defaultStatusCheck)
-
-	return evaluated, err
-}
-
 func (ee ExpressionEvaluator) evaluateScalarYamlNode(node *yaml.Node) error {
 	var in string
 	if err := node.Decode(&in); err != nil {
@@ -37,17 +34,17 @@ func (ee ExpressionEvaluator) evaluateScalarYamlNode(node *yaml.Node) error {
 	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
 		return nil
 	}
-	expr, _ := rewriteSubExpression(in, false)
-	res, err := ee.evaluate(expr, exprparser.DefaultStatusCheckNone)
+	res, err := ee.evaluateScalar(in)
 	if err != nil {
 		return err
 	}
 	return node.Encode(res)
 }
 
+// GitHub has this undocumented feature to merge maps, called insert directive
+var insertDirective = regexp.MustCompile(`\${{\s*insert\s*}}`)
+
 func (ee ExpressionEvaluator) evaluateMappingYamlNode(node *yaml.Node) error {
-	// GitHub has this undocumented feature to merge maps, called insert directive
-	insertDirective := regexp.MustCompile(`\${{\s*insert\s*}}`)
 	for i := 0; i < len(node.Content)/2; {
 		k := node.Content[i*2]
 		v := node.Content[i*2+1]
@@ -102,88 +99,170 @@ func (ee ExpressionEvaluator) EvaluateYamlNode(node *yaml.Node) error {
 	}
 }
 
-func (ee ExpressionEvaluator) Interpolate(in string) string {
-	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
-		return in
-	}
-
-	expr, _ := rewriteSubExpression(in, true)
-	evaluated, err := ee.evaluate(expr, exprparser.DefaultStatusCheckNone)
+// interpolate evaluates every part on its own, so a malformed one cannot restructure its neighbours
+func (ee ExpressionEvaluator) interpolate(in string) (string, error) {
+	parts, err := splitSubExpressions(in)
 	if err != nil {
-		return ""
+		return "", err
 	}
-
-	value, ok := evaluated.(string)
-	if !ok {
-		panic(fmt.Sprintf("Expression %s did not evaluate to a string", expr))
-	}
-
-	return value
-}
-
-func escapeFormatString(in string) string {
-	return strings.ReplaceAll(strings.ReplaceAll(in, "{", "{{"), "}", "}}")
-}
-
-func rewriteSubExpression(in string, forceFormat bool) (string, error) {
-	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+	if len(parts) == 1 && !parts[0].isExpr {
 		return in, nil
 	}
+	var out strings.Builder
+	out.Grow(len(in))
+	for _, part := range parts {
+		if !part.isExpr {
+			out.WriteString(part.text)
+			continue
+		}
+		evaluated, err := ee.interpreter.Evaluate(part.text, exprparser.DefaultStatusCheckNone)
+		if err != nil {
+			return "", err
+		}
+		out.WriteString(coerceToString(evaluated))
+	}
+	return out.String(), nil
+}
 
-	strPattern := regexp.MustCompile("(?:''|[^'])*'")
-	pos := 0
-	exprStart := -1
-	strStart := -1
-	var results []string
-	var formatOut strings.Builder
-	for pos < len(in) {
-		if strStart > -1 {
-			matches := strPattern.FindStringIndex(in[pos:])
-			if matches == nil {
-				return "", errors.New("unclosed string")
-			}
+// evaluateScalar keeps the type of a lone expression, so `${{ fromJSON('[1,2]') }}` stays an array
+func (ee ExpressionEvaluator) evaluateScalar(in string) (any, error) {
+	parts, err := splitSubExpressions(in)
+	if err != nil {
+		return nil, err
+	}
+	if len(parts) == 1 && parts[0].isExpr {
+		return ee.interpreter.Evaluate(parts[0].text, exprparser.DefaultStatusCheckNone)
+	}
+	return ee.interpolate(in)
+}
 
-			strStart = -1
-			pos += matches[1]
-		} else if exprStart > -1 {
-			exprEnd := strings.Index(in[pos:], "}}")
-			strStart = strings.Index(in[pos:], "'")
+// evaluateCondition evaluates an `if:`, an expression even without `${{ }}`. Mixed content
+// interpolates to a string, so the success() default applies to it separately.
+func (ee ExpressionEvaluator) evaluateCondition(in string) (bool, error) {
+	parts, err := splitSubExpressions(in)
+	if err != nil {
+		return false, err
+	}
+	if len(parts) == 1 {
+		evaluated, err := ee.interpreter.Evaluate(parts[0].text, exprparser.DefaultStatusCheckSuccess)
+		if err != nil {
+			return false, err
+		}
+		return exprparser.IsTruthy(evaluated), nil
+	}
 
-			if exprEnd > -1 && strStart > -1 {
-				if exprEnd < strStart {
-					strStart = -1
-				} else {
-					exprEnd = -1
-				}
-			}
-
-			if exprEnd > -1 {
-				fmt.Fprintf(&formatOut, "{%d}", len(results))
-				results = append(results, strings.TrimSpace(in[exprStart:pos+exprEnd]))
-				pos += exprEnd + 2
-				exprStart = -1
-			} else if strStart > -1 {
-				pos += strStart + 1
-			} else {
-				panic("unclosed expression.")
-			}
-		} else {
-			exprStart = strings.Index(in[pos:], "${{")
-			if exprStart != -1 {
-				formatOut.WriteString(escapeFormatString(in[pos : pos+exprStart]))
-				exprStart = pos + exprStart + 3
-				pos = exprStart
-			} else {
-				formatOut.WriteString(escapeFormatString(in[pos:]))
-				pos = len(in)
-			}
+	// mixed content is a string, so the success() default applies to it separately
+	if !expressionCallsFunction(in, "success", "always", "failure", "cancelled") {
+		status, err := ee.interpreter.Evaluate("success()", exprparser.DefaultStatusCheckNone)
+		if err != nil {
+			return false, err
+		}
+		if !exprparser.IsTruthy(status) {
+			return false, nil
 		}
 	}
+	interpolated, err := ee.interpolate(in)
+	if err != nil {
+		return false, err
+	}
+	return exprparser.IsTruthy(interpolated), nil
+}
 
-	if len(results) == 1 && formatOut.String() == "{0}" && !forceFormat {
-		return in, nil
+// coerceToString converts an evaluated expression value to a string the way GitHub does,
+// see https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#operators
+// An already reflected value is accepted as-is, since Interface() would panic on an invalid one.
+func coerceToString(v any) string {
+	value, ok := v.(reflect.Value)
+	if !ok {
+		value = reflect.ValueOf(v)
 	}
 
-	out := fmt.Sprintf("format('%s', %s)", strings.ReplaceAll(formatOut.String(), "'", "''"), strings.Join(results, ", "))
-	return out, nil
+	switch value.Kind() {
+	case reflect.Invalid:
+		return ""
+
+	case reflect.Bool:
+		return strconv.FormatBool(value.Bool())
+
+	case reflect.String:
+		return value.String()
+
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return strconv.FormatInt(value.Int(), 10)
+
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return strconv.FormatUint(value.Uint(), 10)
+
+	case reflect.Float32, reflect.Float64:
+		if math.IsInf(value.Float(), 1) {
+			return "Infinity"
+		} else if math.IsInf(value.Float(), -1) {
+			return "-Infinity"
+		}
+		return fmt.Sprintf("%.15G", value.Float())
+
+	case reflect.Slice, reflect.Array:
+		return "Array"
+
+	// contexts such as `github` are pointers to structs, so they stringify as objects too
+	case reflect.Map, reflect.Struct:
+		return "Object"
+
+	case reflect.Interface, reflect.Pointer:
+		if value.IsNil() {
+			return ""
+		}
+		return coerceToString(value.Elem())
+	}
+
+	return fmt.Sprintf("%v", value)
+}
+
+type exprPart struct {
+	text   string
+	isExpr bool
+}
+
+// splitSubExpressions splits in the way GitHub's template reader does, leaving a value without a
+// complete expression literal.
+func splitSubExpressions(in string) ([]exprPart, error) {
+	if !strings.Contains(in, "${{") || !strings.Contains(in, "}}") {
+		return []exprPart{{text: in}}, nil
+	}
+
+	parts := make([]exprPart, 0, 2*strings.Count(in, "${{")+1)
+	for {
+		start := strings.Index(in, "${{")
+		if start < 0 {
+			if in != "" {
+				parts = append(parts, exprPart{text: in})
+			}
+			return parts, nil
+		}
+		if start > 0 {
+			parts = append(parts, exprPart{text: in[:start]})
+		}
+		rest := in[start+len("${{"):]
+		end := indexExprEnd(rest)
+		if end < 0 {
+			return nil, errors.New("unclosed expression")
+		}
+		parts = append(parts, exprPart{text: strings.TrimSpace(rest[:end]), isExpr: true})
+		in = rest[end+len("}}"):]
+	}
+}
+
+// indexExprEnd returns the offset of the `}}` ending an expression, or -1. A quote toggles string
+// state, so a `}}` inside a string does not end it.
+func indexExprEnd(in string) int {
+	inString := false
+	for i := range len(in) {
+		switch {
+		case in[i] == '\'':
+			inString = !inString
+		case !inString && in[i] == '}' && i+1 < len(in) && in[i+1] == '}':
+			return i
+		}
+	}
+	return -1
 }

package/gitea/source/modules/actions/jobparser/interpeter.go

@@ -4,8 +4,8 @@
 package jobparser
 
 import (
-	"github.com/nektos/act/pkg/exprparser"
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -57,9 +57,14 @@ func NewInterpeter(
 	}
 
 	ee := &exprparser.EvaluationEnvironment{
-		Github:   gitCtx,
-		Env:      nil, // no need
-		Job:      nil, // no need
+		Github: gitCtx,
+		Env:    nil, // no need
+		// Job must be non-nil because cancelled() dereferences Job.Status unconditionally.
+		// See: https://gitea.com/gitea/runner/src/commit/ad967330a8788c9b8ab723abbc1a86d53c3bc5e6/act/exprparser/functions.go#L299
+		// TODO: The empty JobContext.Status is right for now because Gitea never checks `if` condition when the workflow run is cancelled.
+		// This is an implementation gap in Gitea Actions. When a workflow run is cancelled, Gitea should check the job's `if` condition,
+		// and if the condition is met (e.g. `if: ${{ cancelled() }}` ), the job should be executed rather than cancelled.
+		Job:      &model.JobContext{},
 		Steps:    nil, // no need
 		Runner:   nil, // no need
 		Secrets:  nil, // no need

package/gitea/source/modules/actions/jobparser/jobparser.go

@@ -4,25 +4,33 @@
 package jobparser
 
 import (
-	"bytes"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 
-	"github.com/nektos/act/pkg/exprparser"
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
+	"github.com/rhysd/actionlint"
 	"go.yaml.in/yaml/v4"
 )
 
 func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
-	origin, err := model.ReadWorkflow(bytes.NewReader(content))
+	// The workflow is split into one document per job below, which would strand an alias whose
+	// anchor lands in another one.
+	doc, err := resolveYamlAliases(content)
 	if err != nil {
-		return nil, fmt.Errorf("model.ReadWorkflow: %w", err)
+		return nil, fmt.Errorf("resolve aliases: %w", err)
+	}
+
+	origin, err := readWorkflowDoc(doc)
+	if err != nil {
+		return nil, fmt.Errorf("read workflow: %w", err)
 	}
 
 	workflow := &SingleWorkflow{}
-	if err := yaml.Unmarshal(content, workflow); err != nil {
-		return nil, fmt.Errorf("yaml.Unmarshal: %w", err)
+	if err := decodeYamlDoc(doc, workflow); err != nil {
+		return nil, fmt.Errorf("decode workflow: %w", err)
 	}
 
 	pc := &parseContext{}
@@ -48,7 +56,9 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 	}
 
 	evaluator := NewExpressionEvaluator(exprparser.NewInterpeter(&exprparser.EvaluationEnvironment{Github: pc.gitContext, Vars: pc.vars, Inputs: pc.inputs}, exprparser.Config{}))
-	workflow.RunName = evaluator.Interpolate(workflow.RunName)
+	if workflow.RunName, err = evaluator.interpolate(workflow.RunName); err != nil {
+		return nil, fmt.Errorf("interpolate run-name: %w", err)
+	}
 
 	for i, id := range ids {
 		job := jobs[i]
@@ -63,12 +73,19 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 			}
 			job.Strategy.RawMatrix = encodeMatrix(matrix)
 			evaluator := NewExpressionEvaluator(NewInterpeter(id, origin.GetJob(id), matrix, pc.gitContext, results, pc.vars, pc.inputs))
-			job.Name = nameWithMatrix(job.Name, matrix, evaluator)
+			if job.Name, err = nameWithMatrix(job.Name, matrix, evaluator); err != nil {
+				return nil, fmt.Errorf("interpolate name for job %q: %w", id, err)
+			}
 			runsOn := origin.GetJob(id).RunsOn()
 			for i, v := range runsOn {
-				runsOn[i] = evaluator.Interpolate(v)
+				if runsOn[i], err = evaluator.interpolate(v); err != nil {
+					return nil, fmt.Errorf("interpolate runs-on for job %q: %w", id, err)
+				}
 			}
 			job.RawRunsOn = encodeRunsOn(runsOn)
+			if err := evaluator.EvaluateYamlNode(&job.RawContinueOnError); err != nil {
+				return nil, fmt.Errorf("evaluate continue-on-error for job %q: %w", id, err)
+			}
 			swf := &SingleWorkflow{
 				Name:           workflow.Name,
 				RawOn:          workflow.RawOn,
@@ -86,12 +103,6 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 	return ret, nil
 }
 
-func WithJobResults(results map[string]string) ParseOption {
-	return func(c *parseContext) {
-		c.jobResults = results
-	}
-}
-
 func WithGitContext(context *model.GithubContext) ParseOption {
 	return func(c *parseContext) {
 		c.gitContext = context
@@ -120,6 +131,9 @@ type parseContext struct {
 type ParseOption func(c *parseContext)
 
 func getMatrixes(job *model.Job) ([]map[string]any, error) {
+	if err := validateMatrixFilters(job); err != nil {
+		return nil, err
+	}
 	ret, err := job.GetMatrixes()
 	if err != nil {
 		return nil, fmt.Errorf("GetMatrixes: %w", err)
@@ -130,6 +144,32 @@ func getMatrixes(job *model.Job) ([]map[string]any, error) {
 	return ret, nil
 }
 
+// validateMatrixFilters rejects an `include`/`exclude` that is not a list of mappings, so that the
+// usual way to get there, an unevaluated ${{ }} expression that is still a scalar, is named as such
+// instead of panicking inside the expansion.
+func validateMatrixFilters(job *model.Job) error {
+	if job.Strategy == nil || job.Strategy.RawMatrix.Kind != yaml.MappingNode {
+		return nil
+	}
+	content := job.Strategy.RawMatrix.Content
+	for i := 0; i+1 < len(content); i += 2 {
+		name, value := content[i].Value, content[i+1]
+		if name != "include" && name != "exclude" {
+			continue
+		}
+		entries := []*yaml.Node{value}
+		if value.Kind == yaml.SequenceNode {
+			entries = value.Content
+		}
+		for _, entry := range entries {
+			if entry.Kind != yaml.MappingNode {
+				return fmt.Errorf("matrix %s must be a list of mappings", name)
+			}
+		}
+	}
+	return nil
+}
+
 func encodeMatrix(matrix map[string]any) yaml.Node {
 	if len(matrix) == 0 {
 		return yaml.Node{}
@@ -153,16 +193,45 @@ func encodeRunsOn(runsOn []string) yaml.Node {
 	return node
 }
 
-func nameWithMatrix(name string, m map[string]any, evaluator *ExpressionEvaluator) string {
+func nameWithMatrix(name string, m map[string]any, evaluator *ExpressionEvaluator) (string, error) {
 	if len(m) == 0 {
-		return name
+		return name, nil
 	}
 
 	if !strings.Contains(name, "${{") || !strings.Contains(name, "}}") {
-		return name + " " + matrixName(m)
+		return name + " " + matrixName(m), nil
 	}
 
