Merge branch 'main' into gitea-cli

The workflow example had no trigger, so Gitea would reject it as written.
The guides now merge the small account sections and point users at the
nightly builds they describe. Comments and READMEs no longer mention the
dropped reference generator or list the runner as the only hand written
sidebar product, and the sidebar lookup drops a key the fallback covers.

Co-Authored-By: Claude (Opus 5.5) <[email protected]>

README.md

@@ -120,19 +120,12 @@ the runner binary.
 ## CLI docs
 
 The documentation of `gt`, the Gitea CLI from
-[gitea/cli](https://gitea.com/gitea/cli), is laid out like the runner docs:
-
-| Version | Content | URL |
-| --- | --- | --- |
-| develop | `cli-docs/` | `/cli/` until the first release, then `/cli/develop/` |
-| current series | `cli-docs_versioned_docs/version-<series>/` | `/cli/` |
-| older series | `cli-docs_versioned_docs/version-<series>/` | `/cli/<series>/` |
-
-No series is documented yet. Once a release exists, cut its series with
-`make cut-version PRODUCT=cli VERSION=0.1`, then list it in `cliSeries` in
-`packages/content-loader/src/products.ts`; the develop docs then move to
-`/cli/develop/`. Its sidebar is written by hand in `cli-sidebars.js`. The
-guides do not repeat every flag: `gt <command> --help` documents each command.
+[gitea/cli](https://gitea.com/gitea/cli), is laid out like the runner docs, with
+its sidebar in `cli-sidebars.js`. No series is documented yet, so `cli-docs/` is
+served at `/cli/`. Once a release exists, cut its series and list it in
+`cliSeries` in `packages/content-loader/src/products.ts`, which moves the develop
+docs to `/cli/develop/`. The guides leave the flags of each command to
+`gt <command> --help`.
 
 ## Deployment
 

cli-docs/authentication.md

@@ -38,20 +38,18 @@ token:
 gt auth login --host https://gitea.example.com --ssh-key ~/.ssh/id_ed25519
 ```
 
-## Where credentials are kept
+## Accounts
 
-Tokens go to the system keyring by default. `--credential-store file` keeps them in gt's
-configuration directory instead, for machines without a keyring. `gt auth status` lists
-your accounts and `gt auth logout` removes one.
+Tokens go to the system keyring, or with `--credential-store file` to gt's configuration
+directory on machines without one. Run `gt auth login` once per instance and account.
+gt picks the instance from the repository's remote or `--host`, and the account with
+`gt auth switch` or `--user`. `gt auth status` lists your accounts and `gt auth logout`
+removes one.
+
+For instances behind an access proxy, `--header` and `--client-cert` add headers and a
+client certificate.
 
 ## Git over HTTPS
 
 `gt auth setup-git` lets `git push` and `git fetch` over HTTPS use gt's login. gt's own
 clone and checkout commands need no setup.
-
-## Several instances and accounts
-
-Run `gt auth login` for each instance and account. gt picks the instance from the
-repository's remote or `--host`, and the account with `gt auth switch` or `--user`.
-For instances behind an access proxy, `--header` and `--client-cert` add headers and a
-client certificate; see `gt auth login --help`.

cli-docs/ci.md

@@ -21,8 +21,12 @@ Gitea does not allow secret names that start with `GITEA_`, so store the token a
 example, `GT_TOKEN`:
 
