Skip to content

fix(actions): validate workflow param to prevent 500 error#37546

Merged
wxiaoguang merged 5 commits into
go-gitea:mainfrom
KalashThakare:fix/37523-disable-workflow-500
May 5, 2026
Merged

fix(actions): validate workflow param to prevent 500 error#37546
wxiaoguang merged 5 commits into
go-gitea:mainfrom
KalashThakare:fix/37523-disable-workflow-500

Conversation

@KalashThakare

@KalashThakare KalashThakare commented May 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR fixes issue #37523:

  1. Prevents a 500 error on the Actions page when disabling workflows with an empty workflow parameter
  2. Uses a single ctx.JSONError in the handler to return 400 Bad Request with the message “workflow is required” for empty input

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 5, 2026
@KalashThakare

KalashThakare commented May 5, 2026

Copy link
Copy Markdown
Contributor Author

Since we are already returning a 400 Bad Request for an empty workflow parameter on the backend, I’ve added a small UX improvement to hide the disable/enable action when “All Workflows” is selected to prevent triggering invalid requests.

As I wasn’t fully sure about this UI behavior, I’ve kept this change in a separate commit so it can be reverted easily if needed.

wxiaoguang
wxiaoguang requested changes May 5, 2026
View reviewed changes

@wxiaoguang wxiaoguang left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, you don't need to change so many lines.

You only need one ctx.JSONError call in disableOrEnableWorkflowFile

@GiteaBot GiteaBot added lgtm/blocked A maintainer has reservations with the PR and thus it cannot be merged and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 5, 2026
@KalashThakare KalashThakare requested a review from wxiaoguang May 5, 2026 06:12
wxiaoguang
wxiaoguang reviewed May 5, 2026
View reviewed changes
Comment thread web_src/js/features/common-fetch-action.ts Outdated
@KalashThakare KalashThakare requested a review from wxiaoguang May 5, 2026 07:23
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/blocked A maintainer has reservations with the PR and thus it cannot be merged labels May 5, 2026
@wxiaoguang wxiaoguang added type/bug backport/v1.26 This PR should be backported to Gitea 1.26 labels May 5, 2026
@wxiaoguang

wxiaoguang commented May 5, 2026

Copy link
Copy Markdown
Contributor

Thank you very much.

The PR's description also needs to be updated.

@KalashThakare

KalashThakare commented May 5, 2026

Copy link
Copy Markdown
Contributor Author

Thank you very much.

The PR's description also needs to be updated.

ya sure!

@silverwind

silverwind commented May 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

I feel like there are probably more similar mistakes in the code base. I think we should unify all error responses to always be JSON, regardless whether web or api routes trigger them. Then the UI has only one format to handle which makes it very simple.

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 5, 2026
@wxiaoguang wxiaoguang enabled auto-merge (squash) May 5, 2026 16:00
@wxiaoguang wxiaoguang added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 5, 2026
@wxiaoguang wxiaoguang merged commit ee803ad into go-gitea:main May 5, 2026
22 checks passed
@GiteaBot GiteaBot added this to the 1.27.0 milestone May 5, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 5, 2026
@GiteaBot GiteaBot mentioned this pull request May 5, 2026
Merged
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label May 5, 2026
silverwind pushed a commit that referenced this pull request May 5, 2026
@GiteaBot @KalashThakare
fix(actions): validate workflow param to prevent 500 error (#37546) (#…
356a119 
…37554)

Backport #37546 by @KalashThakare

This PR fixes issue #37523:

1. Prevents a 500 error on the Actions page when disabling workflows
with an empty workflow parameter
2. Uses a single **ctx.JSONError** in the handler to return 400 Bad
Request with the message “workflow is required” for empty input