-	return evaluator.Interpolate(name)
+	return evaluator.interpolate(name)
+}
+
+// expressionCallsFunction reports whether any ${{ }} expression in value calls one of the functions.
+func expressionCallsFunction(value string, names ...string) bool {
+	parts, err := splitSubExpressions(value)
+	if err != nil {
+		return true // unparseable here, let the expansion report it against the real values
+	}
+	for _, part := range parts {
+		if !part.isExpr {
+			continue
+		}
+		// The lexer needs the closing `}}` that the scanner strips.
+		expr, err := actionlint.NewExprParser().Parse(actionlint.NewExprLexer(part.text + "}}"))
+		if err != nil {
+			return true // unparseable here, let the expansion report it against the real values
+		}
+		found := false
+		actionlint.VisitExprNode(expr, func(node, _ actionlint.ExprNode, entering bool) {
+			call, ok := node.(*actionlint.FuncCallNode)
+			if entering && ok && slices.Contains(names, strings.ToLower(call.Callee)) {
+				found = true
+			}
+		})
+		if found {
+			return true
+		}
+	}
+	return false
 }
 
 func matrixName(m map[string]any) string {

package/gitea/source/modules/actions/jobparser/jobparser_test.go

@@ -4,9 +4,11 @@
 package jobparser
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
+	"gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
@@ -58,6 +60,11 @@ func TestParse(t *testing.T) {
 			options: nil,
 			wantErr: false,
 		},
+		{
+			name:    "continue_on_error_expr",
+			options: nil,
+			wantErr: false,
+		},
 	}
 	invalidFileTests := []struct {
 		name string
@@ -102,3 +109,86 @@ func TestParse(t *testing.T) {
 		})
 	}
 }
+
+func TestParseInterpolatesRunName(t *testing.T) {
+	workflow := func(runName string) []byte {
+		return []byte("name: t\nrun-name: \"" + runName + "\"\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps: [{run: echo}]\n")
+	}
+
+	for _, tt := range []struct{ name, runName, want string }{
+		{"bool", "${{ true }}", "true"},
+		{"int", "${{ 1 }}", "1"},
+		{"float", "${{ 1.0 }}", "1"},
+		{"null", "${{ null }}", ""},
+		{"object", `${{ fromJSON('{\"a\":1}') }}`, "Object"},
+		{"array", "${{ fromJSON('[1,2]') }}", "Array"},
+		{"context", "${{ github }}", "Object"},
+		{"surrounding literals", "run ${{ 1 }} now", "run 1 now"},
+		{"two expressions", "${{ 1 }}-${{ true }}", "1-true"},
+		{"closing brace inside a string", "${{ 'a}}b' }}", "a}}b"},
+		{"incomplete expression stays literal", "${{ 1", "${{ 1"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := Parse(workflow(tt.runName), WithGitContext(&model.GithubContext{EventName: "push"}))
+			require.NoError(t, err)
+			require.Len(t, result, 1)
+			assert.Equal(t, tt.want, result[0].RunName)
+		})
+	}
+
+	// a malformed part must not restructure the surrounding expression
+	for _, runName := range []string{"${{ 1) && (2 }}", "run ${{ 1) && (2 }} now", "${{ 'a' }} ${{ b", "${{ 'a }}"} {
+		_, err := Parse(workflow(runName), WithGitContext(&model.GithubContext{EventName: "push"}))
+		assert.ErrorContains(t, err, "interpolate run-name")
+	}
+
+	// callers such as commit status parse without a git context, leaving `github` a nil pointer
+	result, err := Parse(workflow("${{ github }}"))
+	require.NoError(t, err)
+	require.Len(t, result, 1)
+	assert.Empty(t, result[0].RunName)
+}
+
+func TestRejectsUnevaluatedMatrixFilters(t *testing.T) {
+	// An unevaluated ${{ }} expression is still a scalar, which act cannot apply as a filter: it used
+	// to reach the expansion and panic there on an unchecked type assertion, taking down the file view
+	// and the push_update queue.
+	const workflow = `
+name: t
+on: push
+jobs:
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      m: ${{ steps.s.outputs.m }}
+    steps: [{id: s, run: echo}]
+  build:
+    needs: setup
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        %s
+    steps: [{run: echo}]
+`
+	for _, tt := range []struct {
+		name   string
+		matrix string
+	}{
+		{name: "include expression", matrix: "include: ${{ fromJson(needs.setup.outputs.m) }}"},
+		{name: "exclude expression", matrix: "os: [a, b]\n        exclude: ${{ fromJson(vars.MATRIX) }}"},
+		{name: "include scalar", matrix: "include: whatever"},
+		{name: "include list of scalars", matrix: "include: [a, b]"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			require.NotPanics(t, func() {
+				_, err := Parse(fmt.Appendf(nil, workflow, tt.matrix))
+				require.ErrorContains(t, err, "must be a list of mappings")
+			})
+		})
+	}
+
+	// a well-formed include/exclude keeps expanding
+	planned, err := Parse(fmt.Appendf(nil, workflow, "os: [a, b]\n        include:\n          - os: c\n        exclude:\n          - os: b"))
+	require.NoError(t, err)
+	assert.Len(t, planned, 3) // setup, plus build for os a and c
+}

package/gitea/source/modules/actions/jobparser/model.go

@@ -7,8 +7,11 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"strings"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.dev/modules/util"
+
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -31,6 +34,11 @@ func (w *SingleWorkflow) Job() (string, *Job) {
 	return "", nil
 }
 
+// WorkflowDispatchConfig returns the `on: workflow_dispatch` declaration, nil if there is none.
+func (w *SingleWorkflow) WorkflowDispatchConfig() *model.WorkflowDispatch {
+	return (&model.Workflow{RawOn: w.RawOn}).WorkflowDispatchConfig()
+}
+
 func (w *SingleWorkflow) jobs() ([]string, []*Job, error) {
 	ids, jobs, err := parseMappingNode[*Job](&w.RawJobs)
 	if err != nil {
@@ -74,27 +82,56 @@ func (w *SingleWorkflow) SetJob(id string, job *Job) error {
 }
 
 func (w *SingleWorkflow) Marshal() ([]byte, error) {
-	return yaml.Marshal(w)
+	// Encode with the same indentation SetJob uses (2). yaml.Marshal's default
+	// indentation (4) makes the encoder emit multi-line block scalars (e.g. a
+	// `run:` step that begins with blank lines) with a wrong explicit indentation
+	// indicator (`run: |4`) that then fails to re-parse, which silently strands
+	// the job during concurrency evaluation. Keeping both encoders at indent 2
+	// makes the serialized single workflow round-trip.
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	if err := enc.Encode(w); err != nil {
+		return nil, err
+	}
+	if err := enc.Close(); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
 }
 
 type Job struct {
-	Name           string                    `yaml:"name,omitempty"`
-	RawNeeds       yaml.Node                 `yaml:"needs,omitempty"`
-	RawRunsOn      yaml.Node                 `yaml:"runs-on,omitempty"`
-	Env            yaml.Node                 `yaml:"env,omitempty"`
-	If             yaml.Node                 `yaml:"if,omitempty"`
-	Steps          []*Step                   `yaml:"steps,omitempty"`
-	TimeoutMinutes string                    `yaml:"timeout-minutes,omitempty"`
-	Services       map[string]*ContainerSpec `yaml:"services,omitempty"`
-	Strategy       Strategy                  `yaml:"strategy,omitempty"`
-	RawContainer   yaml.Node                 `yaml:"container,omitempty"`
-	Defaults       Defaults                  `yaml:"defaults,omitempty"`
-	Outputs        map[string]string         `yaml:"outputs,omitempty"`
-	Uses           string                    `yaml:"uses,omitempty"`
-	With           map[string]any            `yaml:"with,omitempty"`
-	RawSecrets     yaml.Node                 `yaml:"secrets,omitempty"`
-	RawConcurrency *model.RawConcurrency     `yaml:"concurrency,omitempty"`
-	RawPermissions yaml.Node                 `yaml:"permissions,omitempty"`
+	Name               string                    `yaml:"name,omitempty"`
+	RawNeeds           yaml.Node                 `yaml:"needs,omitempty"`
+	RawRunsOn          yaml.Node                 `yaml:"runs-on,omitempty"`
+	Env                yaml.Node                 `yaml:"env,omitempty"`
+	If                 yaml.Node                 `yaml:"if,omitempty"`
+	Steps              []*Step                   `yaml:"steps,omitempty"`
+	TimeoutMinutes     string                    `yaml:"timeout-minutes,omitempty"`
+	RawContinueOnError yaml.Node                 `yaml:"continue-on-error,omitempty"`
+	Services           map[string]*ContainerSpec `yaml:"services,omitempty"`
+	Strategy           Strategy                  `yaml:"strategy,omitempty"`
+	RawContainer       yaml.Node                 `yaml:"container,omitempty"`
+	Defaults           Defaults                  `yaml:"defaults,omitempty"`
+	Outputs            map[string]string         `yaml:"outputs,omitempty"`
+	Uses               string                    `yaml:"uses,omitempty"`
+	With               map[string]any            `yaml:"with,omitempty"`
+	RawSecrets         yaml.Node                 `yaml:"secrets,omitempty"`
+	RawConcurrency     *model.RawConcurrency     `yaml:"concurrency,omitempty"`
+	RawPermissions     yaml.Node                 `yaml:"permissions,omitempty"`
+}
+
+// GetContinueOnError decodes the continue-on-error field to a bool.
+// The field may be a literal bool or an already-evaluated expression node.
+func (j *Job) GetContinueOnError() bool {
+	if j.RawContinueOnError.Kind == 0 {
+		return false
+	}
+	var v bool
+	if err := j.RawContinueOnError.Decode(&v); err != nil {
+		return false
+	}
+	return v
 }
 
 func (j *Job) Clone() *Job {
@@ -102,23 +139,24 @@ func (j *Job) Clone() *Job {
 		return nil
 	}
 	return &Job{
-		Name:           j.Name,
-		RawNeeds:       j.RawNeeds,
-		RawRunsOn:      j.RawRunsOn,
-		Env:            j.Env,
-		If:             j.If,
-		Steps:          j.Steps,
-		TimeoutMinutes: j.TimeoutMinutes,
-		Services:       j.Services,
-		Strategy:       j.Strategy,
-		RawContainer:   j.RawContainer,
-		Defaults:       j.Defaults,
-		Outputs:        j.Outputs,
-		Uses:           j.Uses,
-		With:           j.With,
-		RawSecrets:     j.RawSecrets,
-		RawConcurrency: j.RawConcurrency,
-		RawPermissions: j.RawPermissions,
+		Name:               j.Name,
+		RawNeeds:           j.RawNeeds,
+		RawRunsOn:          j.RawRunsOn,
+		Env:                j.Env,
+		If:                 j.If,
+		Steps:              j.Steps,
+		TimeoutMinutes:     j.TimeoutMinutes,
+		RawContinueOnError: j.RawContinueOnError,
+		Services:           j.Services,
+		Strategy:           j.Strategy,
+		RawContainer:       j.RawContainer,
+		Defaults:           j.Defaults,
+		Outputs:            j.Outputs,
+		Uses:               j.Uses,
+		With:               j.With,
+		RawSecrets:         j.RawSecrets,
+		RawConcurrency:     j.RawConcurrency,
+		RawPermissions:     j.RawPermissions,
 	}
 }
 
@@ -136,17 +174,29 @@ func (j *Job) RunsOn() []string {
 }
 
 type Step struct {
-	ID               string            `yaml:"id,omitempty"`
-	If               yaml.Node         `yaml:"if,omitempty"`
-	Name             string            `yaml:"name,omitempty"`
-	Uses             string            `yaml:"uses,omitempty"`
-	Run              string            `yaml:"run,omitempty"`
-	WorkingDirectory string            `yaml:"working-directory,omitempty"`
-	Shell            string            `yaml:"shell,omitempty"`
-	Env              yaml.Node         `yaml:"env,omitempty"`
-	With             map[string]string `yaml:"with,omitempty"`
-	ContinueOnError  bool              `yaml:"continue-on-error,omitempty"`
-	TimeoutMinutes   string            `yaml:"timeout-minutes,omitempty"`
+	ID                 string            `yaml:"id,omitempty"`
+	If                 yaml.Node         `yaml:"if,omitempty"`
+	Name               string            `yaml:"name,omitempty"`
+	Uses               string            `yaml:"uses,omitempty"`
+	Run                string            `yaml:"run,omitempty"`
+	WorkingDirectory   string            `yaml:"working-directory,omitempty"`
+	Shell              string            `yaml:"shell,omitempty"`
+	Env                yaml.Node         `yaml:"env,omitempty"`
+	With               map[string]string `yaml:"with,omitempty"`
+	RawContinueOnError yaml.Node         `yaml:"continue-on-error,omitempty"` // raw: the runner evaluates it with the steps context
+	TimeoutMinutes     string            `yaml:"timeout-minutes,omitempty"`
+}
+
+// UnmarshalYAML canonicalizes booleans like continue-on-error
+func (s *Step) UnmarshalYAML(node *yaml.Node) error {
+	type rawStep Step
+	if err := node.Decode((*rawStep)(s)); err != nil {
+		return err
+	}
+	if raw := &s.RawContinueOnError; raw.Tag == "!!bool" {
+		raw.Value = strings.ToLower(raw.Value)
+	}
+	return nil
 }
 
 // String gets the name of step
@@ -220,9 +270,11 @@ func (evt *Event) Inputs() []WorkflowDispatchInput {
 }
 
 func ReadWorkflowRawConcurrency(content []byte) (*model.RawConcurrency, error) {
-	w := new(model.Workflow)
-	err := yaml.NewDecoder(bytes.NewReader(content)).Decode(w)
-	return w.RawConcurrency, err
+	w, err := ReadWorkflow(content)
+	if err != nil {
+		return nil, err
+	}
+	return w.RawConcurrency, nil
 }
 
 func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (string, bool, error) {
@@ -261,7 +313,7 @@ func EvaluateConcurrency(rc *model.RawConcurrency, jobID string, job *Job, gitCt
 	if evaluated.RawExpression != "" {
 		return evaluated.RawExpression, false, nil
 	}
-	return evaluated.Group, evaluated.CancelInProgress == "true", nil
+	return evaluated.Group, util.ParseYamlBool(evaluated.CancelInProgress), nil
 }
 
 func toGitContext(input map[string]any) *model.GithubContext {
@@ -298,6 +350,9 @@ func toGitContext(input map[string]any) *model.GithubContext {
 	return gitContext
 }
 
+// workflowCallEvent is only fired by another workflow's `uses:`, so it is excluded from trigger detection.
+const workflowCallEvent = "workflow_call"
+
 func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 	switch rawOn.Kind {
 	case yaml.ScalarNode:
@@ -306,6 +361,9 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		if err != nil {
 			return nil, err
 		}
+		if val == workflowCallEvent {
+			return []*Event{}, nil
+		}
 		return []*Event{
 			{Name: val},
 		}, nil
@@ -319,6 +377,9 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		for _, v := range val {
 			switch t := v.(type) {
 			case string:
+				if t == workflowCallEvent {
+					continue
+				}
 				res = append(res, &Event{Name: t})
 			default:
 				return nil, fmt.Errorf("invalid type %T", t)
@@ -332,6 +393,9 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		}
 		res := make([]*Event, 0, len(events))
 		for i, k := range events {
+			if k == workflowCallEvent {
+				continue
+			}
 			v := triggers[i]
 			switch v.Kind {
 			case yaml.ScalarNode:
@@ -454,6 +518,30 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 	}
 }
 
+func EvaluateJobIfExpression(jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (bool, error) {
+	actJob := &model.Job{
+		Strategy: &model.Strategy{
+			FailFastString:    job.Strategy.FailFastString,
+			MaxParallelString: job.Strategy.MaxParallelString,
+			RawMatrix:         job.Strategy.RawMatrix,
+		},
+	}
+	// Each per-matrix job carries its single matrix combination in RawMatrix so resolve it and pass it in;
+	// otherwise `matrix.*` references in `if:` evaluate to null.
+	// GetMatrixes always returns at least one element (an empty map for a job without a matrix),
+	// so only a non-empty combination should populate `matrix.*`, leaving it nil otherwise.
+	var matrix map[string]any
+	matrixes, err := actJob.GetMatrixes()
+	if err != nil {
+		return false, err
+	}
+	if len(matrixes) > 0 && len(matrixes[0]) > 0 {
+		matrix = matrixes[0]
+	}
+	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
+	return evaluator.evaluateCondition(job.If.Value)
+}
+
 // parseMappingNode parse a mapping node and preserve order.
 func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) {
 	if node.Kind != yaml.MappingNode {

package/gitea/source/modules/actions/jobparser/model_test.go

@@ -4,10 +4,11 @@
 package jobparser
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
@@ -254,6 +255,53 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
+		{
+			// `workflow_call` is only fired by another workflow's `uses:`, so ParseRawOn intentionally excludes it from trigger detection.
+			input: `on:
+  workflow_call:
+    inputs:
+      env:
+        type: string
+        required: true
+    outputs:
+      sha:
+        value: ${{ jobs.build.outputs.commit }}
+    secrets:
+      DEPLOY_KEY:
+        required: true
+`,
+			result: []*Event{},
+		},
+		{
+			// Mixed: a workflow that is both callable AND triggered by push. Only the "push" event surfaces.
+			input: `on:
+  workflow_call:
+    inputs:
+      env:
+        type: string
+  push:
+    branches: [main]
+`,
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{"branches": {"main"}},
+				},
+			},
+		},
+		{
+			// Scalar form: a purely reusable workflow has no event triggers.
+			input:  "on: workflow_call",
+			result: []*Event{},
+		},
+		{
+			// Sequence form: `workflow_call` is excluded while sibling events are kept.
+			input: "on:\n  - push\n  - workflow_call\n  - pull_request",
+			result: []*Event{
+				{Name: "push"},
+				{Name: "pull_request"},
+			},
+		},
 	}
 	for _, kase := range kases {
 		t.Run(kase.input, func(t *testing.T) {
@@ -289,6 +337,52 @@ func TestSingleWorkflow_SetJob(t *testing.T) {
 	})
 }
 
