Add release notes for 1.24.0rc0 (#34305 )

Fix the ci build (#34309 ) (#34310 )
Backport #34309 by @lunny Fix https://github.com/go-gitea/gitea/actions/runs/14722306878/job/41318217870 A fork has been created under https://gitea.com/gitea/go-xsd-duration Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2025-09-03 08:10:38 +02:00 · 2025-04-29 21:45:47 +00:00 · 2025-04-28 22:48:55 -07:00
1800 changed files with 28191 additions and 37177 deletions
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,17 +1,13 @@
 {
  "name": "Gitea DevContainer",
  "image": "mcr.microsoft.com/devcontainers/go:1.24-bookworm",
-  "containerEnv": {
-    // override "local" from packaged version
-    "GOTOOLCHAIN": "auto"
-  },
  "features": {
    // installs nodejs into container
    "ghcr.io/devcontainers/features/node:1": {
-      "version": "lts"
+      "version": "20"
    },
    "ghcr.io/devcontainers/features/git-lfs:1.2.2": {},
-    "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {},
+    "ghcr.io/devcontainers-contrib/features/poetry:2": {},
    "ghcr.io/devcontainers/features/python:1": {
      "version": "3.12"
    },
--- a/.dockerignore
+++ b/.dockerignore
@@ -36,6 +36,15 @@ _testmain.go
 coverage.all
 cpu.out

+/modules/migration/bindata.go
+/modules/migration/bindata.go.hash
+/modules/options/bindata.go
+/modules/options/bindata.go.hash
+/modules/public/bindata.go
+/modules/public/bindata.go.hash
+/modules/templates/bindata.go
+/modules/templates/bindata.go.hash
+
 *.db
 *.log

--- a/.eslintrc.cjs
+++ b/.eslintrc.cjs
@@ -91,7 +91,6 @@ module.exports = {
      plugins: ['@vitest/eslint-plugin'],
      globals: vitestPlugin.environments.env.globals,
      rules: {
-        'github/unescaped-html-literal': [0],
        '@vitest/consistent-test-filename': [0],
        '@vitest/consistent-test-it': [0],
        '@vitest/expect-expect': [0],
@@ -326,7 +325,6 @@ module.exports = {
    '@typescript-eslint/no-unnecessary-type-arguments': [0],
    '@typescript-eslint/no-unnecessary-type-assertion': [2],
    '@typescript-eslint/no-unnecessary-type-constraint': [2],
-    '@typescript-eslint/no-unnecessary-type-conversion': [2],
    '@typescript-eslint/no-unsafe-argument': [0],
    '@typescript-eslint/no-unsafe-assignment': [0],
    '@typescript-eslint/no-unsafe-call': [0],
@@ -425,7 +423,7 @@ module.exports = {
    'github/no-useless-passive': [2],
    'github/prefer-observers': [2],
    'github/require-passive-events': [2],
-    'github/unescaped-html-literal': [2],
+    'github/unescaped-html-literal': [0],
    'grouped-accessor-pairs': [2],
    'guard-for-in': [0],
    'id-blacklist': [0],
@@ -484,7 +482,7 @@ module.exports = {
    'max-nested-callbacks': [0],
    'max-params': [0],
    'max-statements': [0],
-    'multiline-comment-style': [0],
+    'multiline-comment-style': [2, 'separate-lines'],
    'new-cap': [0],
    'no-alert': [0],
    'no-array-constructor': [0], // handled by @typescript-eslint/no-array-constructor
@@ -646,7 +644,7 @@ module.exports = {
    'no-multi-str': [2],
    'no-negated-condition': [0],
    'no-nested-ternary': [0],
-    'no-new-func': [0], // handled by @typescript-eslint/no-implied-eval
+    'no-new-func': [2],
    'no-new-native-nonconstructor': [2],
    'no-new-object': [2],
    'no-new-symbol': [2],
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -61,7 +61,7 @@ modifies/dependencies:
          - "package.json"
          - "package-lock.json"
          - "pyproject.toml"
-          - "uv.lock"
+          - "poetry.lock"
          - "go.mod"
          - "go.sum"

@@ -81,13 +81,3 @@ docs-update-needed:
  - changed-files:
      - any-glob-to-any-file:
          - "custom/conf/app.example.ini"
-
-topic/code-linting:
-  - changed-files:
-      - any-glob-to-any-file:
-          - ".eslintrc.cjs"
-          - ".golangci.yml"
-          - ".markdownlint.yaml"
-          - ".spectral.yaml"
-          - ".yamllint.yaml"
-          - "stylelint.config.js"
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -77,7 +77,7 @@ jobs:
              - "tools/lint-templates-*.js"
              - "templates/**/*.tmpl"
              - "pyproject.toml"
-              - "uv.lock"
+              - "poetry.lock"

            docker:
              - "Dockerfile"
@@ -98,3 +98,4 @@ jobs:
              - "**/*.yaml"
              - ".yamllint.yaml"
              - "pyproject.toml"
+              - "poetry.lock"
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -32,13 +32,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
-      - run: uv python install 3.12
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
+      - run: pip install poetry
      - run: make deps-py
      - run: make deps-frontend
      - run: make lint-templates
@@ -49,8 +51,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v6
-      - run: uv python install 3.12
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install poetry
      - run: make deps-py
      - run: make lint-yaml

@@ -62,7 +66,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend
@@ -133,7 +137,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend
@@ -182,7 +186,7 @@ jobs:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      pgsql:
-        image: postgres:14
+        image: postgres:12
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -25,7 +25,7 @@ jobs:
          check-latest: true
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend frontend deps-backend
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -22,7 +22,7 @@ jobs:
          check-latest: true
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend deps-backend
@@ -75,6 +75,11 @@ jobs:
      - name: Get cleaned branch name
        id: clean_name
        run: |
+          # if main then say nightly otherwise cleanup name
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "branch=nightly" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: Login to Docker Hub
@@ -117,6 +122,11 @@ jobs:
      - name: Get cleaned branch name
        id: clean_name
        run: |
+          # if main then say nightly otherwise cleanup name
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "branch=nightly" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: Login to Docker Hub
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -23,7 +23,7 @@ jobs:
          check-latest: true
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend deps-backend
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -27,7 +27,7 @@ jobs:
          check-latest: true
      - uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version: 22
          cache: npm
          cache-dependency-path: package-lock.json
      - run: make deps-frontend deps-backend
--- a/.gitignore
+++ b/.gitignore
@@ -22,9 +22,6 @@ _test
 .vscode
 __debug_bin*

-# Visual Studio
-/.vs/
-
 *.cgo1.go
 *.cgo2.c
 _cgo_defun.c
@@ -42,10 +39,14 @@ _testmain.go
 coverage.all
 cpu.out

-/modules/migration/bindata.*
-/modules/options/bindata.*
-/modules/public/bindata.*
-/modules/templates/bindata.*
+/modules/migration/bindata.go
+/modules/migration/bindata.go.hash
+/modules/options/bindata.go
+/modules/options/bindata.go.hash
+/modules/public/bindata.go
+/modules/public/bindata.go.hash
+/modules/templates/bindata.go
+/modules/templates/bindata.go.hash

 *.db
 *.log
@@ -109,15 +110,3 @@ prime/

 # Manpage
 /man
-
-# Ignore AI/LLM instruction files
-/.claude/
-/.cursorrules
-/.cursor/
-/.goosehints
-/.windsurfrules
-/.github/copilot-instructions.md
-/AGENT.md
-/CLAUDE.md
-/llms.txt
-
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -45,13 +45,7 @@ linters:
              desc: do not use the ini package, use gitea's config system instead
            - pkg: gitea.com/go-chi/cache
              desc: do not use the go-chi cache package, use gitea's cache system
-    nolintlint:
-      allow-unused: false
-      require-explanation: true
-      require-specific: true
    gocritic:
-      enabled-checks:
-        - equalFold
      disabled-checks:
        - ifElseChain
        - singleCaseSwitch # Every time this occurred in the code, there was no other way.
@@ -89,10 +83,6 @@ linters:
        - name: unreachable-code
        - name: var-declaration
        - name: var-naming
-          arguments:
-            - [] # AllowList - do not remove as args for the rule are positional and won't work without lists first
-            - [] # DenyList
-            - - skip-package-name-checks: true # supress errors from underscore in migration packages
    staticcheck:
      checks:
        - all
--- a/.ignore
+++ b/.ignore
@@ -1,6 +1,9 @@
 *.min.css
 *.min.js
 /assets/*.json
+/modules/options/bindata.go
+/modules/public/bindata.go
+/modules/templates/bindata.go
 /options/gitignore
 /options/license
 /public/assets
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.24.0](https://github.com/go-gitea/gitea/releases/tag/1.24.0) - 2025-05-26
+## [1.24.0-rc0](https://github.com/go-gitea/gitea/releases/tag/1.24.0-rc0) - 2025-04-28

 * BREAKING
  * Make Gitea always use its internal config, ignore `/etc/gitconfig` (#33076)
@@ -41,7 +41,6 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Improve pull request list API performance (#34052)
  * Cache GPG keys, emails and users when list commits (#34086)
  * Refactor Git Attribute & performance optimization (#34154)
-  * Performance optimization for tags synchronization (#34355) #34522

 * ENHANCEMENTS
  * Code
@@ -68,7 +67,6 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
    * Workflow_dispatch use workflow from trigger branch (#33098)
    * Add action auto-scroll (#30057)
    * Add workflow_job webhook (#33694)
-    * Add a button editing action secret (#34462)

  * Pull Request
    * Auto expand "New PR" form (#33971)
@@ -82,7 +80,6 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
    * Show warning on navigation if currently editing comment or title (#32920)
    * Make tracked time representation display as hours (#33315)
    * Add No Results Prompt Message on Issue List Page (#33699)
-    * Add sort option recentclose for issues and pulls (#34525) #34539

  * Packages
    * Link to nuget dependencies (#26554)
@@ -219,28 +216,6 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Simplify context ref name (#33267)

 * BUGFIXES
-  * Fix some dropdown problems on the issue sidebar (#34308) #34327
-  * Do not return archive download URLs in API if downloads are disabled (#34324) #34338
-  * Fix LFS files being editable in web UI (#34356) #34362
-  * Fix only text/* being viewable in web UI (#34374) #34378
-  * Fix LFS file not stored in LFS when uploaded/edited via API or web UI (#34367)
-  * Grey out expired artifact on Artifacts list (#34314) #34404
-  * Fix incorrect divergence cache after switching default branch (#34370) #34406
-  * Refactor commit message rendering and fix bugs (#34412) #34414
-  * Merge and tweak markup editor expander CSS (#34409) #34415
-  * Fix GetUsersByEmails (#34423) #34425
-  * Only git operations should update last changed of a repository (#34388) #34427
-  * Fix comment textarea scroll issue in Firefox (#34438) #34446
-  * Fix repo broken check (#34444) #34452
-  * Fix remove org user failure on mssql (#34449) #34453
-  * Fix Workflow run Not Found page (#34459) #34466
-  * When updating comment, if the content is the same, just return and not update the database (#34422) #34464
-  * Fix project board view (#34470) #34475
-  * Fix get / delete runner to use consistent http 404 and 500 status (#34480) #34488
-  * Fix url validation in webhook add/edit API (#34492) #34496
-  * Fix edithook api can not update package, status and workflow_job events (#34495) #34499
-  * Fix ephemeral runner deletion (#34447) #34513
-  * Don't display error log when .git-blame-ignore-revs doesn't exist (#34457)
  * Only allow admins to rename default/protected branches (#33276)
  * Improve "lock conversation" UI (#34207)
  * Fix incorrect file links (#34189)
@@ -276,37 +251,8 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix dynamic content loading init problem (#33748)
  * Fix git empty check and HEAD request (#33690)
  * Fix Untranslated Text on Actions Page (#33635)
-  * Fix issue label delete incorrect labels webhook payload (#34575)
-  * Fix incorrect page navigation with up and down arrow on last item of dashboard repos (#34570)
-  * Fix/improve avatar sync from LDAP (#34573)
-  * Fix some trivial problems (#34579)
-  * Retain issue sort type when a keyword search is introduced (#34559)
-  * Always use an empty line to separate the commit message and trailer (#34512)
-  * Fix line-button issue after file selection in file tree (#34574)
-  * Fix doctor deleting orphaned issues attachments (#34142)
-  * Add webhook assigning test and fix possible bug (#34420)
-  * Fix possible nil description of pull request when migrating from CodeCommit (#34541)
-  * Refactor commit reader (#34542)
-  * Fix possible pull request broken when leave the page immediately after clicking the update button #34509
-  * Ignore "Close" error when uploading container blob (#34620)
-  * Fix missed merge commit sha and time when migrating from codecommit (#34645)
-  * Fix GetUsersByEmails (#34643)
-  * Misc CSS fixes (#34638)
-  * Add codecommit to supported services in api docs (#34626)
-  * Validate hex colors when creating/editing labels (#34623)
-  * Fix possible pull request broken when leave the page immediately after clicking the update button (#34509)
-  * Fix margin issue in markup paragraph rendering (#34599)
-  * Fix migration pull request title too long (#34577)
-  * Fix footnote jump behavior on the issue page. (#34621)
-  * Fix "oras" OCI client compatibility (#34666)
-  * Fix last admin check when syncing users (#34649)
-  * Fix skip paths check on tag push events in workflows (#34602) #34670

 * MISC
-
-  * Bump to alpine 3.22 (#34613)
-  * Make pull request and issue history more compact (#34588)
-  * Run integration tests against postgres 14 (#34514) #34536
  * Enable addtional linters (#34085)
  * Enable testifylint rules (#34075)
  * Enable staticcheck QFxxxx rules (#34064)
@@ -372,60 +318,6 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix eslint (#33002)
  * Update JS dependencies (#32914)
  * Bump x/net (#32896) (#32900)
-  * Only activity tab needs heatmap data loading (#34652)
-
-## [1.23.8](https://github.com/go-gitea/gitea/releases/tag/1.23.8) - 2025-05-11
-
-* SECURITY
-  * Fix a bug when uploading file via lfs ssh command (#34408) (#34411)
-  * Update net package (#34228) (#34232)
-* BUGFIXES
-  * Fix releases sidebar navigation link (#34436) #34439
-  * Fix bug webhook milestone is not right. (#34419) #34429
-  * Fix two missed null value checks on the wiki page. (#34205) (#34215)
-  * Swift files can be passed either as file or as form value (#34068) (#34236)
-  * Fix bug when API get pull changed files for deleted head repository (#34333) (#34368)
-  * Upgrade github v61 -> v71 to fix migrating bug (#34389)
-  * Fix bug when visiting comparation page (#34334) (#34364)
-  * Fix wrong review requests when updating the pull request (#34286) (#34304)
-  * Fix github migration error when using multiple tokens (#34144) (#34302)
-  * Explicitly not update indexes when sync database schemas (#34281) (#34295)
-  * Fix panic when comment is nil (#34257) (#34277)
-  * Fix project board links to related Pull Requests (#34213) (#34222)
-  * Don't assume the default wiki branch is master in the wiki API (#34244) (#34245)
-* DOCUMENTATION
-  * Update token creation API swagger documentation (#34288) (#34296)
-* MISC
-  * Fix CI Build (#34315)
-  * Add riscv64 support (#34199) (#34204)
-  * Bump go version in go.mod (#34160)
-  * remove hardcoded 'code' string in clone_panel.tmpl (#34153) (#34158)
-
-## [1.23.7](https://github.com/go-gitea/gitea/releases/tag/1.23.7) - 2025-04-07
-
-* Enhancements
-  * Add a config option to block "expensive" pages for anonymous users (#34024) (#34071)
-  * Also check default ssh-cert location for host (#34099) (#34100) (#34116)
-* BUGFIXES
-  * Fix discord webhook 400 status code when description limit is exceeded (#34084) (#34124)
-  * Get changed files based on merge base when checking `pull_request` actions trigger (#34106) (#34120)
-  * Fix invalid version in RPM package path (#34112) (#34115)
-  * Return default avatar url when user id is zero rather than updating database (#34094) (#34095)
-  * Add additional ReplaceAll in pathsep to cater for different pathsep (#34061) (#34070)
-  * Try to fix check-attr bug (#34029) (#34033)
-  * Git client will follow 301 but 307 (#34005) (#34010)
-  * Fix block expensive for 1.23 (#34127)
-  * Fix markdown frontmatter rendering (#34102) (#34107)
-  * Add new CLI flags to set name and scopes when creating a user with access token (#34080) (#34103)
-  * Do not show 500 error when default branch doesn't exist (#34096) (#34097)
-  * Hide activity contributors, recent commits and code frequrency left tabs if there is no code permission (#34053) (#34065)
-  * Simplify emoji rendering (#34048) (#34049)
-  * Adjust the layout of the toolbar on the Issues/Projects page (#33667) (#34047)
-  * Pull request updates will also trigger code owners review requests (#33744) (#34045)
-  * Fix org repo creation being limited by user limits (#34030) (#34044)
-  * Fix git client accessing renamed repo (#34034) (#34043)
-  * Fix the issue with error message logging for the `check-attr` command on Windows OS. (#34035) (#34036)
-  * Polyfill WeakRef (#34025) (#34028)

 ## [1.23.6](https://github.com/go-gitea/gitea/releases/tag/v1.23.6) - 2025-03-24

--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -30,7 +30,7 @@ These are the values to which people in the Gitea community should aspire.
 - **Be constructive.**
  - Avoid derailing: stay on topic; if you want to talk about something else, start a new conversation.
  - Avoid unconstructive criticism: don't merely decry the current state of affairs; offer—or at least solicit—suggestions as to how things may be improved.
-  - Avoid snarking (pithy, unproductive, sniping comments).
+  - Avoid snarking (pithy, unproductive, sniping comments)
  - Avoid discussing potentially offensive or sensitive issues; this all too often leads to unnecessary conflict.
  - Avoid microaggressions (brief and commonplace verbal, behavioral and environmental indignities that communicate hostile, derogatory or negative slights and insults to a person or group).
 - **Be responsible.**
@@ -42,7 +42,7 @@ People are complicated. You should expect to be misunderstood and to misundersta

 ### Our Pledge

-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.