 ```yaml
+on:
+  push:
+    branches: [main]
+
 jobs:
-  deploy:
+  staging:
     runs-on: ubuntu-latest
     env:
       GITEA_TOKEN: ${{ secrets.GT_TOKEN }}
@@ -33,4 +37,4 @@ jobs:
       - run: gt workflow run deploy.yml --ref main --field env=staging --no-input
 ```
 
-`gt run watch` and `gt pr checks --watch` wait for runs and checks and fail when they do.
+`gt run watch` and `gt pr checks --watch` wait for runs and checks and fail when one fails.

cli-docs/index.md

@@ -10,7 +10,7 @@ with repositories, issues, pull requests, releases, Actions and the other resour
 Gitea instance, from a terminal or a script.
 
 :::info Development version
-These pages describe builds from the `main` branch of gitea/cli.
+These pages describe builds from the `main` branch, published as `nightly` binaries and images.
 :::
 
 gt needs Gitea 28 or later, and Git for the commands that clone, check out or push.
@@ -34,6 +34,5 @@ gt needs Gitea 28 or later, and Git for the commands that clone, check out or pu
 
 `gt doctor` checks your setup and suggests a fix for each problem it finds.
 
-Every command documents itself with `--help`. `gt help environment`, `gt help formatting`
-and `gt help exit-codes` cover global flags and environment variables, JSON output, and
-exit codes.
+`gt <command> --help` lists the flags of a command, and `gt help environment` the global
+flags and environment variables.

docs/administration/authentication.md

@@ -337,9 +337,13 @@ The default login user email is `X-WEBAUTH-EMAIL`, you can change it via changin
 
 If set `ENABLE_REVERSE_PROXY_FULL_NAME=true`, a user full name expected in `X-WEBAUTH-FULLNAME` will be assigned to the user when auto creating the user. You can also change the header name with `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`.
 
-You can also limit the reverse proxy's IP address range with `REVERSE_PROXY_TRUSTED_PROXIES` which default value is `127.0.0.0/8,::1/128`. By `REVERSE_PROXY_LIMIT`, you can limit trusted proxies level.
+It applies to the web interface, Git over HTTP, Git LFS and the package registry.
 
-You can enable the this authentication method for the API with
+:::warning
+Gitea trusts these headers on every request it receives. Make sure Gitea is only reachable through your authenticating proxy, and that the proxy sets or removes these headers on every request, including on paths you exempt from authentication, for example for Git or package clients. `REVERSE_PROXY_TRUSTED_PROXIES` does not restrict them.
+:::
+
+To also accept them on the REST API under `/api/v1`, enable:
 
 ```ini
 [service]

docs/administration/config-cheat-sheet.md

@@ -740,8 +740,8 @@ And the following unique queues:
    If you set it to false, maybe it also needs to set `ENABLE_BASIC_AUTHENTICATION` to false to
    completely disable password-based authentication.
 - `ENABLE_PASSKEY_AUTHENTICATION`: **true**: Allow users to sign-in with a passkey
-- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable this to allow reverse proxy authentication for web requests
-- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
+- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable reverse proxy authentication for the web interface, Git over HTTP, Git LFS and the package registry. Gitea must only be reachable through the proxy, see [Reverse Proxy](authentication.md#reverse-proxy).
+- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable reverse proxy authentication for the REST API under `/api/v1`.
 - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: **false**: Enable this to allow auto-registration
    for reverse authentication.
 - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a
@@ -1707,7 +1707,7 @@ PROXY_HOSTS = *.github.com
   But it will save storage space and network bandwidth, so it's still recommended to use compression.
 - `ARTIFACT_RETENTION_DAYS`: **90**: Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
   Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
-  Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
+  Workflows can request a shorter retention period, down to 1 day.
 - `ARTIFACT_PREVIEW_MAX_SIZE`: **10485760**: Maximum total artifact size in bytes that can be browsed or previewed in the web UI. Set to `0` to disable artifact previews or `-1` for no limit. Individual files are also limited by [`MAX_DISPLAY_FILE_SIZE`](#ui-ui).
 - `RUN_RETENTION_DAYS`: **400**: Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever.
 - `ZOMBIE_TASK_TIMEOUT`: **10m**: Timeout to stop the task which have running status, but haven't been updated for a long time

docs/usage/actions/variables.md

@@ -39,7 +39,7 @@ These environment variables are set automatically in every workflow run and can
 | `GITHUB_REF_TYPE` | The type of ref: `branch` or `tag`. | `branch` |
 | `GITHUB_REPOSITORY` | The owner and repository name. | `gitea/docs` |
 | `GITHUB_REPOSITORY_OWNER` | The repository owner's username. | `gitea` |
-| `GITHUB_RETENTION_DAYS` | The number of days that workflow run logs and artifacts are kept. | `90` |
+| `GITHUB_RETENTION_DAYS` | The number of days that artifacts are kept, empty when kept forever. | `90` |
 | `GITHUB_RUN_ATTEMPT` | The attempt number of the workflow run. | `1` |
 | `GITHUB_RUN_ID` | A unique number for each workflow run. | `1234` |
 | `GITHUB_RUN_NUMBER` | A unique number for each run of a particular workflow. | `42` |
@@ -98,7 +98,7 @@ These variables are available in workflow expressions via `${{ gitea.<name> }}`.
 | `gitea.repository`<br/>`github.repository` | The owner and repository name. | `gitea/docs` |
 | `gitea.repository_owner`<br/>`github.repository_owner` | The repository owner's username. | `gitea` |
 | `gitea.repositoryUrl`<br/>`github.repositoryUrl` | The HTML URL to the repository. | `https://gitea.com/gitea/docs` |
-| `gitea.retention_days`<br/>`github.retention_days` | The number of days that workflow run logs and artifacts are kept. | `90` |
+| `gitea.retention_days`<br/>`github.retention_days` | The number of days that artifacts are kept, empty when kept forever. | `90` |
 | `gitea.run_id`<br/>`github.run_id` | A unique number for each workflow run within a repository. Does not change on re-run. | `1234` |
 | `gitea.run_number`<br/>`github.run_number` | A unique number for each run of a particular workflow. Starts at 1 and increments with each new run. | `42` |
 | `gitea.run_attempt`<br/>`github.run_attempt` | A unique number for each re-run attempt. Starts at 1 and increments with each re-run. | `1` |