+func TestGetContinueOnError(t *testing.T) {
+	tests := []struct {
+		name string
+		yaml string
+		want bool
+	}{
+		{
+			name: "absent",
+			yaml: "name: test\non: push\njobs:\n  job1:\n    runs-on: ubuntu-22.04\n    steps:\n      - run: echo hi\n",
+			want: false,
+		},
+		{
+			name: "static true",
+			yaml: "name: test\non: push\njobs:\n  job1:\n    runs-on: ubuntu-22.04\n    continue-on-error: true\n    steps:\n      - run: echo hi\n",
+			want: true,
+		},
+		{
+			name: "static false",
+			yaml: "name: test\non: push\njobs:\n  job1:\n    runs-on: ubuntu-22.04\n    continue-on-error: false\n    steps:\n      - run: echo hi\n",
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := Parse([]byte(tt.yaml))
+			require.NoError(t, err)
+			require.Len(t, got, 1)
+			_, job := got[0].Job()
+			assert.Equal(t, tt.want, job.GetContinueOnError())
+		})
+	}
+
+	// Expression case: ${{ matrix.experimental }} must resolve per matrix variant.
+	t.Run("matrix expression", func(t *testing.T) {
+		content := ReadTestdata(t, "continue_on_error_expr.in.yaml")
+		got, err := Parse(content)
+		require.NoError(t, err)
+		require.Len(t, got, 2)
+		// sorted by matrix name: (false) before (true)
+		_, jobFalse := got[0].Job()
+		_, jobTrue := got[1].Job()
+		assert.False(t, jobFalse.GetContinueOnError())
+		assert.True(t, jobTrue.GetContinueOnError())
+	})
+}
+
 func TestParseMappingNode(t *testing.T) {
 	tests := []struct {
 		input   string
@@ -371,3 +465,110 @@ func TestParseMappingNode(t *testing.T) {
 		})
 	}
 }
+
+func TestEvaluateJobIfExpressionMatrix(t *testing.T) {
+	ifExprs := []string{
+		`${{ contains(fromJSON('["linux","windows"]'), matrix.target) }}`,
+		`${{ contains('["linux","windows"]', matrix.target) }}`,
+	}
+
+	want := map[string]bool{
+		"build (linux)":   true,
+		"build (windows)": true,
+		"build (macos)":   false,
+	}
+
+	for _, ifExpr := range ifExprs {
+		t.Run(ifExpr, func(t *testing.T) {
+			content := fmt.Sprintf(`
+name: test
+on: push
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: %s
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [linux, windows, macos]
+    steps:
+      - run: echo ${{ matrix.target }}
+`, ifExpr)
+
+			swfs, err := Parse([]byte(content))
+			require.NoError(t, err)
+			require.Len(t, swfs, 3)
+
+			got := make(map[string]bool, len(swfs))
+			for _, swf := range swfs {
+				id, job := swf.Job()
+				shouldRun, err := EvaluateJobIfExpression(id, job, map[string]any{}, map[string]*JobResult{id: {}}, nil, nil)
+				require.NoError(t, err)
+				got[job.Name] = shouldRun
+			}
+			assert.Equal(t, want, got)
+		})
+	}
+}
+
+func TestEvaluateJobIfExpression(t *testing.T) {
+	kases := []struct {
+		name       string
+		ifCond     string
+		needResult string
+		expected   bool
+	}{
+		{name: "empty need success", ifCond: "${{ 1 == 1 }}", needResult: "success", expected: true},
+		{name: "always", ifCond: "${{ always() }}", needResult: "failure", expected: true},
+		{name: "failure true", ifCond: "${{ failure() }}", needResult: "failure", expected: true},
+		{name: "failure false", ifCond: "${{ failure() }}", needResult: "success", expected: false},
+		{name: "success true", ifCond: "${{ success() }}", needResult: "success", expected: true},
+		// cancelled() is always false on the server: a cancelled run never evaluates a blocked job's `if:`
+		{name: "cancelled", ifCond: "${{ cancelled() }}", needResult: "success", expected: false},
+		{name: "not cancelled or failure", ifCond: "${{ !(cancelled() || failure()) }}", needResult: "success", expected: true},
+		{name: "not cancelled or failure, need failed", ifCond: "${{ !(cancelled() || failure()) }}", needResult: "failure", expected: false},
+		// a condition is an expression with or without `${{ }}`, literal text around one makes it a string
+		{name: "bare expression", ifCond: "always()", needResult: "failure", expected: true},
+		{name: "literal text keeps the success() default", ifCond: "x ${{ 1 }}", needResult: "failure", expected: false},
+		{name: "literal text around a status function drops it", ifCond: "x ${{ always() }}", needResult: "failure", expected: true},
+	}
+	for _, kase := range kases {
+		t.Run(kase.name, func(t *testing.T) {
+			content := strings.ReplaceAll(`
+name: test
+on: push
+jobs:
+  job1:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo job1
+  job2:
+    runs-on: ubuntu-latest
+    needs: [job1]
+    if: IF_COND
+    steps:
+      - run: echo job2
+`, "IF_COND", kase.ifCond)
+
+			workflows, err := Parse([]byte(content))
+			require.NoError(t, err)
+
+			var job2 *Job
+			for _, wf := range workflows {
+				if id, job := wf.Job(); id == "job2" {
+					job2 = job
+				}
+			}
+			require.NotNil(t, job2)
+
+			// mirrors findJobNeedsAndFillJobResults: the needs' results plus a self entry carrying Needs
+			results := map[string]*JobResult{
+				"job1": {Result: kase.needResult},
+				"job2": {Needs: []string{"job1"}},
+			}
+			got, err := EvaluateJobIfExpression("job2", job2, map[string]any{}, results, nil, nil)
+			require.NoError(t, err)
+			assert.Equal(t, kase.expected, got)
+		})
+	}
+}

package/gitea/source/modules/actions/jobparser/roundtrip_test.go

@@ -0,0 +1,105 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"bytes"
+	"testing"
+
+	"gitea.com/gitea/runner/act/model"
+	"github.com/stretchr/testify/require"
+)
+
+// A step whose `run:` block starts with blank lines must still survive the
+// Parse -> SingleWorkflow.Marshal -> Parse round-trip. Previously Marshal used a
+// different indentation than SetJob, which made the encoder emit the block scalar
+// with a wrong explicit indentation indicator (`run: |4`) that no longer parsed;
+// the job then stayed silently blocked during concurrency evaluation.
+func TestSingleWorkflowRoundTripRunBlockLeadingBlankLines(t *testing.T) {
+	const wf = `name: demo
+on:
+  workflow_call:
+    inputs:
+      app_name:
+        type: string
+        required: true
+jobs:
+  build:
+    name: build
+    env:
+      IMAGE_TAG: ${{ inputs.app_name }}
+    runs-on: ubuntu-latest
+    steps:
+      - if: ${{ inputs.app_name != '' }}
+        name: packages
+        run: |
+
+
+          echo start
+          echo done
+`
+	sws, err := Parse([]byte(wf))
+	require.NoError(t, err)
+	require.Len(t, sws, 1)
+
+	// pin the original run block as the baseline
+	_, origJob := sws[0].Job()
+	require.Len(t, origJob.Steps, 1)
+	const wantRun = "\n\necho start\necho done\n"
+	require.Equal(t, wantRun, origJob.Steps[0].Run)
+
+	payload, err := sws[0].Marshal()
+	require.NoError(t, err)
+
+	// the serialized single workflow must be parseable again -- this is what the
+	// server does in EvaluateJobConcurrencyFillModel -> ParseJob. Before the fix
+	// Marshal emitted `run: |4`, which failed here and left the job blocked.
+	roundTripped, err := Parse(payload)
+	require.NoError(t, err, "serialized single workflow must round-trip; got payload:\n%s", payload)
+	require.Len(t, roundTripped, 1)
+
+	// the round-trip must preserve the run block byte-for-byte
+	_, gotJob := roundTripped[0].Job()
+	require.Len(t, gotJob.Steps, 1)
+	require.Equal(t, wantRun, gotJob.Steps[0].Run, "round-trip must preserve run content; got payload:\n%s", payload)
+}
+
+// Typing a step's continue-on-error as a bool used to reject the whole `jobs:` node.
+func TestSingleWorkflowRoundTripStepContinueOnError(t *testing.T) {
+	const wf = `name: demo
+on: push
+jobs:
+  job1:
+    runs-on: ubuntu-latest
+    steps:
+      - id: quarantine
+        run: echo "q=true" >> "$GITHUB_OUTPUT"
+      - run: exit 1
+        continue-on-error: ${{ steps.quarantine.outputs.q == 'true' }}
+      - run: exit 1
+        continue-on-error: true
+      - run: exit 1
+        continue-on-error: TRUE
+      - run: exit 1
+        continue-on-error: false
+      - run: exit 1
+        continue-on-error: yes
+`
+	want := []string{"", "${{ steps.quarantine.outputs.q == 'true' }}", "true", "true", "false", "yes"}
+
+	sws, err := Parse([]byte(wf))
+	require.NoError(t, err)
+	require.Len(t, sws, 1)
+
+	payload, err := sws[0].Marshal()
+	require.NoError(t, err)
+
+	rw, err := model.ReadWorkflow(bytes.NewReader(payload))
+	require.NoError(t, err, "payload:\n%s", payload)
+	steps := rw.Jobs["job1"].Steps
+	require.Len(t, steps, len(want))
+	for i, w := range want {
+		require.Equal(t, w, steps[i].RawContinueOnError, "step %d, payload:\n%s", i, payload)
+	}
+}

package/gitea/source/modules/actions/jobparser/testdata/continue_on_error_expr.in.yaml

@@ -0,0 +1,10 @@
+name: test
+jobs:
+  job1:
+    strategy:
+      matrix:
+        experimental: [false, true]
+    runs-on: ubuntu-22.04
+    continue-on-error: ${{ matrix.experimental }}
+    steps:
+      - run: echo hi

package/gitea/source/modules/actions/jobparser/testdata/continue_on_error_expr.out.yaml

@@ -0,0 +1,25 @@
+name: test
+jobs:
+  job1:
+    name: job1 (false)
+    runs-on: ubuntu-22.04
+    steps:
+      - run: echo hi
+    continue-on-error: false
+    strategy:
+      matrix:
+        experimental:
+          - false
+---
+name: test
+jobs:
+  job1:
+    name: job1 (true)
+    runs-on: ubuntu-22.04
+    steps:
+      - run: echo hi
+    continue-on-error: true
+    strategy:
+      matrix:
+        experimental:
+          - true

package/gitea/source/modules/actions/jobparser/uses.go

@@ -0,0 +1,79 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"errors"
+	"fmt"
+	"path"
+	"regexp"
+	"strings"
+)
+
+// UsesKind enumerates the supported forms of a reusable workflow "uses:" value.
+type UsesKind int
+
+const (
+	// UsesKindLocalSameRepo is "./<dir>/foo.yml" - a path inside the calling repository.
+	// For example: "./.gitea/workflows/foo.yml"
+	UsesKindLocalSameRepo UsesKind = iota + 1
+	// UsesKindLocalCrossRepo is "owner/repo/<dir>/foo.yml@ref" - a workflow in another repo on the same instance.
+	// For example: "owner/repo/.gitea/workflows/foo.yml@ref"
+	UsesKindLocalCrossRepo
+)
+
+// UsesRef is the parsed form of a reusable workflow "uses:" value.
+type UsesRef struct {
+	Kind  UsesKind
+	Owner string // empty for UsesKindLocalSameRepo
+	Repo  string // empty for UsesKindLocalSameRepo
+	Path  string // workflow file path inside the source repo
+	Ref   string // git ref; empty for UsesKindLocalSameRepo
+}
+
+var (
+	reLocalSameRepo  = regexp.MustCompile(`^\./([^@]+\.ya?ml)$`)
+	reLocalCrossRepo = regexp.MustCompile(`^([-.\w]+)/([-.\w]+)/([^@]+\.ya?ml)@(.+)$`)
+)
+
+// ParseUses parses the SYNTAX of a reusable workflow "uses:" value into a UsesRef. Two forms are supported:
+//   - "./<dir>/foo.yml"               (UsesKindLocalSameRepo, no @ref)
+//   - "OWNER/REPO/<dir>/foo.yml@REF"  (UsesKindLocalCrossRepo)
+//
+// It deliberately does NOT validate that <dir> is an allowed workflow directory: the allowed directories are instance-configurable (WORKFLOW_DIRS / SCOPED_WORKFLOW_DIRS).
+// The caller (services/actions.ResolveUses) enforces the directory allowlist. The returned Path is the cleaned, repo-relative file path.
+func ParseUses(s string) (*UsesRef, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil, errors.New("empty uses value")
+	}
+
+	if strings.HasPrefix(s, "./") {
+		m := reLocalSameRepo.FindStringSubmatch(s)
+		if m == nil {
+			return nil, fmt.Errorf(`invalid local "uses:" %q (expect ./<dir>/<file>.yml)`, s)
+		}
+		p := m[1]
+		if path.Clean(p) != p {
+			return nil, fmt.Errorf("invalid workflow path %q", s)
+		}
+		return &UsesRef{Kind: UsesKindLocalSameRepo, Path: p}, nil
+	}
+
+	m := reLocalCrossRepo.FindStringSubmatch(s)
+	if m == nil {
+		return nil, fmt.Errorf(`invalid cross-repo "uses:" %q (expect owner/repo/<dir>/<file>.yml@ref)`, s)
+	}
+	p := m[3]
+	if path.Clean(p) != p {
+		return nil, fmt.Errorf("invalid workflow path %q", s)
+	}
+	return &UsesRef{
+		Kind:  UsesKindLocalCrossRepo,
+		Owner: m[1],
+		Repo:  m[2],
+		Path:  p,
+		Ref:   m[4],
+	}, nil
+}

package/gitea/source/modules/actions/jobparser/uses_test.go

@@ -0,0 +1,189 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseUses(t *testing.T) {
+	t.Run("LocalSameRepo", func(t *testing.T) {
+		cases := []struct {
+			name string
+			in   string
+			want UsesRef
+		}{
+			{
+				name: "gitea dir, .yml",
+				in:   "./.gitea/workflows/build.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yml"},
+			},
+			{
+				name: "github dir, .yml",
+				in:   "./.github/workflows/build.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".github/workflows/build.yml"},
+			},
+			{
+				name: "gitea dir, .yaml",
+				in:   "./.gitea/workflows/build.yaml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yaml"},
+			},
+			{
+				name: "filename containing dots is allowed",
+				in:   "./.gitea/workflows/foo..bar.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/foo..bar.yml"},
+			},
+			{
+				name: "nested subdirectory",
+				in:   "./.gitea/workflows/sub/build.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/sub/build.yml"},
+			},
+			{
+				// ParseUses is dir-agnostic; the allowed directories (WORKFLOW_DIRS / SCOPED_WORKFLOW_DIRS) are enforced by ResolveUses.
+				name: "scoped workflows dir parses",
+				in:   "./.gitea/scoped_workflows/lib.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/scoped_workflows/lib.yml"},
+			},
+			{
+				name: "non-default dir parses (allowlist enforced downstream)",
+				in:   "./.gitea/custom_workflows/x.yaml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/custom_workflows/x.yaml"},
+			},
+			{
+				name: "leading/trailing whitespace is trimmed",
+				in:   "  ./.gitea/workflows/build.yml  ",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yml"},
+			},
+		}
+		for _, c := range cases {
+			t.Run(c.name, func(t *testing.T) {
+				got, err := ParseUses(c.in)
+				require.NoError(t, err)
+				assert.Equal(t, c.want, *got)
+			})
+		}
+	})
+
+	t.Run("LocalCrossRepo", func(t *testing.T) {
+		cases := []struct {
+			name string
+			in   string
+			want UsesRef
+		}{
+			{
+				name: "gitea dir, simple ref",
+				in:   "owner/repo/.gitea/workflows/build.yml@v1",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/build.yml",
+					Ref:   "v1",
+				},
+			},
+			{
+				name: "github dir, branch ref",
+				in:   "owner/repo/.github/workflows/build.yml@main",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".github/workflows/build.yml",
+					Ref:   "main",
+				},
+			},
+			{
+				name: ".yaml extension",
+				in:   "owner/repo/.gitea/workflows/build.yaml@abc123",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/build.yaml",
+					Ref:   "abc123",
+				},
+			},
+			{
+				name: "ref with slashes (refs/heads/feature)",
+				in:   "owner/repo/.gitea/workflows/build.yml@refs/heads/feature",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/build.yml",
+					Ref:   "refs/heads/feature",
+				},
+			},
+			{
+				name: "nested subdirectory under workflows",
+				in:   "owner/repo/.gitea/workflows/sub/build.yml@v1",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/sub/build.yml",
+					Ref:   "v1",
+				},
+			},
+			{
+				name: "scoped workflows dir parses (allowlist enforced by ResolveUses)",
+				in:   "owner/repo/.gitea/scoped_workflows/lib.yml@v1",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/scoped_workflows/lib.yml",
+					Ref:   "v1",
+				},
+			},
+		}
+		for _, c := range cases {
+			t.Run(c.name, func(t *testing.T) {
+				got, err := ParseUses(c.in)
+				require.NoError(t, err)
+				assert.Equal(t, c.want, *got)
+			})
+		}
+	})
+
+	t.Run("Errors", func(t *testing.T) {
+		cases := []struct {
+			name string
+			in   string
+		}{
+			{name: "empty string", in: ""},
+			{name: "whitespace only", in: "   "},
+
+			// Same-repo malformed (note: a wrong *directory* parses and should be rejected by the caller)
+			{name: "same-repo with @ref", in: "./.gitea/workflows/build.yml@v1"},
+			{name: "same-repo wrong extension", in: "./.gitea/workflows/build.txt"},
+			{name: "same-repo missing extension", in: "./.gitea/workflows/build"},
+			{name: "same-repo absolute path", in: "/.gitea/workflows/build.yml"},
+			{name: "same-repo path traversal", in: "./.gitea/workflows/../escape.yml"},
+			{name: "same-repo double slash", in: "./.gitea/workflows//build.yml"},
+			{name: "same-repo redundant ./", in: "./.gitea/workflows/./build.yml"},
+
+			// Cross-repo malformed
+			{name: "cross-repo missing @ref", in: "owner/repo/.gitea/workflows/build.yml"},
+			{name: "cross-repo empty ref", in: "owner/repo/.gitea/workflows/build.yml@"},
+			{name: "cross-repo missing owner", in: "/repo/.gitea/workflows/build.yml@v1"},
+			{name: "cross-repo missing repo", in: "owner//.gitea/workflows/build.yml@v1"},
+			{name: "cross-repo wrong extension", in: "owner/repo/.gitea/workflows/build.txt@v1"},
+			{name: "cross-repo path traversal", in: "owner/repo/.gitea/workflows/../escape.yml@v1"},
+			{name: "cross-repo double slash in path", in: "owner/repo/.gitea/workflows//build.yml@v1"},
+			// owner/repo with chars Gitea's name validators reject
+			{name: "cross-repo owner with space", in: "bad owner/repo/.gitea/workflows/build.yml@v1"},
+			{name: "cross-repo repo with @", in: "owner/re@po/.gitea/workflows/build.yml@v1"},
+		}
+		for _, c := range cases {
+			t.Run(c.name, func(t *testing.T) {
+				_, err := ParseUses(c.in)
+				assert.Error(t, err)
+			})
+		}
+	})
+}