 ### Our Standards

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -591,7 +591,7 @@ be reviewed by two maintainers and must pass the automatic tests.
 ## Releasing Gitea

 - Let $vmaj, $vmin and $vpat be Major, Minor and Patch version numbers, $vpat should be rc1, rc2, 0, 1, ...... $vmaj.$vmin will be kept the same as milestones on github or gitea in future.
- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
+- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody against in about serval hours.
 - If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
  - Create `-dev` tag as `git tag -s -F release.notes v$vmaj.$vmin.0-dev` and push the tag as `git push origin v$vmaj.$vmin.0-dev`.
  - When CI has finished building tag then you have to create a new branch named `release/v$vmaj.$vmin`
--- a/6
+++ b/6
@@ -1,5 +1,5 @@
 # Build stage
-FROM docker.io/library/golang:1.25-alpine3.22 AS build-env
+FROM docker.io/library/golang:1.24-alpine3.21 AS build-env

 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-direct}
@@ -39,8 +39,9 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
              /tmp/local/etc/s6/.s6-svscan/* \
              /go/src/code.gitea.io/gitea/gitea \
              /go/src/code.gitea.io/gitea/environment-to-ini
+RUN chmod 644 /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete

-FROM docker.io/library/alpine:3.22
+FROM docker.io/library/alpine:3.21
 LABEL maintainer="maintainers@gitea.io"

 EXPOSE 22 3000
@@ -82,3 +83,4 @@ CMD ["/usr/bin/s6-svscan", "/etc/s6"]
 COPY --from=build-env /tmp/local /
 COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
 COPY --from=build-env /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
+COPY --from=build-env /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete /etc/profile.d/gitea_bash_autocomplete.sh
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -1,5 +1,5 @@
 # Build stage
-FROM docker.io/library/golang:1.25-alpine3.22 AS build-env
+FROM docker.io/library/golang:1.24-alpine3.21 AS build-env

 ARG GOPROXY
 ENV GOPROXY=${GOPROXY:-direct}
@@ -37,8 +37,9 @@ RUN chmod 755 /tmp/local/usr/local/bin/docker-entrypoint.sh \
              /tmp/local/usr/local/bin/gitea \
              /go/src/code.gitea.io/gitea/gitea \
              /go/src/code.gitea.io/gitea/environment-to-ini
+RUN chmod 644 /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete

-FROM docker.io/library/alpine:3.22
+FROM docker.io/library/alpine:3.21
 LABEL maintainer="maintainers@gitea.io"

 EXPOSE 2222 3000
@@ -51,7 +52,6 @@ RUN apk --no-cache add \
    git \
    curl \
    gnupg \
-    openssh-keygen \
    && rm -rf /var/cache/apk/*

 RUN addgroup \
@@ -71,6 +71,7 @@ RUN chown git:git /var/lib/gitea /etc/gitea
 COPY --from=build-env /tmp/local /
 COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
 COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
+COPY --from=build-env /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete /etc/profile.d/gitea_bash_autocomplete.sh

 # git:git
 USER 1000:1000
--- a/3
+++ b/3
@@ -36,7 +36,9 @@ a1012112796 <1012112796@qq.com> (@a1012112796)
 Karl Heinz Marbaise <kama@soebes.de> (@khmarbaise)
 Norwin Roosen <git@nroo.de> (@noerw)
 Kyle Dumont <kdumontnu@gmail.com> (@kdumontnu)
+Patrick Schratz <patrick.schratz@gmail.com> (@pat-s)
 Janis Estelmann <admin@oldschoolhack.me> (@KN4CK3R)
+Steven Kriegler <sk.bunsenbrenner@gmail.com> (@justusbunsi)
 Jimmy Praet <jimmy.praet@telenet.be> (@jpraet)
 Leon Hofmeister <dev.lh@web.de> (@delvh)
 Wim <wim@42.be> (@42wim)
@@ -62,4 +64,3 @@ Rowan Bohde <rowan.bohde@gmail.com> (@bohde)
 hiifong <i@hiif.ong> (@hiifong)
 metiftikci <metiftikci@hotmail.com> (@metiftikci)
 Christopher Homberger <christopher.homberger@web.de> (@ChristopherHX)
-Tobias Balle-Petersen <tobiasbp@gmail.com> (@tobiasbp)
--- a/81
+++ b/81
@@ -23,21 +23,20 @@ SHASUM ?= shasum -a 256
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 COMMA := ,

-XGO_VERSION := go-1.25.x
+XGO_VERSION := go-1.24.x

 AIR_PACKAGE ?= github.com/air-verse/air@v1
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3
-GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.8.0
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0
-GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15
-MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.7.0
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.32.3
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.2.1
+GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.7.0
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.0.2
+GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.12
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.6.0
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.31.0
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
 GO_LICENSES_PACKAGE ?= github.com/google/go-licenses@v1
 GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1
-GOPLS_PACKAGE ?= golang.org/x/tools/gopls@v0.20.0
-GOPLS_MODERNIZE_PACKAGE ?= golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@v0.20.0
+GOPLS_PACKAGE ?= golang.org/x/tools/gopls@v0.17.1

 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
@@ -48,17 +47,6 @@ ifeq ($(HAS_GO), yes)
 	CGO_CFLAGS ?= $(shell $(GO) env CGO_CFLAGS) $(CGO_EXTRA_CFLAGS)
 endif

-CGO_ENABLED ?= 0
-ifneq (,$(findstring sqlite,$(TAGS))$(findstring pam,$(TAGS)))
-	CGO_ENABLED = 1
-endif
-
-STATIC ?=
-EXTLDFLAGS ?=
-ifneq ($(STATIC),)
-	EXTLDFLAGS = -extldflags "-static"
-endif
-
 ifeq ($(GOOS),windows)
 	IS_WINDOWS := yes
 else ifeq ($(patsubst Windows%,Windows,$(OS)),Windows)
@@ -92,6 +80,7 @@ ifeq ($(RACE_ENABLED),true)
 endif

 STORED_VERSION_FILE := VERSION
+HUGO_VERSION ?= 0.111.3

 GITHUB_REF_TYPE ?= branch
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
@@ -131,7 +120,8 @@ WEBPACK_CONFIGS := webpack.config.js tailwind.config.js
 WEBPACK_DEST := public/assets/js/index.js public/assets/css/index.css
 WEBPACK_DEST_ENTRIES := public/assets/js public/assets/css public/assets/fonts

-BINDATA_DEST_WILDCARD := modules/migration/bindata.* modules/public/bindata.* modules/options/bindata.* modules/templates/bindata.*
+BINDATA_DEST := modules/public/bindata.go modules/options/bindata.go modules/templates/bindata.go
+BINDATA_HASH := $(addsuffix .hash,$(BINDATA_DEST))

 GENERATED_GO_DEST := modules/charset/invisible_gen.go modules/charset/ambiguous_gen.go

@@ -159,8 +149,14 @@ SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US
 EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.ini

 GO_SOURCES := $(wildcard *.go)
-GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go")
+GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go" ! -path modules/options/bindata.go ! -path modules/public/bindata.go ! -path modules/templates/bindata.go)
 GO_SOURCES += $(GENERATED_GO_DEST)
+GO_SOURCES_NO_BINDATA := $(GO_SOURCES)
+
+ifeq ($(filter $(TAGS_SPLIT),bindata),bindata)
+	GO_SOURCES += $(BINDATA_DEST)
+	GENERATED_GO_DEST += $(BINDATA_DEST)
+endif

 # Force installation of playwright dependencies by setting this flag
 ifdef DEPS_PLAYWRIGHT
@@ -230,7 +226,7 @@ clean-all: clean ## delete backend, frontend and integration files

 .PHONY: clean
 clean: ## delete backend and integration files
-	rm -rf $(EXECUTABLE) $(DIST) $(BINDATA_DEST_WILDCARD) \
+	rm -rf $(EXECUTABLE) $(DIST) $(BINDATA_DEST) $(BINDATA_HASH) \
 		integrations*.test \
 		e2e*.test \
 		tests/integration/gitea-integration-* \
@@ -241,7 +237,7 @@ clean: ## delete backend and integration files
 		tests/e2e/reports/ tests/e2e/test-artifacts/ tests/e2e/test-snapshots/

 .PHONY: fmt
-fmt: ## format the Go and template code
+fmt: ## format the Go code
 	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run build/code-batch-process.go gitea-fmt -w '{file-list}'
 	$(eval TEMPLATES := $(shell find templates -type f -name '*.tmpl'))
 	@# strip whitespace after '{{' or '(' and before '}}' or ')' unless there is only
@@ -260,19 +256,6 @@ fmt-check: fmt
 	  exit 1; \
 	fi

-.PHONY: fix
-fix: ## apply automated fixes to Go code
-	$(GO) run $(GOPLS_MODERNIZE_PACKAGE) -fix ./...
-
-.PHONY: fix-check
-fix-check: fix
-	@diff=$$(git diff --color=always $(GO_SOURCES)); \
-	if [ -n "$$diff" ]; then \
-	  echo "Please run 'make fix' and commit the result:"; \
-	  printf "%s" "$${diff}"; \
-	  exit 1; \
-	fi
-
 .PHONY: $(TAGS_EVIDENCE)
 $(TAGS_EVIDENCE):
 	@mkdir -p $(MAKE_EVIDENCE_DIR)
@@ -285,7 +268,7 @@ endif
 .PHONY: generate-swagger
 generate-swagger: $(SWAGGER_SPEC) ## generate the swagger spec from code comments

-$(SWAGGER_SPEC): $(GO_SOURCES) $(SWAGGER_SPEC_INPUT)
+$(SWAGGER_SPEC): $(GO_SOURCES_NO_BINDATA) $(SWAGGER_SPEC_INPUT)
 	$(GO) run $(SWAGGER_PACKAGE) generate spec --exclude "$(SWAGGER_EXCLUDE)" --input "$(SWAGGER_SPEC_INPUT)" --output './$(SWAGGER_SPEC)'

 .PHONY: swagger-check
@@ -312,7 +295,7 @@ checks: checks-frontend checks-backend ## run various consistency checks
 checks-frontend: lockfile-check svg-check ## check frontend files

 .PHONY: checks-backend
-checks-backend: tidy-check swagger-check fmt-check fix-check swagger-validate security-check ## check backend files
+checks-backend: tidy-check swagger-check fmt-check swagger-validate security-check ## check backend files

 .PHONY: lint
 lint: lint-frontend lint-backend lint-spell ## lint everything
@@ -390,7 +373,7 @@ lint-go-gitea-vet: ## lint go files with gitea-vet
 .PHONY: lint-go-gopls
 lint-go-gopls: ## lint go files with gopls
 	@echo "Running gopls check..."
-	@GO=$(GO) GOPLS_PACKAGE=$(GOPLS_PACKAGE) tools/lint-go-gopls.sh $(GO_SOURCES)
+	@GO=$(GO) GOPLS_PACKAGE=$(GOPLS_PACKAGE) tools/lint-go-gopls.sh $(GO_SOURCES_NO_BINDATA)

 .PHONY: lint-editorconfig
 lint-editorconfig:
@@ -404,11 +387,11 @@ lint-actions: ## lint action workflow files
 .PHONY: lint-templates
 lint-templates: .venv node_modules ## lint template files
 	@node tools/lint-templates-svg.js
-	@uv run --frozen djlint $(shell find templates -type f -iname '*.tmpl')
+	@poetry run djlint $(shell find templates -type f -iname '*.tmpl')

 .PHONY: lint-yaml
 lint-yaml: .venv ## lint yaml files
-	@uv run --frozen yamllint -s .
+	@poetry run yamllint -s .

 .PHONY: watch
 watch: ## watch everything and continuously rebuild
@@ -757,10 +740,7 @@ security-check:
 	go run $(GOVULNCHECK_PACKAGE) -show color ./...

 $(EXECUTABLE): $(GO_SOURCES) $(TAGS_PREREQ)
-ifneq ($(and $(STATIC),$(findstring pam,$(TAGS))),)
-  $(error pam support set via TAGS doesn't support static builds)
-endif
-	CGO_ENABLED="$(CGO_ENABLED)" CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@
+	CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(LDFLAGS)' -o $@

 .PHONY: release
 release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-check
@@ -836,15 +816,14 @@ deps-tools: ## install tool dependencies
 	$(GO) install $(GOVULNCHECK_PACKAGE) & \
 	$(GO) install $(ACTIONLINT_PACKAGE) & \
 	$(GO) install $(GOPLS_PACKAGE) & \
-	$(GO) install $(GOPLS_MODERNIZE_PACKAGE) & \
 	wait

 node_modules: package-lock.json
 	npm install --no-save
 	@touch node_modules

-.venv: uv.lock
-	uv sync
+.venv: poetry.lock
+	poetry install
 	@touch .venv

 .PHONY: update
@@ -862,8 +841,8 @@ update-js: node-check | node_modules ## update js dependencies
 .PHONY: update-py
 update-py: node-check | node_modules ## update py dependencies
 	npx updates -u -f pyproject.toml
-	rm -rf .venv uv.lock
-	uv sync
+	rm -rf .venv poetry.lock
+	poetry install
 	@touch .venv

 .PHONY: webpack
--- a/README.md
+++ b/README.md
@@ -80,9 +80,9 @@ Expected workflow is: Fork -> Patch -> Push -> Pull Request

 [![Crowdin](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com)

-Translations are done through [Crowdin](https://translate.gitea.com). If you want to translate to a new language, ask one of the managers in the Crowdin project to add a new language there.
+Translations are done through [Crowdin](https://translate.gitea.com). If you want to translate to a new language ask one of the managers in the Crowdin project to add a new language there.

-You can also just create an issue for adding a language or ask on Discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty, but we hope to fill it as questions pop up.
+You can also just create an issue for adding a language or ask on discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty but we hope to fill it as questions pop up.

 Get more information from [documentation](https://docs.gitea.com/contributing/localization).

--- a/SECURITY.md
+++ b/SECURITY.md
@@ -14,12 +14,12 @@ Please **DO NOT** file a public issue, instead send your report privately to `se

 Due to the sensitive nature of security information, you can use the below GPG public key to encrypt your mail body.