packages/content-loader/src/products.ts

@@ -247,13 +247,10 @@ const runnerProduct: ProductDef = {
 };
 
 /**
- * gt, the Gitea CLI: one directory per release series, english only, like the
- * runner. The label is the newest release of the series, which is also the tag
- * the generated reference pages of that directory come from.
- *
- * Until the first series is listed here the develop docs are served at the
- * product root, without the unreleased banner, since there is no release to
- * point to. Listing a series moves them to `/cli/develop/`.
+ * gt, the Gitea CLI: laid out like the runner. Until the first series is listed
+ * here the develop docs are served at the product root, without the unreleased
+ * banner, since there is no release to point to. Listing a series moves them to
+ * `/cli/develop/`.
  */
 const cliSeries: { id: string; latestRelease: string }[] = [];
 

packages/content-loader/src/sidebar.ts

@@ -1,7 +1,7 @@
 /**
  * Builds one sidebar per (product, version, language) out of the loaded pages,
  * deriving it from `_category_.json` and from the
- * handwritten sidebar files of the runner docs.
+ * handwritten sidebar files of the runner and the cli docs.
  */
 
 import { defaultLocale } from './products';
@@ -44,7 +44,7 @@ export interface SidebarGroup {
 
 export type SidebarEntry = SidebarLink | SidebarGroup;
 
-/** A hand written sidebar file, as used by the runner docs. */
+/** A hand written sidebar file, as used by the runner and the cli docs. */
 export type SidebarSourceItem =
   | string
   | { type: 'doc'; id: string; label?: string }
@@ -148,7 +148,7 @@ function treeOf(pages: SidebarPage[]): Tree {
   return { build, label };
 }
 
-/** Sidebar described by a hand written sidebar file, used by the runner docs. */
+/** Sidebar described by a hand written sidebar file, used by the runner and the cli docs. */
 function fromSidebarSource(
   items: SidebarSourceItem[],
   pages: SidebarPage[],

sites/docs/README.md

@@ -1,15 +1,15 @@
 # Astro + Starlight site
 
 Renders the gitea documentation with [Starlight](https://starlight.astro.build):
-the docs (6 versions x 3 languages), the runner docs (4 series), the gt (Gitea
-CLI) docs and the api reference (7 swagger documents). The enterprise docs stay in their own
-deployment and are linked from the header.
+the docs (6 versions x 3 languages), the runner docs (4 series), the cli docs
+and the api reference (7 swagger documents). The enterprise docs stay in their
+own deployment and are linked from the header.
 
 The content directories are the ones the site has always used — `docs/`,
-`versioned_docs/`, `i18n/`, `runner-docs/`, `runner-docs_versioned_docs/`,
-`cli-docs/` and
+`versioned_docs/`, `i18n/`, `runner-docs/`, `runner-docs_versioned_docs/` and
 `static/swagger-*.json` (plus `static/openapi3-*.json` since gitea 1.27) — so
-the release scripts and the translation workflow stay unchanged.
+the release scripts and the translation workflow stay unchanged. The cli docs
+in `cli-docs/` follow the layout of the runner docs.
 
 ## Running it
 
@@ -74,10 +74,10 @@ instead of warning.
 The docs are the site itself, so their language comes first: `/zh-cn/1.26/`.
 The runner, the cli and the api are separate products and keep their language
 inside the product, `/runner/zh-cn/3/`, which is reserved: all are published in
-english only today. Starlight builds a fallback page in every configured language for
-every english page, so `/zh-cn/runner/` would exist; the post build integration
-removes those directories and `cloudflare/_redirects` sends them to the
-english page.
+english only today. Starlight builds a fallback page in every configured
+language for every english page, so `/zh-cn/runner/` would exist; the post build
+integration removes those directories and `cloudflare/_redirects` sends them to
+the english page.
 