package/gitea/source/modules/actions/jobparser/workflow_call.go

@@ -0,0 +1,375 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/util"
+
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
+	"go.yaml.in/yaml/v4"
+)
+
+// InputType enumerates the allowed types for a workflow_call input.
+type InputType string
+
+const (
+	InputTypeString  InputType = "string"
+	InputTypeBoolean InputType = "boolean"
+	InputTypeNumber  InputType = "number"
+)
+
+// InputSpec describes a single workflow_call input declaration.
+type InputSpec struct {
+	Description string    `yaml:"description"`
+	Required    bool      `yaml:"required"`
+	Default     yaml.Node `yaml:"default"`
+	Type        InputType `yaml:"type"`
+}
+
+// SecretSpec describes a single workflow_call secret declaration.
+type SecretSpec struct {
+	Description string `yaml:"description"`
+	Required    bool   `yaml:"required"`
+}
+
+// OutputSpec describes a single workflow_call output declaration.
+type OutputSpec struct {
+	Description string `yaml:"description"`
+	Value       string `yaml:"value"`
+}
+
+// WorkflowCallSpec is the parsed "on.workflow_call" schema of a called workflow.
+type WorkflowCallSpec struct {
+	Inputs  map[string]InputSpec
+	Secrets map[string]SecretSpec
+	Outputs map[string]OutputSpec
+}
+
+// JobOutputs is the per-job-id outputs map used for evaluating workflow_call outputs.
+type JobOutputs map[string]map[string]string
+
+// ParseWorkflowCallSpec extracts on.workflow_call.{inputs,secrets,outputs} from a workflow YAML.
+// Returns an error if the workflow does not declare on.workflow_call at all.
+func ParseWorkflowCallSpec(content []byte) (*WorkflowCallSpec, error) {
+	var doc struct {
+		On yaml.Node `yaml:"on"`
+	}
+	if err := decodeResolved(content, &doc); err != nil {
+		return nil, fmt.Errorf("parse workflow yaml: %w", err)
+	}
+
+	wcNode, ok := findWorkflowCallNode(&doc.On)
+	if !ok {
+		return nil, errors.New("workflow does not declare on.workflow_call")
+	}
+
+	spec := &WorkflowCallSpec{
+		Inputs:  map[string]InputSpec{},
+		Secrets: map[string]SecretSpec{},
+		Outputs: map[string]OutputSpec{},
+	}
+
+	if wcNode == nil || wcNode.Kind != yaml.MappingNode {
+		return spec, nil
+	}
+
+	for i := 0; i+1 < len(wcNode.Content); i += 2 {
+		key := wcNode.Content[i]
+		val := wcNode.Content[i+1]
+		switch key.Value {
+		case "inputs":
+			if err := decodeWorkflowCallMapping(val, spec.Inputs); err != nil {
+				return nil, fmt.Errorf("parse workflow_call.inputs: %w", err)
+			}
+		case "secrets":
+			if err := decodeWorkflowCallMapping(val, spec.Secrets); err != nil {
+				return nil, fmt.Errorf("parse workflow_call.secrets: %w", err)
+			}
+		case "outputs":
+			if err := decodeWorkflowCallMapping(val, spec.Outputs); err != nil {
+				return nil, fmt.Errorf("parse workflow_call.outputs: %w", err)
+			}
+		}
+	}
+
+	for name, in := range spec.Inputs {
+		if in.Type == "" {
+			return nil, fmt.Errorf("workflow_call input %q is missing required field \"type\"", name)
+		}
+		switch in.Type {
+		case InputTypeString, InputTypeBoolean, InputTypeNumber:
+		default:
+			return nil, fmt.Errorf("workflow_call input %q has unsupported type %q", name, in.Type)
+		}
+	}
+
+	return spec, nil
+}
+
+// findWorkflowCallNode walks the "on:" node and returns the value mapping (or nil) for "workflow_call".
+// "ok" is true when the workflow declares workflow_call (even with an empty body).
+func findWorkflowCallNode(on *yaml.Node) (val *yaml.Node, ok bool) {
+	if on == nil || on.Kind == 0 {
+		return nil, false
+	}
+	switch on.Kind {
+	case yaml.ScalarNode:
+		return nil, on.Value == "workflow_call"
+	case yaml.SequenceNode:
+		for _, item := range on.Content {
+			if item.Kind == yaml.ScalarNode && item.Value == "workflow_call" {
+				return nil, true
+			}
+		}
+		return nil, false
+	case yaml.MappingNode:
+		for i := 0; i+1 < len(on.Content); i += 2 {
+			k := on.Content[i]
+			v := on.Content[i+1]
+			if k.Value != "workflow_call" {
+				continue
+			}
+			if v.Kind == yaml.MappingNode {
+				return v, true
+			}
+			return nil, true
+		}
+	}
+	return nil, false
+}
+
+func decodeWorkflowCallMapping[T any](node *yaml.Node, dst map[string]T) error {
+	if node == nil || node.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		name := node.Content[i].Value
+		var v T
+		if err := node.Content[i+1].Decode(&v); err != nil {
+			return fmt.Errorf("%q: %w", name, err)
+		}
+		dst[name] = v
+	}
+	return nil
+}
+
+// EvaluateCallerWith evaluates the caller-side expressions in `job.With` against the provided contexts
+func EvaluateCallerWith(
+	jobID string,
+	job *Job,
+	gitCtx map[string]any,
+	results map[string]*JobResult,
+	vars map[string]string,
+	inputs map[string]any,
+) (map[string]any, error) {
+	actJob := &model.Job{Strategy: &model.Strategy{
+		FailFastString:    job.Strategy.FailFastString,
+		MaxParallelString: job.Strategy.MaxParallelString,
+		RawMatrix:         job.Strategy.RawMatrix,
+	}}
+
+	var matrix map[string]any
+	matrixes, err := actJob.GetMatrixes()
+	if err != nil {
+		return nil, fmt.Errorf("get caller %q matrix: %w", jobID, err)
+	}
+	if len(matrixes) > 0 {
+		matrix = matrixes[0]
+	}
+
+	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
+
+	out := make(map[string]any, len(job.With))
+	for k, raw := range job.With {
+		var evaluated any
+		switch v := raw.(type) {
+		case string:
+			node := yaml.Node{}
+			if err := node.Encode(v); err != nil {
+				return nil, fmt.Errorf("encode caller %q with[%q]: %w", jobID, k, err)
+			}
+			if err := evaluator.EvaluateYamlNode(&node); err != nil {
+				return nil, fmt.Errorf("evaluate caller %q with[%q]: %w", jobID, k, err)
+			}
+			if err := node.Decode(&evaluated); err != nil {
+				return nil, fmt.Errorf("decode caller %q with[%q]: %w", jobID, k, err)
+			}
+		default:
+			evaluated = v
+		}
+		out[k] = evaluated
+	}
+	return out, nil
+}
+
+// MatchCallerInputsAgainstSpec checks the caller's already-evaluated `with:` values against the callee's declared `on.workflow_call.inputs` schema
+func MatchCallerInputsAgainstSpec(spec *WorkflowCallSpec, evaluated map[string]any) (map[string]any, error) {
+	resolved := make(map[string]any, len(spec.Inputs))
+
+	// fill defaults first
+	for name, in := range spec.Inputs {
+		if in.Default.IsZero() {
+			continue
+		}
+		var defaultVal any
+		if err := in.Default.Decode(&defaultVal); err != nil {
+			return nil, fmt.Errorf("decode workflow_call input %q default: %w", name, err)
+		}
+		v, err := parseWorkflowCallInput(name, in.Type, defaultVal)
+		if err != nil {
+			return nil, err
+		}
+		resolved[name] = v
+	}
+
+	for k, raw := range evaluated {
+		inputSpec, ok := spec.Inputs[k]
+		if !ok {
+			// ignore unknown "with:" keys
+			continue
+		}
+		converted, err := parseWorkflowCallInput(k, inputSpec.Type, raw)
+		if err != nil {
+			return nil, err
+		}
+		resolved[k] = converted
+	}
+
+	for name, in := range spec.Inputs {
+		if !in.Required {
+			continue
+		}
+		// resolved[name] is set when caller provided it OR when spec has a non-zero default - both satisfy "required".
+		if _, ok := resolved[name]; ok {
+			continue
+		}
+		return nil, fmt.Errorf("workflow_call input %q is required", name)
+	}
+
+	return resolved, nil
+}
+
+func parseWorkflowCallInput(name string, typ InputType, v any) (any, error) {
+	switch typ {
+	case InputTypeString:
+		return coerceToString(v), nil
+	case InputTypeBoolean:
+		// strict type matching: a boolean input only accepts a native bool, not a "true"/"false" string
+		if b, ok := v.(bool); ok {
+			return b, nil
+		}
+		return false, fmt.Errorf("workflow_call input %q expects boolean", name)
+	case InputTypeNumber:
+		// strict type matching: a number input rejects "123"/"3.14" strings.
+		if _, isString := v.(string); isString {
+			return 0.0, fmt.Errorf("workflow_call input %q expects number", name)
+		}
+		return util.ToFloat64(v)
+	default:
+		return nil, fmt.Errorf("workflow_call input %q has unsupported type %q", name, typ)
+	}
+}
+
+// SecretsInherit is the literal keyword used in a caller's `secrets: inherit` directive
+const SecretsInherit = "inherit"
+
+// callerSecretValueRegexp matches the `${{ secrets.NAME }}` form expected for each value in a caller's `secrets:` mapping.
+var callerSecretValueRegexp = regexp.MustCompile(`^\s*\$\{\{\s*secrets\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}\s*$`)
+
+// ParseCallerSecrets decodes a caller's "secrets:" YAML node into one of two forms:
+//   - inherit == true: the caller wrote `secrets: inherit`; mapping is nil
+//   - inherit == false, mapping == {alias: source_name}: explicit mapping. Each value must be of the form `${{ secrets.NAME }}`.
+//
+// Both alias and source name are upper-cased: secret names are case-insensitive (matching GitHub),
+// and Gitea stores secrets upper-cased, so this keeps lookups and schema validation consistent.
+func ParseCallerSecrets(node yaml.Node) (inherit bool, mapping map[string]string, err error) {
+	if node.IsZero() {
+		return false, nil, nil
+	}
+	if node.Kind == yaml.ScalarNode && strings.TrimSpace(node.Value) == SecretsInherit {
+		return true, nil, nil
+	}
+	if node.Kind != yaml.MappingNode {
+		return false, nil, errors.New("invalid secrets: section, expected mapping or 'inherit'")
+	}
+	out := make(map[string]string, len(node.Content)/2)
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		k := node.Content[i]
+		v := node.Content[i+1]
+		var sv string
+		if err := v.Decode(&sv); err != nil {
+			return false, nil, fmt.Errorf("decode secret %q: %w", k.Value, err)
+		}
+		matches := callerSecretValueRegexp.FindStringSubmatch(sv)
+		if len(matches) != 2 {
+			return false, nil, fmt.Errorf("caller secret %q value must be of the form ${{ secrets.NAME }}", k.Value)
+		}
+		out[strings.ToUpper(k.Value)] = strings.ToUpper(matches[1])
+	}
+	return false, out, nil
+}
+
+// ValidateCallerSecrets checks a caller's parsed explicit-mapping `secrets:` against the called workflow's declared `on.workflow_call.secrets` schema.
+func ValidateCallerSecrets(spec *WorkflowCallSpec, mapping map[string]string) error {
+	if spec == nil {
+		return errors.New("ValidateCallerSecrets: nil workflow_call spec")
+	}
+	// Secret names are case-insensitive, so compare declared names and caller aliases upper-cased.
+	declaredNames := make(container.Set[string], len(spec.Secrets))
+	for name := range spec.Secrets {
+		declaredNames.Add(strings.ToUpper(name))
+	}
+	provided := make(container.Set[string], len(mapping))
+	for alias := range mapping {
+		up := strings.ToUpper(alias)
+		provided.Add(up)
+		if !declaredNames.Contains(up) {
+			return fmt.Errorf("caller secret %q is not declared in the called workflow's on.workflow_call.secrets", alias)
+		}
+	}
+	for name, sec := range spec.Secrets {
+		if sec.Required && !provided.Contains(strings.ToUpper(name)) {
+			return fmt.Errorf("required secret %q is not provided by the caller", name)
+		}
+	}
+	return nil
+}
+
+// EvaluateWorkflowCallOutputs evaluates a called workflow's "on.workflow_call.outputs.<name>.value" expressions against the provided contexts.
+func EvaluateWorkflowCallOutputs(spec *WorkflowCallSpec, gitCtx *model.GithubContext, vars map[string]string, inputs map[string]any, jobOutputs JobOutputs) (map[string]string, error) {
+	if spec == nil || len(spec.Outputs) == 0 {
+		return map[string]string{}, nil
+	}
+
+	jobsCtx := make(map[string]*model.WorkflowCallResult, len(jobOutputs))
+	for jobID, outputs := range jobOutputs {
+		jobsCtx[jobID] = &model.WorkflowCallResult{Outputs: outputs}
+	}
+
+	// See `on.workflow_call.outputs.<output_id>.value` in https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#context-availability
+	env := &exprparser.EvaluationEnvironment{
+		Github: gitCtx,
+		Jobs:   &jobsCtx,
+		Vars:   vars,
+		Inputs: inputs,
+	}
+	evaluator := NewExpressionEvaluator(exprparser.NewInterpeter(env, exprparser.Config{}))
+
+	out := make(map[string]string, len(spec.Outputs))
+	for name, o := range spec.Outputs {
+		v, err := evaluator.interpolate(o.Value)
+		if err != nil {
+			return nil, fmt.Errorf("workflow_call output %q: %w", name, err)
+		}
+		out[name] = v
+	}
+	return out, nil
+}

