Update gitea to 1.19.3

Gitea 1.19 is here. Release notes can be found at:

  https://github.com/go-gitea/gitea/blob/v1.19.3/CHANGELOG.md

I've highlighted the breaking changes entries in this commit message
with notes on whether or not this affects us.

* 1.19.0
  * Add loading yaml label template files (#22976) (#23232)
    * I think this is for auto applying labels to PRs? Shouldn't affect
      us.
  * Make issue and code search support camel case for Bleve (#22829)
    * We don't rely on code search in gitea yet, but this seems like a
      good addition.
  * Repositories: by default disable all units except code and pulls on forks (#22541)
    * We don't allow forks so this shouldn't affect us.
  * Support template for merge message description (#22248)
    * We don't do merging via gitea so this shouldn't affect us.
  * Remove ONLY_SHOW_RELEVANT_REPOS setting (#21962)
    * We don't set this flag in our app.ini config file.
  * Implement actions (#21937)
    * They are disabled by default, but I've explicitly disabled them as
      we use Zuul.
  * Remove deprecated DSA host key from Docker Container (#21522)
    * Our installatins were all created prior to this update which
      generated DSA keys. We can go and manually clean them up with
      gitea disabled if we like.
  * Improve valid user name check (#20136)
    * As long as our CI job is able to create the necessary accounts we
      should be fine.

* 1.19.1
  * Rename actions unit to repo.actions and add docs for it (#23733) (#23881)
    * app.ini.j2 updated to use repo.actions to disable the repo unit.

* 1.19.2
  * No breaking changes listed.

* 1.19.3
  * No breaking changes listed.

In addition to the breaking changes upstream has updated to golang 1.20
and nodejs 18. We update our image to match.

In 1.19.0 and 1.19.1 org listing required authentication which was a new
change/regression in [0] gitea. I have updated the logo update role to
drop authentication details to make it clear this API should be publicly
accessible. In earlier patchsets I was forcing basic auth due to another
bug [1] which is not correct as we expect this API to be public.
Updating the role this way makes that more clear.

Finally the usual template updates are applied to keep our forked
templates in line with upstream. There were no template changes between
1.19.0, 1.19.1, 1.19.2, and 1.19.3 according to git diff.

[0] https://github.com/go-gitea/gitea/issues/24159
[1] https://github.com/go-gitea/gitea/issues/24160

Change-Id: I5570deaf505a27c8c90c58896de990a4d2d44530

docker/gitea/Dockerfile

@@ -25,17 +25,17 @@
 
 ###################################
 #Build stage
-FROM docker.io/library/golang:1.19-bullseye AS build-env
+FROM docker.io/library/golang:1.20-bullseye AS build-env
 
 LABEL maintainer="infra-root@openstack.org"
 
-ARG GITEA_VERSION="v1.18.5"
+ARG GITEA_VERSION="v1.19.3"
 ENV TAGS "bindata $TAGS"
 
 #Build deps
 RUN apt-get update && apt-get -y install build-essential git apt-transport-https curl gnupg2 \
   && curl -sS https://deb.nodesource.com/gpgkey/nodesource.gpg.key | apt-key add - \
-  && echo "deb https://deb.nodesource.com/node_16.x bullseye main" | tee /etc/apt/sources.list.d/nodesource.list \
+  && echo "deb https://deb.nodesource.com/node_18.x bullseye main" | tee /etc/apt/sources.list.d/nodesource.list \
   && apt-get update \
   && apt-get -q --option "Dpkg::Options::=--force-confold" --assume-yes install nodejs \
   && mkdir -p ${GOPATH}/src/code.gitea.io/gitea