-The PGP key is valid until July 4, 2026.
+The PGP key is valid until July 9, 2025.

 ```
 Key ID: 6FCD2D5B
 Key Type: RSA
-Expires: 7/4/2026
+Expires: 7/9/2025
 Key Size: 4096/4096
 Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
 ```
@@ -42,18 +42,18 @@ lzpAjnN9/KLtQroutrm+Ft0mdjDiJUeFVl1cOHDhoyfCsQh62HumoyZoZvqzQd6e
 AbN11nq6aViMe2Q3je1AbiBnRnQSHxt1Tc8X4IshO3MQK1Sk7oPI6LA5oQARAQAB
 tCJHaXRlYSBTZWN1cml0eSA8c2VjdXJpdHlAZ2l0ZWEuaW8+iQJXBBMBCABBAhsD
 BQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAFiEEPeA9HhRKfwaTWZncqv0jgW/N
-LVsFAmhoHmkFCQeT6esACgkQqv0jgW/NLVuFLRAAmjBQSKRAgs2bFIEj7HLAbDp4
-f+XkdH+GsT3jRPOZ9QZgmtM+TfoE4yNgIVfOl+s4RdjM/W4QzqZuPQ55hbEHd056
-cJmm7B+6GsHFcdrPmh65sOCEIyh4+t45dUfeWpFsDPqm9j1UHXAJQIpB8vDEVAPH
-t+3wLCk8GMPJs1o5tIyMmaO23ngvkwn8eG7KgY+rp2PzObrb5g7ppci0ILzILkrp
-HVjZsEfUWRgSVF7LuU5ppqDKrlcqwUpQq6n3kGMZcLrCp6ACKP04TBmTfUxNwdL7
-I0N7apI2Pbct9T1Gv/lYAUFWyU2c3gh/EBLbO6BukaLOFRQHrtNfdJV/YnMPlcXr
-LUJjK9K4eAH9DsrZqrisz/LthsC2BaNIN3KRMTk5YTYgmIh8GXzSgihORmtDFELC
-RroID3pTuS0zjXh+wpY9GuPTh7UW23p42Daxca4fAT4k5EclvDRUrL21xMopPMiL
-HuNdELz4FVchRTy05PjzKVyjVInDNojE2KUxnjxZDzYJ6aT/g+coD5yfntYm8BEj
-+ZzL0ndZES54hzKLpv7zwBQwFzam68clZYmDPILOPTflQDfpGEWmJK4undFU5obz
-ZsQRz0R3ulspChATbZxO0d5LX2obLpKO9X3b5VoO1KF+R8Vjw1Y0KxrNZ6rIcfqH
-Z50QVQKSe9dm08K0ON+5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
+LVsFAmaMse0FCQW4fW8ACgkQqv0jgW/NLVtXLg/+PF4G9Jhlui15BTNlEBJAV2P/
+1QlAV2krk0fP7tykn0FR9RfGIfVV/kwC1f+ouosYPQDDevl9LWdUIM+g94DtNo2o
+7ACpcL3morvt5lVGpIZHL8TbX0qmFRXL/pB/cB+K6IwYvh2mrbp2zH+r4SCRyFYq
+BjgXYFTI1MylJ1ShAjU6Z+m3oJ+2xs5LzHS0X6zkTjzA2Zl4zQzciQ9T+wJcE7Zi
+HXdM1+YMF8KGNP8J9Rpug5oNDJ98lgZirRY7c3A/1xmYBiPnULwuuymdqEZO7l70
+SeAlE1RWYX8kbOBnBb/KY4XwE3Vic1oEzc9DiPWVH1ElX86WNNsFzuyULiwoBoWg
+pqZGhL9x1p5+46RGQSDczsHM7YGVtfYOiDo2PAVrmwsT0BnXnK8Oe3YIkvmUPEJu
+OkLt0Z6A5n8pz8zhQzuApwBsK4ncJ8zTCpvz/pfKKqZC/Vnoh3gKGhDGvOZ+b5IJ
+0kUTe2JsbnwFixDUMDtacQ1op8XOyLoLVmgqLn0+Pws4XPBlMof2bioFir3yHKnP
+gNchsF1agrlSIo5GA8u4ga+IlCSfvFIKrl7+cxacKcJYt/vbOU5KcvVJI5EtHKCG
+xfHjHY2ah1Qww7SxW6IXiRZZzPpsL2mBM2CD7N3qh9bV2s27wxYCdUodsIZbiyHe
+oWPzfBnkmiAN8KlZxHm5Ag0EYrVn/gEQALrFLQjCR3GjuHSindz0rd3Fnx/t7Sen
 T+p07yCSSoSlmnJHCQmwh4vfg1blyz0zZ4vkIhtpHsEgc+ZAG+WQXSsJ2iRz+eSN
 GwoOQl4XC3n+QWkc1ws+btr48+6UqXIQU+F8TPQyx/PIgi2nZXJB7f5+mjCqsk46
 XvH4nTr4kJjuqMSR/++wvre2qNQRa/q/dTsK0OaN/mJsdX6Oi+aGNaQJUhIG7F+E
@@ -65,19 +65,19 @@ s+GsP9I3cmWWQcKYxWHtE8xTXnNCVPFZQj2nwhJzae8ypfOtulBRA3dUKWGKuDH/
 axFENhUsT397aOU3qkP/od4a64JyNIEo4CTTSPVeWd7njsGqli2U3A4xL2CcyYvt
 D/MWcMBGEoLSNTswwKdom4FaJpn5KThnK/T0bQcmJblJhoCtppXisbexZnCpuS0x
 Zdlm2T14KJ3LABEBAAGJAjwEGAEIACYCGwwWIQQ94D0eFEp/BpNZmdyq/SOBb80t
-WwUCaGgeJAUJB5PppgAKCRCq/SOBb80tW/NWEACB6Jrf0gWlk7e+hNCdnbM0ZVWU
-f2sHNFfXxxsdhpcDgKbNHtkZb8nZgv8AX+5fTtUwMVa3vKcdw30xFiIM5N7cCIPV
-vg/5z5BtfEaitnabEUG2iiVDIy8IHXIcK10rX+7BosA3QDl2PsiBHwyi5G13lRk8
-zGTSNDuOalug33h5/lr2dPigamkq74Aoy29q8Rjad6GfWHipL2bFimgtY+Zdi0BH
-NLk4EJXxj1SgVx5dtkQzWJReBA5M+FQ4QYQZBO+f4TDoOLmjui152uhkoLBQbGAa
-WWJFTVxm0bG5MXloEL3gA8DfU7XDwuW/sHJC5pBko8RpQViooOhckMepZV3Y83DK
-bwLYa3JmPgj2rEv4993dvrJbQhpGd082HOxOsllCs8pgNq1SnXpWYfcGTgGKC3ts
-U8YZUUJUQ7mi2L8Tv3ix20c9EiGmA30JAmA8eZTC3cWup91ZkkVBFRml2czTXajd
-RWZ6GbHV5503ueDQcB8yBVgF3CSixs67+dGSbD3p86OqGrjAcJzM5TFbNKcnGLdE
-kGbZpNwAISy750lXzXKmyrh5RTCeTOQerbwCMBvHZO+HAevA/LXDTw2OAiSIQlP5
-sYA4sFYLQ30OAkgJcmdp/pSgVj/erNtSN07ClrOpDb/uFpQymO6K2h0Pst3feNVK
-9M2VbqL9C51z/wyHLg==
-=SfZA
+WwUCZoyyjQUJBbh+DwAKCRCq/SOBb80tW18XD/9MXztmf01MT+1kZdBouZ/7Rp/7
+9kuqo//B1G+RXau4oFtPqb67kNe2WaIc3u5B73PUHsMf3i6z4ib2KbMhZZerLn0O
+dRglcuPeNWmsASY3dH/XVG0cT0zvvWegagd12TJEl3Vs+7XNrOw4cwDj9L1+GH9m
+kSt4uaANWn/6a3RvMRhiVEYuNwhAzcKaactPmYqrLJgoVLbRSDkgyHaMQ2jKgLxk
+ifS/fvluGV0ub2Po6DJiqfRpd1tDvPhe9y1+r1WFDZsOcvTcZUfSt/7dXMGfqGu0
+2daVFlfeSXSALrDE5uc0UxodHCpP3sqRYDZevGLBRaaTkIjYXG/+N898+7K5WJF4
+xXOLWxM2cwGkG7eC9pugcDnBp9XlF7O+GBiZ05JUe5flXDQFZ+h3exjopu6KHF1B
+RnzNy8LC0UKb+AuvRIOLV92a9Q9wGWU/jaVDu6nZ0umAeuSzxiHoDsonm0Fl9QAz
+2/xCokebuoeLrEK7R2af3X86mqq3sVO4ax+HPYChzOaVQBiHUW/TAldWcldYYphR
+/e2WsbmQfvCRtz/bZfo+aUVnrHNjzVMtF2SszdVmA/04Y8pS28MqtuRqhm5DPOOd
+g1YeUywK5jRZ1twyo1kzJEFPLaoeaXaycsR1PMVBW0Urik5mrR/pOWq7PPoZoKb2
+lXYLE8bwkuQTmsyL1g==
+=9i7d
 -----END PGP PUBLIC KEY BLOCK-----

 ```
--- a/assets/go-licenses.json
+++ b/assets/go-licenses.json
--- a/build.go
+++ b/build.go
@@ -5,10 +5,19 @@

 package main

-// Libraries that are included to vendor utilities used during Makefile build.
+// Libraries that are included to vendor utilities used during build.
 // These libraries will not be included in a normal compilation.

 import (
+	// for embed
+	_ "github.com/shurcooL/vfsgen"
+
+	// for cover merge
+	_ "golang.org/x/tools/cover"
+
 	// for vet
 	_ "code.gitea.io/gitea-vet"
+
+	// for swagger
+	_ "github.com/go-swagger/go-swagger/cmd/swagger"
 )
--- a/build/generate-bindata.go
+++ b/build/generate-bindata.go
@@ -6,22 +6,87 @@
 package main

 import (
+	"bytes"
+	"crypto/sha1"
 	"fmt"
+	"log"
+	"net/http"
 	"os"
+	"path/filepath"
+	"strconv"

-	"code.gitea.io/gitea/modules/assetfs"
+	"github.com/shurcooL/vfsgen"
 )

-func main() {
-	if len(os.Args) != 3 {
-		fmt.Println("usage: ./generate-bindata {local-directory} {bindata-filename}")
-		os.Exit(1)
+func needsUpdate(dir, filename string) (bool, []byte) {
+	needRegen := false
+	_, err := os.Stat(filename)
+	if err != nil {
+		needRegen = true
 	}

-	dir, filename := os.Args[1], os.Args[2]
-	fmt.Printf("generating bindata for %s to %s\n", dir, filename)
-	if err := assetfs.GenerateEmbedBindata(dir, filename); err != nil {
-		fmt.Printf("failed: %s\n", err.Error())
-		os.Exit(1)
+	oldHash, err := os.ReadFile(filename + ".hash")
+	if err != nil {
+		oldHash = []byte{}
 	}
+
+	hasher := sha1.New()
+
+	err = filepath.WalkDir(dir, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		info, err := d.Info()
+		if err != nil {
+			return err
+		}
+		_, _ = hasher.Write([]byte(d.Name()))
+		_, _ = hasher.Write([]byte(info.ModTime().String()))
+		_, _ = hasher.Write([]byte(strconv.FormatInt(info.Size(), 16)))
+		return nil
+	})
+	if err != nil {
+		return true, oldHash
+	}
+
+	newHash := hasher.Sum([]byte{})
+
+	if bytes.Compare(oldHash, newHash) != 0 {
+		return true, newHash
+	}
+
+	return needRegen, newHash
+}
+
+func main() {
+	if len(os.Args) < 4 {
+		log.Fatal("Insufficient number of arguments. Need: directory packageName filename")
+	}
+
+	dir, packageName, filename := os.Args[1], os.Args[2], os.Args[3]
+	var useGlobalModTime bool
+	if len(os.Args) == 5 {
+		useGlobalModTime, _ = strconv.ParseBool(os.Args[4])
+	}
+
+	update, newHash := needsUpdate(dir, filename)
+
+	if !update {
+		fmt.Printf("bindata for %s already up-to-date\n", packageName)
+		return
+	}
+
+	fmt.Printf("generating bindata for %s\n", packageName)
+	var fsTemplates http.FileSystem = http.Dir(dir)
+	err := vfsgen.Generate(fsTemplates, vfsgen.Options{
+		PackageName:      packageName,
+		BuildTags:        "bindata",
+		VariableName:     "Assets",
+		Filename:         filename,
+		UseGlobalModTime: useGlobalModTime,
+	})
+	if err != nil {
+		log.Fatalf("%v\n", err)
+	}
+	_ = os.WriteFile(filename+".hash", newHash, 0o666)
 }
--- a/cmd/actions.go
+++ b/cmd/actions.go
@@ -4,13 +4,12 @@
 package cmd

 import (
-	"context"
 	"fmt"

 	"code.gitea.io/gitea/modules/private"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
@@ -18,7 +17,7 @@ var (
 	CmdActions = &cli.Command{
 		Name:  "actions",
 		Usage: "Manage Gitea Actions",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			subcmdActionsGenRunnerToken,
 		},
 	}
@@ -39,7 +38,10 @@ var (
 	}
 )

-func runGenerateActionsRunnerToken(ctx context.Context, c *cli.Command) error {
+func runGenerateActionsRunnerToken(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setting.MustInstalled()

 	scope := c.String("scope")
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -15,7 +15,7 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	repo_module "code.gitea.io/gitea/modules/repository"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
@@ -23,7 +23,7 @@ var (
 	CmdAdmin = &cli.Command{
 		Name:  "admin",
 		Usage: "Perform common administrative operations",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			subcmdUser,
 			subcmdRepoSyncReleases,
 			subcmdRegenerate,
@@ -41,7 +41,7 @@ var (
 	subcmdRegenerate = &cli.Command{
 		Name:  "regenerate",
 		Usage: "Regenerate specific files",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			microcmdRegenHooks,
 			microcmdRegenKeys,
 		},
@@ -50,15 +50,15 @@ var (
 	subcmdAuth = &cli.Command{
 		Name:  "auth",
 		Usage: "Modify external auth providers",
-		Commands: []*cli.Command{
-			microcmdAuthAddOauth(),
-			microcmdAuthUpdateOauth(),
-			microcmdAuthAddLdapBindDn(),
-			microcmdAuthUpdateLdapBindDn(),
-			microcmdAuthAddLdapSimpleAuth(),
-			microcmdAuthUpdateLdapSimpleAuth(),
-			microcmdAuthAddSMTP(),
-			microcmdAuthUpdateSMTP(),
+		Subcommands: []*cli.Command{
+			microcmdAuthAddOauth,
+			microcmdAuthUpdateOauth,
+			microcmdAuthAddLdapBindDn,
+			microcmdAuthUpdateLdapBindDn,
+			microcmdAuthAddLdapSimpleAuth,
+			microcmdAuthUpdateLdapSimpleAuth,
+			microcmdAuthAddSMTP,
+			microcmdAuthUpdateSMTP,
 			microcmdAuthList,
 			microcmdAuthDelete,
 		},
@@ -70,9 +70,9 @@ var (
 		Action: runSendMail,
 		Flags: []cli.Flag{
 			&cli.StringFlag{
-				Name:     "title",
-				Usage:    "a title of a message",
-				Required: true,
+				Name:  "title",
+				Usage: `a title of a message`,
+				Value: "",
 			},
 			&cli.StringFlag{
 				Name:  "content",
@@ -86,27 +86,28 @@ var (
 			},
 		},
 	}
-)

-func idFlag() *cli.Int64Flag {
-	return &cli.Int64Flag{
+	idFlag = &cli.Int64Flag{
 		Name:  "id",
 		Usage: "ID of authentication source",
 	}
-}
+)
+
+func runRepoSyncReleases(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()

-func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 	if err := initDB(ctx); err != nil {
 		return err
 	}

-	if err := git.InitSimple(); err != nil {
+	if err := git.InitSimple(ctx); err != nil {
 		return err
 	}

 	log.Trace("Synchronizing repository releases (this may take a while)")
 	for page := 1; ; page++ {
-		repos, count, err := repo_model.SearchRepositoryByName(ctx, repo_model.SearchRepoOptions{
+		repos, count, err := repo_model.SearchRepositoryByName(ctx, &repo_model.SearchRepoOptions{
 			ListOptions: db.ListOptions{
 				PageSize: repo_model.RepositoryListDefaultPageSize,
 				Page:     page,
--- a/cmd/admin_auth.go
+++ b/cmd/admin_auth.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -14,14 +13,14 @@ import (
 	"code.gitea.io/gitea/models/db"
 	auth_service "code.gitea.io/gitea/services/auth"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
 	microcmdAuthDelete = &cli.Command{
 		Name:   "delete",
 		Usage:  "Delete specific auth source",
-		Flags:  []cli.Flag{idFlag()},
+		Flags:  []cli.Flag{idFlag},
 		Action: runDeleteAuth,
 	}
 	microcmdAuthList = &cli.Command{
@@ -57,7 +56,10 @@ var (
 	}
 )

-func runListAuth(ctx context.Context, c *cli.Command) error {
+func runListAuth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}
@@ -88,11 +90,14 @@ func runListAuth(ctx context.Context, c *cli.Command) error {
 	return nil
 }

-func runDeleteAuth(ctx context.Context, c *cli.Command) error {
+func runDeleteAuth(c *cli.Context) error {
 	if !c.IsSet("id") {
 		return errors.New("--id flag is missing")
 	}

+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}
--- a/cmd/admin_auth_ldap.go
+++ b/cmd/admin_auth_ldap.go
@@ -12,7 +12,7 @@ import (
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/auth/source/ldap"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 type (
@@ -24,8 +24,8 @@ type (
 	}
 )

-func commonLdapCLIFlags() []cli.Flag {
-	return []cli.Flag{
+var (
+	commonLdapCLIFlags = []cli.Flag{
 		&cli.StringFlag{
 			Name:  "name",
 			Usage: "Authentication name.",
@@ -103,10 +103,8 @@ func commonLdapCLIFlags() []cli.Flag {
 			Usage: "The attribute of the user’s LDAP record containing the user’s avatar.",
 		},
 	}
-}

-func ldapBindDnCLIFlags() []cli.Flag {
-	return append(commonLdapCLIFlags(),
+	ldapBindDnCLIFlags = append(commonLdapCLIFlags,
 		&cli.StringFlag{
 			Name:  "bind-dn",
 			Usage: "The DN to bind to the LDAP server with when searching for the user.",
@@ -159,59 +157,49 @@ func ldapBindDnCLIFlags() []cli.Flag {
 			Name:  "group-team-map-removal",
 			Usage: "Remove users from synchronized teams if user does not belong to corresponding LDAP group",
 		})
-}

-func ldapSimpleAuthCLIFlags() []cli.Flag {
-	return append(commonLdapCLIFlags(),
+	ldapSimpleAuthCLIFlags = append(commonLdapCLIFlags,
 		&cli.StringFlag{
 			Name:  "user-dn",
 			Usage: "The user's DN.",
 		})
-}

-func microcmdAuthAddLdapBindDn() *cli.Command {
-	return &cli.Command{
+	microcmdAuthAddLdapBindDn = &cli.Command{
 		Name:  "add-ldap",
 		Usage: "Add new LDAP (via Bind DN) authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().addLdapBindDn(ctx, cmd)
+		Action: func(c *cli.Context) error {
+			return newAuthService().addLdapBindDn(c)
 		},
-		Flags: ldapBindDnCLIFlags(),
+		Flags: ldapBindDnCLIFlags,
 	}
-}

-func microcmdAuthUpdateLdapBindDn() *cli.Command {
-	return &cli.Command{
+	microcmdAuthUpdateLdapBindDn = &cli.Command{
 		Name:  "update-ldap",
 		Usage: "Update existing LDAP (via Bind DN) authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().updateLdapBindDn(ctx, cmd)
+		Action: func(c *cli.Context) error {
+			return newAuthService().updateLdapBindDn(c)
 		},
-		Flags: append([]cli.Flag{idFlag()}, ldapBindDnCLIFlags()...),
+		Flags: append([]cli.Flag{idFlag}, ldapBindDnCLIFlags...),
 	}
-}

-func microcmdAuthAddLdapSimpleAuth() *cli.Command {
-	return &cli.Command{
+	microcmdAuthAddLdapSimpleAuth = &cli.Command{
 		Name:  "add-ldap-simple",
 		Usage: "Add new LDAP (simple auth) authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().addLdapSimpleAuth(ctx, cmd)
+		Action: func(c *cli.Context) error {
+			return newAuthService().addLdapSimpleAuth(c)
 		},
-		Flags: ldapSimpleAuthCLIFlags(),
+		Flags: ldapSimpleAuthCLIFlags,
 	}
-}

-func microcmdAuthUpdateLdapSimpleAuth() *cli.Command {
-	return &cli.Command{
+	microcmdAuthUpdateLdapSimpleAuth = &cli.Command{
 		Name:  "update-ldap-simple",
 		Usage: "Update existing LDAP (simple auth) authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().updateLdapSimpleAuth(ctx, cmd)
+		Action: func(c *cli.Context) error {
+			return newAuthService().updateLdapSimpleAuth(c)
 		},
-		Flags: append([]cli.Flag{idFlag()}, ldapSimpleAuthCLIFlags()...),
+		Flags: append([]cli.Flag{idFlag}, ldapSimpleAuthCLIFlags...),
 	}
-}
+)

 // newAuthService creates a service with default functions.
 func newAuthService() *authService {
@@ -224,7 +212,7 @@ func newAuthService() *authService {
 }

 // parseAuthSourceLdap assigns values on authSource according to command line flags.
-func parseAuthSourceLdap(c *cli.Command, authSource *auth.Source) {
+func parseAuthSourceLdap(c *cli.Context, authSource *auth.Source) {
 	if c.IsSet("name") {
 		authSource.Name = c.String("name")
 	}
@@ -244,7 +232,7 @@ func parseAuthSourceLdap(c *cli.Command, authSource *auth.Source) {
 }

 // parseLdapConfig assigns values on config according to command line flags.
-func parseLdapConfig(c *cli.Command, config *ldap.Source) error {
+func parseLdapConfig(c *cli.Context, config *ldap.Source) error {
 	if c.IsSet("name") {
 		config.Name = c.String("name")
 	}
@@ -257,7 +245,7 @@ func parseLdapConfig(c *cli.Command, config *ldap.Source) error {
 	if c.IsSet("security-protocol") {
 		p, ok := findLdapSecurityProtocolByName(c.String("security-protocol"))
 		if !ok {
-			return fmt.Errorf("unknown security protocol name: %s", c.String("security-protocol"))
+			return fmt.Errorf("Unknown security protocol name: %s", c.String("security-protocol"))
 		}
 		config.SecurityProtocol = p
 	}
@@ -349,27 +337,32 @@ func findLdapSecurityProtocolByName(name string) (ldap.SecurityProtocol, bool) {

 // getAuthSource gets the login source by its id defined in the command line flags.
 // It returns an error if the id is not set, does not match any source or if the source is not of expected type.
-func (a *authService) getAuthSource(ctx context.Context, c *cli.Command, authType auth.Type) (*auth.Source, error) {
+func (a *authService) getAuthSource(ctx context.Context, c *cli.Context, authType auth.Type) (*auth.Source, error) {
 	if err := argsSet(c, "id"); err != nil {
 		return nil, err
 	}
+
 	authSource, err := a.getAuthSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return nil, err
 	}

 	if authSource.Type != authType {
-		return nil, fmt.Errorf("invalid authentication type. expected: %s, actual: %s", authType.String(), authSource.Type.String())
+		return nil, fmt.Errorf("Invalid authentication type. expected: %s, actual: %s", authType.String(), authSource.Type.String())
 	}

 	return authSource, nil
 }

 // addLdapBindDn adds a new LDAP via Bind DN authentication source.
-func (a *authService) addLdapBindDn(ctx context.Context, c *cli.Command) error {
+func (a *authService) addLdapBindDn(c *cli.Context) error {
 	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-search-base", "user-filter", "email-attribute"); err != nil {
 		return err
 	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
@@ -391,7 +384,10 @@ func (a *authService) addLdapBindDn(ctx context.Context, c *cli.Command) error {
 }

 // updateLdapBindDn updates a new LDAP via Bind DN authentication source.
-func (a *authService) updateLdapBindDn(ctx context.Context, c *cli.Command) error {
+func (a *authService) updateLdapBindDn(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
@@ -410,11 +406,14 @@ func (a *authService) updateLdapBindDn(ctx context.Context, c *cli.Command) erro
 }

 // addLdapSimpleAuth adds a new LDAP (simple auth) authentication source.
-func (a *authService) addLdapSimpleAuth(ctx context.Context, c *cli.Command) error {
+func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 	if err := argsSet(c, "name", "security-protocol", "host", "port", "user-dn", "user-filter", "email-attribute"); err != nil {
 		return err
 	}

+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
@@ -436,7 +435,10 @@ func (a *authService) addLdapSimpleAuth(ctx context.Context, c *cli.Command) err
 }

 // updateLdapSimpleAuth updates a new LDAP (simple auth) authentication source.
-func (a *authService) updateLdapSimpleAuth(ctx context.Context, c *cli.Command) error {
+func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := a.initDB(ctx); err != nil {
 		return err
 	}
--- a/cmd/admin_auth_ldap_test.go
+++ b/cmd/admin_auth_ldap_test.go
@@ -8,16 +8,17 @@ import (
 	"testing"

 	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/test"
 	"code.gitea.io/gitea/services/auth/source/ldap"

 	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 func TestAddLdapBindDn(t *testing.T) {
 	// Mock cli functions to do not exit on error
-	defer test.MockVariableValue(&cli.OsExiter, func(code int) {})()
+	osExiter := cli.OsExiter
+	defer func() { cli.OsExiter = osExiter }()
+	cli.OsExiter = func(code int) {}

 	// Test cases
 	cases := []struct {
@@ -134,7 +135,7 @@ func TestAddLdapBindDn(t *testing.T) {
 				"--user-filter", "(memberOf=cn=user-group,ou=example,dc=domain,dc=org)",
 				"--email-attribute", "mail",
 			},