package/gitea/source/modules/actions/jobparser/workflow_call_test.go

@@ -0,0 +1,471 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"maps"
+	"testing"
+
+	"gitea.com/gitea/runner/act/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
+)
+
+func TestParseWorkflowCallSpec(t *testing.T) {
+	t.Run("malformed YAML surfaces a parse error", func(t *testing.T) {
+		// Mismatched flow-sequence brackets — yaml.Unmarshal must reject this.
+		_, err := ParseWorkflowCallSpec([]byte(`name: bad
+on: [workflow_call
+jobs:
+  noop: { }
+`))
+		require.Error(t, err)
+	})
+
+	t.Run("workflow without on.workflow_call is rejected", func(t *testing.T) {
+		notCallable := []byte(`name: ordinary
+on: push
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
+`)
+		_, err := ParseWorkflowCallSpec(notCallable)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "does not declare on.workflow_call")
+	})
+
+	t.Run("input missing the required type field is rejected", func(t *testing.T) {
+		content := callableWorkflow(t, `inputs:
+      x:
+        description: missing type
+`)
+		_, err := ParseWorkflowCallSpec(content)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `missing required field "type"`)
+	})
+
+	t.Run("inputs/secrets/outputs are decoded", func(t *testing.T) {
+		content := callableWorkflow(t, `inputs:
+      env:
+        type: string
+        required: true
+    secrets:
+      DEPLOY_KEY:
+        required: true
+    outputs:
+      sha:
+        value: ${{ jobs.build.outputs.commit }}
+`)
+		spec, err := ParseWorkflowCallSpec(content)
+		require.NoError(t, err)
+		assert.Equal(t, InputTypeString, spec.Inputs["env"].Type)
+		assert.True(t, spec.Inputs["env"].Required)
+		assert.True(t, spec.Secrets["DEPLOY_KEY"].Required)
+		assert.Equal(t, "${{ jobs.build.outputs.commit }}", spec.Outputs["sha"].Value)
+	})
+}
+
+func TestEvaluateCallerWith(t *testing.T) {
+	t.Run("empty with: returns empty map", func(t *testing.T) {
+		out, err := EvaluateCallerWith("caller", &Job{}, nil, callerResults("caller", nil, nil), nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("non-string raw values pass through unchanged", func(t *testing.T) {
+		job := &Job{With: map[string]any{
+			"already_bool":  true,
+			"already_int":   42,
+			"already_slice": []any{"a", "b"},
+		}}
+		out, err := EvaluateCallerWith("caller", job, nil, callerResults("caller", nil, nil), nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, true, out["already_bool"])
+		assert.Equal(t, 42, out["already_int"])
+		assert.Equal(t, []any{"a", "b"}, out["already_slice"])
+	})
+
+	t.Run("expressions resolve against vars/inputs/results", func(t *testing.T) {
+		job := &Job{With: map[string]any{
+			"env_name":    "${{ vars.ENV }}",
+			"from_inputs": "${{ inputs.PARENT_VAR }}",
+			"from_needs":  "${{ needs.upstream.outputs.commit }}",
+		}}
+		gitCtx := map[string]any{"event": map[string]any{}}
+		results := callerResults("caller", []string{"upstream"}, map[string]*JobResult{
+			"upstream": {Result: "success", Outputs: map[string]string{"commit": "abc123"}},
+		})
+		vars := map[string]string{"ENV": "staging"}
+		inputs := map[string]any{"PARENT_VAR": "from-parent"}
+		out, err := EvaluateCallerWith("caller", job, gitCtx, results, vars, inputs)
+		require.NoError(t, err)
+		assert.Equal(t, "staging", out["env_name"])
+		assert.Equal(t, "from-parent", out["from_inputs"])
+		assert.Equal(t, "abc123", out["from_needs"])
+	})
+
+	t.Run("matrix.X resolves to this caller row's matrix instance", func(t *testing.T) {
+		var rawMatrix yaml.Node
+		require.NoError(t, rawMatrix.Encode(map[string][]any{"target": {"staging"}}))
+		job := &Job{
+			With:     map[string]any{"env": "${{ matrix.target }}"},
+			Strategy: Strategy{RawMatrix: rawMatrix},
+		}
+		out, err := EvaluateCallerWith("caller", job, nil, callerResults("caller", nil, nil), nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "staging", out["env"])
+	})
+}
+
+func TestMatchCallerInputsAgainstSpec(t *testing.T) {
+	// mustParseSpec wraps ParseWorkflowCallSpec for test brevity.
+	mustParseSpec := func(t *testing.T, content []byte) *WorkflowCallSpec {
+		t.Helper()
+		spec, err := ParseWorkflowCallSpec(content)
+		require.NoError(t, err)
+		return spec
+	}
+
+	t.Run("default is filled when caller does not provide the input", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      greeting:
+        type: string
+        default: hi
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, nil)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"greeting": "hi"}, out)
+	})
+
+	t.Run("caller-provided value wins over default", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      greeting:
+        type: string
+        default: hi
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"greeting": "hello"})
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"greeting": "hello"}, out)
+	})
+
+	t.Run("required input must be provided", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      target:
+        type: string
+        required: true
+`))
+		_, err := MatchCallerInputsAgainstSpec(spec, nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `"target" is required`)
+	})
+
+	t.Run("required input is satisfied by a default value", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      target:
+        type: string
+        required: true
+        default: prod
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, nil)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"target": "prod"}, out)
+	})
+
+	t.Run("boolean inputs accept native bool values and bool defaults", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      flag1:
+        type: boolean
+      flag2:
+        type: boolean
+        default: true
+      flag3:
+        type: boolean
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{
+			"flag1": true,
+			"flag3": false,
+		})
+		require.NoError(t, err)
+		assert.Equal(t, true, out["flag1"])
+		assert.Equal(t, true, out["flag2"]) // from default
+		assert.Equal(t, false, out["flag3"])
+	})
+
+	t.Run("boolean input rejects strings", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      flag:
+        type: boolean
+`))
+		_, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"flag": "true"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expects boolean")
+	})
+
+	t.Run("number inputs accept native numeric values and number defaults", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      count:
+        type: number
+      ratio:
+        type: number
+        default: 0.5
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"count": 42})
+		require.NoError(t, err)
+		assert.InDelta(t, 42.0, out["count"], 0)
+		assert.InDelta(t, 0.5, out["ratio"], 0)
+	})
+
+	t.Run("number input rejects strings", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      count:
+        type: number
+`))
+		_, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"count": "42"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expects number")
+	})
+
+	t.Run("unknown caller-with key is silently dropped", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      known:
+        type: string
+        default: ok
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{
+			"known":   "yes",
+			"unknown": "ignored",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"known": "yes"}, out)
+	})
+}
+
+func TestParseCallerSecrets(t *testing.T) {
+	// secretYAMLNode unmarshals raw YAML text into a yaml.Node so tests can hand it to ParseCallerSecrets.
+	secretYAMLNode := func(t *testing.T, s string) yaml.Node {
+		t.Helper()
+		var node yaml.Node
+		require.NoError(t, yaml.Unmarshal([]byte(s), &node))
+		// yaml.Unmarshal wraps content in a DocumentNode; the meaningful node is the first child.
+		if node.Kind == yaml.DocumentNode && len(node.Content) > 0 {
+			return *node.Content[0]
+		}
+		return node
+	}
+
+	t.Run("zero node returns no inherit, no mapping", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(yaml.Node{})
+		require.NoError(t, err)
+		assert.False(t, inherit)
+		assert.Nil(t, mapping)
+	})
+
+	t.Run("\"inherit\" scalar sets inherit=true", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(secretYAMLNode(t, `inherit`))
+		require.NoError(t, err)
+		assert.True(t, inherit)
+		assert.Nil(t, mapping)
+	})
+
+	t.Run("non-inherit scalar is rejected", func(t *testing.T) {
+		_, _, err := ParseCallerSecrets(secretYAMLNode(t, `something-else`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expected mapping or 'inherit'")
+	})
+
+	t.Run("mapping of secrets-style references is parsed", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(secretYAMLNode(t, `
+DEPLOY_KEY: ${{ secrets.GITEA_DEPLOY_KEY }}
+DB_PASS:    ${{ secrets.PROD_DB_PASS }}
+`))
+		require.NoError(t, err)
+		assert.False(t, inherit)
+		assert.Equal(t, map[string]string{
+			"DEPLOY_KEY": "GITEA_DEPLOY_KEY",
+			"DB_PASS":    "PROD_DB_PASS",
+		}, mapping)
+	})
+
+	t.Run("alias and source names are upper-cased", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(secretYAMLNode(t, `
+deploy_key: ${{ secrets.gitea_deploy_key }}
+`))
+		require.NoError(t, err)
+		assert.False(t, inherit)
+		assert.Equal(t, map[string]string{"DEPLOY_KEY": "GITEA_DEPLOY_KEY"}, mapping)
+	})
+
+	t.Run("mapping value not in ${{ secrets.NAME }} form is rejected", func(t *testing.T) {
+		// plain string
+		_, _, err := ParseCallerSecrets(secretYAMLNode(t, `KEY: not-an-expression`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `must be of the form ${{ secrets.NAME }}`)
+
+		// expression but referencing the wrong context (vars instead of secrets)
+		_, _, err = ParseCallerSecrets(secretYAMLNode(t, `KEY: ${{ vars.NAME }}`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `must be of the form ${{ secrets.NAME }}`)
+	})
+}
+
+func TestValidateCallerSecrets(t *testing.T) {
+	specWith := func(secrets map[string]SecretSpec) *WorkflowCallSpec {
+		return &WorkflowCallSpec{Secrets: secrets}
+	}
+
+	t.Run("explicit mapping with all required + only declared aliases is accepted", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{
+			"DEPLOY_KEY": {Required: true},
+			"OPTIONAL":   {},
+		})
+		mapping := map[string]string{
+			"DEPLOY_KEY": "PROD_DEPLOY_KEY",
+			"OPTIONAL":   "SOMETHING_ELSE",
+		}
+		require.NoError(t, ValidateCallerSecrets(spec, mapping))
+	})
+
+	t.Run("alias not in callee schema is rejected", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{"DEPLOY_KEY": {}})
+		mapping := map[string]string{
+			"DEPLOY_KEY": "PROD_DEPLOY_KEY",
+			"EXTRA":      "SOMETHING_NOT_DECLARED",
+		}
+		err := ValidateCallerSecrets(spec, mapping)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `caller secret "EXTRA"`)
+		assert.Contains(t, err.Error(), `not declared`)
+	})
+
+	t.Run("missing required secret is rejected", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{
+			"MUST_HAVE": {Required: true},
+			"OPTIONAL":  {},
+		})
+		mapping := map[string]string{"OPTIONAL": "X"}
+		err := ValidateCallerSecrets(spec, mapping)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `required secret "MUST_HAVE"`)
+		assert.Contains(t, err.Error(), `not provided`)
+	})
+
+	t.Run("callee with no secrets schema accepts an empty mapping", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{})
+		require.NoError(t, ValidateCallerSecrets(spec, nil))
+		require.NoError(t, ValidateCallerSecrets(spec, map[string]string{}))
+	})
+
+	t.Run("callee with no secrets schema rejects a non-empty mapping", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{})
+		err := ValidateCallerSecrets(spec, map[string]string{"X": "Y"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `caller secret "X"`)
+	})
+
+	t.Run("name matching is case-insensitive", func(t *testing.T) {
+		// declared name and caller alias differ only in case; both should match.
+		spec := specWith(map[string]SecretSpec{"deploy_key": {Required: true}})
+		mapping := map[string]string{"DEPLOY_KEY": "PROD_DEPLOY_KEY"}
+		require.NoError(t, ValidateCallerSecrets(spec, mapping))
+	})
+
+	t.Run("nil spec is rejected", func(t *testing.T) {
+		err := ValidateCallerSecrets(nil, map[string]string{"X": "Y"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "nil workflow_call spec")
+	})
+}
+
+func TestEvaluateWorkflowCallOutputs(t *testing.T) {
+	t.Run("nil spec returns empty map", func(t *testing.T) {
+		out, err := EvaluateWorkflowCallOutputs(nil, &model.GithubContext{}, nil, nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("spec with no outputs returns empty map", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{}}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("plain string value passes through unchanged", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"name": {Value: "static-value"},
+		}}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"name": "static-value"}, out)
+	})
+
+	t.Run("output references jobs.<id>.outputs.<name>", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"sha": {Value: "${{ jobs.build.outputs.commit }}"},
+		}}
+		jobOutputs := JobOutputs{
+			"build": {"commit": "deadbeef"},
+		}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, jobOutputs)
+		require.NoError(t, err)
+		assert.Equal(t, "deadbeef", out["sha"])
+	})
+
+	t.Run("output references inputs.<name>", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"target": {Value: "${{ inputs.env_name }}"},
+		}}
+		inputs := map[string]any{"env_name": "staging"}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, inputs, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "staging", out["target"])
+	})
+
+	t.Run("multiple outputs are all evaluated", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"static":  {Value: "static-value"},
+			"dynamic": {Value: "${{ vars.SUFFIX }}"},
+		}}
+		vars := map[string]string{"SUFFIX": "abc"}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, vars, nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "static-value", out["static"])
+		assert.Equal(t, "abc", out["dynamic"])
+	})
+
+	t.Run("expression referencing an undefined symbol surfaces an error", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"bad": {Value: "${{ this.is.not.valid() }}"},
+		}}
+		_, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `output "bad"`)
+	})
+}
+
+// callableWorkflow returns a minimal valid called-workflow YAML with on.workflow_call.
+func callableWorkflow(t *testing.T, body string) []byte {
+	t.Helper()
+	return []byte(`name: callable
+on:
+  workflow_call:
+    ` + body + `
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: "echo"
+`)
+}
+
+// callerResults returns the minimum results map shape that NewInterpeter expects
+func callerResults(callerJobID string, callerNeeds []string, deps map[string]*JobResult) map[string]*JobResult {
+	out := make(map[string]*JobResult, len(deps)+1)
+	maps.Copy(out, deps)
+	out[callerJobID] = &JobResult{Needs: callerNeeds}
+	return out
+}

package/gitea/source/modules/actions/log.go

@@ -12,12 +12,12 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/dbfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/zstd"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/models/dbfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/zstd"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 

package/gitea/source/modules/actions/scoped_workflows.go

@@ -0,0 +1,90 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
+)
+
+// ListScopedWorkflows lists scoped workflow files (under SCOPED_WORKFLOW_DIRS) at the given commit.
+func ListScopedWorkflows(commit *git.Commit) (string, git.Entries, error) {
+	return listWorkflowsInDirs(commit, setting.Actions.ScopedWorkflowDirs)
+}
+
+// ParsedScopedWorkflow is one scoped workflow's source-side parse result
+type ParsedScopedWorkflow struct {
+	EntryName   string
+	DisplayName string             // the workflow `name:` or base file name
+	Content     []byte             // raw content of the workflow file
+	Events      []*jobparser.Event // decoded `on:` events
+}
+
+// ParseScopedWorkflows lists and parses the scoped workflow files at sourceCommit (under SCOPED_WORKFLOW_DIRS).
+func ParseScopedWorkflows(sourceCommit *git.Commit) ([]*ParsedScopedWorkflow, error) {
+	_, entries, err := ListScopedWorkflows(sourceCommit)
+	if err != nil {
+		return nil, err
+	}
+
+	parsed := make([]*ParsedScopedWorkflow, 0, len(entries))
+	for _, entry := range entries {
+		content, err := GetContentFromEntry(entry)
+		if err != nil {
+			return nil, err
+		}
+
+		// one workflow may have multiple events
+		events, err := GetEventsFromContent(content)
+		if err != nil {
+			log.Warn("ignore invalid scoped workflow %q: %v", entry.Name(), err)
+			continue
+		}
+		parsed = append(parsed, &ParsedScopedWorkflow{
+			EntryName:   entry.Name(),
+			DisplayName: WorkflowDisplayName(entry.Name(), content),
+			Content:     content,
+			Events:      events,
+		})
+	}
+	return parsed, nil
+}
+
+// MatchScopedWorkflows evaluates already-parsed scoped workflows against one consuming event.
+// It returns the workflows whose `on:` matches, and those that matched the event but were excluded by a branch/paths filter (filtered).
+func MatchScopedWorkflows(
+	parsed []*ParsedScopedWorkflow,
+	sourceCommitSHA string,
+	consumerGitRepo *git.Repository,
+	consumerCommit *git.Commit,
+	triggedEvent webhook_module.HookEventType,
+	payload api.Payloader,
+) (matched, filtered []*DetectedWorkflow) {
+	for _, p := range parsed {
+		for _, evt := range p.Events {
+			if evt.IsSchedule() {
+				// schedule is a non-target for scoped workflows
+				continue
+			}
+			dwf := &DetectedWorkflow{
+				EntryName:       p.EntryName,
+				TriggerEvent:    evt,
+				Content:         p.Content,
+				SourceCommitSHA: sourceCommitSHA,
+			}
+			switch detectWorkflowMatch(consumerGitRepo, consumerCommit, triggedEvent, payload, evt) {
+			case detectMatched:
+				matched = append(matched, dwf)
+			case detectFilteredOut:
+				filtered = append(filtered, dwf)
+			case detectNotApplicable:
+			}
+		}
+	}
+	return matched, filtered
+}

package/gitea/source/modules/actions/scoped_workflows_test.go

@@ -0,0 +1,62 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsWorkflowInDirs(t *testing.T) {
+	tests := []struct {
+		name     string
+		dirs     []string
+		path     string
+		expected bool
+	}{
+		{
+			name:     "default scoped dir with yml",
+			dirs:     []string{".gitea/scoped_workflows", ".github/scoped_workflows"},
+			path:     ".gitea/scoped_workflows/security.yml",
+			expected: true,
+		},
+		{
+			name:     "default scoped dir with yaml",
+			dirs:     []string{".gitea/scoped_workflows", ".github/scoped_workflows"},
+			path:     ".github/scoped_workflows/lint.yaml",
+			expected: true,
+		},
+		{
+			name:     "normal workflow path is not a scoped workflow",
+			dirs:     []string{".gitea/scoped_workflows"},
+			path:     ".gitea/workflows/ci.yml",
+			expected: false,
+		},
+		{
+			name:     "non-yaml file",
+			dirs:     []string{".gitea/scoped_workflows"},
+			path:     ".gitea/scoped_workflows/readme.md",
+			expected: false,
+		},
+		{
+			name:     "feature disabled (no scoped dirs)",
+			dirs:     []string{},
+			path:     ".gitea/scoped_workflows/security.yml",
+			expected: false,
+		},
+		{
+			name:     "directory boundary",
+			dirs:     []string{".gitea/scoped_workflows"},
+			path:     ".gitea/scoped_workflows2/security.yml",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, isWorkflowInDirs(tt.path, tt.dirs))
+		})
+	}
+}

package/gitea/source/modules/actions/task_state.go

@@ -4,7 +4,7 @@
 package actions
 
 import (
-	actions_model "code.gitea.io/gitea/models/actions"
+	actions_model "gitea.dev/models/actions"
 )
 
 const (
@@ -30,8 +30,9 @@ func FullSteps(task *actions_model.ActionTask) []*actions_model.ActionTaskStep {
 	// For example,
 	// 1. preStep(Success) -> step1(Success) -> step2(Running) -> step3(Waiting) -> postStep(Waiting): lastHasRunStep is step1.
 	// 2. preStep(Success) -> step1(Success) -> step2(Success) -> step3(Success) -> postStep(Success): lastHasRunStep is step3.
-	// 3. preStep(Success) -> step1(Success) -> step2(Failure) -> step3 -> postStep(Waiting): lastHasRunStep is step2.
-	// So its Stopped is the Started of postStep when there are no more steps to run.
+	// 3. preStep(Success) -> step1(Success) -> step2(Failure) -> step3(Waiting) -> postStep(Waiting): lastHasRunStep is step2.
+	// 4. preStep(Success) -> step1(Success) -> step2(Skipped) -> postStep(Success): lastHasRunStep is step1, because a skipped step never ran.
+	// So its Stopped is the Started of postStep once no step is left to run.
 	var lastHasRunStep *actions_model.ActionTaskStep
 
 	var logIndex int64
@@ -71,8 +72,8 @@ func FullSteps(task *actions_model.ActionTask) []*actions_model.ActionTaskStep {
 		Name:   postStepName,
 		Status: actions_model.StatusWaiting,
 	}
-	// If the lastHasRunStep is the last step, or it has failed, postStep has started.
-	if lastHasRunStep.Status.IsFailure() || lastHasRunStep == task.Steps[len(task.Steps)-1] {
+	// If no step is left to run, or the lastHasRunStep has failed, postStep has started.
+	if lastHasRunStep.Status.IsFailure() || task.Steps[len(task.Steps)-1].Status.IsDone() {
 		postStep.LogIndex = logIndex
 		postStep.LogLength = task.LogLength - postStep.LogIndex
 		postStep.Started = lastHasRunStep.Stopped

package/gitea/source/modules/actions/task_state_test.go

@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
+	actions_model "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -156,6 +156,27 @@ func TestFullSteps(t *testing.T) {
 				{Name: postStepName, Status: actions_model.StatusSuccess, LogIndex: 90, LogLength: 10, Started: 10090, Stopped: 10100},
 			},
 		},
+		{
+			name: "last step is skipped",
+			task: &actions_model.ActionTask{
+				Steps: []*actions_model.ActionTaskStep{
+					{Status: actions_model.StatusSuccess, LogIndex: 10, LogLength: 20, Started: 10010, Stopped: 10020},
+					{Status: actions_model.StatusSuccess, LogIndex: 30, LogLength: 60, Started: 10020, Stopped: 10090},
+					{Status: actions_model.StatusSkipped, LogIndex: 0, LogLength: 0, Started: 0, Stopped: 0},
+				},
+				Status:    actions_model.StatusSuccess,
+				Started:   10000,
+				Stopped:   10100,
+				LogLength: 100,
+			},
+			want: []*actions_model.ActionTaskStep{
+				{Name: preStepName, Status: actions_model.StatusSuccess, LogIndex: 0, LogLength: 10, Started: 10000, Stopped: 10010},
+				{Status: actions_model.StatusSuccess, LogIndex: 10, LogLength: 20, Started: 10010, Stopped: 10020},
+				{Status: actions_model.StatusSuccess, LogIndex: 30, LogLength: 60, Started: 10020, Stopped: 10090},
+				{Status: actions_model.StatusSkipped, LogIndex: 0, LogLength: 0, Started: 0, Stopped: 0},
+				{Name: postStepName, Status: actions_model.StatusSuccess, LogIndex: 90, LogLength: 10, Started: 10090, Stopped: 10100},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

package/gitea/source/modules/actions/workflowpattern/workflow_pattern.go

@@ -0,0 +1,65 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package workflowpattern
+
+import (
+	"strings"
+
+	"gitea.dev/modules/glob"
+)
+
+type WorkflowPattern struct {
+	negative bool
+	glob     glob.Glob
+}
+
+func CompilePatterns(patterns ...string) ([]*WorkflowPattern, error) {
+	ret := make([]*WorkflowPattern, 0, len(patterns))
+	for _, pattern := range patterns {
+		cp, err := glob.CompileWorkflow(pattern)
+		if err != nil {
+			return nil, err
+		}
+		ret = append(ret, &WorkflowPattern{glob: cp, negative: strings.HasPrefix(pattern, "!")})
+	}
+	return ret, nil
+}
+
+// Skip returns true if the workflow should be skipped per paths/branches semantics.
+func Skip(sequence []*WorkflowPattern, input []string) bool {
+	allSkipped := true
+	for _, file := range input {
+		shouldSkip := true
+		for _, item := range sequence {
+			if item.negative {
+				// "!README.md" doesn't match "README.md", so "README.md" should be skipped
+				// "!README.md" matches "help.md" but it shouldn't affect "skip or not", because "help.md" might have been skipped by other rules like "docs/*.md"
+				if !item.glob.Match(file) {
+					shouldSkip = true
+				}
+			} else if item.glob.Match(file) {
+				// if "*.md" matches "help.md" so it shouldn't be skipped
+				shouldSkip = false
+			}
+		}
+		allSkipped = allSkipped && shouldSkip
+	}
+	return len(sequence) > 0 && allSkipped
+}
+
+// Filter returns true if the workflow should be skipped per paths-ignore/branches-ignore semantics.
+func Filter(sequence []*WorkflowPattern, input []string) bool {
+	for _, file := range input {
+		anyMatched := false
+		for _, item := range sequence {
+			if anyMatched = item.glob.Match(file); anyMatched {
+				break
+			}
+		}
+		if !anyMatched {
+			return false
+		}
+	}
+	return len(sequence) != 0
+}

