From dfe89dfb6bf22dcbd2a6203bef8aa262e65ea085 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 23 Aug 2026 12:44:52 +0000 Subject: [PATCH 1/3] fix(deps): update go toolchain directive to v1.26.6 [security] (#1103) Co-authored-by: Renovate Bot --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index fba7910c..2f0b38e4 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module gitea.dev/tea go 1.26.0 -toolchain go1.26.5 +toolchain go1.26.6 require ( charm.land/glamour/v2 v2.0.1 From bfda25be63dc3c35593140efb28c386b5ca7d8f0 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Sun, 23 Aug 2026 12:46:22 +0000 Subject: [PATCH 2/3] Read issue/PR description from stdin or a file (#1096) Closes #1095. `tea issues create` and `tea pulls create` now resolve the description in the same way as comments: when stdin is piped and neither `--description` nor `--description-file` is given, the body is read from stdin. Both create and edit commands also accept: ```text --description-file # '-' reads stdin ``` This avoids the PowerShell 5.1 argument mangling and ANSI code page issues described in #1095. ## Changes - Add `--description-file` to `issues create`, `issues edit`, `pulls create`, and `pulls edit`. - Create commands fall back to piped stdin when no description flag is set. - Add unit tests for the new body resolution. --------- Co-authored-by: bircni Reviewed-on: https://gitea.com/gitea/tea/pulls/1096 Reviewed-by: bircni Co-authored-by: Lunny Xiao --- cmd/flags/body.go | 73 +++++++++++++++++++ cmd/flags/body_test.go | 161 +++++++++++++++++++++++++++++++++++++++++ cmd/flags/issue_pr.go | 33 +++++++-- docs/CLI.md | 8 ++ 4 files changed, 270 insertions(+), 5 deletions(-) create mode 100644 cmd/flags/body.go create mode 100644 cmd/flags/body_test.go diff --git a/cmd/flags/body.go b/cmd/flags/body.go new file mode 100644 index 00000000..211e3d28 --- /dev/null +++ b/cmd/flags/body.go @@ -0,0 +1,73 @@ +// Copyright 2026 The Gitea Authors. All rights reserved. +// SPDX-License-Identifier: MIT + +package flags + +import ( + "fmt" + "io" + "os" + + "golang.org/x/term" +) + +// stdinPiped reports whether stdin is not a terminal, e.g. when a description +// is piped from a file, command substitution, or a CI harness. +func stdinPiped() bool { + return !term.IsTerminal(int(os.Stdin.Fd())) +} + +// resolveCreateBody returns the issue/PR description for create commands. +// +// Precedence: +// 1. --description-file (read from the file, or stdin when the path is "-") +// 2. --description +// 3. piped stdin +func resolveCreateBody(description, descriptionFile string, descriptionFileSet, stdinPiped bool, stdin io.Reader) (string, error) { + if descriptionFileSet { + return readDescriptionSource(descriptionFile, stdin) + } + if description != "" { + return description, nil + } + if stdinPiped { + return readDescriptionStdin(stdin) + } + return "", nil +} + +// resolveEditBody returns the new issue/PR body when a description flag was +// provided, or nil when the caller should leave the body unchanged. +func resolveEditBody(description string, descriptionSet bool, descriptionFile string, descriptionFileSet bool, stdin io.Reader) (*string, error) { + if descriptionFileSet { + body, err := readDescriptionSource(descriptionFile, stdin) + if err != nil { + return nil, err + } + return &body, nil + } + if descriptionSet { + body := description + return &body, nil + } + return nil, nil +} + +func readDescriptionSource(source string, stdin io.Reader) (string, error) { + if source == "-" { + return readDescriptionStdin(stdin) + } + data, err := os.ReadFile(source) + if err != nil { + return "", fmt.Errorf("could not read description file %q: %w", source, err) + } + return string(data), nil +} + +func readDescriptionStdin(stdin io.Reader) (string, error) { + data, err := io.ReadAll(stdin) + if err != nil { + return "", fmt.Errorf("could not read description from stdin: %w", err) + } + return string(data), nil +} diff --git a/cmd/flags/body_test.go b/cmd/flags/body_test.go new file mode 100644 index 00000000..dc3651bb --- /dev/null +++ b/cmd/flags/body_test.go @@ -0,0 +1,161 @@ +// Copyright 2026 The Gitea Authors. All rights reserved. +// SPDX-License-Identifier: MIT + +package flags + +import ( + "os" + "path/filepath" + "strings" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestResolveCreateBody(t *testing.T) { + file := filepath.Join(t.TempDir(), "body.md") + require.NoError(t, os.WriteFile(file, []byte("from file"), 0o600)) + + tests := []struct { + name string + description string + descriptionFile string + descriptionFileSet bool + stdinPiped bool + stdin string + want string + }{ + { + name: "description flag", + description: "from -d", + want: "from -d", + }, + { + name: "description file", + descriptionFile: file, + descriptionFileSet: true, + want: "from file", + }, + { + name: "description file wins over description", + description: "from -d", + descriptionFile: file, + descriptionFileSet: true, + want: "from file", + }, + { + name: "dash reads stdin", + descriptionFile: "-", + descriptionFileSet: true, + stdin: "from stdin", + want: "from stdin", + }, + { + name: "description wins over piped stdin", + description: "from -d", + stdinPiped: true, + stdin: "from stdin", + want: "from -d", + }, + { + name: "piped stdin", + stdinPiped: true, + stdin: "from stdin", + want: "from stdin", + }, + { + name: "empty description falls back to piped stdin", + description: "", + stdinPiped: true, + stdin: "from stdin", + want: "from stdin", + }, + { + name: "empty when no source provided", + want: "", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := resolveCreateBody(tt.description, tt.descriptionFile, tt.descriptionFileSet, tt.stdinPiped, strings.NewReader(tt.stdin)) + require.NoError(t, err) + assert.Equal(t, tt.want, got) + }) + } +} + +func TestResolveEditBody(t *testing.T) { + file := filepath.Join(t.TempDir(), "body.md") + require.NoError(t, os.WriteFile(file, []byte("from file"), 0o600)) + + tests := []struct { + name string + description string + descriptionSet bool + descriptionFile string + descriptionFileSet bool + stdin string + wantBody string + wantSet bool + }{ + { + name: "no description flag", + }, + { + name: "description flag", + description: "from -d", + descriptionSet: true, + wantBody: "from -d", + wantSet: true, + }, + { + name: "empty description clears body", + descriptionSet: true, + wantSet: true, + }, + { + name: "description file", + descriptionFile: file, + descriptionFileSet: true, + wantBody: "from file", + wantSet: true, + }, + { + name: "description file wins over description", + description: "from -d", + descriptionSet: true, + descriptionFile: file, + descriptionFileSet: true, + wantBody: "from file", + wantSet: true, + }, + { + name: "dash reads stdin", + descriptionFile: "-", + descriptionFileSet: true, + stdin: "from stdin", + wantBody: "from stdin", + wantSet: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := resolveEditBody(tt.description, tt.descriptionSet, tt.descriptionFile, tt.descriptionFileSet, strings.NewReader(tt.stdin)) + require.NoError(t, err) + if !tt.wantSet { + assert.Nil(t, got) + return + } + require.NotNil(t, got) + assert.Equal(t, tt.wantBody, *got) + }) + } +} + +func TestResolveDescriptionSourceError(t *testing.T) { + _, err := resolveCreateBody("", filepath.Join(t.TempDir(), "missing.md"), true, false, strings.NewReader("")) + require.ErrorContains(t, err, "could not read description file") +} diff --git a/cmd/flags/issue_pr.go b/cmd/flags/issue_pr.go index 65d96da2..3259c885 100644 --- a/cmd/flags/issue_pr.go +++ b/cmd/flags/issue_pr.go @@ -100,6 +100,10 @@ var issuePRFlags = append([]cli.Flag{ Name: "description", Aliases: []string{"d"}, }, + &cli.StringFlag{ + Name: "description-file", + Usage: "Read description from file ('-' for stdin)", + }, &cli.StringFlag{ Name: "referenced-version", Aliases: []string{"v"}, @@ -133,12 +137,22 @@ var IssuePRCreateFlags = append([]cli.Flag{ // GetIssuePRCreateFlags parses all IssuePREditFlags func GetIssuePRCreateFlags(requestCtx stdctx.Context, ctx *context.TeaContext) (*gitea.CreateIssueOption, error) { + body, err := resolveCreateBody( + ctx.String("description"), + ctx.String("description-file"), + ctx.IsSet("description-file"), + stdinPiped(), + ctx.Reader, + ) + if err != nil { + return nil, err + } + opts := gitea.CreateIssueOption{ Title: ctx.String("title"), - Body: ctx.String("description"), + Body: body, Assignees: strings.Split(ctx.String("assignees"), ","), } - var err error date := ctx.String("deadline") if date != "" { @@ -208,9 +222,18 @@ func GetIssuePREditFlags(ctx *context.TeaContext) (*task.EditIssueOption, error) val := ctx.String("title") opts.Title = &val } - if ctx.IsSet("description") { - val := ctx.String("description") - opts.Body = &val + body, err := resolveEditBody( + ctx.String("description"), + ctx.IsSet("description"), + ctx.String("description-file"), + ctx.IsSet("description-file"), + ctx.Reader, + ) + if err != nil { + return nil, err + } + if body != nil { + opts.Body = body } if ctx.IsSet("referenced-version") { val := ctx.String("referenced-version") diff --git a/docs/CLI.md b/docs/CLI.md index 3f74a38e..e9a57e65 100644 --- a/docs/CLI.md +++ b/docs/CLI.md @@ -221,6 +221,8 @@ Create an issue on repository **--description, -d**="": +**--description-file**="": Read description from file ('-' for stdin) + **--labels, -L**="": Comma-separated list of labels to assign **--login, -l**="": Use a different Gitea Login. Optional @@ -247,6 +249,8 @@ Edit one or more issues **--description, -d**="": +**--description-file**="": Read description from file ('-' for stdin) + **--login, -l**="": Use a different Gitea Login. Optional **--milestone, -m**="": Milestone to assign @@ -379,6 +383,8 @@ Create a pull-request **--description, -d**="": +**--description-file**="": Read description from file ('-' for stdin) + **--draft**: Create as a draft (prepends "WIP: " to the title; Gitea treats WIP-prefixed PRs as drafts) **--head**="": Branch name of the PR source (default is current one). To specify a different head repo, use : @@ -437,6 +443,8 @@ Edit one or more pull requests **--description, -d**="": +**--description-file**="": Read description from file ('-' for stdin) + **--draft**: Mark as draft by prepending "WIP: " to the title (idempotent) **--login, -l**="": Use a different Gitea Login. Optional From 22d43ec9b6530d636294845209e11fec4d98ff1f Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Sun, 23 Aug 2026 19:20:19 +0000 Subject: [PATCH 3/3] fix(login): avoid panic when parsing auto-discovered SSH keys (#1100) ## Problem `tea login add` can panic while auto-discovering SSH keys. The interactive login flow calls `regexp.FindStringSubmatch` and immediately indexes `[1]` without checking whether the regex matched. When the selected key display string does not have the expected format, the returned slice is `nil` and tea crashes with: ``` panic: runtime error: index out of range [1] with length 0 ``` This is the crash reported in #527. ## Root cause `regexp.Regexp.FindStringSubmatch` returns `nil` when the input does not match. Indexing that result with `[1]` assumes a match and causes the panic. The same unchecked pattern exists for SSH certificates and plain public keys in `modules/interact/login.go`. ## Changes - Extract auto-discovered SSH key/certificate display parsing into `parseSSHPubkeySelection`. - Add a `regexpSubmatch` helper that returns an error when a regex does not match, so login fails with a descriptive error instead of panicking. - Add table-driven tests for local/agent keys, local/agent certificates, and malformed input. Fixes #527 --------- Co-authored-by: bircni Reviewed-on: https://gitea.com/gitea/tea/pulls/1100 Reviewed-by: bircni Co-authored-by: Lunny Xiao --- modules/interact/login.go | 56 +++++++++++++++++---------- modules/interact/login_test.go | 69 ++++++++++++++++++++++++++++++++++ 2 files changed, 106 insertions(+), 19 deletions(-) create mode 100644 modules/interact/login_test.go diff --git a/modules/interact/login.go b/modules/interact/login.go index b59d24b9..d0c0d2e2 100644 --- a/modules/interact/login.go +++ b/modules/interact/login.go @@ -200,25 +200,9 @@ func CreateLogin(ctx context.Context) error { } printTitleAndContent("Selected ssh-key:", sshKey) - // ssh certificate - if strings.Contains(sshKey, "principals") { - sshCertPrincipal = regexp.MustCompile(`.*?principals: (.*?)[,|\s]`).FindStringSubmatch(sshKey)[1] - if strings.Contains(sshKey, "(ssh-agent)") { - sshAgent = true - sshKey = "" - } else { - sshKey = regexp.MustCompile(`\((.*?)\)$`).FindStringSubmatch(sshKey)[1] - sshKey = strings.TrimSuffix(sshKey, "-cert.pub") - } - } else { - sshKeyFingerprint = regexp.MustCompile(`(SHA256:.