-			errMsg: "unknown security protocol name: zzzzz",
+			errMsg: "Unknown security protocol name: zzzzz",
 		},
 		// case 3
 		{
@@ -238,13 +239,12 @@ func TestAddLdapBindDn(t *testing.T) {
 		}

 		// Create a copy of command to test
-		app := cli.Command{
-			Flags:  microcmdAuthAddLdapBindDn().Flags,
-			Action: service.addLdapBindDn,
-		}
+		app := cli.NewApp()
+		app.Flags = microcmdAuthAddLdapBindDn.Flags
+		app.Action = service.addLdapBindDn

 		// Run it
-		err := app.Run(t.Context(), c.args)
+		err := app.Run(c.args)
 		if c.errMsg != "" {
 			assert.EqualError(t, err, c.errMsg, "case %d: error should match", n)
 		} else {
@@ -256,7 +256,9 @@ func TestAddLdapBindDn(t *testing.T) {

 func TestAddLdapSimpleAuth(t *testing.T) {
 	// Mock cli functions to do not exit on error
-	defer test.MockVariableValue(&cli.OsExiter, func(code int) {})()
+	osExiter := cli.OsExiter
+	defer func() { cli.OsExiter = osExiter }()
+	cli.OsExiter = func(code int) {}

 	// Test cases
 	cases := []struct {
@@ -346,12 +348,12 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				"--name", "ldap (simple auth) source",
 				"--security-protocol", "zzzzz",
 				"--host", "ldap-server",
-				"--port", "1234",
+				"--port", "123",
 				"--user-filter", "(&(objectClass=posixAccount)(cn=%s))",
 				"--email-attribute", "mail",
 				"--user-dn", "cn=%s,ou=Users,dc=domain,dc=org",
 			},
-			errMsg: "unknown security protocol name: zzzzz",
+			errMsg: "Unknown security protocol name: zzzzz",
 		},
 		// case 3
 		{
@@ -468,13 +470,12 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 		}

 		// Create a copy of command to test
-		app := &cli.Command{
-			Flags:  microcmdAuthAddLdapSimpleAuth().Flags,
-			Action: service.addLdapSimpleAuth,
-		}
+		app := cli.NewApp()
+		app.Flags = microcmdAuthAddLdapSimpleAuth.Flags
+		app.Action = service.addLdapSimpleAuth

 		// Run it
-		err := app.Run(t.Context(), c.args)
+		err := app.Run(c.args)
 		if c.errMsg != "" {
 			assert.EqualError(t, err, c.errMsg, "case %d: error should match", n)
 		} else {
@@ -486,7 +487,9 @@ func TestAddLdapSimpleAuth(t *testing.T) {

 func TestUpdateLdapBindDn(t *testing.T) {
 	// Mock cli functions to do not exit on error
-	defer test.MockVariableValue(&cli.OsExiter, func(code int) {})()
+	osExiter := cli.OsExiter
+	defer func() { cli.OsExiter = osExiter }()
+	cli.OsExiter = func(code int) {}

 	// Test cases
 	cases := []struct {
@@ -861,7 +864,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--security-protocol", "xxxxx",
 			},
-			errMsg: "unknown security protocol name: xxxxx",
+			errMsg: "Unknown security protocol name: xxxxx",
 		},
 		// case 22
 		{
@@ -880,7 +883,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				Type: auth.OAuth2,
 				Cfg:  &ldap.Source{},
 			},
-			errMsg: "invalid authentication type. expected: LDAP (via BindDN), actual: OAuth2",
+			errMsg: "Invalid authentication type. expected: LDAP (via BindDN), actual: OAuth2",
 		},
 		// case 24
 		{
@@ -944,12 +947,12 @@ func TestUpdateLdapBindDn(t *testing.T) {
 		}

 		// Create a copy of command to test
-		app := cli.Command{
-			Flags:  microcmdAuthUpdateLdapBindDn().Flags,
-			Action: service.updateLdapBindDn,
-		}
+		app := cli.NewApp()
+		app.Flags = microcmdAuthUpdateLdapBindDn.Flags
+		app.Action = service.updateLdapBindDn
+
 		// Run it
-		err := app.Run(t.Context(), c.args)
+		err := app.Run(c.args)
 		if c.errMsg != "" {
 			assert.EqualError(t, err, c.errMsg, "case %d: error should match", n)
 		} else {
@@ -961,7 +964,9 @@ func TestUpdateLdapBindDn(t *testing.T) {

 func TestUpdateLdapSimpleAuth(t *testing.T) {
 	// Mock cli functions to do not exit on error
-	defer test.MockVariableValue(&cli.OsExiter, func(code int) {})()
+	osExiter := cli.OsExiter
+	defer func() { cli.OsExiter = osExiter }()
+	cli.OsExiter = func(code int) {}

 	// Test cases
 	cases := []struct {
@@ -1252,7 +1257,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--security-protocol", "xxxxx",
 			},
-			errMsg: "unknown security protocol name: xxxxx",
+			errMsg: "Unknown security protocol name: xxxxx",
 		},
 		// case 18
 		{
@@ -1271,7 +1276,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				Type: auth.PAM,
 				Cfg:  &ldap.Source{},
 			},
-			errMsg: "invalid authentication type. expected: LDAP (simple auth), actual: PAM",
+			errMsg: "Invalid authentication type. expected: LDAP (simple auth), actual: PAM",
 		},
 		// case 20
 		{
@@ -1332,12 +1337,12 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 		}

 		// Create a copy of command to test
-		app := cli.Command{
-			Flags:  microcmdAuthUpdateLdapSimpleAuth().Flags,
-			Action: service.updateLdapSimpleAuth,
-		}
+		app := cli.NewApp()
+		app.Flags = microcmdAuthUpdateLdapSimpleAuth.Flags
+		app.Action = service.updateLdapSimpleAuth
+
 		// Run it
-		err := app.Run(t.Context(), c.args)
+		err := app.Run(c.args)
 		if c.errMsg != "" {
 			assert.EqualError(t, err, c.errMsg, "case %d: error should match", n)
 		} else {
--- a/cmd/admin_auth_oauth.go
+++ b/cmd/admin_auth_oauth.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"net/url"
@@ -13,11 +12,11 @@ import (
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/auth/source/oauth2"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func oauthCLIFlags() []cli.Flag {
-	return []cli.Flag{
+var (
+	oauthCLIFlags = []cli.Flag{
 		&cli.StringFlag{
 			Name:  "name",
 			Value: "",
@@ -87,14 +86,6 @@ func oauthCLIFlags() []cli.Flag {
 			Value: nil,
 			Usage: "Scopes to request when to authenticate against this OAuth2 source",
 		},
-		&cli.StringFlag{
-			Name:  "ssh-public-key-claim-name",
-			Usage: "Claim name that provides SSH public keys",
-		},
-		&cli.StringFlag{
-			Name:  "full-name-claim-name",
-			Usage: "Claim name that provides user's full name",
-		},
 		&cli.StringFlag{
 			Name:  "required-claim-name",
 			Value: "",
@@ -130,34 +121,23 @@ func oauthCLIFlags() []cli.Flag {
 			Usage: "Activate automatic team membership removal depending on groups",
 		},
 	}
-}

-func microcmdAuthAddOauth() *cli.Command {
-	return &cli.Command{
-		Name:  "add-oauth",
-		Usage: "Add new Oauth authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().runAddOauth(ctx, cmd)
-		},
-		Flags: oauthCLIFlags(),
+	microcmdAuthAddOauth = &cli.Command{
+		Name:   "add-oauth",
+		Usage:  "Add new Oauth authentication source",
+		Action: runAddOauth,
+		Flags:  oauthCLIFlags,
 	}
-}

-func microcmdAuthUpdateOauth() *cli.Command {
-	return &cli.Command{
-		Name:  "update-oauth",
-		Usage: "Update existing Oauth authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().runUpdateOauth(ctx, cmd)
-		},
-		Flags: append(oauthCLIFlags()[:1], append([]cli.Flag{&cli.Int64Flag{
-			Name:  "id",
-			Usage: "ID of authentication source",
-		}}, oauthCLIFlags()[1:]...)...),
+	microcmdAuthUpdateOauth = &cli.Command{
+		Name:   "update-oauth",
+		Usage:  "Update existing Oauth authentication source",
+		Action: runUpdateOauth,
+		Flags:  append(oauthCLIFlags[:1], append([]cli.Flag{idFlag}, oauthCLIFlags[1:]...)...),
 	}
-}
+)

-func parseOAuth2Config(c *cli.Command) *oauth2.Source {
+func parseOAuth2Config(c *cli.Context) *oauth2.Source {
 	var customURLMapping *oauth2.CustomURLMapping
 	if c.IsSet("use-custom-urls") {
 		customURLMapping = &oauth2.CustomURLMapping{
@@ -185,13 +165,14 @@ func parseOAuth2Config(c *cli.Command) *oauth2.Source {
 		RestrictedGroup:               c.String("restricted-group"),
 		GroupTeamMap:                  c.String("group-team-map"),
 		GroupTeamMapRemoval:           c.Bool("group-team-map-removal"),
-		SSHPublicKeyClaimName:         c.String("ssh-public-key-claim-name"),
-		FullNameClaimName:             c.String("full-name-claim-name"),
 	}
 }

-func (a *authService) runAddOauth(ctx context.Context, c *cli.Command) error {
-	if err := a.initDB(ctx); err != nil {
+func runAddOauth(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
 		return err
 	}

@@ -203,7 +184,7 @@ func (a *authService) runAddOauth(ctx context.Context, c *cli.Command) error {
 		}
 	}

-	return a.createAuthSource(ctx, &auth_model.Source{
+	return auth_model.CreateSource(ctx, &auth_model.Source{
 		Type:            auth_model.OAuth2,
 		Name:            c.String("name"),
 		IsActive:        true,
@@ -212,16 +193,19 @@ func (a *authService) runAddOauth(ctx context.Context, c *cli.Command) error {
 	})
 }

-func (a *authService) runUpdateOauth(ctx context.Context, c *cli.Command) error {
+func runUpdateOauth(c *cli.Context) error {
 	if !c.IsSet("id") {
 		return errors.New("--id flag is missing")
 	}

-	if err := a.initDB(ctx); err != nil {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
 		return err
 	}

-	source, err := a.getAuthSourceByID(ctx, c.Int64("id"))
+	source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return err
 	}
@@ -278,12 +262,6 @@ func (a *authService) runUpdateOauth(ctx context.Context, c *cli.Command) error
 	if c.IsSet("group-team-map-removal") {
 		oAuth2Config.GroupTeamMapRemoval = c.Bool("group-team-map-removal")
 	}
-	if c.IsSet("ssh-public-key-claim-name") {
-		oAuth2Config.SSHPublicKeyClaimName = c.String("ssh-public-key-claim-name")
-	}
-	if c.IsSet("full-name-claim-name") {
-		oAuth2Config.FullNameClaimName = c.String("full-name-claim-name")
-	}

 	// update custom URL mapping
 	customURLMapping := &oauth2.CustomURLMapping{}
@@ -318,5 +296,5 @@ func (a *authService) runUpdateOauth(ctx context.Context, c *cli.Command) error
 	oAuth2Config.CustomURLMapping = customURLMapping
 	source.Cfg = oAuth2Config
 	source.TwoFactorPolicy = util.Iif(c.Bool("skip-local-2fa"), "skip", "")
-	return a.updateAuthSource(ctx, source)
+	return auth_model.UpdateSource(ctx, source)
 }
--- a/cmd/admin_auth_oauth_test.go
+++ b/cmd/admin_auth_oauth_test.go
@@ -1,343 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"testing"
-
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
-)
-
-func TestAddOauth(t *testing.T) {
-	testCases := []struct {
-		name   string
-		args   []string
-		source *auth_model.Source
-		errMsg string
-	}{
-		{
-			name: "valid config",
-			args: []string{
-				"--name", "test",
-				"--provider", "github",
-				"--key", "some_key",
-				"--secret", "some_secret",
-			},
-			source: &auth_model.Source{
-				Type:     auth_model.OAuth2,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Scopes:       []string{},
-					Provider:     "github",
-					ClientID:     "some_key",
-					ClientSecret: "some_secret",
-				},
-				TwoFactorPolicy: "",
-			},
-		},
-		{
-			name: "valid config with openid connect",
-			args: []string{
-				"--name", "test",
-				"--provider", "openidConnect",
-				"--key", "some_key",
-				"--secret", "some_secret",
-				"--auto-discover-url", "https://example.com",
-			},
-			source: &auth_model.Source{
-				Type:     auth_model.OAuth2,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Scopes:                        []string{},
-					Provider:                      "openidConnect",
-					ClientID:                      "some_key",
-					ClientSecret:                  "some_secret",
-					OpenIDConnectAutoDiscoveryURL: "https://example.com",
-				},
-				TwoFactorPolicy: "",
-			},
-		},
-		{
-			name: "valid config with options",
-			args: []string{
-				"--name", "test",
-				"--provider", "gitlab",
-				"--key", "some_key",
-				"--secret", "some_secret",
-				"--use-custom-urls", "true",
-				"--custom-token-url", "https://example.com/token",
-				"--custom-auth-url", "https://example.com/auth",
-				"--custom-profile-url", "https://example.com/profile",
-				"--custom-email-url", "https://example.com/email",
-				"--custom-tenant-id", "some_tenant",
-				"--icon-url", "https://example.com/icon",
-				"--scopes", "scope1,scope2",
-				"--skip-local-2fa", "true",
-				"--required-claim-name", "claim_name",
-				"--required-claim-value", "claim_value",
-				"--group-claim-name", "group_name",
-				"--admin-group", "admin",
-				"--restricted-group", "restricted",
-				"--group-team-map", `{"group1": [1,2]}`,
-				"--group-team-map-removal=true",
-				"--ssh-public-key-claim-name", "attr_ssh_pub_key",
-				"--full-name-claim-name", "attr_full_name",
-			},
-			source: &auth_model.Source{
-				Type:     auth_model.OAuth2,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Provider:     "gitlab",
-					ClientID:     "some_key",
-					ClientSecret: "some_secret",
-					CustomURLMapping: &oauth2.CustomURLMapping{
-						TokenURL:   "https://example.com/token",
-						AuthURL:    "https://example.com/auth",
-						ProfileURL: "https://example.com/profile",
-						EmailURL:   "https://example.com/email",
-						Tenant:     "some_tenant",
-					},
-					IconURL:               "https://example.com/icon",
-					Scopes:                []string{"scope1", "scope2"},
-					RequiredClaimName:     "claim_name",
-					RequiredClaimValue:    "claim_value",
-					GroupClaimName:        "group_name",
-					AdminGroup:            "admin",
-					RestrictedGroup:       "restricted",
-					GroupTeamMap:          `{"group1": [1,2]}`,
-					GroupTeamMapRemoval:   true,
-					SSHPublicKeyClaimName: "attr_ssh_pub_key",
-					FullNameClaimName:     "attr_full_name",
-				},
-				TwoFactorPolicy: "skip",
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			var createdSource *auth_model.Source
-			a := &authService{
-				initDB: func(ctx context.Context) error {
-					return nil
-				},
-				createAuthSource: func(ctx context.Context, source *auth_model.Source) error {
-					createdSource = source
-					return nil
-				},
-			}
-
-			app := &cli.Command{
-				Flags:  microcmdAuthAddOauth().Flags,
-				Action: a.runAddOauth,
-			}
-
-			args := []string{"oauth-test"}
-			args = append(args, tc.args...)
-
-			err := app.Run(t.Context(), args)
-
-			if tc.errMsg != "" {
-				assert.EqualError(t, err, tc.errMsg)
-			} else {
-				assert.NoError(t, err)
-				assert.Equal(t, tc.source, createdSource)
-			}
-		})
-	}
-}
-
-func TestUpdateOauth(t *testing.T) {
-	testCases := []struct {
-		name               string
-		args               []string
-		id                 int64
-		existingAuthSource *auth_model.Source
-		authSource         *auth_model.Source
-		errMsg             string
-	}{
-		{
-			name: "missing id",
-			args: []string{
-				"--name", "test",
-			},
-			errMsg: "--id flag is missing",
-		},
-		{
-			name: "valid config",
-			id:   1,
-			existingAuthSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.OAuth2,
-				Name:     "old name",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Provider:     "github",
-					ClientID:     "old_key",
-					ClientSecret: "old_secret",
-				},
-				TwoFactorPolicy: "",
-			},
-			args: []string{
-				"--id", "1",
-				"--name", "test",
-				"--provider", "gitlab",
-				"--key", "new_key",
-				"--secret", "new_secret",
-			},
-			authSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.OAuth2,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Provider:         "gitlab",
-					ClientID:         "new_key",
-					ClientSecret:     "new_secret",
-					CustomURLMapping: &oauth2.CustomURLMapping{},
-				},
-				TwoFactorPolicy: "",
-			},
-		},
-		{
-			name: "valid config with options",
-			id:   1,
-			existingAuthSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.OAuth2,
-				Name:     "old name",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Provider:     "gitlab",
-					ClientID:     "old_key",
-					ClientSecret: "old_secret",
-					CustomURLMapping: &oauth2.CustomURLMapping{
-						TokenURL:   "https://old.example.com/token",
-						AuthURL:    "https://old.example.com/auth",
-						ProfileURL: "https://old.example.com/profile",
-						EmailURL:   "https://old.example.com/email",
-						Tenant:     "old_tenant",
-					},
-					IconURL:               "https://old.example.com/icon",
-					Scopes:                []string{"old_scope1", "old_scope2"},
-					RequiredClaimName:     "old_claim_name",
-					RequiredClaimValue:    "old_claim_value",
-					GroupClaimName:        "old_group_name",
-					AdminGroup:            "old_admin",
-					RestrictedGroup:       "old_restricted",
-					GroupTeamMap:          `{"old_group1": [1,2]}`,
-					GroupTeamMapRemoval:   true,
-					SSHPublicKeyClaimName: "old_ssh_pub_key",
-					FullNameClaimName:     "old_full_name",
-				},
-				TwoFactorPolicy: "",
-			},
-			args: []string{
-				"--id", "1",
-				"--name", "test",
-				"--provider", "github",
-				"--key", "new_key",
-				"--secret", "new_secret",
-				"--use-custom-urls", "true",
-				"--custom-token-url", "https://example.com/token",
-				"--custom-auth-url", "https://example.com/auth",
-				"--custom-profile-url", "https://example.com/profile",
-				"--custom-email-url", "https://example.com/email",
-				"--custom-tenant-id", "new_tenant",
-				"--icon-url", "https://example.com/icon",
-				"--scopes", "scope1,scope2",
-				"--skip-local-2fa=true",
-				"--required-claim-name", "claim_name",
-				"--required-claim-value", "claim_value",
-				"--group-claim-name", "group_name",
-				"--admin-group", "admin",
-				"--restricted-group", "restricted",
-				"--group-team-map", `{"group1": [1,2]}`,
-				"--group-team-map-removal=false",
-				"--ssh-public-key-claim-name", "new_ssh_pub_key",
-				"--full-name-claim-name", "new_full_name",
-			},
-			authSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.OAuth2,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &oauth2.Source{
-					Provider:     "github",
-					ClientID:     "new_key",
-					ClientSecret: "new_secret",
-					CustomURLMapping: &oauth2.CustomURLMapping{
-						TokenURL:   "https://example.com/token",
-						AuthURL:    "https://example.com/auth",
-						ProfileURL: "https://example.com/profile",
-						EmailURL:   "https://example.com/email",
-						Tenant:     "new_tenant",
-					},
-					IconURL:               "https://example.com/icon",
-					Scopes:                []string{"scope1", "scope2"},
-					RequiredClaimName:     "claim_name",
-					RequiredClaimValue:    "claim_value",
-					GroupClaimName:        "group_name",
-					AdminGroup:            "admin",
-					RestrictedGroup:       "restricted",
-					GroupTeamMap:          `{"group1": [1,2]}`,
-					GroupTeamMapRemoval:   false,
-					SSHPublicKeyClaimName: "new_ssh_pub_key",
-					FullNameClaimName:     "new_full_name",
-				},
-				TwoFactorPolicy: "skip",
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			a := &authService{
-				initDB: func(ctx context.Context) error {
-					return nil
-				},
-				getAuthSourceByID: func(ctx context.Context, id int64) (*auth_model.Source, error) {
-					return &auth_model.Source{
-						ID:       1,
-						Type:     auth_model.OAuth2,
-						Name:     "test",
-						IsActive: true,
-						Cfg: &oauth2.Source{
-							CustomURLMapping: &oauth2.CustomURLMapping{},
-						},
-						TwoFactorPolicy: "skip",
-					}, nil
-				},
-				updateAuthSource: func(ctx context.Context, source *auth_model.Source) error {
-					assert.Equal(t, tc.authSource, source)
-					return nil
-				},
-			}
-
-			app := &cli.Command{
-				Flags:  microcmdAuthUpdateOauth().Flags,
-				Action: a.runUpdateOauth,
-			}
-
-			args := []string{"oauth-test"}
-			args = append(args, tc.args...)
-
-			err := app.Run(t.Context(), args)
-
-			if tc.errMsg != "" {