package/gitea/source/modules/actions/workflowpattern/workflow_pattern_test.go

@@ -0,0 +1,416 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package workflowpattern
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMatchPattern(t *testing.T) {
+	kases := []struct {
+		inputs       []string
+		patterns     []string
+		skipResult   bool
+		filterResult bool
+	}{
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"path/with/slash"},
+			skipResult:   true,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"meta", "path/b", "otherfile"},
+			skipResult:   false,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/b"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/c", "path/b"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/c", "path/b", "path/a"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/c", "path/b", "path/d", "path/a"},
+			skipResult:   false,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{},
+			inputs:       []string{},
+			skipResult:   false,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{"\\!file"},
+			inputs:       []string{"!file"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"escape\\\\backslash"},
+			inputs:       []string{"escape\\backslash"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{".yml"},
+			inputs:       []string{"fyml"},
+			skipResult:   true,
+			filterResult: false,
+		},
+		// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#patterns-to-match-branches-and-tags
+		{
+			patterns:     []string{"feature/*"},
+			inputs:       []string{"feature/my-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/*"},
+			inputs:       []string{"feature/your-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/**"},
+			inputs:       []string{"feature/beta-a/my-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/**"},
+			inputs:       []string{"feature/beta-a/my-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/**"},
+			inputs:       []string{"feature/mona/the/octocat"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"main", "releases/mona-the-octocat"},
+			inputs:       []string{"main"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"main", "releases/mona-the-octocat"},
+			inputs:       []string{"releases/mona-the-octocat"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"main"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"releases"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**"},
+			inputs:       []string{"all/the/branches"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**"},
+			inputs:       []string{"every/tag"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*feature"},
+			inputs:       []string{"mona-feature"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*feature"},
+			inputs:       []string{"feature"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*feature"},
+			inputs:       []string{"ver-10-feature"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v2*"},
+			inputs:       []string{"v2"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v2*"},
+			inputs:       []string{"v2.0"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v2*"},
+			inputs:       []string{"v2.9"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v[12].[0-9]+.[0-9]+"},
+			inputs:       []string{"v1.10.1"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v[12].[0-9]+.[0-9]+"},
+			inputs:       []string{"v2.0.0"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#patterns-to-match-file-paths
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"server.rb"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.jsx?"},
+			inputs:       []string{"page.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.jsx?"},
+			inputs:       []string{"page.jsx"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**"},
+			inputs:       []string{"all/the/files.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.js"},
+			inputs:       []string{"app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.js"},
+			inputs:       []string{"index.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**.js"},
+			inputs:       []string{"index.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**.js"},
+			inputs:       []string{"js/index.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**.js"},
+			inputs:       []string{"src/js/app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/*"},
+			inputs:       []string{"docs/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/*"},
+			inputs:       []string{"docs/file.txt"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**"},
+			inputs:       []string{"docs/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**"},
+			inputs:       []string{"docs/mona/octocat.txt"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**/*.md"},
+			inputs:       []string{"docs/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**/*.md"},
+			inputs:       []string{"docs/mona/hello-world.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**/*.md"},
+			inputs:       []string{"docs/a/markdown/file.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/docs/**"},
+			inputs:       []string{"docs/hello.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/docs/**"},
+			inputs:       []string{"dir/docs/my-file.txt"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/docs/**"},
+			inputs:       []string{"space/docs/plan/space.doc"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/README.md"},
+			inputs:       []string{"README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/README.md"},
+			inputs:       []string{"js/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*src/**"},
+			inputs:       []string{"a/src/app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*src/**"},
+			inputs:       []string{"my-src/code/js/app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*-post.md"},
+			inputs:       []string{"my-post.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*-post.md"},
+			inputs:       []string{"path/their-post.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/migrate-*.sql"},
+			inputs:       []string{"migrate-10909.sql"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/migrate-*.sql"},
+			inputs:       []string{"db/migrate-v1.0.sql"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/migrate-*.sql"},
+			inputs:       []string{"db/sept/migrate-v1.sql"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md"},
+			inputs:       []string{"hello.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md"},
+			inputs:       []string{"README.md"},
+			skipResult:   true,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md"},
+			inputs:       []string{"docs/hello.md"},
+			skipResult:   true,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md", "README*"},
+			inputs:       []string{"hello.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md", "README*"},
+			inputs:       []string{"README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md", "README*"},
+			inputs:       []string{"README.doc"},
+			skipResult:   false,
+			filterResult: true,
+		},
+	}
+
+	for _, kase := range kases {
+		msg := fmt.Sprintf("patterns=%s, input=%s", strings.Join(kase.patterns, ","), strings.Join(kase.inputs, ","))
+		patterns, err := CompilePatterns(kase.patterns...)
+		assert.NoError(t, err, "compile error: %s", msg)
+		assert.Equal(t, kase.skipResult, Skip(patterns, kase.inputs), "unexpected skip result: %s", msg)
+		assert.Equal(t, kase.filterResult, Filter(patterns, kase.inputs), "unexpected filter result: %s", msg)
+	}
+}

package/gitea/source/modules/actions/workflows.go

@@ -4,21 +4,22 @@
 package actions
 
 import (
-	"bytes"
+	"fmt"
+	"path"
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/actions/workflowpattern"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 
-	"github.com/nektos/act/pkg/model"
-	"github.com/nektos/act/pkg/workflowpattern"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -26,8 +27,18 @@ type DetectedWorkflow struct {
 	EntryName    string
 	TriggerEvent *jobparser.Event
 	Content      []byte
+	// SourceCommitSHA is the commit Content was read from, and must always be filled in together with Content.
+	SourceCommitSHA string
 }
 
+type detectResult int
+
+const (
+	detectMatched       detectResult = iota // event matched; run normally
+	detectNotApplicable                     // event/type doesn't apply; create nothing
+	detectFilteredOut                       // matched but excluded by a branch/paths filter; posts a skipped commit status when the context is a required check
+)
+
 func init() {
 	model.OnDecodeNodeError = func(node yaml.Node, out any, err error) {
 		// Log the error instead of panic or fatal.
@@ -38,11 +49,20 @@ func init() {
 }
 
 func IsWorkflow(path string) bool {
+	return isWorkflowInDirs(path, setting.Actions.WorkflowDirs)
+}
+
+// IsWorkflowOrScopedWorkflow reports whether path is a workflow file under WORKFLOW_DIRS or SCOPED_WORKFLOW_DIRS.
+func IsWorkflowOrScopedWorkflow(path string) bool {
+	return isWorkflowInDirs(path, setting.Actions.WorkflowDirs) || isWorkflowInDirs(path, setting.Actions.ScopedWorkflowDirs)
+}
+
+func isWorkflowInDirs(path string, dirs []string) bool {
 	if (!strings.HasSuffix(path, ".yaml")) && (!strings.HasSuffix(path, ".yml")) {
 		return false
 	}
 
-	for _, workflowDir := range setting.Actions.WorkflowDirs {
+	for _, workflowDir := range dirs {
 		if strings.HasPrefix(path, workflowDir+"/") {
 			return true
 		}
@@ -51,10 +71,14 @@ func IsWorkflow(path string) bool {
 }
 
 func ListWorkflows(commit *git.Commit) (string, git.Entries, error) {
+	return listWorkflowsInDirs(commit, setting.Actions.WorkflowDirs)
+}
+
+func listWorkflowsInDirs(commit *git.Commit, dirs []string) (string, git.Entries, error) {
 	var tree *git.Tree
 	var err error
 	var workflowDir string
-	for _, workflowDir = range setting.Actions.WorkflowDirs {
+	for _, workflowDir = range dirs {
 		tree, err = commit.SubTree(workflowDir)
 		if err == nil {
 			break
@@ -95,7 +119,7 @@ func GetContentFromEntry(entry *git.TreeEntry) ([]byte, error) {
 }
 
 func GetEventsFromContent(content []byte) ([]*jobparser.Event, error) {
-	workflow, err := model.ReadWorkflow(bytes.NewReader(content))
+	workflow, err := jobparser.ReadWorkflow(content)
 	if err != nil {
 		return nil, err
 	}
@@ -117,24 +141,56 @@ func ValidateWorkflowContent(content []byte) error {
 	return err
 }
 
+// WorkflowDisplayName returns a workflow's display name: its `name:` if non-blank, otherwise the base file name.
+// This is the value used as the workflow segment of its commit-status context.
+func WorkflowDisplayName(file string, content []byte) string {
+	displayName := path.Base(file)
+	if wfs, err := jobparser.Parse(content); err == nil && len(wfs) > 0 {
+		if name := strings.TrimSpace(wfs[0].Name); name != "" {
+			displayName = name
+		}
+	}
+	return displayName
+}
+
+// WorkflowStatusContextName builds a workflow job's commit-status context name: "<display> / <job> (<event>)".
+func WorkflowStatusContextName(displayName, jobName, event string) string {
+	return strings.TrimSpace(fmt.Sprintf("%s / %s (%s)", displayName, jobName, event))
+}
+
+// ScopedWorkflowStatusContextName prefixes a scoped run's status-check context with its source repo, set off by a colon: "<prefix>: <display> / <job> (<event>)".
+func ScopedWorkflowStatusContextName(prefix, displayName, jobName, event string) string {
+	return strings.TrimSpace(fmt.Sprintf("%s: %s", prefix, WorkflowStatusContextName(displayName, jobName, event)))
+}
+
+// ShouldEventCreateCommitStatus reports whether a run triggered by the given workflow `on:` event posts a commit status,
+// so its context can serve as a required status check.
+// TODO: this allowlist duplicates the truth in services/actions.getCommitStatusEventNameAndCommitID, which decides the actual event string and whether a status is posted.
+// The two are kept in sync by hand and can drift; unify them into a single source so adding a status-producing event in one place automatically updates the other.
+func ShouldEventCreateCommitStatus(event string) bool {
+	switch event {
+	case "push", "pull_request", "pull_request_target", "pull_request_review", "pull_request_review_comment", "release":
+		return true
+	}
+	return false
+}
+
 func DetectWorkflows(
 	gitRepo *git.Repository,
 	commit *git.Commit,
 	triggedEvent webhook_module.HookEventType,
 	payload api.Payloader,
 	detectSchedule bool,
-) ([]*DetectedWorkflow, []*DetectedWorkflow, error) {
+) (workflows, schedules, filtered []*DetectedWorkflow, err error) {
 	_, entries, err := ListWorkflows(commit)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
-	workflows := make([]*DetectedWorkflow, 0, len(entries))
-	schedules := make([]*DetectedWorkflow, 0, len(entries))
 	for _, entry := range entries {
 		content, err := GetContentFromEntry(entry)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 
 		// one workflow may have multiple events
@@ -148,24 +204,32 @@ func DetectWorkflows(
 			if evt.IsSchedule() {
 				if detectSchedule {
 					dwf := &DetectedWorkflow{
-						EntryName:    entry.Name(),
-						TriggerEvent: evt,
-						Content:      content,
+						EntryName:       entry.Name(),
+						TriggerEvent:    evt,
+						Content:         content,
+						SourceCommitSHA: commit.ID.String(),
 					}
 					schedules = append(schedules, dwf)
 				}
-			} else if detectMatched(gitRepo, commit, triggedEvent, payload, evt) {
+			} else {
 				dwf := &DetectedWorkflow{
-					EntryName:    entry.Name(),
-					TriggerEvent: evt,
-					Content:      content,
+					EntryName:       entry.Name(),
+					TriggerEvent:    evt,
+					Content:         content,
+					SourceCommitSHA: commit.ID.String(),
+				}
+				switch detectWorkflowMatch(gitRepo, commit, triggedEvent, payload, evt) {
+				case detectMatched:
+					workflows = append(workflows, dwf)
+				case detectFilteredOut:
+					filtered = append(filtered, dwf)
+				case detectNotApplicable:
 				}
-				workflows = append(workflows, dwf)
 			}
 		}
 	}
 
-	return workflows, schedules, nil
+	return workflows, schedules, filtered, nil
 }
 
 func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*DetectedWorkflow, error) {
@@ -191,9 +255,10 @@ func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*D
 			if evt.IsSchedule() {
 				log.Trace("detect scheduled workflow: %q", entry.Name())
 				dwf := &DetectedWorkflow{
-					EntryName:    entry.Name(),
-					TriggerEvent: evt,
-					Content:      content,
+					EntryName:       entry.Name(),
+					TriggerEvent:    evt,
+					Content:         content,
+					SourceCommitSHA: commit.ID.String(),
 				}
 				wfs = append(wfs, dwf)
 			}
@@ -203,9 +268,9 @@ func DetectScheduledWorkflows(gitRepo *git.Repository, commit *git.Commit) ([]*D
 	return wfs, nil
 }
 
-func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent webhook_module.HookEventType, payload api.Payloader, evt *jobparser.Event) bool {
+func detectWorkflowMatch(gitRepo *git.Repository, commit *git.Commit, triggedEvent webhook_module.HookEventType, payload api.Payloader, evt *jobparser.Event) detectResult {
 	if !canGithubEventMatch(evt.Name, triggedEvent) {
-		return false
+		return detectNotApplicable
 	}
 
 	switch triggedEvent {
@@ -219,7 +284,7 @@ func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent web
 			log.Warn("Ignore unsupported %s event arguments %v", triggedEvent, evt.Acts())
 		}
 		// no special filter parameters for these events, just return true if name matched
-		return true
+		return detectMatched
 
 	case // push
 		webhook_module.HookEventPush:
@@ -230,14 +295,20 @@ func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent web
 		webhook_module.HookEventIssueAssign,
 		webhook_module.HookEventIssueLabel,
 		webhook_module.HookEventIssueMilestone:
-		return matchIssuesEvent(payload.(*api.IssuePayload), evt)
+		if matchIssuesEvent(payload.(*api.IssuePayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // issue_comment
 		webhook_module.HookEventIssueComment,
 		// `pull_request_comment` is same as `issue_comment`
 		// See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_comment-use-issue_comment
 		webhook_module.HookEventPullRequestComment:
-		return matchIssueCommentEvent(payload.(*api.IssueCommentPayload), evt)
+		if matchIssueCommentEvent(payload.(*api.IssueCommentPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // pull_request
 		webhook_module.HookEventPullRequest,
@@ -251,34 +322,49 @@ func detectMatched(gitRepo *git.Repository, commit *git.Commit, triggedEvent web
 	case // pull_request_review
 		webhook_module.HookEventPullRequestReviewApproved,
 		webhook_module.HookEventPullRequestReviewRejected:
-		return matchPullRequestReviewEvent(payload.(*api.PullRequestPayload), evt)
+		if matchPullRequestReviewEvent(payload.(*api.PullRequestPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // pull_request_review_comment
 		webhook_module.HookEventPullRequestReviewComment:
-		return matchPullRequestReviewCommentEvent(payload.(*api.PullRequestPayload), evt)
+		if matchPullRequestReviewCommentEvent(payload.(*api.PullRequestPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // release
 		webhook_module.HookEventRelease:
-		return matchReleaseEvent(payload.(*api.ReleasePayload), evt)
+		if matchReleaseEvent(payload.(*api.ReleasePayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // registry_package
 		webhook_module.HookEventPackage:
-		return matchPackageEvent(payload.(*api.PackagePayload), evt)
+		if matchPackageEvent(payload.(*api.PackagePayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	case // workflow_run
 		webhook_module.HookEventWorkflowRun:
-		return matchWorkflowRunEvent(payload.(*api.WorkflowRunPayload), evt)
+		if matchWorkflowRunEvent(payload.(*api.WorkflowRunPayload), evt) {
+			return detectMatched
+		}
+		return detectNotApplicable
 
 	default:
 		log.Warn("unsupported event %q", triggedEvent)
-		return false
+		return detectNotApplicable
 	}
 }
 
-func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) bool {
+func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobparser.Event) detectResult {
 	// with no special filter parameters
 	if len(evt.Acts()) == 0 {
-		return true
+		return detectMatched
 	}
 
 	matchTimes := 0
@@ -297,7 +383,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{refName.BranchName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{refName.BranchName()}) {
 				matchTimes++
 			}
 		case "branches-ignore":
@@ -309,7 +395,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{refName.BranchName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{refName.BranchName()}) {
 				matchTimes++
 			}
 		case "tags":
@@ -321,7 +407,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{refName.TagName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{refName.TagName()}) {
 				matchTimes++
 			}
 		case "tags-ignore":
@@ -333,7 +419,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{refName.TagName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{refName.TagName()}) {
 				matchTimes++
 			}
 		case "paths":
@@ -344,14 +430,14 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Skip(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Skip(patterns, filesChanged) {
+				matchTimes++
 			}
 		case "paths-ignore":
 			if refName.IsTag() {
@@ -361,14 +447,14 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			filesChanged, err := commit.GetFilesChangedSinceCommit(pushPayload.Before)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", commit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Filter(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Filter(patterns, filesChanged) {
+				matchTimes++
 			}
 		default:
 			log.Warn("push event unsupported condition %q", cond)
@@ -378,7 +464,10 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 	if hasBranchFilter && hasTagFilter {
 		matchTimes++
 	}
-	return matchTimes == len(evt.Acts())
+	if matchTimes == len(evt.Acts()) {
+		return detectMatched
+	}
+	return detectFilteredOut
 }
 
 func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool {
@@ -429,7 +518,7 @@ func matchIssuesEvent(issuePayload *api.IssuePayload, evt *jobparser.Event) bool
 	return matchTimes == len(evt.Acts())
 }
 
