forgejo/routers
abdo e16dc2ebfd fix: apply signed-merge checks by merge style (#11403)
Fixes #6438

When a protected branch requires signed commits and no signing key is available, fast-forward-only merges should still be allowed because they do not create a new commit.

This patch applies signing checks by merge behaviour/style instead of one global gate:

- pass `mergeStyle` through `CheckPullMergeable(...)` in web/API/automerge paths
- require signing for commit-creating styles (`merge`, `rebase`, `rebase-merge`, `squash`)
- bypass signing precheck only for `fast-forward-only`
- align merge UI options with backend behaviour so signing-dependent styles are unavailable when signing cannot happen
- add Go unit tests for merge-style signing requirements
- add frontend unit coverage for the no-allowed-merge-styles guard

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11403
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: abdo <dev@abdo.wtf>
Co-committed-by: abdo <dev@abdo.wtf>
2026-04-09 20:26:27 +02:00
..
api fix: apply signed-merge checks by merge style (#11403) 2026-04-09 20:26:27 +02:00
common Update module code.forgejo.org/go-chi/session to v1.0.3 (forgejo) (#11324) 2026-03-20 08:18:51 +01:00
install chore: add modernizer linter (#11936) 2026-04-02 03:29:37 +02:00
private chore: add modernizer linter (#11936) 2026-04-02 03:29:37 +02:00
utils [PORT] drop utils.IsExternalURL (and expand IsRiskyRedirectURL tests) (#3167) 2024-04-15 13:03:08 +00:00
web fix: apply signed-merge checks by merge style (#11403) 2026-04-09 20:26:27 +02:00
init.go fix: don't clobber authorized_keys file during installation (#10948) 2026-01-23 18:38:09 +01:00