-				assert.EqualError(t, err, tc.errMsg)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}
--- a/cmd/admin_auth_smtp_test.go
+++ b/cmd/admin_auth_smtp_test.go
@@ -1,271 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"testing"
-
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/smtp"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
-)
-
-func TestAddSMTP(t *testing.T) {
-	testCases := []struct {
-		name   string
-		args   []string
-		source *auth_model.Source
-		errMsg string
-	}{
-		{
-			name: "missing name",
-			args: []string{
-				"--host", "localhost",
-				"--port", "25",
-			},
-			errMsg: "name must be set",
-		},
-		{
-			name: "missing host",
-			args: []string{
-				"--name", "test",
-				"--port", "25",
-			},
-			errMsg: "host must be set",
-		},
-		{
-			name: "missing port",
-			args: []string{
-				"--name", "test",
-				"--host", "localhost",
-			},
-			errMsg: "port must be set",
-		},
-		{
-			name: "valid config",
-			args: []string{
-				"--name", "test",
-				"--host", "localhost",
-				"--port", "25",
-			},
-			source: &auth_model.Source{
-				Type:     auth_model.SMTP,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &smtp.Source{
-					Auth: "PLAIN",
-					Host: "localhost",
-					Port: 25,
-				},
-				TwoFactorPolicy: "",
-			},
-		},
-		{
-			name: "valid config with options",
-			args: []string{
-				"--name", "test",
-				"--host", "localhost",
-				"--port", "25",
-				"--auth-type", "LOGIN",
-				"--force-smtps",
-				"--skip-verify",
-				"--helo-hostname", "example.com",
-				"--disable-helo=true",
-				"--allowed-domains", "example.com,example.org",
-				"--skip-local-2fa",
-				"--active=false",
-			},
-			source: &auth_model.Source{
-				Type:     auth_model.SMTP,
-				Name:     "test",
-				IsActive: false,
-				Cfg: &smtp.Source{
-					Auth:           "LOGIN",
-					Host:           "localhost",
-					Port:           25,
-					ForceSMTPS:     true,
-					SkipVerify:     true,
-					HeloHostname:   "example.com",
-					DisableHelo:    true,
-					AllowedDomains: "example.com,example.org",
-				},
-				TwoFactorPolicy: "skip",
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			a := &authService{
-				initDB: func(ctx context.Context) error {
-					return nil
-				},
-				createAuthSource: func(ctx context.Context, source *auth_model.Source) error {
-					assert.Equal(t, tc.source, source)
-					return nil
-				},
-			}
-
-			cmd := &cli.Command{
-				Flags:  microcmdAuthAddSMTP().Flags,
-				Action: a.runAddSMTP,
-			}
-
-			args := []string{"smtp-test"}
-			args = append(args, tc.args...)
-
-			t.Log(args)
-			err := cmd.Run(t.Context(), args)
-
-			if tc.errMsg != "" {
-				assert.EqualError(t, err, tc.errMsg)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}
-
-func TestUpdateSMTP(t *testing.T) {
-	testCases := []struct {
-		name               string
-		args               []string
-		existingAuthSource *auth_model.Source
-		authSource         *auth_model.Source
-		errMsg             string
-	}{
-		{
-			name: "missing id",
-			args: []string{
-				"--name", "test",
-				"--host", "localhost",
-				"--port", "25",
-			},
-			errMsg: "--id flag is missing",
-		},
-		{
-			name: "valid config",
-			existingAuthSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.SMTP,
-				Name:     "old name",
-				IsActive: true,
-				Cfg: &smtp.Source{
-					Auth: "PLAIN",
-					Host: "old host",
-					Port: 26,
-				},
-			},
-			args: []string{
-				"--id", "1",
-				"--name", "test",
-				"--host", "localhost",
-				"--port", "25",
-			},
-			authSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.SMTP,
-				Name:     "test",
-				IsActive: true,
-				Cfg: &smtp.Source{
-					Auth: "PLAIN",
-					Host: "localhost",
-					Port: 25,
-				},
-			},
-		},
-		{
-			name: "valid config with options",
-			existingAuthSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.SMTP,
-				Name:     "old name",
-				IsActive: true,
-				Cfg: &smtp.Source{
-					Auth:           "PLAIN",
-					Host:           "old host",
-					Port:           26,
-					HeloHostname:   "old.example.com",
-					AllowedDomains: "old.example.com",
-				},
-				TwoFactorPolicy: "",
-			},
-			args: []string{
-				"--id", "1",
-				"--name", "test",
-				"--host", "localhost",
-				"--port", "25",
-				"--auth-type", "LOGIN",
-				"--force-smtps",
-				"--skip-verify",
-				"--helo-hostname", "example.com",
-				"--disable-helo",
-				"--allowed-domains", "example.com,example.org",
-				"--skip-local-2fa",
-				"--active=false",
-			},
-			authSource: &auth_model.Source{
-				ID:       1,
-				Type:     auth_model.SMTP,
-				Name:     "test",
-				IsActive: false,
-				Cfg: &smtp.Source{
-					Auth:           "LOGIN",
-					Host:           "localhost",
-					Port:           25,
-					ForceSMTPS:     true,
-					SkipVerify:     true,
-					HeloHostname:   "example.com",
-					DisableHelo:    true,
-					AllowedDomains: "example.com,example.org",
-				},
-				TwoFactorPolicy: "skip",
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			a := &authService{
-				initDB: func(ctx context.Context) error {
-					return nil
-				},
-				getAuthSourceByID: func(ctx context.Context, id int64) (*auth_model.Source, error) {
-					return &auth_model.Source{
-						ID:       1,
-						Type:     auth_model.SMTP,
-						Name:     "test",
-						IsActive: true,
-						Cfg: &smtp.Source{
-							Auth: "PLAIN",
-						},
-					}, nil
-				},
-
-				updateAuthSource: func(ctx context.Context, source *auth_model.Source) error {
-					assert.Equal(t, tc.authSource, source)
-					return nil
-				},
-			}
-
-			app := &cli.Command{
-				Flags:  microcmdAuthUpdateSMTP().Flags,
-				Action: a.runUpdateSMTP,
-			}
-			args := []string{"smtp-tests"}
-			args = append(args, tc.args...)
-
-			err := app.Run(t.Context(), args)
-
-			if tc.errMsg != "" {
-				assert.EqualError(t, err, tc.errMsg)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}
--- a/cmd/admin_auth_stmp.go
+++ b/cmd/admin_auth_stmp.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"strings"

@@ -12,11 +11,11 @@ import (
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/auth/source/smtp"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func smtpCLIFlags() []cli.Flag {
-	return []cli.Flag{
+var (
+	smtpCLIFlags = []cli.Flag{
 		&cli.StringFlag{
 			Name:  "name",
 			Value: "",
@@ -39,10 +38,12 @@ func smtpCLIFlags() []cli.Flag {
 		&cli.BoolFlag{
 			Name:  "force-smtps",
 			Usage: "SMTPS is always used on port 465. Set this to force SMTPS on other ports.",
+			Value: true,
 		},
 		&cli.BoolFlag{
 			Name:  "skip-verify",
 			Usage: "Skip TLS verify.",
+			Value: true,
 		},
 		&cli.StringFlag{
 			Name:  "helo-hostname",
@@ -52,6 +53,7 @@ func smtpCLIFlags() []cli.Flag {
 		&cli.BoolFlag{
 			Name:  "disable-helo",
 			Usage: "Disable SMTP helo.",
+			Value: true,
 		},
 		&cli.StringFlag{
 			Name:  "allowed-domains",
@@ -61,6 +63,7 @@ func smtpCLIFlags() []cli.Flag {
 		&cli.BoolFlag{
 			Name:  "skip-local-2fa",
 			Usage: "Skip 2FA to log on.",
+			Value: true,
 		},
 		&cli.BoolFlag{
 			Name:  "active",
@@ -68,34 +71,23 @@ func smtpCLIFlags() []cli.Flag {
 			Value: true,
 		},
 	}
-}

-func microcmdAuthUpdateSMTP() *cli.Command {
-	return &cli.Command{
-		Name:  "update-smtp",
-		Usage: "Update existing SMTP authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().runUpdateSMTP(ctx, cmd)
-		},
-		Flags: append(smtpCLIFlags()[:1], append([]cli.Flag{&cli.Int64Flag{
-			Name:  "id",
-			Usage: "ID of authentication source",
-		}}, smtpCLIFlags()[1:]...)...),
+	microcmdAuthAddSMTP = &cli.Command{
+		Name:   "add-smtp",
+		Usage:  "Add new SMTP authentication source",
+		Action: runAddSMTP,
+		Flags:  smtpCLIFlags,
 	}
-}

-func microcmdAuthAddSMTP() *cli.Command {
-	return &cli.Command{
-		Name:  "add-smtp",
-		Usage: "Add new SMTP authentication source",
-		Action: func(ctx context.Context, cmd *cli.Command) error {
-			return newAuthService().runAddSMTP(ctx, cmd)
-		},
-		Flags: smtpCLIFlags(),
+	microcmdAuthUpdateSMTP = &cli.Command{
+		Name:   "update-smtp",
+		Usage:  "Update existing SMTP authentication source",
+		Action: runUpdateSMTP,
+		Flags:  append(smtpCLIFlags[:1], append([]cli.Flag{idFlag}, smtpCLIFlags[1:]...)...),
 	}
-}
+)

-func parseSMTPConfig(c *cli.Command, conf *smtp.Source) error {
+func parseSMTPConfig(c *cli.Context, conf *smtp.Source) error {
 	if c.IsSet("auth-type") {
 		conf.Auth = c.String("auth-type")
 		validAuthTypes := []string{"PLAIN", "LOGIN", "CRAM-MD5"}
@@ -128,8 +120,11 @@ func parseSMTPConfig(c *cli.Command, conf *smtp.Source) error {
 	return nil
 }

-func (a *authService) runAddSMTP(ctx context.Context, c *cli.Command) error {
-	if err := a.initDB(ctx); err != nil {
+func runAddSMTP(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
 		return err
 	}

@@ -157,7 +152,7 @@ func (a *authService) runAddSMTP(ctx context.Context, c *cli.Command) error {
 		smtpConfig.Auth = "PLAIN"
 	}

-	return a.createAuthSource(ctx, &auth_model.Source{
+	return auth_model.CreateSource(ctx, &auth_model.Source{
 		Type:            auth_model.SMTP,
 		Name:            c.String("name"),
 		IsActive:        active,
@@ -166,16 +161,19 @@ func (a *authService) runAddSMTP(ctx context.Context, c *cli.Command) error {
 	})
 }

-func (a *authService) runUpdateSMTP(ctx context.Context, c *cli.Command) error {
+func runUpdateSMTP(c *cli.Context) error {
 	if !c.IsSet("id") {
 		return errors.New("--id flag is missing")
 	}

-	if err := a.initDB(ctx); err != nil {
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
 		return err
 	}

-	source, err := a.getAuthSourceByID(ctx, c.Int64("id"))
+	source, err := auth_model.GetSourceByID(ctx, c.Int64("id"))
 	if err != nil {
 		return err
 	}
@@ -196,5 +194,5 @@ func (a *authService) runUpdateSMTP(ctx context.Context, c *cli.Command) error {

 	source.Cfg = smtpConfig
 	source.TwoFactorPolicy = util.Iif(c.Bool("skip-local-2fa"), "skip", "")
-	return a.updateAuthSource(ctx, source)
+	return auth_model.UpdateSource(ctx, source)
 }
--- a/cmd/admin_regenerate.go
+++ b/cmd/admin_regenerate.go
@@ -4,13 +4,11 @@
 package cmd

 import (
-	"context"
-
 	"code.gitea.io/gitea/modules/graceful"
 	asymkey_service "code.gitea.io/gitea/services/asymkey"
 	repo_service "code.gitea.io/gitea/services/repository"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
@@ -27,14 +25,20 @@ var (
 	}
 )

-func runRegenerateHooks(ctx context.Context, _ *cli.Command) error {
+func runRegenerateHooks(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}
 	return repo_service.SyncRepositoryHooks(graceful.GetManager().ShutdownContext())
 }

-func runRegenerateKeys(ctx context.Context, _ *cli.Command) error {
+func runRegenerateKeys(_ *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}
--- a/cmd/admin_user.go
+++ b/cmd/admin_user.go
@@ -4,18 +4,18 @@
 package cmd

 import (
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var subcmdUser = &cli.Command{
 	Name:  "user",
 	Usage: "Modify users",
-	Commands: []*cli.Command{
-		microcmdUserCreate(),
+	Subcommands: []*cli.Command{
+		microcmdUserCreate,
 		microcmdUserList,
-		microcmdUserChangePassword(),
-		microcmdUserDelete(),
+		microcmdUserChangePassword,
+		microcmdUserDelete,
 		microcmdUserGenerateAccessToken,
-		microcmdUserMustChangePassword(),
+		microcmdUserMustChangePassword,
 	},
 }
--- a/cmd/admin_user_change_password.go
+++ b/cmd/admin_user_change_password.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"

@@ -14,41 +13,44 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	user_service "code.gitea.io/gitea/services/user"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func microcmdUserChangePassword() *cli.Command {
-	return &cli.Command{
-		Name:   "change-password",
-		Usage:  "Change a user's password",
-		Action: runChangePassword,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:     "username",
-				Aliases:  []string{"u"},
-				Usage:    "The user to change password for",
-				Required: true,
-			},
-			&cli.StringFlag{
-				Name:     "password",
-				Aliases:  []string{"p"},
-				Usage:    "New password to set for user",
-				Required: true,
-			},
-			&cli.BoolFlag{
-				Name:  "must-change-password",
-				Usage: "User must change password (can be disabled by --must-change-password=false)",
-				Value: true,
-			},
+var microcmdUserChangePassword = &cli.Command{
+	Name:   "change-password",
+	Usage:  "Change a user's password",
+	Action: runChangePassword,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "username",
+			Aliases: []string{"u"},
+			Value:   "",
+			Usage:   "The user to change password for",
 		},
-	}
+		&cli.StringFlag{
+			Name:    "password",
+			Aliases: []string{"p"},
+			Value:   "",
+			Usage:   "New password to set for user",
+		},
+		&cli.BoolFlag{
+			Name:  "must-change-password",
+			Usage: "User must change password (can be disabled by --must-change-password=false)",
+			Value: true,
+		},
+	},
 }

-func runChangePassword(ctx context.Context, c *cli.Command) error {
-	if !setting.IsInTesting {
-		if err := initDB(ctx); err != nil {
-			return err
-		}
+func runChangePassword(c *cli.Context) error {
+	if err := argsSet(c, "username", "password"); err != nil {
+		return err
+	}
+
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
 	}

 	user, err := user_model.GetUserByName(ctx, c.String("username"))
--- a/cmd/admin_user_change_password_test.go
+++ b/cmd/admin_user_change_password_test.go
@@ -1,91 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"testing"
-
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestChangePasswordCommand(t *testing.T) {
-	ctx := t.Context()
-
-	defer func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}))
-	}()
-
-	t.Run("change password successfully", func(t *testing.T) {
-		// defer func() {
-		// 	require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}))
-		// }()
-		// Prepare test user
-		unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-		err := microcmdUserCreate().Run(ctx, []string{"create", "--username", "testuser", "--email", "testuser@gitea.local", "--random-password"})
-		require.NoError(t, err)
-
-		// load test user
-		userBase := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-
-		// Change the password
-		err = microcmdUserChangePassword().Run(ctx, []string{"change-password", "--username", "testuser", "--password", "newpassword"})
-		require.NoError(t, err)
-
-		// Verify the password has been changed
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-		assert.NotEqual(t, userBase.Passwd, user.Passwd)
-		assert.NotEqual(t, userBase.Salt, user.Salt)
-
-		// Additional check for must-change-password flag
-		require.NoError(t, microcmdUserChangePassword().Run(ctx, []string{"change-password", "--username", "testuser", "--password", "anotherpassword", "--must-change-password=false"}))
-		user = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-		assert.False(t, user.MustChangePassword)
-
-		require.NoError(t, microcmdUserChangePassword().Run(ctx, []string{"change-password", "--username", "testuser", "--password", "yetanotherpassword", "--must-change-password"}))
-		user = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-		assert.True(t, user.MustChangePassword)
-	})
-
-	t.Run("failure cases", func(t *testing.T) {
-		testCases := []struct {
-			name        string
-			args        []string
-			expectedErr string
-		}{
-			{
-				name:        "user does not exist",
-				args:        []string{"change-password", "--username", "nonexistentuser", "--password", "newpassword"},
-				expectedErr: "user does not exist",
-			},
-			{
-				name:        "missing username",
-				args:        []string{"change-password", "--password", "newpassword"},
-				expectedErr: `"username" not set`,
-			},
-			{
-				name:        "missing password",
-				args:        []string{"change-password", "--username", "testuser"},
-				expectedErr: `"password" not set`,
-			},
-			{
-				name:        "too short password",
-				args:        []string{"change-password", "--username", "testuser", "--password", "1"},
-				expectedErr: "password is not long enough",
-			},
-		}
-
-		for _, tc := range testCases {
-			t.Run(tc.name, func(t *testing.T) {
-				err := microcmdUserChangePassword().Run(ctx, tc.args)
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.expectedErr)
-			})
-		}
-	})
-}
--- a/cmd/admin_user_create.go
+++ b/cmd/admin_user_create.go
@@ -16,95 +16,87 @@ import (
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func microcmdUserCreate() *cli.Command {
-	return &cli.Command{
-		Name:   "create",
-		Usage:  "Create a new user in database",
-		Action: runCreateUser,
-		MutuallyExclusiveFlags: []cli.MutuallyExclusiveFlags{
-			{
-				Flags: [][]cli.Flag{
-					{
-						&cli.StringFlag{
-							Name:  "name",
-							Usage: "Username. DEPRECATED: use username instead",
-						},
-						&cli.StringFlag{
-							Name:  "username",
-							Usage: "Username",
-						},
-					},
-				},
-				Required: true,
-			},
+var microcmdUserCreate = &cli.Command{
+	Name:   "create",
+	Usage:  "Create a new user in database",
+	Action: runCreateUser,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "name",
+			Usage: "Username. DEPRECATED: use username instead",
 		},
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:  "user-type",
-				Usage: "Set user's type: individual or bot",
-				Value: "individual",
-			},
-			&cli.StringFlag{
-				Name:  "password",
-				Usage: "User password",
-			},
-			&cli.StringFlag{
-				Name:     "email",
-				Usage:    "User email address",
-				Required: true,
-			},
-			&cli.BoolFlag{
-				Name:  "admin",
-				Usage: "User is an admin",
-			},
-			&cli.BoolFlag{
-				Name:  "random-password",
-				Usage: "Generate a random password for the user",
-			},
-			&cli.BoolFlag{
-				Name:        "must-change-password",
-				Usage:       "User must change password after initial login, defaults to true for all users except the first one (can be disabled by --must-change-password=false)",
-				HideDefault: true,
-			},
-			&cli.IntFlag{
-				Name:  "random-password-length",
-				Usage: "Length of the random password to be generated",
-				Value: 12,
-			},
-			&cli.BoolFlag{
-				Name:  "access-token",
-				Usage: "Generate access token for the user",
-			},
-			&cli.StringFlag{
-				Name:  "access-token-name",
-				Usage: `Name of the generated access token`,
-				Value: "gitea-admin",
-			},
-			&cli.StringFlag{
-				Name:  "access-token-scopes",
-				Usage: `Scopes of the generated access token, comma separated. Examples: "all", "public-only,read:issue", "write:repository,write:user"`,
-				Value: "all",
-			},
-			&cli.BoolFlag{
-				Name:  "restricted",
-				Usage: "Make a restricted user account",
-			},
-			&cli.StringFlag{
-				Name:  "fullname",
-				Usage: `The full, human-readable name of the user`,
-			},
+		&cli.StringFlag{
+			Name:  "username",
+			Usage: "Username",
 		},
-	}
+		&cli.StringFlag{
+			Name:  "user-type",
+			Usage: "Set user's type: individual or bot",
+			Value: "individual",
+		},
+		&cli.StringFlag{
+			Name:  "password",
+			Usage: "User password",
+		},
+		&cli.StringFlag{
+			Name:  "email",
+			Usage: "User email address",
+		},
+		&cli.BoolFlag{