docker/gitea/custom/templates/base/head_navbar.tmpl

@@ -1,24 +1,26 @@
-<div class="ui container" id="navbar">
+<nav class="ui container" id="navbar" aria-label="{{.locale.Tr "aria.navbar"}}">
 	{{$notificationUnreadCount := 0}}
 	{{if .IsSigned}}
 		{{if .NotificationUnreadCount}}{{$notificationUnreadCount = call .NotificationUnreadCount}}{{end}}
 	{{end}}
-	<div class="item brand" style="justify-content: space-between;">
+	<div class="item brand gt-sb">
 		<a href="{{AppSubUrl}}/" aria-label="{{if .IsSigned}}{{.locale.Tr "dashboard"}}{{else}}{{.locale.Tr "home"}}{{end}}">
 			<img width="30" height="30" src="{{AssetUrlPrefix}}/img/logo.svg" alt="{{.locale.Tr "logo"}}" aria-hidden="true">
 		</a>
+		<div class="gt-df gt-ac">
 			{{if .IsSigned}}
-		<a href="{{AppSubUrl}}/notifications" class="tooltip mobile-only" data-content='{{.locale.Tr "notifications"}}'>
+			<a href="{{AppSubUrl}}/notifications" class="tooltip mobile-only gt-mr-4 gt-mt-3" data-content="{{.locale.Tr "notifications"}}" aria-label="{{.locale.Tr "notifications"}}">
-			<span class="text black">
+				<span class="fitted item">
-				<span class="fitted">{{svg "octicon-bell"}}</span>
+					{{svg "octicon-bell"}}
-				<span class="ui red label mini{{if not $notificationUnreadCount}} hidden{{end}} notification_count">
+					<span class="notification_count{{if not $notificationUnreadCount}} gt-hidden{{end}}">
 						{{$notificationUnreadCount}}
 					</span>
 				</span>
 			</a>
 			{{end}}
-		<div class="ui basic icon button mobile-only" id="navbar-expand-toggle">
+			<button class="ui icon button mobile-only" id="navbar-expand-toggle">
-			<i class="sidebar icon"></i>
+				{{svg "octicon-three-bars"}}
+			</button>
 		</div>
 	</div>
 
@@ -47,7 +49,7 @@
 		<div class="item">
 		<div class="ui icon input">
 		<input class="searchbox" type="text" placeholder="{{.locale.Tr "search_project"}}">
-		<i class="icon df ac jc">{{svg "octicon-search" 16}}</i>
+		<i class="icon gt-df gt-ac gt-jc">{{svg "octicon-search" 16}}</i>
 		</div>
 		</div>
 	*/}}
@@ -57,7 +59,7 @@
 		<div class="right stackable menu">
 			<div class="ui dropdown jump item tooltip" tabindex="-1" data-content="{{.locale.Tr "user_profile_and_more"}}">
 				<span class="text">
-					{{avatar .SignedUser 24 "tiny"}}
+					{{avatar $.Context .SignedUser 24 "tiny"}}
 					<span class="sr-only">{{.locale.Tr "user_profile_and_more"}}</span>
 					<span class="mobile-only">{{.SignedUser.Name}}</span>
 					<span class="fitted not-mobile" tabindex="-1">{{svg "octicon-triangle-down"}}</span>
@@ -78,21 +80,19 @@
 	{{else if .IsSigned}}
 		<div class="right stackable menu">
 			{{if EnableTimetracking}}
-			<a class="active-stopwatch-trigger item ui label {{if not .ActiveStopwatch}}hidden{{end}}" href="{{.ActiveStopwatch.IssueLink}}">
+			<a class="active-stopwatch-trigger item ui gt-mx-0{{if not .ActiveStopwatch}} gt-hidden{{end}}" href="{{.ActiveStopwatch.IssueLink}}">
-				<span class="text">
+				<span class="fitted gt-relative">
-					<span class="fitted item">
 					{{svg "octicon-stopwatch"}}
-						<span class="red" style="position:absolute; right:-0.6em; top:-0.6em;">{{svg "octicon-dot-fill"}}</span>
+					<span class="header-stopwatch-dot"></span>
-					</span>
 					<span class="sr-mobile-only">{{.locale.Tr "active_stopwatch"}}</span>
 				</span>
 			</a>
 			<div class="active-stopwatch-popup tippy-target">
-				<div class="df ac">
+				<div class="gt-df gt-ac">
-					<a class="stopwatch-link df ac" href="{{.ActiveStopwatch.IssueLink}}">
+					<a class="stopwatch-link gt-df gt-ac" href="{{.ActiveStopwatch.IssueLink}}">
-						{{svg "octicon-issue-opened" 16 "mr-3"}}
+						{{svg "octicon-issue-opened" 16 "gt-mr-3"}}
 						<span class="stopwatch-issue">{{.ActiveStopwatch.RepoSlug}}#{{.ActiveStopwatch.IssueIndex}}</span>
-						<span class="ui primary label stopwatch-time my-0 mx-4" data-seconds="{{.ActiveStopwatch.Seconds}}">
+						<span class="ui primary label stopwatch-time gt-my-0 gt-mx-4" data-seconds="{{.ActiveStopwatch.Seconds}}">
 							{{if .ActiveStopwatch}}{{Sec2Time .ActiveStopwatch.Seconds}}{{end}}
 						</span>
 					</a>
@@ -118,16 +118,16 @@
 			</div>
 			{{end}}
 
