[PR #105] [MERGED] fix: Forgejo 12 compatibility - use separate auth fields for private repos (#102) #131

New issue

Closed

opened 2026-02-27 15:55:15 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 15:55:15 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/RayLabsHQ/gitea-mirror/pull/105
Author: @arunavo4
Created: 9/30/2025
Status: ✅ Merged
Merged: 10/1/2025
Merged by: @arunavo4

Base: main ← Head: fix/forgejo-12-private-repos

📝 Commits (2)

34f741b fix: Forgejo 12 compatibility - use separate auth fields for private repos (#102)
096e0c0 images now tagged lowercase in comments

📊 Changes

2 files changed (+129 additions, -63 deletions)

View changed files

📝 .github/workflows/docker-build.yml (+62 -5)
📝 src/lib/gitea.ts (+67 -58)

📄 Description

Problem

Forgejo 12.0+ rejects migration API calls with credentials embedded in URLs, causing HTTP 422 errors when mirroring private GitHub repositories.

Root Cause

Breaking security change in Forgejo 12.0 (July 2025) enforces credential separation to prevent accidental exposure in logs/errors. Previous versions (Forgejo 11.x, Gitea 1.x) accepted embedded credentials.

Solution

Use separate auth_username and auth_token fields instead of embedding credentials in clone URLs
Set auth_username to "oauth2" for GitHub token authentication
Pass GitHub token via auth_token field

Changes

src/lib/gitea.ts:
- mirrorGithubRepoToGitea(): Use separate auth fields for private repos
- mirrorGitHubRepoToGiteaOrg(): Use separate auth fields for private repos
.github/workflows/docker-build.yml:
- Enable PR image building and pushing to GHCR
- Tag PR images as pr- for easy testing
- Add automated PR comment with image details and testing instructions
- Separate load step for security scanning

Backward Compatibility

✅ Works with Forgejo 12.0+
✅ Works with Forgejo 11.x and earlier
✅ Works with Gitea 1.x

Testing

Public repos: ✅ Working (no auth needed)
Private repos: ✅ Fixed (separate auth fields)

Fixes #102

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/RayLabsHQ/gitea-mirror/pull/105 **Author:** [@arunavo4](https://github.com/arunavo4) **Created:** 9/30/2025 **Status:** ✅ Merged **Merged:** 10/1/2025 **Merged by:** [@arunavo4](https://github.com/arunavo4) **Base:** `main` ← **Head:** `fix/forgejo-12-private-repos` --- ### 📝 Commits (2) - [`34f741b`](https://github.com/RayLabsHQ/gitea-mirror/commit/34f741beeface64920bf8fc4a184c50ed21dbc3b) fix: Forgejo 12 compatibility - use separate auth fields for private repos (#102) - [`096e0c0`](https://github.com/RayLabsHQ/gitea-mirror/commit/096e0c03ac0b1b4b96cd29cfc88e3bcee50a69ef) images now tagged lowercase in comments ### 📊 Changes **2 files changed** (+129 additions, -63 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/docker-build.yml` (+62 -5) 📝 `src/lib/gitea.ts` (+67 -58) </details> ### 📄 Description ## Problem Forgejo 12.0+ rejects migration API calls with credentials embedded in URLs, causing HTTP 422 errors when mirroring private GitHub repositories. ## Root Cause Breaking security change in Forgejo 12.0 (July 2025) enforces credential separation to prevent accidental exposure in logs/errors. Previous versions (Forgejo 11.x, Gitea 1.x) accepted embedded credentials. ## Solution - Use separate `auth_username` and `auth_token` fields instead of embedding credentials in clone URLs - Set `auth_username` to "oauth2" for GitHub token authentication - Pass GitHub token via `auth_token` field ## Changes - src/lib/gitea.ts: - mirrorGithubRepoToGitea(): Use separate auth fields for private repos - mirrorGitHubRepoToGiteaOrg(): Use separate auth fields for private repos - .github/workflows/docker-build.yml: - Enable PR image building and pushing to GHCR - Tag PR images as pr-<number> for easy testing - Add automated PR comment with image details and testing instructions - Separate load step for security scanning ## Backward Compatibility ✅ Works with Forgejo 12.0+ ✅ Works with Forgejo 11.x and earlier ✅ Works with Gitea 1.x ## Testing Public repos: ✅ Working (no auth needed) Private repos: ✅ Fixed (separate auth fields) Fixes #102 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>