+			Name:  "admin",
+			Usage: "User is an admin",
+		},
+		&cli.BoolFlag{
+			Name:  "random-password",
+			Usage: "Generate a random password for the user",
+		},
+		&cli.BoolFlag{
+			Name:               "must-change-password",
+			Usage:              "User must change password after initial login, defaults to true for all users except the first one (can be disabled by --must-change-password=false)",
+			DisableDefaultText: true,
+		},
+		&cli.IntFlag{
+			Name:  "random-password-length",
+			Usage: "Length of the random password to be generated",
+			Value: 12,
+		},
+		&cli.BoolFlag{
+			Name:  "access-token",
+			Usage: "Generate access token for the user",
+		},
+		&cli.StringFlag{
+			Name:  "access-token-name",
+			Usage: `Name of the generated access token`,
+			Value: "gitea-admin",
+		},
+		&cli.StringFlag{
+			Name:  "access-token-scopes",
+			Usage: `Scopes of the generated access token, comma separated. Examples: "all", "public-only,read:issue", "write:repository,write:user"`,
+			Value: "all",
+		},
+		&cli.BoolFlag{
+			Name:  "restricted",
+			Usage: "Make a restricted user account",
+		},
+		&cli.StringFlag{
+			Name:  "fullname",
+			Usage: `The full, human-readable name of the user`,
+		},
+	},
 }

-func runCreateUser(ctx context.Context, c *cli.Command) error {
+func runCreateUser(c *cli.Context) error {
 	// this command highly depends on the many setting options (create org, visibility, etc.), so it must have a full setting load first
 	// duplicate setting loading should be safe at the moment, but it should be refactored & improved in the future.
 	setting.LoadSettings()

+	if err := argsSet(c, "email"); err != nil {
+		return err
+	}
+
 	userTypes := map[string]user_model.UserType{
 		"individual": user_model.UserTypeIndividual,
 		"bot":        user_model.UserTypeBot,
@@ -121,6 +113,12 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 			return errors.New("password can only be set for individual users")
 		}
 	}
+	if c.IsSet("name") && c.IsSet("username") {
+		return errors.New("cannot set both --name and --username flags")
+	}
+	if !c.IsSet("name") && !c.IsSet("username") {
+		return errors.New("one of --name or --username flags must be set")
+	}

 	if c.IsSet("password") && c.IsSet("random-password") {
 		return errors.New("cannot set both -random-password and -password flags")
@@ -131,12 +129,16 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 		username = c.String("username")
 	} else {
 		username = c.String("name")
-		_, _ = fmt.Fprintf(c.ErrWriter, "--name flag is deprecated. Use --username instead.\n")
+		_, _ = fmt.Fprintf(c.App.ErrWriter, "--name flag is deprecated. Use --username instead.\n")
 	}

+	ctx := c.Context
 	if !setting.IsInTesting {
-		// FIXME: need to refactor the "initDB" related code later
+		// FIXME: need to refactor the "installSignals/initDB" related code later
 		// it doesn't make sense to call it in (almost) every command action function
+		var cancel context.CancelFunc
+		ctx, cancel = installSignals()
+		defer cancel()
 		if err := initDB(ctx); err != nil {
 			return err
 		}
--- a/cmd/admin_user_create_test.go
+++ b/cmd/admin_user_create_test.go
@@ -18,10 +18,12 @@ import (
 )

 func TestAdminUserCreate(t *testing.T) {
+	app := NewMainApp(AppVersion{})
+
 	reset := func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}))
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.EmailAddress{}))
-		require.NoError(t, db.TruncateBeans(t.Context(), &auth_model.AccessToken{}))
+		require.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.User{}))
+		require.NoError(t, db.TruncateBeans(db.DefaultContext, &user_model.EmailAddress{}))
+		require.NoError(t, db.TruncateBeans(db.DefaultContext, &auth_model.AccessToken{}))
 	}

 	t.Run("MustChangePassword", func(t *testing.T) {
@@ -29,9 +31,8 @@ func TestAdminUserCreate(t *testing.T) {
 			IsAdmin            bool
 			MustChangePassword bool
 		}
-
 		createCheck := func(name, args string) check {
-			require.NoError(t, microcmdUserCreate().Run(t.Context(), strings.Fields(fmt.Sprintf("create --username %s --email %s@gitea.local %s --password foobar", name, name, args))))
+			require.NoError(t, app.Run(strings.Fields(fmt.Sprintf("./gitea admin user create --username %s --email %s@gitea.local %s --password foobar", name, name, args))))
 			u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: name})
 			return check{IsAdmin: u.IsAdmin, MustChangePassword: u.MustChangePassword}
 		}
@@ -50,7 +51,7 @@ func TestAdminUserCreate(t *testing.T) {
 	})

 	createUser := func(name string, args ...string) error {
-		return microcmdUserCreate().Run(t.Context(), append([]string{"create", "--username", name, "--email", name + "@gitea.local"}, args...))
+		return app.Run(append([]string{"./gitea", "admin", "user", "create", "--username", name, "--email", name + "@gitea.local"}, args...))
 	}

 	t.Run("UserType", func(t *testing.T) {
--- a/cmd/admin_user_delete.go
+++ b/cmd/admin_user_delete.go
@@ -4,56 +4,53 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"strings"

 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/storage"
 	user_service "code.gitea.io/gitea/services/user"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func microcmdUserDelete() *cli.Command {
-	return &cli.Command{
-		Name:  "delete",
-		Usage: "Delete specific user by id, name or email",
-		Flags: []cli.Flag{
-			&cli.Int64Flag{
-				Name:  "id",
-				Usage: "ID of user of the user to delete",
-			},
-			&cli.StringFlag{
-				Name:    "username",
-				Aliases: []string{"u"},
-				Usage:   "Username of the user to delete",
-			},
-			&cli.StringFlag{
-				Name:    "email",
-				Aliases: []string{"e"},
-				Usage:   "Email of the user to delete",
-			},
-			&cli.BoolFlag{
-				Name:  "purge",
-				Usage: "Purge user, all their repositories, organizations and comments",
-			},
+var microcmdUserDelete = &cli.Command{
+	Name:  "delete",
+	Usage: "Delete specific user by id, name or email",
+	Flags: []cli.Flag{
+		&cli.Int64Flag{
+			Name:  "id",
+			Usage: "ID of user of the user to delete",
 		},
-		Action: runDeleteUser,
-	}
+		&cli.StringFlag{
+			Name:    "username",
+			Aliases: []string{"u"},
+			Usage:   "Username of the user to delete",
+		},
+		&cli.StringFlag{
+			Name:    "email",
+			Aliases: []string{"e"},
+			Usage:   "Email of the user to delete",
+		},
+		&cli.BoolFlag{
+			Name:  "purge",
+			Usage: "Purge user, all their repositories, organizations and comments",
+		},
+	},
+	Action: runDeleteUser,
 }

-func runDeleteUser(ctx context.Context, c *cli.Command) error {
+func runDeleteUser(c *cli.Context) error {
 	if !c.IsSet("id") && !c.IsSet("username") && !c.IsSet("email") {
 		return errors.New("You must provide the id, username or email of a user to delete")
 	}

-	if !setting.IsInTesting {
-		if err := initDB(ctx); err != nil {
-			return err
-		}
+	ctx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(ctx); err != nil {
+		return err
 	}

 	if err := storage.Init(); err != nil {
@@ -73,11 +70,11 @@ func runDeleteUser(ctx context.Context, c *cli.Command) error {
 		return err
 	}
 	if c.IsSet("username") && user.LowerName != strings.ToLower(strings.TrimSpace(c.String("username"))) {
-		return fmt.Errorf("the user %s who has email %s does not match the provided username %s", user.Name, c.String("email"), c.String("username"))
+		return fmt.Errorf("The user %s who has email %s does not match the provided username %s", user.Name, c.String("email"), c.String("username"))
 	}

 	if c.IsSet("id") && user.ID != c.Int64("id") {
-		return fmt.Errorf("the user %s does not match the provided id %d", user.Name, c.Int64("id"))
+		return fmt.Errorf("The user %s does not match the provided id %d", user.Name, c.Int64("id"))
 	}

 	return user_service.DeleteUser(ctx, user, c.Bool("purge"))
--- a/cmd/admin_user_delete_test.go
+++ b/cmd/admin_user_delete_test.go
@@ -1,111 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"strconv"
-	"strings"
-	"testing"
-
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestAdminUserDelete(t *testing.T) {
-	ctx := t.Context()
-	defer func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}))
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.EmailAddress{}))
-		require.NoError(t, db.TruncateBeans(t.Context(), &auth_model.AccessToken{}))
-	}()
-
-	setupTestUser := func(t *testing.T) {
-		unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-		err := microcmdUserCreate().Run(t.Context(), []string{"create", "--username", "testuser", "--email", "testuser@gitea.local", "--random-password"})
-		require.NoError(t, err)
-	}
-
-	t.Run("delete user by id", func(t *testing.T) {
-		setupTestUser(t)
-
-		u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-		err := microcmdUserDelete().Run(ctx, []string{"delete-test", "--id", strconv.FormatInt(u.ID, 10)})
-		require.NoError(t, err)
-		unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-	})
-	t.Run("delete user by username", func(t *testing.T) {
-		setupTestUser(t)
-
-		err := microcmdUserDelete().Run(ctx, []string{"delete-test", "--username", "testuser"})
-		require.NoError(t, err)
-		unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-	})
-	t.Run("delete user by email", func(t *testing.T) {
-		setupTestUser(t)
-
-		err := microcmdUserDelete().Run(ctx, []string{"delete-test", "--email", "testuser@gitea.local"})
-		require.NoError(t, err)
-		unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-	})
-	t.Run("delete user by all 3 attributes", func(t *testing.T) {
-		setupTestUser(t)
-
-		u := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-		err := microcmdUserDelete().Run(ctx, []string{"delete", "--id", strconv.FormatInt(u.ID, 10), "--username", "testuser", "--email", "testuser@gitea.local"})
-		require.NoError(t, err)
-		unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-	})
-}
-
-func TestAdminUserDeleteFailure(t *testing.T) {
-	testCases := []struct {
-		name        string
-		args        []string
-		expectedErr string
-	}{
-		{
-			name:        "no user to delete",
-			args:        []string{"delete", "--username", "nonexistentuser"},
-			expectedErr: "user does not exist",
-		},
-		{
-			name:        "user exists but provided username does not match",
-			args:        []string{"delete", "--email", "testuser@gitea.local", "--username", "wrongusername"},
-			expectedErr: "the user testuser who has email testuser@gitea.local does not match the provided username wrongusername",
-		},
-		{
-			name:        "user exists but provided id does not match",
-			args:        []string{"delete", "--username", "testuser", "--id", "999"},
-			expectedErr: "the user testuser does not match the provided id 999",
-		},
-		{
-			name:        "no required flags are provided",
-			args:        []string{"delete"},
-			expectedErr: "You must provide the id, username or email of a user to delete",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := t.Context()
-			if strings.Contains(tc.name, "user exists") {
-				unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "testuser"})
-				err := microcmdUserCreate().Run(t.Context(), []string{"create", "--username", "testuser", "--email", "testuser@gitea.local", "--random-password"})
-				require.NoError(t, err)
-			}
-
-			err := microcmdUserDelete().Run(ctx, tc.args)
-			require.Error(t, err)
-			require.Contains(t, err.Error(), tc.expectedErr)
-		})
-
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}))
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.EmailAddress{}))
-		require.NoError(t, db.TruncateBeans(t.Context(), &auth_model.AccessToken{}))
-	}
-}
--- a/cmd/admin_user_generate_access_token.go
+++ b/cmd/admin_user_generate_access_token.go
@@ -4,14 +4,13 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"

 	auth_model "code.gitea.io/gitea/models/auth"
 	user_model "code.gitea.io/gitea/models/user"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var microcmdUserGenerateAccessToken = &cli.Command{
@@ -42,11 +41,14 @@ var microcmdUserGenerateAccessToken = &cli.Command{
 	Action: runGenerateAccessToken,
 }

-func runGenerateAccessToken(ctx context.Context, c *cli.Command) error {
+func runGenerateAccessToken(c *cli.Context) error {
 	if !c.IsSet("username") {
 		return errors.New("you must provide a username to generate a token for")
 	}

+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}
--- a/cmd/admin_user_list.go
+++ b/cmd/admin_user_list.go
@@ -4,14 +4,13 @@
 package cmd

 import (
-	"context"
 	"fmt"
 	"os"
 	"text/tabwriter"

 	user_model "code.gitea.io/gitea/models/user"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var microcmdUserList = &cli.Command{
@@ -26,7 +25,10 @@ var microcmdUserList = &cli.Command{
 	},
 }

-func runListUsers(ctx context.Context, c *cli.Command) error {
+func runListUsers(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if err := initDB(ctx); err != nil {
 		return err
 	}
--- a/cmd/admin_user_must_change_password.go
+++ b/cmd/admin_user_must_change_password.go
@@ -4,41 +4,40 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"

 	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func microcmdUserMustChangePassword() *cli.Command {
-	return &cli.Command{
-		Name:   "must-change-password",
-		Usage:  "Set the must change password flag for the provided users or all users",
-		Action: runMustChangePassword,
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:    "all",
-				Aliases: []string{"A"},
-				Usage:   "All users must change password, except those explicitly excluded with --exclude",
-			},
-			&cli.StringSliceFlag{
-				Name:    "exclude",
-				Aliases: []string{"e"},
-				Usage:   "Do not change the must-change-password flag for these users",
-			},
-			&cli.BoolFlag{
-				Name:  "unset",
-				Usage: "Instead of setting the must-change-password flag, unset it",
-			},
+var microcmdUserMustChangePassword = &cli.Command{
+	Name:   "must-change-password",
+	Usage:  "Set the must change password flag for the provided users or all users",
+	Action: runMustChangePassword,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:    "all",
+			Aliases: []string{"A"},
+			Usage:   "All users must change password, except those explicitly excluded with --exclude",
 		},
-	}
+		&cli.StringSliceFlag{
+			Name:    "exclude",
+			Aliases: []string{"e"},
+			Usage:   "Do not change the must-change-password flag for these users",
+		},
+		&cli.BoolFlag{
+			Name:  "unset",
+			Usage: "Instead of setting the must-change-password flag, unset it",
+		},
+	},
 }

-func runMustChangePassword(ctx context.Context, c *cli.Command) error {
+func runMustChangePassword(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	if c.NArg() == 0 && !c.IsSet("all") {
 		return errors.New("either usernames or --all must be provided")
 	}
@@ -47,10 +46,8 @@ func runMustChangePassword(ctx context.Context, c *cli.Command) error {
 	all := c.Bool("all")
 	exclude := c.StringSlice("exclude")

-	if !setting.IsInTesting {
-		if err := initDB(ctx); err != nil {
-			return err
-		}
+	if err := initDB(ctx); err != nil {
+		return err
 	}

 	n, err := user_model.SetMustChangePassword(ctx, all, mustChangePassword, c.Args().Slice(), exclude)
--- a/cmd/admin_user_must_change_password_test.go
+++ b/cmd/admin_user_must_change_password_test.go
@@ -1,78 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"testing"
-
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMustChangePassword(t *testing.T) {
-	defer func() {
-		require.NoError(t, db.TruncateBeans(t.Context(), &user_model.User{}))
-	}()
-	err := microcmdUserCreate().Run(t.Context(), []string{"create", "--username", "testuser", "--email", "testuser@gitea.local", "--random-password"})
-	require.NoError(t, err)
-	err = microcmdUserCreate().Run(t.Context(), []string{"create", "--username", "testuserexclude", "--email", "testuserexclude@gitea.local", "--random-password"})
-	require.NoError(t, err)
-	// Reset password change flag
-	err = microcmdUserMustChangePassword().Run(t.Context(), []string{"change-test", "--all", "--unset"})
-	require.NoError(t, err)
-
-	testUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-	assert.False(t, testUser.MustChangePassword)
-	testUserExclude := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuserexclude"})
-	assert.False(t, testUserExclude.MustChangePassword)
-
-	// Make all users change password
-	err = microcmdUserMustChangePassword().Run(t.Context(), []string{"change-test", "--all"})
-	require.NoError(t, err)
-
-	testUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-	assert.True(t, testUser.MustChangePassword)
-	testUserExclude = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuserexclude"})
-	assert.True(t, testUserExclude.MustChangePassword)
-
-	// Reset password change flag but exclude all tested users
-	err = microcmdUserMustChangePassword().Run(t.Context(), []string{"change-test", "--all", "--unset", "--exclude", "testuser,testuserexclude"})
-	require.NoError(t, err)
-
-	testUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-	assert.True(t, testUser.MustChangePassword)
-	testUserExclude = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuserexclude"})
-	assert.True(t, testUserExclude.MustChangePassword)
-
-	// Reset password change flag by listing multiple users
-	err = microcmdUserMustChangePassword().Run(t.Context(), []string{"change-test", "--unset", "testuser", "testuserexclude"})
-	require.NoError(t, err)
-
-	testUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-	assert.False(t, testUser.MustChangePassword)
-	testUserExclude = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuserexclude"})
-	assert.False(t, testUserExclude.MustChangePassword)
-
-	// Exclude a user from all user
-	err = microcmdUserMustChangePassword().Run(t.Context(), []string{"change-test", "--all", "--exclude", "testuserexclude"})
-	require.NoError(t, err)
-
-	testUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-	assert.True(t, testUser.MustChangePassword)
-	testUserExclude = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuserexclude"})
-	assert.False(t, testUserExclude.MustChangePassword)
-
-	// Unset a flag for single user
-	err = microcmdUserMustChangePassword().Run(t.Context(), []string{"change-test", "--unset", "testuser"})
-	require.NoError(t, err)
-
-	testUser = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuser"})
-	assert.False(t, testUser.MustChangePassword)
-	testUserExclude = unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: "testuserexclude"})
-	assert.False(t, testUserExclude.MustChangePassword)
-}
--- a/cmd/cert.go
+++ b/cmd/cert.go
@@ -6,7 +6,6 @@
 package cmd

 import (
-	"context"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
@@ -14,7 +13,6 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
-	"fmt"
 	"log"
 	"math/big"
 	"net"
@@ -22,59 +20,47 @@ import (
 	"strings"
 	"time"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-// cmdCert represents the available cert sub-command.
-func cmdCert() *cli.Command {
-	return &cli.Command{
-		Name:  "cert",
-		Usage: "Generate self-signed certificate",
-		Description: `Generate a self-signed X.509 certificate for a TLS server.
+// CmdCert represents the available cert sub-command.
+var CmdCert = &cli.Command{
+	Name:  "cert",
+	Usage: "Generate self-signed certificate",