*?)\s`).FindStringSubmatch(sshKey)[1] - if strings.Contains(sshKey, "(ssh-agent)") { - sshAgent = true - sshKey = "" - } else { - sshKey = regexp.MustCompile(`\((.*?)\)$`).FindStringSubmatch(sshKey)[1] - sshKey = strings.TrimSuffix(sshKey, ".pub") - } + sshKey, sshCertPrincipal, sshKeyFingerprint, sshAgent, err = parseSSHPubkeySelection(sshKey) + if err != nil { + return err } } } @@ -274,6 +258,40 @@ func CreateLogin(ctx context.Context) error { return task.CreateLogin(ctx, name, token, user, passwd, otp, scopes, sshKey, giteaURL, sshCertPrincipal, sshKeyFingerprint, insecure, sshAgent, versionCheck, helper) } +func parseSSHPubkeySelection(display string) (sshKey, sshCertPrincipal, sshKeyFingerprint string, sshAgent bool, err error) { + if strings.Contains(display, "principals") { + if sshCertPrincipal, err = regexpSubmatch(regexp.MustCompile(`.*?principals: (.*?)[,|\s]`), display); err != nil { + return "", "", "", false, fmt.Errorf("failed to parse SSH certificate principal from %q: %w", display, err) + } + if strings.HasSuffix(display, "(ssh-agent)") { + return "", sshCertPrincipal, "", true, nil + } + if sshKey, err = regexpSubmatch(regexp.MustCompile(`\((.*?)\)$`), display); err != nil { + return "", "", "", false, fmt.Errorf("failed to parse SSH certificate path from %q: %w", display, err) + } + return strings.TrimSuffix(sshKey, "-cert.pub"), sshCertPrincipal, "", false, nil + } + + if sshKeyFingerprint, err = regexpSubmatch(regexp.MustCompile(`(SHA256:.*?)\s`), display); err != nil { + return "", "", "", false, fmt.Errorf("failed to parse SSH key fingerprint from %q: %w", display, err) + } + if strings.HasSuffix(display, "(ssh-agent)") { + return "", "", sshKeyFingerprint, true, nil + } + if sshKey, err = regexpSubmatch(regexp.MustCompile(`\((.*?)\)$`), display); err != nil { + return "", "", "", false, fmt.Errorf("failed to parse SSH key path from %q: %w", display, err) + } + return strings.TrimSuffix(sshKey, ".pub"), "", sshKeyFingerprint, false, nil +} + +func regexpSubmatch(re *regexp.Regexp, s string) (string, error) { + match := re.FindStringSubmatch(s) + if len(match) < 2 { + return "", fmt.Errorf("no match") + } + return match[1], nil +} + var tokenScopeOpts = []string{ string(gitea.AccessTokenScopeAll), string(gitea.AccessTokenScopeRepo), diff --git a/modules/interact/login_test.go b/modules/interact/login_test.go new file mode 100644 index 00000000..e763ce4b --- /dev/null +++ b/modules/interact/login_test.go @@ -0,0 +1,69 @@ +// Copyright 2026 The Gitea Authors. All rights reserved. +// SPDX-License-Identifier: MIT + +package interact + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestParseSSHPubkeySelection(t *testing.T) { + tests := []struct { + name string + display string + wantSSHKey string + wantCertPrincipal string + wantKeyFingerprint string + wantSSHAgent bool + wantErr bool + }{ + { + name: "local ed25519 key", + display: "SHA256:abc ssh-ed25519 comment (/home/user/.ssh/id_ed25519.pub)", + wantSSHKey: "/home/user/.ssh/id_ed25519", + wantKeyFingerprint: "SHA256:abc", + }, + { + name: "agent ed25519 key", + display: "SHA256:abc ssh-ed25519 comment (ssh-agent)", + wantKeyFingerprint: "SHA256:abc", + wantSSHAgent: true, + }, + { + name: "local certificate", + display: "SHA256:abc ssh-ed25519-cert-v01@openssh.com comment - principals: user1,user2 (/home/user/.ssh/id_ed25519-cert.pub)", + wantSSHKey: "/home/user/.ssh/id_ed25519", + wantCertPrincipal: "user1", + }, + { + name: "agent certificate", + display: "SHA256:abc ssh-ed25519-cert-v01@openssh.com comment - principals: user1 (ssh-agent)", + wantCertPrincipal: "user1", + wantSSHAgent: true, + }, + { + name: "unexpected display", + display: "ssh-ed25519 comment", + wantErr: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + sshKey, certPrincipal, keyFingerprint, sshAgent, err := parseSSHPubkeySelection(tt.display) + if tt.wantErr { + require.Error(t, err) + return + } + + require.NoError(t, err) + assert.Equal(t, tt.wantSSHKey, sshKey) + assert.Equal(t, tt.wantCertPrincipal, certPrincipal) + assert.Equal(t, tt.wantKeyFingerprint, keyFingerprint) + assert.Equal(t, tt.wantSSHAgent, sshAgent) + }) + } +}