Co-authored-by: Kalash Thakare ☯︎ <kalashthakare898@gmail.com>
silverwind added a commit to McMichalK/gitea that referenced this pull request May 5, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into filter-by-file-extension
9c8cf2a 
* origin/main: (49 commits)
  ci: lint PR titles with commitlint (go-gitea#37498)
  Make ServeSetHeaders default to download attachment if filename exists (go-gitea#37552)
  fix(actions): validate workflow param to prevent 500 error (go-gitea#37546)
  Fix various problems (go-gitea#37547)
  docs: fix 4 typos in CHANGELOG.md (go-gitea#37549)
  [skip ci] Updated translations via Crowdin
  chore(deps): update action dependencies (go-gitea#37540)
  fix: Fix `nolyfill` for renovate (go-gitea#37537)
  Refactor pull request view (7) (go-gitea#37524)
  Update go js py dependencies (go-gitea#37525)
  Don't unblock run-level-concurrency-blocked runs in the resolver (go-gitea#37461)
  Refactor pull request view (6) (go-gitea#37522)
  Refactor pull request view (5) (go-gitea#37517)
  fix: persist mirror repository metadata (go-gitea#37519)
  fix(packages): use file names for generic web downloads (go-gitea#37514)
  fix: merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once (go-gitea#37512)
  Fix update branch protection order (go-gitea#37508)
  Refactor "flex-list" to "flex-divided-list" (go-gitea#37505)
  fix: redirect early CLI console logger to stderr (go-gitea#37507)
  Fix mCaptcha broken after Vite migration (go-gitea#37492)
  ...

# Conflicts:
#	templates/repo/diff/box.tmpl
zjjhot added a commit to zjjhot/gitea that referenced this pull request May 6, 2026
@zjjhot
Merge branch 'main' into mainzjj
7a4c3ea 
* main: (36 commits)
  refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (go-gitea#37557)
  ci: lint PR titles with commitlint (go-gitea#37498)
  Make ServeSetHeaders default to download attachment if filename exists (go-gitea#37552)
  fix(actions): validate workflow param to prevent 500 error (go-gitea#37546)
  Fix various problems (go-gitea#37547)
  docs: fix 4 typos in CHANGELOG.md (go-gitea#37549)
  [skip ci] Updated translations via Crowdin
  chore(deps): update action dependencies (go-gitea#37540)
  fix: Fix `nolyfill` for renovate (go-gitea#37537)
  Refactor pull request view (7) (go-gitea#37524)
  Update go js py dependencies (go-gitea#37525)
  Don't unblock run-level-concurrency-blocked runs in the resolver (go-gitea#37461)
  Refactor pull request view (6) (go-gitea#37522)
  Refactor pull request view (5) (go-gitea#37517)
  fix: persist mirror repository metadata (go-gitea#37519)
  fix(packages): use file names for generic web downloads (go-gitea#37514)
  fix: merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once (go-gitea#37512)
  Fix update branch protection order (go-gitea#37508)
  Refactor "flex-list" to "flex-divided-list" (go-gitea#37505)
  fix: redirect early CLI console logger to stderr (go-gitea#37507)
  ...
silverwind added a commit to silverwind/gitea that referenced this pull request May 8, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into acticons
eddeb3f 
* origin/main: (41 commits)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin
  refactor: use modernc sqlite driver as default (go-gitea#37562)
  refactor(templates): remove ctxData from tmpl files, use ctx.RootData instead (go-gitea#37567)
  ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (go-gitea#37565)
  fix(deps): update go dependencies (go-gitea#37541)
  refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (go-gitea#37557)
  ci: lint PR titles with commitlint (go-gitea#37498)
  Make ServeSetHeaders default to download attachment if filename exists (go-gitea#37552)
  fix(actions): validate workflow param to prevent 500 error (go-gitea#37546)
  Fix various problems (go-gitea#37547)
  docs: fix 4 typos in CHANGELOG.md (go-gitea#37549)
  ...