+	Description: `Generate a self-signed X.509 certificate for a TLS server.
 Outputs to 'cert.pem' and 'key.pem' and will overwrite existing files.`,
-		Action: runCert,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:     "host",
-				Usage:    "Comma-separated hostnames and IPs to generate a certificate for",
-				Required: true,
-			},
-			&cli.StringFlag{
-				Name:  "ecdsa-curve",
-				Value: "",
-				Usage: "ECDSA curve to use to generate a key. Valid values are P224, P256, P384, P521",
-			},
-			&cli.IntFlag{
-				Name:  "rsa-bits",
-				Value: 3072,
-				Usage: "Size of RSA key to generate. Ignored if --ecdsa-curve is set",
-			},
-			&cli.StringFlag{
-				Name:  "start-date",
-				Value: "",
-				Usage: "Creation date formatted as Jan 1 15:04:05 2011",
-			},
-			&cli.DurationFlag{
-				Name:  "duration",
-				Value: 365 * 24 * time.Hour,
-				Usage: "Duration that certificate is valid for",
-			},
-			&cli.BoolFlag{
-				Name:  "ca",
-				Usage: "whether this cert should be its own Certificate Authority",
-			},
-			&cli.StringFlag{
-				Name:  "out",
-				Value: "cert.pem",
-				Usage: "Path to the file where there certificate will be saved",
-			},
-			&cli.StringFlag{
-				Name:  "keyout",
-				Value: "key.pem",
-				Usage: "Path to the file where there certificate key will be saved",
-			},
+	Action: runCert,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "host",
+			Value: "",
+			Usage: "Comma-separated hostnames and IPs to generate a certificate for",
 		},
-	}
+		&cli.StringFlag{
+			Name:  "ecdsa-curve",
+			Value: "",
+			Usage: "ECDSA curve to use to generate a key. Valid values are P224, P256, P384, P521",
+		},
+		&cli.IntFlag{
+			Name:  "rsa-bits",
+			Value: 3072,
+			Usage: "Size of RSA key to generate. Ignored if --ecdsa-curve is set",
+		},
+		&cli.StringFlag{
+			Name:  "start-date",
+			Value: "",
+			Usage: "Creation date formatted as Jan 1 15:04:05 2011",
+		},
+		&cli.DurationFlag{
+			Name:  "duration",
+			Value: 365 * 24 * time.Hour,
+			Usage: "Duration that certificate is valid for",
+		},
+		&cli.BoolFlag{
+			Name:  "ca",
+			Usage: "whether this cert should be its own Certificate Authority",
+		},
+	},
 }

 func publicKey(priv any) any {
@@ -103,7 +89,11 @@ func pemBlockForKey(priv any) *pem.Block {
 	}
 }

-func runCert(_ context.Context, c *cli.Command) error {
+func runCert(c *cli.Context) error {
+	if err := argsSet(c, "host"); err != nil {
+		return err
+	}
+
 	var priv any
 	var err error
 	switch c.String("ecdsa-curve") {
@@ -118,17 +108,17 @@ func runCert(_ context.Context, c *cli.Command) error {
 	case "P521":
 		priv, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
 	default:
-		err = fmt.Errorf("unrecognized elliptic curve: %q", c.String("ecdsa-curve"))
+		log.Fatalf("Unrecognized elliptic curve: %q", c.String("ecdsa-curve"))
 	}
 	if err != nil {
-		return fmt.Errorf("failed to generate private key: %w", err)
+		log.Fatalf("Failed to generate private key: %v", err)
 	}

 	var notBefore time.Time
 	if startDate := c.String("start-date"); startDate != "" {
 		notBefore, err = time.Parse("Jan 2 15:04:05 2006", startDate)
 		if err != nil {
-			return fmt.Errorf("failed to parse creation date %w", err)
+			log.Fatalf("Failed to parse creation date: %v", err)
 		}
 	} else {
 		notBefore = time.Now()
@@ -139,7 +129,7 @@ func runCert(_ context.Context, c *cli.Command) error {
 	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
 	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
-		return fmt.Errorf("failed to generate serial number: %w", err)
+		log.Fatalf("Failed to generate serial number: %v", err)
 	}

 	template := x509.Certificate{
@@ -156,8 +146,8 @@ func runCert(_ context.Context, c *cli.Command) error {
 		BasicConstraintsValid: true,
 	}

-	hosts := strings.SplitSeq(c.String("host"), ",")
-	for h := range hosts {
+	hosts := strings.Split(c.String("host"), ",")
+	for _, h := range hosts {
 		if ip := net.ParseIP(h); ip != nil {
 			template.IPAddresses = append(template.IPAddresses, ip)
 		} else {
@@ -172,35 +162,35 @@ func runCert(_ context.Context, c *cli.Command) error {

 	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, publicKey(priv), priv)
 	if err != nil {
-		return fmt.Errorf("failed to create certificate: %w", err)
+		log.Fatalf("Failed to create certificate: %v", err)
 	}

-	certOut, err := os.Create(c.String("out"))
+	certOut, err := os.Create("cert.pem")
 	if err != nil {
-		return fmt.Errorf("failed to open %s for writing: %w", c.String("keyout"), err)
+		log.Fatalf("Failed to open cert.pem for writing: %v", err)
 	}
 	err = pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
 	if err != nil {
-		return fmt.Errorf("failed to encode certificate: %w", err)
+		log.Fatalf("Failed to encode certificate: %v", err)
 	}
 	err = certOut.Close()
 	if err != nil {
-		return fmt.Errorf("failed to write cert: %w", err)
+		log.Fatalf("Failed to write cert: %v", err)
 	}
-	fmt.Fprintf(c.Writer, "Written cert to %s\n", c.String("out"))
+	log.Println("Written cert.pem")

-	keyOut, err := os.OpenFile(c.String("keyout"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	keyOut, err := os.OpenFile("key.pem", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 	if err != nil {
-		return fmt.Errorf("failed to open %s for writing: %w", c.String("keyout"), err)
+		log.Fatalf("Failed to open key.pem for writing: %v", err)
 	}
 	err = pem.Encode(keyOut, pemBlockForKey(priv))
 	if err != nil {
-		return fmt.Errorf("failed to encode key: %w", err)
+		log.Fatalf("Failed to encode key: %v", err)
 	}
 	err = keyOut.Close()
 	if err != nil {
-		return fmt.Errorf("failed to write key: %w", err)
+		log.Fatalf("Failed to write key: %v", err)
 	}
-	fmt.Fprintf(c.Writer, "Written key to %s\n", c.String("keyout"))
+	log.Println("Written key.pem")
 	return nil
 }
--- a/cmd/cert_test.go
+++ b/cmd/cert_test.go
@@ -1,123 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCertCommand(t *testing.T) {
-	cases := []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "RSA cert generation",
-			args: []string{
-				"cert-test",
-				"--host", "localhost",
-				"--rsa-bits", "2048",
-				"--duration", "1h",
-				"--start-date", "Jan 1 00:00:00 2024",
-			},
-		},
-		{
-			name: "ECDSA cert generation",
-			args: []string{
-				"cert-test",
-				"--host", "localhost",
-				"--ecdsa-curve", "P256",
-				"--duration", "1h",
-				"--start-date", "Jan 1 00:00:00 2024",
-			},
-		},
-		{
-			name: "mixed host, certificate authority",
-			args: []string{
-				"cert-test",
-				"--host", "localhost,127.0.0.1",
-				"--duration", "1h",
-				"--start-date", "Jan 1 00:00:00 2024",
-			},
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			app := cmdCert()
-			tempDir := t.TempDir()
-
-			certFile := filepath.Join(tempDir, "cert.pem")
-			keyFile := filepath.Join(tempDir, "key.pem")
-
-			err := app.Run(t.Context(), append(c.args, "--out", certFile, "--keyout", keyFile))
-			require.NoError(t, err)
-
-			assert.FileExists(t, certFile)
-			assert.FileExists(t, keyFile)
-		})
-	}
-}
-
-func TestCertCommandFailures(t *testing.T) {
-	cases := []struct {
-		name   string
-		args   []string
-		errMsg string
-	}{
-		{
-			name: "Start Date Parsing failure",
-			args: []string{
-				"cert-test",
-				"--host", "localhost",
-				"--start-date", "invalid-date",
-			},
-			errMsg: "parsing time",
-		},
-		{
-			name: "Unknown curve",
-			args: []string{
-				"cert-test",
-				"--host", "localhost",
-				"--ecdsa-curve", "invalid-curve",
-			},
-			errMsg: "unrecognized elliptic curve",
-		},
-		{
-			name: "Key generation failure",
-			args: []string{
-				"cert-test",
-				"--host", "localhost",
-				"--rsa-bits", "invalid-bits",
-			},
-		},
-		{
-			name: "Missing parameters",
-			args: []string{
-				"cert-test",
-			},
-			errMsg: `"host" not set`,
-		},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			app := cmdCert()
-			tempDir := t.TempDir()
-
-			certFile := filepath.Join(tempDir, "cert.pem")
-			keyFile := filepath.Join(tempDir, "key.pem")
-			err := app.Run(t.Context(), append(c.args, "--out", certFile, "--keyout", keyFile))
-			require.Error(t, err)
-			if c.errMsg != "" {
-				assert.ErrorContains(t, err, c.errMsg)
-			}
-			assert.NoFileExists(t, certFile)
-			assert.NoFileExists(t, keyFile)
-		})
-	}
-}
--- a/cmd/cmd.go
+++ b/cmd/cmd.go
@@ -18,19 +18,20 @@ import (
 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // argsSet checks that all the required arguments are set. args is a list of
 // arguments that must be set in the passed Context.
-func argsSet(c *cli.Command, args ...string) error {
+func argsSet(c *cli.Context, args ...string) error {
 	for _, a := range args {
 		if !c.IsSet(a) {
 			return errors.New(a + " is not set")
 		}

-		if c.Value(a) == nil {
+		if util.IsEmptyString(c.String(a)) {
 			return errors.New(a + " is required")
 		}
 	}
@@ -108,7 +109,7 @@ func setupConsoleLogger(level log.Level, colorize bool, out io.Writer) {
 	log.GetManager().GetLogger(log.DEFAULT).ReplaceAllWriters(writer)
 }

-func globalBool(c *cli.Command, name string) bool {
+func globalBool(c *cli.Context, name string) bool {
 	for _, ctx := range c.Lineage() {
 		if ctx.Bool(name) {
 			return true
@@ -119,8 +120,8 @@ func globalBool(c *cli.Command, name string) bool {

 // PrepareConsoleLoggerLevel by default, use INFO level for console logger, but some sub-commands (for git/ssh protocol) shouldn't output any log to stdout.
 // Any log appears in git stdout pipe will break the git protocol, eg: client can't push and hangs forever.
-func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(context.Context, *cli.Command) (context.Context, error) {
-	return func(ctx context.Context, c *cli.Command) (context.Context, error) {
+func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(*cli.Context) error {
+	return func(c *cli.Context) error {
 		level := defaultLevel
 		if globalBool(c, "quiet") {
 			level = log.FATAL
@@ -129,16 +130,6 @@ func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(context.Context, *cl
 			level = log.TRACE
 		}
 		log.SetConsoleLogger(log.DEFAULT, "console-default", level)
-		return ctx, nil
+		return nil
 	}
 }
-
-func isValidDefaultSubCommand(cmd *cli.Command) (string, bool) {
-	// Dirty patch for urfave/cli's strange design.
-	// "./gitea bad-cmd" should not start the web server.
-	rootArgs := cmd.Root().Args().Slice()
-	if len(rootArgs) != 0 && rootArgs[0] != cmd.Name {
-		return rootArgs[0], false
-	}
-	return "", true
-}
--- a/cmd/cmd_test.go
+++ b/cmd/cmd_test.go
@@ -1,38 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
-)
-
-func TestDefaultCommand(t *testing.T) {
-	test := func(t *testing.T, args []string, expectedRetName string, expectedRetValid bool) {
-		called := false
-		cmd := &cli.Command{
-			DefaultCommand: "test",
-			Commands: []*cli.Command{
-				{
-					Name: "test",
-					Action: func(ctx context.Context, command *cli.Command) error {
-						retName, retValid := isValidDefaultSubCommand(command)
-						assert.Equal(t, expectedRetName, retName)
-						assert.Equal(t, expectedRetValid, retValid)
-						called = true
-						return nil
-					},
-				},
-			},
-		}
-		assert.NoError(t, cmd.Run(t.Context(), args))
-		assert.True(t, called)
-	}
-	test(t, []string{"./gitea"}, "", true)
-	test(t, []string{"./gitea", "test"}, "", true)
-	test(t, []string{"./gitea", "other"}, "other", false)
-}
--- a/cmd/docs.go
+++ b/cmd/docs.go
@@ -4,13 +4,11 @@
 package cmd

 import (
-	"context"
 	"fmt"
 	"os"
 	"strings"

-	cli_docs "github.com/urfave/cli-docs/v3"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdDocs represents the available docs sub-command.
@@ -32,16 +30,16 @@ var CmdDocs = &cli.Command{
 	},
 }

-func runDocs(_ context.Context, cmd *cli.Command) error {
-	docs, err := cli_docs.ToMarkdown(cmd.Root())
-	if cmd.Bool("man") {
-		docs, err = cli_docs.ToMan(cmd.Root())
+func runDocs(ctx *cli.Context) error {
+	docs, err := ctx.App.ToMarkdown()
+	if ctx.Bool("man") {
+		docs, err = ctx.App.ToMan()
 	}
 	if err != nil {
 		return err
 	}

-	if !cmd.Bool("man") {
+	if !ctx.Bool("man") {
 		// Clean up markdown. The following bug was fixed in v2, but is present in v1.
 		// It affects markdown output (even though the issue is referring to man pages)
 		// https://github.com/urfave/cli/issues/1040
@@ -53,8 +51,8 @@ func runDocs(_ context.Context, cmd *cli.Command) error {
 	}

 	out := os.Stdout
-	if cmd.String("output") != "" {
-		fi, err := os.Create(cmd.String("output"))
+	if ctx.String("output") != "" {
+		fi, err := os.Create(ctx.String("output"))
 		if err != nil {
 			return err
 		}
--- a/cmd/doctor.go
+++ b/cmd/doctor.go
@@ -20,7 +20,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/services/doctor"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 	"xorm.io/xorm"
 )

@@ -30,7 +30,7 @@ var CmdDoctor = &cli.Command{
 	Usage:       "Diagnose and optionally fix problems, convert or re-create database tables",
 	Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",

-	Commands: []*cli.Command{
+	Subcommands: []*cli.Command{
 		cmdDoctorCheck,
 		cmdRecreateTable,
 		cmdDoctorConvert,
@@ -93,13 +93,16 @@ You should back-up your database before doing this and ensure that your database
 	Action: runRecreateTable,
 }

-func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
+func runRecreateTable(ctx *cli.Context) error {
+	stdCtx, cancel := installSignals()
+	defer cancel()
+
 	// Redirect the default golog to here
 	golog.SetFlags(0)
 	golog.SetPrefix("")
 	golog.SetOutput(log.LoggerToWriter(log.GetLogger(log.DEFAULT).Info))

-	debug := cmd.Bool("debug")
+	debug := ctx.Bool("debug")
 	setting.MustInstalled()
 	setting.LoadDBSetting()

@@ -110,15 +113,15 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	}

 	setting.Database.LogSQL = debug
-	if err := db.InitEngine(ctx); err != nil {
+	if err := db.InitEngine(stdCtx); err != nil {
 		fmt.Println(err)
 		fmt.Println("Check if you are using the right config file. You can use a --config directive to specify one.")
 		return nil
 	}

-	args := cmd.Args()
-	names := make([]string, 0, cmd.NArg())
-	for i := 0; i < cmd.NArg(); i++ {
+	args := ctx.Args()
+	names := make([]string, 0, ctx.NArg())
+	for i := 0; i < ctx.NArg(); i++ {
 		names = append(names, args.Get(i))
 	}

@@ -128,7 +131,7 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	}
 	recreateTables := migrate_base.RecreateTables(beans...)

-	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x *xorm.Engine) error {
+	return db.InitEngineWithMigration(stdCtx, func(ctx context.Context, x *xorm.Engine) error {
 		if err := migrations.EnsureUpToDate(ctx, x); err != nil {
 			return err
 		}
@@ -136,11 +139,11 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	})
 }

-func setupDoctorDefaultLogger(cmd *cli.Command, colorize bool) {
+func setupDoctorDefaultLogger(ctx *cli.Context, colorize bool) {
 	// Silence the default loggers
 	setupConsoleLogger(log.FATAL, log.CanColorStderr, os.Stderr)

-	logFile := cmd.String("log-file")
+	logFile := ctx.String("log-file")
 	switch logFile {
 	case "":
 		return // if no doctor log-file is set, do not show any log from default logger
@@ -158,20 +161,23 @@ func setupDoctorDefaultLogger(cmd *cli.Command, colorize bool) {
 	}
 }

-func runDoctorCheck(ctx context.Context, cmd *cli.Command) error {
+func runDoctorCheck(ctx *cli.Context) error {
+	stdCtx, cancel := installSignals()
+	defer cancel()
+
 	colorize := log.CanColorStdout
-	if cmd.IsSet("color") {
-		colorize = cmd.Bool("color")
+	if ctx.IsSet("color") {
+		colorize = ctx.Bool("color")
 	}

-	setupDoctorDefaultLogger(cmd, colorize)
+	setupDoctorDefaultLogger(ctx, colorize)

 	// Finally redirect the default golang's log to here
 	golog.SetFlags(0)
 	golog.SetPrefix("")
 	golog.SetOutput(log.LoggerToWriter(log.GetLogger(log.DEFAULT).Info))

-	if cmd.IsSet("list") {
+	if ctx.IsSet("list") {
 		w := tabwriter.NewWriter(os.Stdout, 0, 8, 1, '\t', 0)
 		_, _ = w.Write([]byte("Default\tName\tTitle\n"))
 		doctor.SortChecks(doctor.Checks)
@@ -189,12 +195,12 @@ func runDoctorCheck(ctx context.Context, cmd *cli.Command) error {
 	}

 	var checks []*doctor.Check
-	if cmd.Bool("all") {
+	if ctx.Bool("all") {
 		checks = make([]*doctor.Check, len(doctor.Checks))
 		copy(checks, doctor.Checks)
-	} else if cmd.IsSet("run") {
-		addDefault := cmd.Bool("default")
-		runNamesSet := container.SetOf(cmd.StringSlice("run")...)
+	} else if ctx.IsSet("run") {
+		addDefault := ctx.Bool("default")
+		runNamesSet := container.SetOf(ctx.StringSlice("run")...)
 		for _, check := range doctor.Checks {
 			if (addDefault && check.IsDefault) || runNamesSet.Contains(check.Name) {
 				checks = append(checks, check)
@@ -211,5 +217,5 @@ func runDoctorCheck(ctx context.Context, cmd *cli.Command) error {
 			}
 		}
 	}
-	return doctor.RunChecks(ctx, colorize, cmd.Bool("fix"), checks)
+	return doctor.RunChecks(stdCtx, colorize, ctx.Bool("fix"), checks)
 }
--- a/cmd/doctor_convert.go
+++ b/cmd/doctor_convert.go
@@ -4,14 +4,13 @@
 package cmd

 import (
-	"context"
 	"fmt"

 	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // cmdDoctorConvert represents the available convert sub-command.
@@ -22,8 +21,11 @@ var cmdDoctorConvert = &cli.Command{
 	Action:      runDoctorConvert,
 }

-func runDoctorConvert(ctx context.Context, cmd *cli.Command) error {
-	if err := initDB(ctx); err != nil {
+func runDoctorConvert(ctx *cli.Context) error {
+	stdCtx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(stdCtx); err != nil {
 		return err
 	}

--- a/cmd/doctor_test.go
+++ b/cmd/doctor_test.go
@@ -11,7 +11,7 @@ import (
 	"code.gitea.io/gitea/services/doctor"

 	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 func TestDoctorRun(t *testing.T) {
@@ -22,13 +22,12 @@ func TestDoctorRun(t *testing.T) {

 		SkipDatabaseInitialization: true,
 	})
-	app := &cli.Command{
-		Commands: []*cli.Command{cmdDoctorCheck},
-	}
-	err := app.Run(t.Context(), []string{"./gitea", "check", "--run", "test-check"})
+	app := cli.NewApp()
+	app.Commands = []*cli.Command{cmdDoctorCheck}
+	err := app.Run([]string{"./gitea", "check", "--run", "test-check"})
 	assert.NoError(t, err)
-	err = app.Run(t.Context(), []string{"./gitea", "check", "--run", "no-such"})
+	err = app.Run([]string{"./gitea", "check", "--run", "no-such"})
 	assert.ErrorContains(t, err, `unknown checks: "no-such"`)
-	err = app.Run(t.Context(), []string{"./gitea", "check", "--run", "test-check,no-such"})
+	err = app.Run([]string{"./gitea", "check", "--run", "test-check,no-such"})
 	assert.ErrorContains(t, err, `unknown checks: "no-such"`)
 }
--- a/cmd/dump.go
+++ b/cmd/dump.go
@@ -5,7 +5,6 @@
 package cmd

 import (
-	"context"
 	"os"
 	"path"
 	"path/filepath"
@@ -20,7 +19,8 @@ import (
 	"code.gitea.io/gitea/modules/util"

 	"gitea.com/go-chi/session"
-	"github.com/urfave/cli/v3"
+	"github.com/mholt/archiver/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdDump represents the available dump sub-command.
@@ -101,17 +101,17 @@ func fatal(format string, args ...any) {
 	log.Fatal(format, args...)
 }

-func runDump(ctx context.Context, cmd *cli.Command) error {
+func runDump(ctx *cli.Context) error {
 	setting.MustInstalled()

-	quite := cmd.Bool("quiet")