-			<a href="{{AppSubUrl}}/notifications" class="item tooltip not-mobile" data-content="{{.locale.Tr "notifications"}}" aria-label="{{.locale.Tr "notifications"}}">
+			<a href="{{AppSubUrl}}/notifications" class="item tooltip not-mobile gt-mx-0" data-content="{{.locale.Tr "notifications"}}" aria-label="{{.locale.Tr "notifications"}}">
-				<span class="text">
+				<span class="fitted item">
-					<span class="fitted">{{svg "octicon-bell"}}</span>
+					{{svg "octicon-bell"}}
-					<span class="ui red label {{if not $notificationUnreadCount}}hidden{{end}} notification_count">
+					<span class="notification_count{{if not $notificationUnreadCount}} gt-hidden{{end}}">
 						{{$notificationUnreadCount}}
 					</span>
 				</span>
 			</a>
 
-			<div class="ui dropdown jump item tooltip" data-content="{{.locale.Tr "create_new"}}">
+			<div class="ui dropdown jump item tooltip gt-mx-0" data-content="{{.locale.Tr "create_new"}}">
 				<span class="text">
 					<span class="fitted">{{svg "octicon-plus"}}</span>
 					<span class="sr-mobile-only">{{.locale.Tr "create_new"}}</span>
@@ -150,9 +150,9 @@
 				</div><!-- end content create new menu -->
 			</div><!-- end dropdown menu create new -->
 
-			<div class="ui dropdown jump item tooltip" tabindex="-1" data-content="{{.locale.Tr "user_profile_and_more"}}">
+			<div class="ui dropdown jump item tooltip gt-mx-0" data-content="{{.locale.Tr "user_profile_and_more"}}">
 				<span class="text">
-					{{avatar .SignedUser 24 "tiny"}}
+					{{avatar $.Context .SignedUser 24 "tiny"}}
 					<span class="sr-only">{{.locale.Tr "user_profile_and_more"}}</span>
 					<span class="mobile-only">{{.SignedUser.Name}}</span>
 					<span class="fitted not-mobile" tabindex="-1">{{svg "octicon-triangle-down"}}</span>
@@ -190,14 +190,14 @@
 
 						<a class="{{if .PageIsAdmin}}active {{end}}item" href="{{AppSubUrl}}/admin">
 							{{svg "octicon-server"}}
-							{{.locale.Tr "admin_panel"}}<!-- Admin Panel -->
+							{{.locale.Tr "admin_panel"}}
 						</a>
 					{{end}}
 
 					<div class="divider"></div>
 					<a class="item link-action" href data-url="{{AppSubUrl}}/user/logout" data-redirect="{{AppSubUrl}}/">
 						{{svg "octicon-sign-out"}}
-						{{.locale.Tr "sign_out"}}<!-- Sign Out -->
+						{{.locale.Tr "sign_out"}}
 					</a>
 				</div><!-- end content avatar menu -->
 			</div><!-- end dropdown avatar menu -->
@@ -217,4 +217,4 @@
 			-->
 		</div><!-- end anonymous right menu -->
 	{{end}}
-</div>
+</nav>