-func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayload *api.PullRequestPayload, evt *jobparser.Event) bool {
+func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayload *api.PullRequestPayload, evt *jobparser.Event) detectResult {
 	acts := evt.Acts()
 	activityTypeMatched := false
 	matchTimes := 0
@@ -476,7 +565,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 		headCommit, err = gitRepo.GetCommit(prPayload.PullRequest.Head.Sha)
 		if err != nil {
 			log.Error("GetCommit [ref: %s]: %v", prPayload.PullRequest.Head.Sha, err)
-			return false
+			return detectNotApplicable
 		}
 	}
 
@@ -492,7 +581,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{refName.ShortName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{refName.ShortName()}) {
 				matchTimes++
 			}
 		case "branches-ignore":
@@ -501,40 +590,46 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{refName.ShortName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{refName.ShortName()}) {
 				matchTimes++
 			}
 		case "paths":
 			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Skip(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Skip(patterns, filesChanged) {
+				matchTimes++
 			}
 		case "paths-ignore":
 			filesChanged, err := headCommit.GetFilesChangedSinceCommit(prPayload.PullRequest.MergeBase)
 			if err != nil {
 				log.Error("GetFilesChangedSinceCommit [commit_sha1: %s]: %v", headCommit.ID.String(), err)
-			} else {
-				patterns, err := workflowpattern.CompilePatterns(vals...)
-				if err != nil {
-					break
-				}
-				if !workflowpattern.Filter(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
-					matchTimes++
-				}
+				return detectNotApplicable
+			}
+			patterns, err := workflowpattern.CompilePatterns(vals...)
+			if err != nil {
+				break
+			}
+			if !workflowpattern.Filter(patterns, filesChanged) {
+				matchTimes++
 			}
 		default:
 			log.Warn("pull request event unsupported condition %q", cond)
 		}
 	}
-	return activityTypeMatched && matchTimes == len(evt.Acts())
+	if !activityTypeMatched {
+		return detectNotApplicable
+	}
+	if matchTimes != len(evt.Acts()) {
+		return detectFilteredOut
+	}
+	return detectMatched
 }
 
 func matchIssueCommentEvent(issueCommentPayload *api.IssueCommentPayload, evt *jobparser.Event) bool {
@@ -747,7 +842,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{workflow.Name}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{workflow.Name}) {
 				matchTimes++
 			}
 		case "branches":
@@ -755,7 +850,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{payload.WorkflowRun.HeadBranch}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{payload.WorkflowRun.HeadBranch}) {
 				matchTimes++
 			}
 		case "branches-ignore":
@@ -763,7 +858,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{payload.WorkflowRun.HeadBranch}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{payload.WorkflowRun.HeadBranch}) {
 				matchTimes++
 			}
 		default:

package/gitea/source/modules/actions/workflows_test.go

@@ -6,11 +6,11 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -101,49 +101,49 @@ func TestDetectMatched(t *testing.T) {
 		triggedEvent webhook_module.HookEventType
 		payload      api.Payloader
 		yamlOn       string
-		expected     bool
+		expected     detectResult
 	}{
 		{
 			desc:         "HookEventCreate(create) matches GithubEventCreate(create)",
 			triggedEvent: webhook_module.HookEventCreate,
 			payload:      nil,
 			yamlOn:       "on: create",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventIssues(issues) `opened` action matches GithubEventIssues(issues)",
 			triggedEvent: webhook_module.HookEventIssues,
 			payload:      &api.IssuePayload{Action: api.HookIssueOpened},
 			yamlOn:       "on: issues",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventIssues(issues) `milestoned` action matches GithubEventIssues(issues)",
 			triggedEvent: webhook_module.HookEventIssues,
 			payload:      &api.IssuePayload{Action: api.HookIssueMilestoned},
 			yamlOn:       "on: issues",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequestSync(pull_request_sync) matches GithubEventPullRequest(pull_request)",
 			triggedEvent: webhook_module.HookEventPullRequestSync,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueSynchronized},
 			yamlOn:       "on: pull_request",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `label_updated` action doesn't match GithubEventPullRequest(pull_request) with no activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueLabelUpdated},
 			yamlOn:       "on: pull_request",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `closed` action doesn't match GithubEventPullRequest(pull_request) with no activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueClosed},
 			yamlOn:       "on: pull_request",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `closed` action doesn't match GithubEventPullRequest(pull_request) with branches",
@@ -155,56 +155,56 @@ func TestDetectMatched(t *testing.T) {
 				},
 			},
 			yamlOn:   "on:\n  pull_request:\n    branches: [main]",
-			expected: false,
+			expected: detectNotApplicable,
 		},
 		{
 			desc:         "HookEventPullRequest(pull_request) `label_updated` action matches GithubEventPullRequest(pull_request) with `label` activity type",
 			triggedEvent: webhook_module.HookEventPullRequest,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueLabelUpdated},
 			yamlOn:       "on:\n  pull_request:\n    types: [labeled]",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequestReviewComment(pull_request_review_comment) matches GithubEventPullRequestReviewComment(pull_request_review_comment)",
 			triggedEvent: webhook_module.HookEventPullRequestReviewComment,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueReviewed},
 			yamlOn:       "on:\n  pull_request_review_comment:\n    types: [created]",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPullRequestReviewRejected(pull_request_review_rejected) doesn't match GithubEventPullRequestReview(pull_request_review) with `dismissed` activity type (we don't support `dismissed` at present)",
 			triggedEvent: webhook_module.HookEventPullRequestReviewRejected,
 			payload:      &api.PullRequestPayload{Action: api.HookIssueReviewed},
 			yamlOn:       "on:\n  pull_request_review:\n    types: [dismissed]",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventRelease(release) `published` action matches GithubEventRelease(release) with `published` activity type",
 			triggedEvent: webhook_module.HookEventRelease,
 			payload:      &api.ReleasePayload{Action: api.HookReleasePublished},
 			yamlOn:       "on:\n  release:\n    types: [published]",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventPackage(package) `created` action doesn't match GithubEventRegistryPackage(registry_package) with `updated` activity type",
 			triggedEvent: webhook_module.HookEventPackage,
 			payload:      &api.PackagePayload{Action: api.HookPackageCreated},
 			yamlOn:       "on:\n  registry_package:\n    types: [updated]",
-			expected:     false,
+			expected:     detectNotApplicable,
 		},
 		{
 			desc:         "HookEventWiki(wiki) matches GithubEventGollum(gollum)",
 			triggedEvent: webhook_module.HookEventWiki,
 			payload:      nil,
 			yamlOn:       "on: gollum",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "HookEventSchedule(schedule) matches GithubEventSchedule(schedule)",
 			triggedEvent: webhook_module.HookEventSchedule,
 			payload:      nil,
 			yamlOn:       "on: schedule",
-			expected:     true,
+			expected:     detectMatched,
 		},
 		{
 			desc:         "push to tag matches workflow with paths condition (should skip paths check)",
@@ -222,7 +222,19 @@ func TestDetectMatched(t *testing.T) {
 			},
 			commit:   nil,
 			yamlOn:   "on:\n  push:\n    paths:\n      - src/**",
-			expected: true,
+			expected: detectMatched,
+		},
+		{
+			desc:         "push branch filter excludes -> filtered out",
+			triggedEvent: webhook_module.HookEventPush,
+			payload: &api.PushPayload{
+				Ref:     "refs/heads/feature/x",
+				Before:  "0000000",
+				Commits: []*api.PayloadCommit{{ID: "abc", Added: []string{"a.go"}, Message: "x"}},
+			},
+			commit:   nil,
+			yamlOn:   "on:\n  push:\n    branches: [main]",
+			expected: detectFilteredOut,
 		},
 	}
 
@@ -231,7 +243,7 @@ func TestDetectMatched(t *testing.T) {
 			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)
-			assert.Equal(t, tc.expected, detectMatched(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
+			assert.Equal(t, tc.expected, detectWorkflowMatch(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
 		})
 	}
 }

package/gitea/source/modules/assetfs/embed.go

@@ -15,8 +15,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 type EmbeddedFile interface {

package/gitea/source/modules/assetfs/layered.go

@@ -14,10 +14,10 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/util"
 
 	"github.com/fsnotify/fsnotify"
 )

package/gitea/source/modules/auth/common.go

@@ -4,8 +4,8 @@
 package auth
 
 import (
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 )
 
 func UnmarshalGroupTeamMapping(raw string) (map[string]map[string][]string, error) {

package/gitea/source/modules/auth/httpauth/httpauth.go

@@ -7,7 +7,7 @@ import (
 	"encoding/base64"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type BasicAuth struct {

package/gitea/source/modules/auth/openid/openid.go

@@ -4,8 +4,14 @@
 package openid
 
 import (
+	"net/http"
+	"sync"
 	"time"
 
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/setting"
+
 	"github.com/yohcop/openid-go"
 )
 
@@ -19,11 +25,23 @@ import (
 var (
 	nonceStore     = openid.NewSimpleNonceStore()
 	discoveryCache = newTimedDiscoveryCache(24 * time.Hour)
+
+	// openIDInstance does discovery/verification via an SSRF-protected client, so a user-supplied
+	// OpenID identifier can't reach internal/loopback/reserved addresses. It honors the operator's
+	// [security] ALLOWED_HOST_LIST (empty defaults to "external"), matching the avatar/webhook/migration
+	// clients, and validates the proxy path too. Lazy: reads proxy/settings once.
+	openIDInstance = sync.OnceValue(func() *openid.OpenID {
+		allowList := hostmatcher.ParseHostMatchList("security.ALLOWED_HOST_LIST", setting.Security.AllowedHostList)
+		return openid.NewOpenID(&http.Client{
+			Timeout:   30 * time.Second,
+			Transport: hostmatcher.NewHTTPTransport("openid", allowList, nil, proxy.Proxy(), setting.Proxy.ProxyURLFixed, nil),
+		})
+	})
 )
 
 // Verify handles response from OpenID provider
 func Verify(fullURL string) (id string, err error) {
-	return openid.Verify(fullURL, discoveryCache, nonceStore)
+	return openIDInstance().Verify(fullURL, discoveryCache, nonceStore)
 }
 
 // Normalize normalizes an OpenID URI
@@ -33,5 +51,5 @@ func Normalize(url string) (id string, err error) {
 
 // RedirectURL redirects browser
 func RedirectURL(id, callbackURL, realm string) (string, error) {
-	return openid.RedirectURL(id, callbackURL, realm)
+	return openIDInstance().RedirectURL(id, callbackURL, realm)
 }

package/gitea/source/modules/auth/openid/openid_test.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package openid
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOpenIDDiscoveryBlocksInternalHost(t *testing.T) {
+	var reached atomic.Bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached.Store(true)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	// RedirectURL performs server-side discovery of the identifier URL; a loopback URL
+	// must be refused at dial time instead of reaching the internal server
+	_, err := RedirectURL(srv.URL, "http://example.com/callback", "http://example.com/")
+	require.Error(t, err)
+	assert.False(t, reached.Load(), "OpenID discovery must not reach an internal/loopback host")
+}

package/gitea/source/modules/auth/pam/pam_test.go

@@ -1,8 +1,8 @@
-//go:build pam
-
 // Copyright 2021 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build pam
+
 package pam
 
 import (

package/gitea/source/modules/auth/password/hash/argon2.go

@@ -7,7 +7,7 @@ import (
 	"encoding/hex"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/crypto/argon2"
 )

package/gitea/source/modules/auth/password/hash/common.go

@@ -6,8 +6,8 @@ package hash
 import (
 	"strconv"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 func parseIntParam(value, param, algorithmName, config string, previousErr error) (int, error) {

package/gitea/source/modules/auth/password/hash/hash.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // This package takes care of hashing passwords, verifying passwords, defining

package/gitea/source/modules/auth/password/hash/hash_test.go

@@ -74,6 +74,7 @@ func TestHashing(t *testing.T) {
 	runTests := func(password, salt string, shouldPass bool) {
 		for _, algorithmName := range hashAlgorithmsToTest {
 			t.Run(algorithmName, func(t *testing.T) {
+				t.Parallel() // CPU-bound; these subtests only read the shared hasher registry
 				output, err := Parse(algorithmName).Hash(password, salt)
 				if shouldPass {
 					assert.NoError(t, err)
@@ -182,6 +183,7 @@ func TestVectors(t *testing.T) {
 	for i, vector := range vectors {
 		for _, algorithm := range vector.algorithms {
 			t.Run(strconv.Itoa(i)+": "+algorithm, func(t *testing.T) {
+				t.Parallel() // CPU-bound; these subtests only read the shared hasher registry
 				pa := Parse(algorithm)
 				assert.Equal(t, !vector.shouldfail, pa.VerifyPassword(vector.password, vector.output, vector.salt))
 			})

package/gitea/source/modules/auth/password/hash/pbkdf2.go

@@ -8,7 +8,7 @@ import (
 	"encoding/hex"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/crypto/pbkdf2"
 )

package/gitea/source/modules/auth/password/hash/scrypt.go

@@ -7,7 +7,7 @@ import (
 	"encoding/hex"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/crypto/scrypt"
 )

package/gitea/source/modules/auth/password/password.go

@@ -13,8 +13,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 )
 
 var (

package/gitea/source/modules/auth/password/pwn.go

@@ -8,8 +8,8 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/auth/password/pwn"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/auth/password/pwn"
+	"gitea.dev/modules/setting"
 )
 
 var ErrIsPwned = errors.New("password has been pwned")

package/gitea/source/modules/auth/password/pwn/pwn.go

@@ -14,7 +14,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 const passwordURL = "https://api.pwnedpasswords.com/range/"

package/gitea/source/modules/auth/webauthn/webauthn.go

@@ -8,10 +8,10 @@ import (
 	"encoding/binary"
 	"encoding/gob"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
@@ -28,13 +28,10 @@ func Init() {
 
 	WebAuthn = &webauthn.WebAuthn{
 		Config: &webauthn.Config{
-			RPDisplayName: setting.AppName,
-			RPID:          setting.Domain,
-			RPOrigins:     []string{appURL},
-			AuthenticatorSelection: protocol.AuthenticatorSelection{
-				UserVerification: protocol.VerificationDiscouraged,
-			},
-			AttestationPreference: protocol.PreferDirectAttestation,
+			RPDisplayName:         setting.AppName,
+			RPID:                  setting.Domain,
+			RPOrigins:             []string{appURL},
+			AttestationPreference: protocol.PreferNoAttestation, // Gitea never verifies attestation
 		},
 	}
 }

package/gitea/source/modules/auth/webauthn/webauthn_test.go

@@ -6,7 +6,7 @@ package webauthn
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/avatar/avatar.go

@@ -11,15 +11,14 @@ import (
 	"image/color"
 	"image/png"
 
-	_ "image/gif"  // for processing gif images
-	_ "image/jpeg" // for processing jpeg images
-
-	"code.gitea.io/gitea/modules/avatar/identicon"
-	"code.gitea.io/gitea/modules/setting"
-
-	"golang.org/x/image/draw"
+	"gitea.dev/modules/avatar/identicon"
+	"gitea.dev/modules/setting"
 
 	_ "golang.org/x/image/webp" // for processing webp images
+	_ "image/gif"               // for processing gif images
+	_ "image/jpeg"              // for processing jpeg images
+
+	"golang.org/x/image/draw"
 )
 
 // DefaultAvatarSize is the target CSS pixel size for avatar generation. It is

package/gitea/source/modules/avatar/avatar_test.go

@@ -10,7 +10,7 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/avatar/hash_test.go

@@ -9,7 +9,7 @@ import (
 	"image/png"
 	"testing"
 
-	"code.gitea.io/gitea/modules/avatar"
+	"gitea.dev/modules/avatar"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/badge/badge.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 	"unicode"
 
-	actions_model "code.gitea.io/gitea/models/actions"
+	actions_model "gitea.dev/models/actions"
 )
 
 // The Badge layout: |offset|label|message|

package/gitea/source/modules/base/tool.go

@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/dustin/go-humanize"
 )

package/gitea/source/modules/base/tool_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/cache/cache.go

@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	_ "gitea.com/go-chi/cache/memcache" //nolint:depguard // memcache plugin for cache, it is required for config "ADAPTER=memcache"
 )

package/gitea/source/modules/cache/cache_redis.go

@@ -8,8 +8,8 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/nosql"
 
 	"gitea.com/go-chi/cache" //nolint:depguard // we wrap this package here
 	"github.com/redis/go-redis/v9"

package/gitea/source/modules/cache/cache_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/cache/cache_twoqueue.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	mc "gitea.com/go-chi/cache" //nolint:depguard // we wrap this package here
 	lru "github.com/hashicorp/golang-lru/v2"

package/gitea/source/modules/cache/context_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/cache/ephemeral.go

@@ -8,8 +8,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 // EphemeralCache is a cache that can be used to store data in a request level context

package/gitea/source/modules/cache/string_cache.go

@@ -7,9 +7,9 @@ import (
 	"errors"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	chi_cache "gitea.com/go-chi/cache" //nolint:depguard // we wrap this package here
 )

package/gitea/source/modules/charset/ambiguous.go

@@ -8,7 +8,7 @@ import (
 	"strings"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 )
 
 // AmbiguousTablesForLocale provides the table of ambiguous characters for this locale.

package/gitea/source/modules/charset/ambiguous_gen_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/charset/charset.go

@@ -12,8 +12,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/gogs/chardet"
 	"golang.org/x/net/html/charset"
@@ -89,7 +89,10 @@ func ToUTF8(content []byte, opts ConvertOpts) []byte {
 	encoding, _ := charset.Lookup(charsetLabel)
 	if encoding == nil {
 		setting.PanicInDevOrTesting("unsupported detected charset %q, it shouldn't happen", charsetLabel)
-		return content
+		if opts.ErrorReturnOrigin {
+			return content
+		}
+		return bytes.ToValidUTF8(content, opts.ErrorReplacement)
 	}
 
 	var decoded []byte

package/gitea/source/modules/charset/charset_test.go

@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/charset/escape.go

@@ -8,8 +8,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 )
 
 type EscapeOptions struct {

package/gitea/source/modules/charset/escape_stream.go

@@ -11,8 +11,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 )
 
 type htmlChunkReader struct {

package/gitea/source/modules/charset/escape_test.go

@@ -7,9 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

package/gitea/source/modules/charset/generate/generate.go

@@ -13,7 +13,7 @@ import (
 	"text/template"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"golang.org/x/text/unicode/rangetable"
 )

package/gitea/source/modules/consts/asymkey.go

@@ -0,0 +1,12 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package consts
+
+const (
+	AsymKeyMinBitsRsa = 3071 // 3072-1 to tolerate the leading zero
+	AsymKeyMinBitsEC  = 256
+
+	AsymKeyDefaultBitsRsa   = 4096 // ssh-keygen command defaults to 3072
+	AsymKeyDefaultBitsEcdsa = 256
+)

package/gitea/source/modules/csv/csv.go

@@ -11,9 +11,9 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 )
 
 const (

package/gitea/source/modules/csv/csv_test.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/dump/dumper.go