 The version served at the root of a product has no number in its url: docs 1.27
 is `/`, runner 3 is `/runner/` and api 1.27 is `/api/`. `/1.27/`, `/runner/3/`

sites/docs/src/integrations/postbuild.ts

@@ -11,9 +11,9 @@ import { defaultLocale, locales, products, type LocaleId } from '@gitea-docs/con
  *   generated as `/api/126/`. The directories are renamed and the links inside
  *   the build are rewritten.
  * - starlight builds a fallback page in every configured language for every
- *   english page. That is what we want for the docs, but the runner and the api
- *   are separate products with their own language list, so `/zh-cn/runner/` has
- *   to go; `cloudflare/_redirects` sends it to the english page.
+ *   english page. That is what we want for the docs, but the other products
+ *   have their own language list, so `/zh-cn/runner/` has to go;
+ *   `cloudflare/_redirects` sends it to the english page.
  */
 export function giteaPostBuild(): AstroIntegration {
   return {

sites/docs/src/lib/pagefind-ui.ts

@@ -90,7 +90,7 @@ function addScopeToggle(root: HTMLElement, onChange: (allVersions: boolean) => v
 
 /**
  * While all versions are searched the same page shows up once per version, so
- * the version (and the product, for the api and the runner) is appended to the
+ * the version (and the product, for every product but the docs) is appended to the
  * title of a result.
  */
 function labelResult(result: PagefindResult): void {

sites/docs/src/lib/sidebars.ts

@@ -53,7 +53,7 @@ function sidebarSources(): Map<string, SidebarSourceItem[]> {
 
   for (const [key, file] of Object.entries(files)) {
     const config = read(file);
-    const items = config && (config.docs ?? config.runner ?? config.cli ?? Object.values(config)[0]);
+    const items = config && (config.docs ?? config.runner ?? Object.values(config)[0]);
     if (items) sidebars.set(key, items);
   }
   return sidebars;

versioned_docs/version-1.27/administration/authentication.md

@@ -337,9 +337,13 @@ The default login user email is `X-WEBAUTH-EMAIL`, you can change it via changin
 
 If set `ENABLE_REVERSE_PROXY_FULL_NAME=true`, a user full name expected in `X-WEBAUTH-FULLNAME` will be assigned to the user when auto creating the user. You can also change the header name with `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`.
 
-You can also limit the reverse proxy's IP address range with `REVERSE_PROXY_TRUSTED_PROXIES` which default value is `127.0.0.0/8,::1/128`. By `REVERSE_PROXY_LIMIT`, you can limit trusted proxies level.
+It applies to the web interface, Git over HTTP, Git LFS and the package registry.
 
-You can enable the this authentication method for the API with
+:::warning
+Gitea trusts these headers on every request it receives. Make sure Gitea is only reachable through your authenticating proxy, and that the proxy sets or removes these headers on every request, including on paths you exempt from authentication, for example for Git or package clients. `REVERSE_PROXY_TRUSTED_PROXIES` does not restrict them.
+:::
+
+To also accept them on the REST API under `/api/v1`, enable:
 
 ```ini
 [service]

versioned_docs/version-1.27/administration/config-cheat-sheet.md

@@ -746,8 +746,8 @@ And the following unique queues:
    If you set it to false, maybe it also needs to set `ENABLE_BASIC_AUTHENTICATION` to false to
    completely disable password-based authentication.
 - `ENABLE_PASSKEY_AUTHENTICATION`: **true**: Allow users to sign-in with a passkey
-- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable this to allow reverse proxy authentication for web requests
-- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
+- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable reverse proxy authentication for the web interface, Git over HTTP, Git LFS and the package registry. Gitea must only be reachable through the proxy, see [Reverse Proxy](authentication.md#reverse-proxy).
+- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable reverse proxy authentication for the REST API under `/api/v1`.
 - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: **false**: Enable this to allow auto-registration
    for reverse authentication.
 - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a

versioned_docs/version-28/administration/authentication.md

@@ -337,9 +337,13 @@ The default login user email is `X-WEBAUTH-EMAIL`, you can change it via changin
 
 If set `ENABLE_REVERSE_PROXY_FULL_NAME=true`, a user full name expected in `X-WEBAUTH-FULLNAME` will be assigned to the user when auto creating the user. You can also change the header name with `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`.
 
-You can also limit the reverse proxy's IP address range with `REVERSE_PROXY_TRUSTED_PROXIES` which default value is `127.0.0.0/8,::1/128`. By `REVERSE_PROXY_LIMIT`, you can limit trusted proxies level.
+It applies to the web interface, Git over HTTP, Git LFS and the package registry.
 
-You can enable the this authentication method for the API with
+:::warning
+Gitea trusts these headers on every request it receives. Make sure Gitea is only reachable through your authenticating proxy, and that the proxy sets or removes these headers on every request, including on paths you exempt from authentication, for example for Git or package clients. `REVERSE_PROXY_TRUSTED_PROXIES` does not restrict them.
+:::
+
+To also accept them on the REST API under `/api/v1`, enable:
 