# Conflicts:
#	templates/repo/actions/runs_list.tmpl
#	templates/repo/issue/view_content/pull_merge_box.tmpl
#	templates/repo/pulls/status.tmpl
eleboucher pushed a commit to eleboucher/apoci that referenced this pull request May 20, 2026
@eleboucher
fix(deps): update module code.gitea.io/gitea (v1.26.1 → v1.26.2) (#47)
ce5a949 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [code.gitea.io/gitea](https://github.com/go-gitea/gitea) | `v1.26.1` → `v1.26.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/code.gitea.io%2fgitea/v1.26.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.gitea.io%2fgitea/v1.26.1/v1.26.2?slim=true) |

---

### Release Notes

<details>
<summary>go-gitea/gitea (code.gitea.io/gitea)</summary>

### [`v1.26.2`](https://github.com/go-gitea/gitea/releases/tag/v1.26.2)

[Compare Source](go-gitea/gitea@v1.26.1...v1.26.2)

- SECURITY
  - fix(permissions): Fix reading permission ([#&#8203;37769](go-gitea/gitea#37769))
  - fix(actions): make artifact signature payloads unambiguous ([#&#8203;37707](go-gitea/gitea#37707))
  - fix: Unify public-only token filtering in API queries and repo access checks ([#&#8203;37118](go-gitea/gitea#37118))
  - fix: Add missed token scope checking ([#&#8203;37735](go-gitea/gitea#37735))
  - fix(oauth): bind token exchanges to the original client request ([#&#8203;37704](go-gitea/gitea#37704))
  - fix(oauth): strengthen PKCE validation and refresh token replay protection ([#&#8203;37706](go-gitea/gitea#37706))
  - fix(web): enforce token scopes on raw, media, and attachment downloads ([#&#8203;37698](go-gitea/gitea#37698))
  - fix(security): enforce wiki git writes and LFS token access at request time ([#&#8203;37695](go-gitea/gitea#37695))
  - feat(api): encrypt AWS creds ([#&#8203;37679](go-gitea/gitea#37679))
  - fix(deps): update dependency mermaid to v11.15.0 \[security], add e2e test
  - fix(packages): Add label for private and internal package and fix composor package source permission check ([#&#8203;37610](go-gitea/gitea#37610))
  - fix(git): Fix smart http request scope bug ([#&#8203;37583](go-gitea/gitea#37583))
  - Fix basic auth bug ([#&#8203;37503](go-gitea/gitea#37503))
  - Fix allow maintainer edit permission check ([#&#8203;37479](go-gitea/gitea#37479)) ([#&#8203;37484](go-gitea/gitea#37484))
  - Fix URL sanitization to handle schemeless credentials ([#&#8203;37440](go-gitea/gitea#37440)) ([#&#8203;37471](go-gitea/gitea#37471))
  - Fix attachment Content-Security-Policy ([#&#8203;37455](go-gitea/gitea#37455)) ([#&#8203;37464](go-gitea/gitea#37464))
  - chore(deps): bump go-git/go-git/v5 to 5.19.0 ([#&#8203;37608](go-gitea/gitea#37608))

