Support actions and reusable workflows from private repos

[Zettat123]

Resolve https://gitea.com/gitea/act_runner/issues/102

This PR allows administrators of a private repository to specify some collaborative owners. The repositories of collaborative owners will be allowed to access this repository's actions and workflows.

Settings for private repos:

---

This PR also moves "Enable Actions" setting to Actions > General page

[Zettat123]

To support this feature, act_runner also needs some improvements, which I am working on.

For changes in act_runner, see https://gitea.com/gitea/act/pulls/123

[Zettat123]

Docs: https://gitea.com/gitea/docs/pulls/107

[lunny]

Is this related to #24635 ?

[SamuNatsu]

Any progress for it?

[IBims1ckoky]

Any progress there?

[codeguy]

Any movement here? This would really really help us in our Gitea Cloud account.

[lunny]

Any movement here? This would really really help us in our Gitea Cloud account.

I will take the task.

[ChristopherHX]

I think we should rewrite

gitea/routers/api/v1/api.go

Lines 198 to 201 in 38dd432

	if task.RepoID != repo.ID {
	ctx.APIErrorNotFound()
	return
	}

first to allow cloning public repositories, backport that then continue here.

My expectation was, I can use gitea.token to clone any public repository from my gitea instance. However I was wrong and we didn't seem to had any test on act_runner side to prevent the act change from merge.

[ChristopherHX]

Found duplicated permission checks in

gitea/routers/api/v1/api.go

Lines 191 to 214 in ebd88af

	if ctx.Doer != nil && ctx.Doer.ID == user_model.ActionsUserID {
	taskID := ctx.Data["ActionsTaskID"].(int64)
	task, err := actions_model.GetTaskByID(ctx, taskID)
	if err != nil {
	ctx.APIErrorInternal(err)
	return
	}
	if task.RepoID != repo.ID {
	ctx.APIErrorNotFound()
	return
	}
	if task.IsForkPullRequest {
	ctx.Repo.Permission.AccessMode = perm.AccessModeRead
	} else {
	ctx.Repo.Permission.AccessMode = perm.AccessModeWrite
	}
	if err := ctx.Repo.Repository.LoadUnits(ctx); err != nil {
	ctx.APIErrorInternal(err)
	return
	}
	ctx.Repo.Permission.SetUnitsWithDefaultAccessMode(ctx.Repo.Repository.Units, ctx.Repo.Permission.AccessMode)
	} else {

Maybe those should use a common function, githttp access and no api access is odd.

[ChristopherHX]

Then lfs again, 3 times same code

gitea/services/lfs/server.go

Lines 523 to 537 in ebd88af

	taskID := ctx.Data["ActionsTaskID"].(int64)
	task, err := actions_model.GetTaskByID(ctx, taskID)
	if err != nil {
	log.Error("Unable to GetTaskByID for task[%d] Error: %v", taskID, err)
	return false
	}
	if task.RepoID != repository.ID {
	return false
	}
	if task.IsForkPullRequest {
	return accessMode <= perm_model.AccessModeRead
	}
	return accessMode <= perm_model.AccessModeWrite
	}

See here for my proposal: #35688, then only a single method decides wether and what level you can access an repository via an actions token

[Zettat123]

See here for my proposal: #35688, then only a single method decides wether and what level you can access an repository via an actions token

I convert this PR to Draft and will improve the permission check after #35688 is merged.

[ChristopherHX]

Please double check this change, migrated your permission check.

This feels like we need action token tests for this as well, not only api manage tests

[Zettat123]

Thanks for the change, I think it looks good.

I updated the test, please review:

• tests/integration/actions_settings_test.go