docker/gitea/custom/templates/repo/header.tmpl

@@ -2,19 +2,21 @@
 {{with .Repository}}
 	<div class="ui container">
 		<div class="repo-header">
-			<div class="repo-title-wrap df fc">
+			<div class="repo-title-wrap gt-df gt-fc">
-				<div class="repo-title">
+				<div class="repo-title" role="heading" aria-level="1">
-					{{$avatar := (repoAvatar . 32 "mr-3")}}
+					{{$avatar := (repoAvatar . 32 "gt-mr-3")}}
 					{{if $avatar}}
 						{{$avatar}}
 					{{else}}
 						{{template "repo/icon" .}}
 					{{end}}
 					<a href="{{.Owner.HomeLink}}">{{.Owner.Name}}</a>
-					<div class="mx-2">/</div>
+					<div class="gt-mx-2">/</div>
 					<a href="{{$.RepoLink}}">{{.Name}}</a>
-					<a href="{{$.RepoLink}}.rss"><i class="ui grey icon tooltip ml-3" data-content="{{$.locale.Tr "rss_feed"}}" data-position="top center">{{svg "octicon-rss" 18}}</i></a>
+					{{if $.EnableFeed}}
-					<div class="labels df ac fw">
+						<a href="{{$.RepoLink}}.rss"><i class="ui grey icon tooltip gt-ml-3" data-content="{{$.locale.Tr "rss_feed"}}" data-position="top center">{{svg "octicon-rss" 18}}</i></a>
+					{{end}}
+					<div class="labels gt-df gt-ac gt-fw">
 						{{if .IsTemplate}}
 							{{if .IsPrivate}}
 								<span class="ui basic label">{{$.locale.Tr "repo.desc.private_template"}}</span>
@@ -67,7 +69,7 @@
 					{{end}}
 					<form method="post" action="{{$.RepoLink}}/action/{{if $.IsWatchingRepo}}un{{end}}watch?redirect_to={{$.Link}}">
 						{{$.CsrfTokenHtml}}
-						<div class="ui labeled button{{if not $.IsSigned}} tooltip{{end}}" tabindex="0"{{if not $.IsSigned}} data-content="{{$.locale.Tr "repo.watch_guest_user"}}" data-position="top center"{{end}}>
+						<div class="ui labeled button{{if not $.IsSigned}} tooltip{{end}}"{{if not $.IsSigned}} data-content="{{$.locale.Tr "repo.watch_guest_user"}}" data-position="top center"{{end}}>
 							<button type="submit" class="ui compact small basic button"{{if not $.IsSigned}} disabled{{end}}>
 								{{if $.IsWatchingRepo}}{{svg "octicon-eye-closed" 16}}{{$.locale.Tr "repo.unwatch"}}{{else}}{{svg "octicon-eye"}}{{$.locale.Tr "repo.watch"}}{{end}}
 							</button>
@@ -79,7 +81,7 @@
 					{{if not $.DisableStars}}
 						<form method="post" action="{{$.RepoLink}}/action/{{if $.IsStaringRepo}}un{{end}}star?redirect_to={{$.Link}}">
 							{{$.CsrfTokenHtml}}
-							<div class="ui labeled button{{if not $.IsSigned}} tooltip{{end}}" tabindex="0"{{if not $.IsSigned}} data-content="{{$.locale.Tr "repo.star_guest_user"}}" data-position="top center"{{end}}>
+							<div class="ui labeled button{{if not $.IsSigned}} tooltip{{end}}"{{if not $.IsSigned}} data-content="{{$.locale.Tr "repo.star_guest_user"}}" data-position="top center"{{end}}>
 								<button type="submit" class="ui compact small basic button"{{if not $.IsSigned}} disabled{{end}}>
 									{{if $.IsStaringRepo}}{{svg "octicon-star-fill"}}{{$.locale.Tr "repo.unstar"}}{{else}}{{svg "octicon-star"}}{{$.locale.Tr "repo.star"}}{{end}}
 								</button>
@@ -99,7 +101,7 @@
 							{{else if and (not $.CanSignedUserFork) (eq (len $.UserAndOrgForks) 0)}}
 								data-content="{{$.locale.Tr "repo.fork_from_self"}}"
 							{{end}}
-						data-position="top center" tabindex="0">
+						data-position="top center">
 							<a class="ui compact{{if $.ShowForkModal}} show-modal{{end}} small basic button"
 								{{if not $.CanSignedUserFork}}
 									{{if gt (len $.UserAndOrgForks) 1}}
@@ -121,12 +123,12 @@
 								<div class="header">
 									{{$.locale.Tr "repo.already_forked" .Name}}
 								</div>
-								<div class="content tl">
+								<div class="content gt-tl">
 									<div class="ui list">
 										{{range $.UserAndOrgForks}}
-											<div class="ui item py-3">
+											<div class="ui item gt-py-3">
 												<a href="{{.Link}}">
-													{{svg "octicon-repo-forked" 16 "mr-3"}}{{.FullName}}
+													{{svg "octicon-repo-forked" 16 "gt-mr-3"}}{{.FullName}}
 												</a>
 											</div>
 										{{end}}
@@ -163,7 +165,7 @@
 					<a class="{{if .PageIsIssueList}}active {{end}}item" href="{{.RepoLink}}/issues">
 						{{svg "octicon-issue-opened"}} {{.locale.Tr "repo.issues"}}
 						{{if .Repository.NumOpenIssues}}
-							<span class="ui primary small label">{{CountFmt .Repository.NumOpenIssues}}</span>
+							<span class="ui small label">{{CountFmt .Repository.NumOpenIssues}}</span>
 						{{end}}
 					</a>
 				{{end}}
@@ -178,14 +180,14 @@
 					<a class="{{if .PageIsPullList}}active {{end}}item" href="{{.RepoLink}}/pulls">
 						{{svg "octicon-git-pull-request"}} {{.locale.Tr "repo.pulls"}}
 						{{if .Repository.NumOpenPulls}}
-							<span class="ui primary small label">{{CountFmt .Repository.NumOpenPulls}}</span>
+							<span class="ui small label">{{CountFmt .Repository.NumOpenPulls}}</span>
 						{{end}}
 					</a>
 				{{end}}
 