- BUGFIXES
  - fix(pull): handle empty pull request files view to allow reviews ([#&#8203;37783](go-gitea/gitea#37783))
  - fix(markup): make RenderString never fail ([#&#8203;37779](go-gitea/gitea#37779))
  - fix: add natural sort to sortTreeViewNodes ([#&#8203;37772](go-gitea/gitea#37772))
  - fix: package creation unique conflict ([#&#8203;37774](go-gitea/gitea#37774))
  - fix!: add DEFAULT\_TITLE\_SOURCE setting for pull request title default behavior ([#&#8203;37465](go-gitea/gitea#37465))
  - fix: Allow direct commits for unprotected files with push restrictions ([#&#8203;37657](go-gitea/gitea#37657))
  - fix(actions): wrong assumption that run id always >= job id ([#&#8203;37737](go-gitea/gitea#37737))
  - fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register ([#&#8203;37564](go-gitea/gitea#37564)) ([#&#8203;37588](go-gitea/gitea#37588))
  - fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState ([#&#8203;37692](go-gitea/gitea#37692))
  - fix(repo): /generate must sync the branch table for the new repo ([#&#8203;37693](go-gitea/gitea#37693))
  - build: Fix snap build (1.26)
  - fix(actions): run TransferLogs on UpdateLog{Rows:\[], NoMore:true} ([#&#8203;37631](go-gitea/gitea#37631))
  - fix show correct mergebase
  - fix: make clone URL respect public URL detection setting ([#&#8203;37615](go-gitea/gitea#37615))
  - fix: "run as root" check ([#&#8203;37622](go-gitea/gitea#37622))
  - chore(deps): update dependency go to v1.26.3 ([#&#8203;37601](go-gitea/gitea#37601))
  - Compare dropdown fails when selecting branch with no common merge-base ([#&#8203;37470](go-gitea/gitea#37470))
  - fix: treat email addresses case-insensitively ([#&#8203;37600](go-gitea/gitea#37600))
  - fix(actions): fix blank lines after ::endgroup:: ([#&#8203;37597](go-gitea/gitea#37597))
  - fix(actions): report individual step status in workflow job API response ([#&#8203;37592](go-gitea/gitea#37592))
  - fix: Invalid UTF-8 commit messages in JSON API responses ([#&#8203;37542](go-gitea/gitea#37542))
  - fix: use consistent GetUser family functions ([#&#8203;37553](go-gitea/gitea#37553))
  - fix(api): return 409 message instead of empty JSON for wrong commit id ([#&#8203;37572](go-gitea/gitea#37572))
  - fix(actions): prevent panic when workflow contains null jobs ([#&#8203;37570](go-gitea/gitea#37570))
  - Make ServeSetHeaders default to download attachment if filename exists ([#&#8203;37552](go-gitea/gitea#37552)) ([#&#8203;37555](go-gitea/gitea#37555))
  - Fix(actions): validate workflow param to prevent 500 error ([#&#8203;37546](go-gitea/gitea#37546)) ([#&#8203;37554](go-gitea/gitea#37554))
  - Don't unblock run-level-concurrency-blocked runs in the resolver ([#&#8203;37461](go-gitea/gitea#37461)) ([#&#8203;37538](go-gitea/gitea#37538))
  - Fix(packages): use file names for generic web downloads ([#&#8203;37514](go-gitea/gitea#37514)) ([#&#8203;37520](go-gitea/gitea#37520))
  - Fix merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once ([#&#8203;37512](go-gitea/gitea#37512)) ([#&#8203;37516](go-gitea/gitea#37516))
  - Fix update branch protection order ([#&#8203;37508](go-gitea/gitea#37508)) ([#&#8203;37513](go-gitea/gitea#37513))
  - Fix mCaptcha broken after Vite migration ([#&#8203;37492](go-gitea/gitea#37492)) ([#&#8203;37509](go-gitea/gitea#37509))
  - Fix review submission from single-commit PR view ([#&#8203;37475](go-gitea/gitea#37475)) ([#&#8203;37485](go-gitea/gitea#37485))
  - Fix scheduled action panic with null event payload ([#&#8203;37459](go-gitea/gitea#37459)) ([#&#8203;37466](go-gitea/gitea#37466))
  - Make GetPossibleUserByID can handle deleted user ([#&#8203;37430](go-gitea/gitea#37430)) ([#&#8203;37431](go-gitea/gitea#37431))
  - Remove excessive quote from terraform instructions ([#&#8203;37424](go-gitea/gitea#37424)) ([#&#8203;37426](go-gitea/gitea#37426))
  - Fix color regressions, add `priority` color ([#&#8203;37417](go-gitea/gitea#37417)) ([#&#8203;37421](go-gitea/gitea#37421))

- MISC
  - Add CurrentURL template variable back ([#&#8203;37444](go-gitea/gitea#37444)) ([#&#8203;37449](go-gitea/gitea#37449))

Instances on **[Gitea Cloud](https://cloud.gitea.com)** will be automatically upgraded to this version during the specified maintenance window.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/apoci/pulls/47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lunny lunny lunny approved these changes

@wxiaoguang wxiaoguang wxiaoguang approved these changes

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/v1.26 This PR should be backported to Gitea 1.26 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/bug

Projects

None yet

Milestone

1.27.0

Development

Successfully merging this pull request may close these issues.

5 participants

@KalashThakare @wxiaoguang @silverwind @lunny @GiteaBot