 ```ini
 [service]

versioned_docs/version-28/administration/config-cheat-sheet.md

@@ -739,8 +739,8 @@ And the following unique queues:
    If you set it to false, maybe it also needs to set `ENABLE_BASIC_AUTHENTICATION` to false to
    completely disable password-based authentication.
 - `ENABLE_PASSKEY_AUTHENTICATION`: **true**: Allow users to sign-in with a passkey
-- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable this to allow reverse proxy authentication for web requests
-- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible.
+- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable reverse proxy authentication for the web interface, Git over HTTP, Git LFS and the package registry. Gitea must only be reachable through the proxy, see [Reverse Proxy](authentication.md#reverse-proxy).
+- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable reverse proxy authentication for the REST API under `/api/v1`.
 - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: **false**: Enable this to allow auto-registration
    for reverse authentication.
 - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a
@@ -1706,7 +1706,7 @@ PROXY_HOSTS = *.github.com
   But it will save storage space and network bandwidth, so it's still recommended to use compression.
 - `ARTIFACT_RETENTION_DAYS`: **90**: Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
   Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
-  Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
+  Workflows can request a shorter retention period, down to 1 day.
 - `ARTIFACT_PREVIEW_MAX_SIZE`: **10485760**: Maximum total artifact size in bytes that can be browsed or previewed in the web UI. Set to `0` to disable artifact previews or `-1` for no limit. Individual files are also limited by [`MAX_DISPLAY_FILE_SIZE`](#ui-ui).
 - `RUN_RETENTION_DAYS`: **400**: Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever.
 - `ZOMBIE_TASK_TIMEOUT`: **10m**: Timeout to stop the task which have running status, but haven't been updated for a long time

versioned_docs/version-28/usage/actions/variables.md

@@ -39,7 +39,7 @@ These environment variables are set automatically in every workflow run and can
 | `GITHUB_REF_TYPE` | The type of ref: `branch` or `tag`. | `branch` |
 | `GITHUB_REPOSITORY` | The owner and repository name. | `gitea/docs` |
 | `GITHUB_REPOSITORY_OWNER` | The repository owner's username. | `gitea` |
-| `GITHUB_RETENTION_DAYS` | The number of days that workflow run logs and artifacts are kept. | `90` |
+| `GITHUB_RETENTION_DAYS` | The number of days that artifacts are kept, empty when kept forever. | `90` |
 | `GITHUB_RUN_ATTEMPT` | The attempt number of the workflow run. | `1` |
 | `GITHUB_RUN_ID` | A unique number for each workflow run. | `1234` |
 | `GITHUB_RUN_NUMBER` | A unique number for each run of a particular workflow. | `42` |
@@ -98,7 +98,7 @@ These variables are available in workflow expressions via `${{ gitea.<name> }}`.
 | `gitea.repository`<br/>`github.repository` | The owner and repository name. | `gitea/docs` |
 | `gitea.repository_owner`<br/>`github.repository_owner` | The repository owner's username. | `gitea` |
 | `gitea.repositoryUrl`<br/>`github.repositoryUrl` | The HTML URL to the repository. | `https://gitea.com/gitea/docs` |
-| `gitea.retention_days`<br/>`github.retention_days` | The number of days that workflow run logs and artifacts are kept. | `90` |
+| `gitea.retention_days`<br/>`github.retention_days` | The number of days that artifacts are kept, empty when kept forever. | `90` |
 | `gitea.run_id`<br/>`github.run_id` | A unique number for each workflow run within a repository. Does not change on re-run. | `1234` |
 | `gitea.run_number`<br/>`github.run_number` | A unique number for each run of a particular workflow. Starts at 1 and increments with each new run. | `42` |
 | `gitea.run_attempt`<br/>`github.run_attempt` | A unique number for each re-run attempt. Starts at 1 and increments with each re-run. | `1` |