LoginSign Up
← Back to all sparks
G

Gitea

INFRA · APIS
Velocity0.0

Lightweight self-hosted Git service with issues, pull requests and CI

about.gitea.com ↗

Gitea's release notes are now mostly Actions: org-scoped workflows, concurrency, and the security debt that follows.

git-forgeci-actionsself-hostedaccess-controlpackage-registry
◆Current state
Only release candidates and a dev tag are visible in this window, and both RCs lead with the same theme. 1.26.0-rc0 added Actions concurrency syntax, a Terraform state registry, instance-wide maintenance mode and OpenAPI spec rendering. 1.27.0-rc0 followed with reusable workflow support marked breaking, owner-level and globally scoped workflows, and five security fixes — three of them about access control rather than memory safety.
◆Where it's heading
Gitea is building out CI to the point where workflows are an instance-level asset, not a per-repository file, and the security fixes track that expansion: denying fork-PR cross-repo access through a collaborative owner, restricting OAuth introspection to the issuing client, closing private org membership leakage through public_members. Each is a permission boundary that the broader Actions and API surface put under new pressure.
◆Prediction
Expect the 1.27 line to reach stable with the reusable-workflow breaking change intact, and further access-control fixes as owner-level and global workflows meet real multi-tenant instances.

◆Recent moves

  1. 1mo ago

    Owner-level and global workflows, plus five access-control fixes

    Reusable workflow support improves in a way marked breaking, and workflows gain owner-level and global scoping. The security batch is the interesting half: fork-PR cross-repo access via a collaborative owner, OAuth introspection scope, private org membership exposed through public_members, and path traversal in repository restore.

    View source ↗
  2. 1mo ago

    Rolling dev tag, dependency bump only

    A rolling development tag carrying a single GitLab client dependency update. It appears in the release feed but is not a release.

    View source ↗
  3. 3mo ago

    Actions concurrency syntax, Terraform state registry, maintenance mode

    Adds concurrency control to Actions, a Terraform state registry alongside the existing package registries, an instance-wide info banner with maintenance mode, and OpenAPI spec rendering. The breaking changes are API-shaped — corrected swagger annotations and a removed registration-token endpoint.

    View source ↗