@@ -16,9 +16,9 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/mholt/archives"
 )

package/gitea/source/modules/dump/dumper_test.go

@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

package/gitea/source/modules/emoji/emoji.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Gemoji is a set of emoji data.

package/gitea/source/modules/emoji/emoji_test.go

@@ -7,9 +7,9 @@ package emoji
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/eventsource/event.go

@@ -7,10 +7,9 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 func wrapNewlines(w io.Writer, prefix, value []byte) (sum int64, err error) {
@@ -110,9 +109,3 @@ func (e *Event) WriteTo(w io.Writer) (int64, error) {
 
 	return sum, err
 }
-
-func (e *Event) String() string {
-	buf := new(strings.Builder)
-	_, _ = e.WriteTo(buf)
-	return buf.String()
-}

package/gitea/source/modules/eventsource/manager_run.go

@@ -7,16 +7,16 @@ import (
 	"context"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/services/convert"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/services/convert"
 )
 
 // Init starts this eventsource

package/gitea/source/modules/fileicon/basic.go

@@ -6,8 +6,8 @@ package fileicon
 import (
 	"html/template"
 
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/util"
 )
 
 func BasicEntryIconName(entry *EntryInfo) string {

package/gitea/source/modules/fileicon/entry.go

@@ -3,7 +3,7 @@
 
 package fileicon
 
-import "code.gitea.io/gitea/modules/git"
+import "gitea.dev/modules/git"
 
 type EntryInfo struct {
 	BaseName      string

package/gitea/source/modules/fileicon/material.go

@@ -8,12 +8,12 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/util"
 )
 
 type materialIconRulesData struct {

package/gitea/source/modules/fileicon/material_test.go

@@ -6,9 +6,9 @@ package fileicon_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/fileicon/render.go

@@ -7,7 +7,7 @@ import (
 	"html/template"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 type RenderedIconPool struct {

package/gitea/source/modules/fileicon/render_test.go

@@ -6,10 +6,10 @@ package fileicon_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )

package/gitea/source/modules/generate/generate.go

@@ -5,15 +5,23 @@
 package generate
 
 import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
 	"crypto/rand"
+	"crypto/rsa"
 	"encoding/base64"
+	"encoding/pem"
 	"fmt"
 	"io"
 	"time"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/consts"
+	"gitea.dev/modules/util"
 
 	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/ssh"
 )
 
 // NewInternalToken generate a new value intended to be used by INTERNAL_TOKEN.
@@ -65,10 +73,77 @@ func NewJwtSecretWithBase64() ([]byte, string) {
 
 // NewSecretKey generate a new value intended to be used by SECRET_KEY.
 func NewSecretKey() (string, error) {
-	secretKey, err := util.CryptoRandomString(64)
+	return util.CryptoRandomString(64), nil
+}
+
+type SSHKeyType string
+
+const (
+	SSHKeyRSA     SSHKeyType = "rsa"
+	SSHKeyECDSA   SSHKeyType = "ecdsa"
+	SSHKeyED25519 SSHKeyType = "ed25519"
+)
+
+func NewSSHKey(keyType SSHKeyType, bits int) (ssh.PublicKey, *pem.Block, error) {
+	pub, priv, err := commonKeyGen(keyType, bits)
 	if err != nil {
-		return "", err
+		return nil, nil, err
+	}
+	pemPriv, err := ssh.MarshalPrivateKey(priv, "")
+	if err != nil {
+		return nil, nil, err
+	}
+	sshPub, err := ssh.NewPublicKey(pub)
+	if err != nil {
+		return nil, nil, err
 	}
 
-	return secretKey, nil
+	return sshPub, pemPriv, nil
+}
+
+// commonKeyGen is an abstraction over rsa, ecdsa, and ed25519 generating functions
+func commonKeyGen(keyType SSHKeyType, bits int) (crypto.PublicKey, crypto.PrivateKey, error) {
+	switch keyType {
+	case SSHKeyRSA:
+		bits = util.IfZero(bits, consts.AsymKeyDefaultBitsRsa)
+		if bits < consts.AsymKeyMinBitsRsa {
+			return nil, nil, util.NewInvalidArgumentErrorf("invalid rsa bits: %d", bits)
+		}
+		privateKey, err := rsa.GenerateKey(rand.Reader, bits)
+		if err != nil {
+			return nil, nil, err
+		}
+		return &privateKey.PublicKey, privateKey, nil
+	case SSHKeyED25519:
+		return ed25519.GenerateKey(rand.Reader)
+	case SSHKeyECDSA:
+		bits = util.IfZero(bits, consts.AsymKeyDefaultBitsEcdsa)
+		if bits < consts.AsymKeyMinBitsEC {
+			return nil, nil, util.NewInvalidArgumentErrorf("invalid elliptic-curve bits: %d", bits)
+		}
+		curve, err := getEllipticCurve(bits)
+		if err != nil {
+			return nil, nil, err
+		}
+		privateKey, err := ecdsa.GenerateKey(curve, rand.Reader)
+		if err != nil {
+			return nil, nil, err
+		}
+		return &privateKey.PublicKey, privateKey, nil
+	default:
+		return nil, nil, util.NewInvalidArgumentErrorf("unknown key type: %s", keyType)
+	}
+}
+
+func getEllipticCurve(bits int) (elliptic.Curve, error) {
+	switch bits {
+	case 256:
+		return elliptic.P256(), nil
+	case 384:
+		return elliptic.P384(), nil
+	case 521:
+		return elliptic.P521(), nil
+	default:
+		return nil, util.NewInvalidArgumentErrorf("unsupported elliptic-curve bits: %d", bits)
+	}
 }

package/gitea/source/modules/git/attribute/attribute.go

@@ -6,7 +6,7 @@ package attribute
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 )
 
 type Attribute string

package/gitea/source/modules/git/attribute/batch.go

@@ -11,9 +11,9 @@ import (
 	"path/filepath"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // BatchChecker provides a reader for check-attribute content that can be long running

package/gitea/source/modules/git/attribute/batch_test.go

@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

package/gitea/source/modules/git/attribute/checker.go

@@ -10,8 +10,8 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 func checkAttrCommand(gitRepo *git.Repository, treeish string, filenames, attributes []string) (*gitcmd.Command, []string, func(), error) {

package/gitea/source/modules/git/attribute/checker_test.go

@@ -7,9 +7,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

package/gitea/source/modules/git/attribute/main_test.go

@@ -8,9 +8,9 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 func testRun(m *testing.M) error {

package/gitea/source/modules/git/blob.go

@@ -11,8 +11,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 )
 
 // This file contains common functions between the gogit and !gogit variants for git Blobs

package/gitea/source/modules/git/blob_gogit.go

@@ -9,7 +9,7 @@ package git
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/go-git/go-git/v5/plumbing"
 )

package/gitea/source/modules/git/blob_nogogit.go

@@ -8,7 +8,7 @@ package git
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Blob represents a Git object.

package/gitea/source/modules/git/catfile_batch_command.go

@@ -9,9 +9,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // catFileBatchCommand implements the CatFileBatch interface using the "cat-file --batch-command" command

package/gitea/source/modules/git/catfile_batch_legacy.go

@@ -10,9 +10,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // catFileBatchLegacy implements the CatFileBatch interface using the "cat-file --batch" command and "cat-file --batch-check" command

package/gitea/source/modules/git/catfile_batch_reader.go

@@ -10,13 +10,14 @@ import (
 	"errors"
 	"io"
 	"math"
+	"slices"
 	"strconv"
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 type catFileBatchCommunicator struct {
@@ -172,77 +173,46 @@ headerLoop:
 	return id, DiscardFull(rd, size-n+1)
 }
 
-// git tree files are a list:
-// <mode-in-ascii> SP <fname> NUL <binary Hash>
-//
-// Unfortunately this 20-byte notation is somewhat in conflict to all other git tools
-// Therefore we need some method to convert these binary hashes to hex hashes
-
 // ParseCatFileTreeLine reads an entry from a tree in a cat-file --batch stream
-// This carefully avoids allocations - except where fnameBuf is too small.
-// It is recommended therefore to pass in an fnameBuf large enough to avoid almost all allocations
-//
-// Each line is composed of:
-// <mode-in-ascii-dropping-initial-zeros> SP <fname> NUL <binary HASH>
-//
-// We don't attempt to convert the raw HASH to save a lot of time
-func ParseCatFileTreeLine(objectFormat ObjectFormat, rd BufferedReader, modeBuf, fnameBuf, shaBuf []byte) (mode, fname, sha []byte, n int, err error) {
-	var readBytes []byte
-
-	// Read the Mode & fname
-	readBytes, err = rd.ReadSlice('\x00')
-	if err != nil {
-		return mode, fname, sha, n, err
-	}
-	idx := bytes.IndexByte(readBytes, ' ')
-	if idx < 0 {
-		log.Debug("missing space in readBytes ParseCatFileTreeLine: %s", readBytes)
-		return mode, fname, sha, n, &ErrNotExist{}
-	}
-
-	n += idx + 1
-	copy(modeBuf, readBytes[:idx])
-	if len(modeBuf) >= idx {
-		modeBuf = modeBuf[:idx]
-	} else {
-		modeBuf = append(modeBuf, readBytes[len(modeBuf):idx]...)
-	}
-	mode = modeBuf
-
-	readBytes = readBytes[idx+1:]
-
-	// Deal with the fname
-	copy(fnameBuf, readBytes)
-	if len(fnameBuf) > len(readBytes) {
-		fnameBuf = fnameBuf[:len(readBytes)]
-	} else {
-		fnameBuf = append(fnameBuf, readBytes[len(fnameBuf):]...)
-	}
-	for err == bufio.ErrBufferFull {
-		readBytes, err = rd.ReadSlice('\x00')
-		fnameBuf = append(fnameBuf, readBytes...)
-	}
-	n += len(fnameBuf)
-	if err != nil {
-		return mode, fname, sha, n, err
-	}
-	fnameBuf = fnameBuf[:len(fnameBuf)-1]
-	fname = fnameBuf
-
-	// Deal with the binary hash
-	idx = 0
-	length := objectFormat.FullLength() / 2
-	for idx < length {
-		var read int
-		read, err = rd.Read(shaBuf[idx:length])
-		n += read
-		if err != nil {
-			return mode, fname, sha, n, err
+// Each entry is composed of:
+// <mode-in-ascii-dropping-initial-zeros> SP <name> NUL <binary-hash>
+func ParseCatFileTreeLine(objectFormat ObjectFormat, rd BufferedReader) (mode EntryMode, name string, objID ObjectID, n int, err error) {
+	// use the in-buffer memory as much as possible to avoid extra allocations
+	bufBytes, err := rd.ReadSlice('\x00')
+	const maxEntryInfoBytes = 1024 * 1024
+	if errors.Is(err, bufio.ErrBufferFull) {
+		bufBytes = slices.Clone(bufBytes)
+		for len(bufBytes) < maxEntryInfoBytes && errors.Is(err, bufio.ErrBufferFull) {
+			var tmp []byte
+			tmp, err = rd.ReadSlice('\x00')
+			bufBytes = append(bufBytes, tmp...)
 		}
-		idx += read
 	}
-	sha = shaBuf
-	return mode, fname, sha, n, err
+	if err != nil {
+		return mode, name, objID, len(bufBytes), err
+	}
+
+	idx := bytes.IndexByte(bufBytes, ' ')
+	if idx < 0 {
+		return mode, name, objID, len(bufBytes), errors.New("invalid CatFileTreeLine output")
+	}
+
+	mode = ParseEntryMode(util.UnsafeBytesToString(bufBytes[:idx]))
+	name = string(bufBytes[idx+1 : len(bufBytes)-1]) // trim the NUL terminator, it needs a copy because the bufBytes will be reused by the reader
+	if mode == EntryModeNoEntry {
+		return mode, name, objID, len(bufBytes), errors.New("invalid entry mode: " + string(bufBytes[:idx]))
+	}
+
+	switch objectFormat {
+	case Sha1ObjectFormat:
+		objID = &Sha1Hash{}
+	case Sha256ObjectFormat:
+		objID = &Sha256Hash{}
+	default:
+		panic("unsupported object format: " + objectFormat.Name())
+	}
+	readIDLen, err := io.ReadFull(rd, objID.RawValue())
+	return mode, name, objID, len(bufBytes) + readIDLen, err
 }
 
 func DiscardFull(rd BufferedReader, discard int64) error {

package/gitea/source/modules/git/catfile_batch_test.go

@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

package/gitea/source/modules/git/commit.go

@@ -11,19 +11,20 @@ import (
 	"os/exec"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 // Commit represents a git commit.
 type Commit struct {
 	Tree // FIXME: bad design, this field can be nil if the commit is from "last commit cache"
 
-	ID            ObjectID
-	Author        *Signature // never nil
-	Committer     *Signature // never nil
-	CommitMessage string
-	Signature     *CommitSignature
+	CommitMessage
+
+	ID        ObjectID
+	Author    *Signature // never nil
+	Committer *Signature // never nil
+	Signature *CommitSignature
 
 	Parents        []ObjectID // ID strings
 	submoduleCache *ObjectCache[*SubModule]
@@ -35,17 +36,6 @@ type CommitSignature struct {
 	Payload   string
 }
 
-// Message returns the commit message. Same as retrieving CommitMessage directly.
-func (c *Commit) Message() string {
-	return strings.ToValidUTF8(c.CommitMessage, "?")
-}
-
-// Summary returns first line of commit message.
-// The string is forced to be valid UTF8
-func (c *Commit) Summary() string {
-	return strings.ToValidUTF8(strings.Split(strings.TrimSpace(c.CommitMessage), "\n")[0], "?")
-}
-
 // ParentID returns oid of n-th parent (0-based index).
 // It returns nil if no such parent exists.
 func (c *Commit) ParentID(n int) (ObjectID, error) {
@@ -140,13 +130,9 @@ func (c *Commit) CommitsBeforeLimit(num int) ([]*Commit, error) {
 	return c.repo.getCommitsBeforeLimit(c.ID, num)
 }
 
-// CommitsBeforeUntil returns the commits between commitID to current revision
-func (c *Commit) CommitsBeforeUntil(commitID string) ([]*Commit, error) {
-	endCommit, err := c.repo.GetCommit(commitID)
-	if err != nil {
-		return nil, err
-	}
-	return c.repo.CommitsBetween(c, endCommit)
+// CommitsBeforeUntil returns the commits in range "[cur, ref)"
+func (c *Commit) CommitsBeforeUntil(ref RefName) ([]*Commit, error) {
+	return c.repo.CommitsBetween(c.ID.RefName(), ref, -1)
 }
 
 // SearchCommitsOptions specify the parameters for SearchCommits
@@ -267,11 +253,15 @@ func IsStringLikelyCommitID(objFmt ObjectFormat, s string, minLength ...int) boo
 	if len(s) < minLen || len(s) > maxLen {
 		return false
 	}
+	return isStringLowerHex(s)
+}
+
+func isStringLowerHex(s string) bool {
 	for _, c := range s {
 		isHex := (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')
 		if !isHex {
 			return false
 		}
 	}
-	return true
+	return len(s) > 0 // it accepts odd length because "shorten commit id" can be 7-chars
 }

package/gitea/source/modules/git/commit_convert_gogit.go

@@ -66,7 +66,7 @@ func convertPGPSignature(c *object.Commit) *CommitSignature {
 func convertCommit(c *object.Commit) *Commit {
 	return &Commit{
 		ID:            ParseGogitHash(c.Hash),
-		CommitMessage: c.Message,
+		CommitMessage: CommitMessage{MessageRaw: c.Message},
 		Committer:     &c.Committer,
 		Author:        &c.Author,
 		Signature:     convertPGPSignature(c),

package/gitea/source/modules/git/commit_info_gogit.go

@@ -7,6 +7,7 @@ package git
 
 import (
 	"context"
+	"maps"
 	"path"
 
 	"github.com/emirpasic/gods/trees/binaryheap"
@@ -47,9 +48,7 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 				return nil, nil, err
 			}
 
-			for k, v := range revs2 {
-				revs[k] = v
-			}
+			maps.Copy(revs, revs2)
 		}
 	} else {
 		revs, err = GetLastCommitForPaths(ctx, nil, c, treePath, entryPaths)
@@ -201,7 +200,7 @@ heaploop:
 		// Load the parent commits for the one we are currently examining
 		numParents := current.commit.NumParents()
 		var parents []cgobject.CommitNode
-		for i := 0; i < numParents; i++ {
+		for i := range numParents {
 			parent, err := current.commit.ParentNode(i)
 			if err != nil {
 				break
@@ -273,9 +272,8 @@ heaploop:
 
 				if len(newRemainingPaths) == 0 {
 					break
-				} else {
-					remainingPaths = newRemainingPaths
 				}
+				remainingPaths = newRemainingPaths
 			}
 		}
 	}

package/gitea/source/modules/git/commit_info_nogogit.go

@@ -11,7 +11,7 @@ import (
 	"path"
 	"sort"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // GetCommitsInfo gets information of all commits that are corresponding to these entries
@@ -106,7 +106,7 @@ func getLastCommitForPathsByCache(commitID, treePath string, paths []string, cac
 // GetLastCommitForPaths returns last commit information
 func GetLastCommitForPaths(ctx context.Context, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
 	// We read backwards from the commit to obtain all of the commits
-	revs, err := WalkGitLog(ctx, commit.repo, commit, treePath, paths...)
+	revs, err := walkGitLog(ctx, commit.repo, commit, treePath, paths...)
 	if err != nil {
 		return nil, err
 	}