 				<!-- Added to redirect PR links to Gerrit -->
 				<a class="item" href="https://review.opendev.org/#/q/status:open+project:{{.Owner.Name}}/{{.Repository.Name}}">
-					{{svg "octicon-git-pull-request"}} Proposed changes
+					{{svg "octicon-git-pull-request"}} Proposed changes </span>
 				</a>
 
 				{{if .Permission.CanRead $.UnitTypePackages}}
@@ -198,7 +200,7 @@
 					<a href="{{.RepoLink}}/projects" class="{{if .IsProjectsPage}}active {{end}}item">
 						{{svg "octicon-project"}} {{.locale.Tr "repo.project_board"}}
 						{{if .Repository.NumOpenProjects}}
-							<span class="ui primary small label">{{CountFmt .Repository.NumOpenProjects}}</span>
+							<span class="ui small label">{{CountFmt .Repository.NumOpenProjects}}</span>
 						{{end}}
 					</a>
 				{{end}}
@@ -208,14 +210,14 @@
 				<a class="{{if .PageIsReleaseList}}active {{end}}item" href="{{.RepoLink}}/releases">
 					{{svg "octicon-tag"}} {{.locale.Tr "repo.releases"}}
 					{{if .NumReleases}}
-						<span class="ui primary small label">{{CountFmt .NumReleases}}</span>
+						<span class="ui small label">{{CountFmt .NumReleases}}</span>
 					{{end}}
 				</a>
 				{{end}}
 				-->
 
 				{{if or (.Permission.CanRead $.UnitTypeWiki) (.Permission.CanRead $.UnitTypeExternalWiki)}}
-					<a class="{{if .PageIsWiki}}active{{end}} item" href="{{.RepoLink}}/wiki" {{if and (.Permission.CanRead $.UnitTypeExternalWiki) (not (HasPrefix ((.Repository.MustGetUnit $.UnitTypeExternalWiki).ExternalWikiConfig.ExternalWikiURL) (.Repository.HTMLURL)))}} target="_blank" rel="noopener noreferrer" {{end}}>
+					<a class="{{if .PageIsWiki}}active {{end}}item" href="{{.RepoLink}}/wiki" {{if and (.Permission.CanRead $.UnitTypeExternalWiki) (not (HasPrefix ((.Repository.MustGetUnit $.Context $.UnitTypeExternalWiki).ExternalWikiConfig.ExternalWikiURL) (.Repository.Link)))}} target="_blank" rel="noopener noreferrer" {{end}}>
 						{{svg "octicon-book"}} {{.locale.Tr "repo.wiki"}}
 					</a>
 				{{end}}

playbooks/roles/gitea-set-org-logos/tasks/main.yaml

@@ -2,14 +2,11 @@
   uri:
     url: 'https://localhost:3000/api/v1/orgs'
     method: GET
-    user: root
-    password: '{{ gitea_root_password }}'
     return_content: yes
     validate_certs: false
     status_code: 200
     body_format: json
   register: _org_list_raw
-  no_log: True
 
 - name: Filter org list
   set_fact:

playbooks/roles/gitea/templates/app.ini.j2

@@ -31,7 +31,7 @@ LOG_SQL  = false
 
 [repository]
 ROOT = /data/git/repositories
-DISABLED_REPO_UNITS = repo.issues,repo.pulls,repo.wiki,repo.projects
+DISABLED_REPO_UNITS = repo.issues,repo.pulls,repo.wiki,repo.projects,repo.actions
 DISABLE_STARS = true
 DISABLE_MIGRATIONS = true
 
@@ -110,3 +110,6 @@ IS_INPUT_FILE = false
 
 [ui]
 THEME_COLOR_META_TAG = `#ee265e`
+
+[actions]
+ENABLED = false