-	verbose := cmd.Bool("verbose")
+	quite := ctx.Bool("quiet")
+	verbose := ctx.Bool("verbose")
 	if verbose && quite {
 		fatal("Option --quiet and --verbose cannot both be set")
 	}

 	// outFileName is either "-" or a file name (will be made absolute)
-	outFileName, outType := dump.PrepareFileNameAndType(cmd.String("file"), cmd.String("type"))
+	outFileName, outType := dump.PrepareFileNameAndType(ctx.String("file"), ctx.String("type"))
 	if outType == "" {
 		fatal("Invalid output type")
 	}
@@ -136,7 +136,10 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 	setting.DisableLoggerInit()
 	setting.LoadSettings() // cannot access session settings otherwise

-	err := db.InitEngine(ctx)
+	stdCtx, cancel := installSignals()
+	defer cancel()
+
+	err := db.InitEngine(stdCtx)
 	if err != nil {
 		return err
 	}
@@ -145,20 +148,24 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 		return err
 	}

-	dumper, err := dump.NewDumper(ctx, outType, outFile)
+	archiverGeneric, err := archiver.ByExtension("." + outType)
 	if err != nil {
-		fatal("Failed to create archive %q: %v", outFile, err)
-		return err
+		fatal("Unable to get archiver for extension: %v", err)
 	}
-	dumper.Verbose = verbose
-	dumper.GlobalExcludeAbsPath(outFileName)
-	defer func() {
-		if err := dumper.Close(); err != nil {
-			fatal("Failed to save archive %q: %v", outFileName, err)
-		}
-	}()

-	if cmd.IsSet("skip-repository") && cmd.Bool("skip-repository") {
+	archiverWriter := archiverGeneric.(archiver.Writer)
+	if err := archiverWriter.Create(outFile); err != nil {
+		fatal("Creating archiver.Writer failed: %v", err)
+	}
+	defer archiverWriter.Close()
+
+	dumper := &dump.Dumper{
+		Writer:  archiverWriter,
+		Verbose: verbose,
+	}
+	dumper.GlobalExcludeAbsPath(outFileName)
+
+	if ctx.IsSet("skip-repository") && ctx.Bool("skip-repository") {
 		log.Info("Skip dumping local repositories")
 	} else {
 		log.Info("Dumping local repositories... %s", setting.RepoRootPath)
@@ -166,7 +173,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 			fatal("Failed to include repositories: %v", err)
 		}

-		if cmd.IsSet("skip-lfs-data") && cmd.Bool("skip-lfs-data") {
+		if ctx.IsSet("skip-lfs-data") && ctx.Bool("skip-lfs-data") {
 			log.Info("Skip dumping LFS data")
 		} else if !setting.LFS.StartServer {
 			log.Info("LFS isn't enabled. Skip dumping LFS data")
@@ -175,18 +182,18 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 			if err != nil {
 				return err
 			}
-			return dumper.AddFileByReader(object, info, path.Join("data", "lfs", objPath))
+			return dumper.AddReader(object, info, path.Join("data", "lfs", objPath))
 		}); err != nil {
 			fatal("Failed to dump LFS objects: %v", err)
 		}
 	}

-	if cmd.Bool("skip-db") {
+	if ctx.Bool("skip-db") {
 		// Ensure that we don't dump the database file that may reside in setting.AppDataPath or elsewhere.
 		dumper.GlobalExcludeAbsPath(setting.Database.Path)
 		log.Info("Skipping database")
 	} else {
-		tmpDir := cmd.String("tempdir")
+		tmpDir := ctx.String("tempdir")
 		if _, err := os.Stat(tmpDir); os.IsNotExist(err) {
 			fatal("Path does not exist: %s", tmpDir)
 		}
@@ -202,7 +209,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 			}
 		}()

-		targetDBType := cmd.String("database")
+		targetDBType := ctx.String("database")
 		if len(targetDBType) > 0 && targetDBType != setting.Database.Type.String() {
 			log.Info("Dumping database %s => %s...", setting.Database.Type, targetDBType)
 		} else {
@@ -213,17 +220,17 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 			fatal("Failed to dump database: %v", err)
 		}

-		if err = dumper.AddFileByPath("gitea-db.sql", dbDump.Name()); err != nil {
+		if err = dumper.AddFile("gitea-db.sql", dbDump.Name()); err != nil {
 			fatal("Failed to include gitea-db.sql: %v", err)
 		}
 	}

 	log.Info("Adding custom configuration file from %s", setting.CustomConf)
-	if err = dumper.AddFileByPath("app.ini", setting.CustomConf); err != nil {
+	if err = dumper.AddFile("app.ini", setting.CustomConf); err != nil {
 		fatal("Failed to include specified app.ini: %v", err)
 	}

-	if cmd.IsSet("skip-custom-dir") && cmd.Bool("skip-custom-dir") {
+	if ctx.IsSet("skip-custom-dir") && ctx.Bool("skip-custom-dir") {
 		log.Info("Skipping custom directory")
 	} else {
 		customDir, err := os.Stat(setting.CustomPath)
@@ -256,7 +263,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 			excludes = append(excludes, opts.ProviderConfig)
 		}

-		if cmd.IsSet("skip-index") && cmd.Bool("skip-index") {
+		if ctx.IsSet("skip-index") && ctx.Bool("skip-index") {
 			excludes = append(excludes, setting.Indexer.RepoPath)
 			excludes = append(excludes, setting.Indexer.IssuePath)
 		}
@@ -271,19 +278,19 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 		}
 	}

-	if cmd.IsSet("skip-attachment-data") && cmd.Bool("skip-attachment-data") {
+	if ctx.IsSet("skip-attachment-data") && ctx.Bool("skip-attachment-data") {
 		log.Info("Skip dumping attachment data")
 	} else if err := storage.Attachments.IterateObjects("", func(objPath string, object storage.Object) error {
 		info, err := object.Stat()
 		if err != nil {
 			return err
 		}
-		return dumper.AddFileByReader(object, info, path.Join("data", "attachments", objPath))
+		return dumper.AddReader(object, info, path.Join("data", "attachments", objPath))
 	}); err != nil {
 		fatal("Failed to dump attachments: %v", err)
 	}

-	if cmd.IsSet("skip-package-data") && cmd.Bool("skip-package-data") {
+	if ctx.IsSet("skip-package-data") && ctx.Bool("skip-package-data") {
 		log.Info("Skip dumping package data")
 	} else if !setting.Packages.Enabled {
 		log.Info("Packages isn't enabled. Skip dumping package data")
@@ -292,7 +299,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 		if err != nil {
 			return err
 		}
-		return dumper.AddFileByReader(object, info, path.Join("data", "packages", objPath))
+		return dumper.AddReader(object, info, path.Join("data", "packages", objPath))
 	}); err != nil {
 		fatal("Failed to dump packages: %v", err)
 	}
@@ -300,7 +307,7 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 	// Doesn't check if LogRootPath exists before processing --skip-log intentionally,
 	// ensuring that it's clear the dump is skipped whether the directory's initialized
 	// yet or not.
-	if cmd.IsSet("skip-log") && cmd.Bool("skip-log") {
+	if ctx.IsSet("skip-log") && ctx.Bool("skip-log") {
 		log.Info("Skip dumping log files")
 	} else {
 		isExist, err := util.IsExist(setting.Log.RootPath)
@@ -317,6 +324,10 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 	if outFileName == "-" {
 		log.Info("Finish dumping to stdout")
 	} else {
+		if err = archiverWriter.Close(); err != nil {
+			_ = os.Remove(outFileName)
+			fatal("Failed to save %q: %v", outFileName, err)
+		}
 		if err = os.Chmod(outFileName, 0o600); err != nil {
 			log.Info("Can't change file access permissions mask to 0600: %v", err)
 		}
--- a/cmd/dump_repo.go
+++ b/cmd/dump_repo.go
@@ -19,7 +19,7 @@ import (
 	"code.gitea.io/gitea/services/convert"
 	"code.gitea.io/gitea/services/migrations"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdDumpRepository represents the available dump repository sub-command.
@@ -79,18 +79,16 @@ wiki, issues, labels, releases, release_assets, milestones, pull_requests, comme
 	},
 }

-func runDumpRepository(ctx context.Context, cmd *cli.Command) error {
-	setupConsoleLogger(log.INFO, log.CanColorStderr, os.Stderr)
+func runDumpRepository(ctx *cli.Context) error {
+	stdCtx, cancel := installSignals()
+	defer cancel()

-	setting.DisableLoggerInit()
-	setting.LoadSettings() // cannot access skip_tls_verify settings otherwise
-
-	if err := initDB(ctx); err != nil {
+	if err := initDB(stdCtx); err != nil {
 		return err
 	}

 	// migrations.GiteaLocalUploader depends on git module
-	if err := git.InitSimple(); err != nil {
+	if err := git.InitSimple(context.Background()); err != nil {
 		return err
 	}

@@ -102,8 +100,8 @@ func runDumpRepository(ctx context.Context, cmd *cli.Command) error {

 	var (
 		serviceType structs.GitServiceType
-		cloneAddr   = cmd.String("clone_addr")
-		serviceStr  = cmd.String("git_service")
+		cloneAddr   = ctx.String("clone_addr")
+		serviceStr  = ctx.String("git_service")
 	)

 	if strings.HasPrefix(strings.ToLower(cloneAddr), "https://github.com/") {
@@ -121,13 +119,13 @@ func runDumpRepository(ctx context.Context, cmd *cli.Command) error {
 	opts := base.MigrateOptions{
 		GitServiceType: serviceType,
 		CloneAddr:      cloneAddr,
-		AuthUsername:   cmd.String("auth_username"),
-		AuthPassword:   cmd.String("auth_password"),
-		AuthToken:      cmd.String("auth_token"),
-		RepoName:       cmd.String("repo_name"),
+		AuthUsername:   ctx.String("auth_username"),
+		AuthPassword:   ctx.String("auth_password"),
+		AuthToken:      ctx.String("auth_token"),
+		RepoName:       ctx.String("repo_name"),
 	}

-	if len(cmd.String("units")) == 0 {
+	if len(ctx.String("units")) == 0 {
 		opts.Wiki = true
 		opts.Issues = true
 		opts.Milestones = true
@@ -137,8 +135,8 @@ func runDumpRepository(ctx context.Context, cmd *cli.Command) error {
 		opts.PullRequests = true
 		opts.ReleaseAssets = true
 	} else {
-		units := strings.SplitSeq(cmd.String("units"), ",")
-		for unit := range units {
+		units := strings.Split(ctx.String("units"), ",")
+		for _, unit := range units {
 			switch strings.ToLower(strings.TrimSpace(unit)) {
 			case "":
 				continue
@@ -166,7 +164,7 @@ func runDumpRepository(ctx context.Context, cmd *cli.Command) error {

 	// the repo_dir will be removed if error occurs in DumpRepository
 	// make sure the directory doesn't exist or is empty, prevent from deleting user files
-	repoDir := cmd.String("repo_dir")
+	repoDir := ctx.String("repo_dir")
 	if exists, err := util.IsExist(repoDir); err != nil {
 		return fmt.Errorf("unable to stat repo_dir %q: %w", repoDir, err)
 	} else if exists {
@@ -179,9 +177,9 @@ func runDumpRepository(ctx context.Context, cmd *cli.Command) error {
 	}

 	if err := migrations.DumpRepository(
-		ctx,
+		context.Background(),
 		repoDir,
-		cmd.String("owner_name"),
+		ctx.String("owner_name"),
 		opts,
 	); err != nil {
 		log.Fatal("Failed to dump repository: %v", err)
--- a/cmd/embedded.go
+++ b/cmd/embedded.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -20,7 +19,7 @@ import (
 	"code.gitea.io/gitea/modules/util"

 	"github.com/gobwas/glob"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdEmbedded represents the available extract sub-command.
@@ -29,7 +28,7 @@ var (
 		Name:        "embedded",
 		Usage:       "Extract embedded resources",
 		Description: "A command for extracting embedded resources, like templates and images",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			subcmdList,
 			subcmdView,
 			subcmdExtract,
@@ -101,7 +100,7 @@ type assetFile struct {
 	path string
 }

-func initEmbeddedExtractor(c *cli.Command) error {
+func initEmbeddedExtractor(c *cli.Context) error {
 	setupConsoleLogger(log.ERROR, log.CanColorStderr, os.Stderr)

 	patterns, err := compileCollectPatterns(c.Args().Slice())
@@ -116,31 +115,31 @@ func initEmbeddedExtractor(c *cli.Command) error {
 	return nil
 }

-func runList(_ context.Context, c *cli.Command) error {
+func runList(c *cli.Context) error {
 	if err := runListDo(c); err != nil {
-		_, _ = fmt.Fprintf(os.Stderr, "%v\n", err)
+		fmt.Fprintf(os.Stderr, "%v\n", err)
 		return err
 	}
 	return nil
 }

-func runView(_ context.Context, c *cli.Command) error {
+func runView(c *cli.Context) error {
 	if err := runViewDo(c); err != nil {
-		_, _ = fmt.Fprintf(os.Stderr, "%v\n", err)
+		fmt.Fprintf(os.Stderr, "%v\n", err)
 		return err
 	}
 	return nil
 }

-func runExtract(_ context.Context, c *cli.Command) error {
+func runExtract(c *cli.Context) error {
 	if err := runExtractDo(c); err != nil {
-		_, _ = fmt.Fprintf(os.Stderr, "%v\n", err)
+		fmt.Fprintf(os.Stderr, "%v\n", err)
 		return err
 	}
 	return nil
 }

-func runListDo(c *cli.Command) error {
+func runListDo(c *cli.Context) error {
 	if err := initEmbeddedExtractor(c); err != nil {
 		return err
 	}
@@ -152,7 +151,7 @@ func runListDo(c *cli.Command) error {
 	return nil
 }

-func runViewDo(c *cli.Command) error {
+func runViewDo(c *cli.Context) error {
 	if err := initEmbeddedExtractor(c); err != nil {
 		return err
 	}
@@ -175,7 +174,7 @@ func runViewDo(c *cli.Command) error {
 	return nil
 }

-func runExtractDo(c *cli.Command) error {
+func runExtractDo(c *cli.Context) error {
 	if err := initEmbeddedExtractor(c); err != nil {
 		return err
 	}
@@ -217,7 +216,7 @@ func runExtractDo(c *cli.Command) error {
 	for _, a := range matchedAssetFiles {
 		if err := extractAsset(destdir, a, overwrite, rename); err != nil {
 			// Non-fatal error
-			_, _ = fmt.Fprintf(os.Stderr, "%s: %v\n", a.path, err)
+			fmt.Fprintf(os.Stderr, "%s: %v", a.path, err)
 		}
 	}

@@ -272,7 +271,7 @@ func extractAsset(d string, a assetFile, overwrite, rename bool) error {
 	return nil
 }

-func collectAssetFilesByPattern(c *cli.Command, globs []glob.Glob, path string, layer *assetfs.Layer) {
+func collectAssetFilesByPattern(c *cli.Context, globs []glob.Glob, path string, layer *assetfs.Layer) {
 	fs := assetfs.Layered(layer)
 	files, err := fs.ListAllFiles(".", true)
 	if err != nil {
@@ -295,14 +294,16 @@ func collectAssetFilesByPattern(c *cli.Command, globs []glob.Glob, path string,
 	}
 }

-func compileCollectPatterns(args []string) (_ []glob.Glob, err error) {
+func compileCollectPatterns(args []string) ([]glob.Glob, error) {
 	if len(args) == 0 {
 		args = []string{"**"}
 	}
 	pat := make([]glob.Glob, len(args))
 	for i := range args {
-		if pat[i], err = glob.Compile(args[i], '/'); err != nil {
-			return nil, fmt.Errorf("invalid glob patterh %q: %w", args[i], err)
+		if g, err := glob.Compile(args[i], '/'); err != nil {
+			return nil, fmt.Errorf("'%s': Invalid glob pattern: %w", args[i], err)
+		} else { //nolint:revive
+			pat[i] = g
 		}
 	}
 	return pat, nil
--- a/cmd/generate.go
+++ b/cmd/generate.go
@@ -5,14 +5,13 @@
 package cmd

 import (
-	"context"
 	"fmt"
 	"os"

 	"code.gitea.io/gitea/modules/generate"

 	"github.com/mattn/go-isatty"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
@@ -20,7 +19,7 @@ var (
 	CmdGenerate = &cli.Command{
 		Name:  "generate",
 		Usage: "Generate Gitea's secrets/keys/tokens",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			subcmdSecret,
 		},
 	}
@@ -28,7 +27,7 @@ var (
 	subcmdSecret = &cli.Command{
 		Name:  "secret",
 		Usage: "Generate a secret token",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			microcmdGenerateInternalToken,
 			microcmdGenerateLfsJwtSecret,
 			microcmdGenerateSecretKey,
@@ -55,7 +54,7 @@ var (
 	}
 )

-func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
+func runGenerateInternalToken(c *cli.Context) error {
 	internalToken, err := generate.NewInternalToken()
 	if err != nil {
 		return err
@@ -70,7 +69,7 @@ func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 	return nil
 }

-func runGenerateLfsJwtSecret(_ context.Context, c *cli.Command) error {
+func runGenerateLfsJwtSecret(c *cli.Context) error {
 	_, jwtSecretBase64, err := generate.NewJwtSecretWithBase64()
 	if err != nil {
 		return err
@@ -85,7 +84,7 @@ func runGenerateLfsJwtSecret(_ context.Context, c *cli.Command) error {
 	return nil
 }

-func runGenerateSecretKey(_ context.Context, c *cli.Command) error {
+func runGenerateSecretKey(c *cli.Context) error {
 	secretKey, err := generate.NewSecretKey()
 	if err != nil {
 		return err
--- a/cmd/hook.go
+++ b/cmd/hook.go
@@ -20,11 +20,11 @@ import (
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 const (
-	hookBatchSize = 500
+	hookBatchSize = 30
 )

 var (
@@ -32,10 +32,9 @@ var (
 	CmdHook = &cli.Command{
 		Name:        "hook",
 		Usage:       "(internal) Should only be called by Git",
-		Hidden:      true, // internal commands shouldn't be visible
 		Description: "Delegate commands to corresponding Git hooks",
 		Before:      PrepareConsoleLoggerLevel(log.FATAL),
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			subcmdHookPreReceive,
 			subcmdHookUpdate,
 			subcmdHookPostReceive,
@@ -162,10 +161,12 @@ func (n *nilWriter) WriteString(s string) (int, error) {
 	return len(s), nil
 }

-func runHookPreReceive(ctx context.Context, c *cli.Command) error {
+func runHookPreReceive(c *cli.Context) error {
 	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
 		return nil
 	}
+	ctx, cancel := installSignals()
+	defer cancel()

 	setup(ctx, c.Bool("debug"))

@@ -291,7 +292,7 @@ Gitea or set your environment appropriately.`, "")

 // runHookUpdate avoid to do heavy operations on update hook because it will be
 // invoked for every ref update which does not like pre-receive and post-receive
-func runHookUpdate(_ context.Context, c *cli.Command) error {
+func runHookUpdate(c *cli.Context) error {
 	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
 		return nil
 	}
@@ -308,12 +309,15 @@ func runHookUpdate(_ context.Context, c *cli.Command) error {
 	return nil
 }

-func runHookPostReceive(ctx context.Context, c *cli.Command) error {
+func runHookPostReceive(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))

 	// First of all run update-server-info no matter what
 	if _, _, err := git.NewCommand("update-server-info").RunStdString(ctx, nil); err != nil {
-		return fmt.Errorf("failed to call 'git update-server-info': %w", err)
+		return fmt.Errorf("Failed to call 'git update-server-info': %w", err)
 	}

 	// Now if we're an internal don't do anything else
@@ -481,7 +485,7 @@ func hookPrintResult(output, isCreate bool, branch, url string) {
 func pushOptions() map[string]string {
 	opts := make(map[string]string)
 	if pushCount, err := strconv.Atoi(os.Getenv(private.GitPushOptionCount)); err == nil {
-		for idx := range pushCount {
+		for idx := 0; idx < pushCount; idx++ {
 			opt := os.Getenv(fmt.Sprintf("GIT_PUSH_OPTION_%d", idx))
 			kv := strings.SplitN(opt, "=", 2)
 			if len(kv) == 2 {
@@ -492,7 +496,10 @@ func pushOptions() map[string]string {
 	return opts
 }

-func runHookProcReceive(ctx context.Context, c *cli.Command) error {
+func runHookProcReceive(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))

 	if len(os.Getenv("SSH_ORIGINAL_COMMAND")) == 0 {
@@ -733,7 +740,7 @@ func readPktLine(ctx context.Context, in *bufio.Reader, requestType pktLineType)

 	// read prefix
 	lengthBytes := make([]byte, 4)
-	for i := range 4 {
+	for i := 0; i < 4; i++ {
 		lengthBytes[i], err = in.ReadByte()
 		if err != nil {
 			return nil, fail(ctx, "Protocol: stdin error", "Pkt-Line: read stdin failed : %v", err)
--- a/cmd/keys.go
+++ b/cmd/keys.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"strings"
@@ -12,14 +11,13 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/private"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdKeys represents the available keys sub-command
 var CmdKeys = &cli.Command{
 	Name:        "keys",
 	Usage:       "(internal) Should only be called by SSH server",
-	Hidden:      true, // internal commands shouldn't not be visible
 	Description: "Queries the Gitea database to get the authorized command for a given ssh key fingerprint",
 	Before:      PrepareConsoleLoggerLevel(log.FATAL),
 	Action:      runKeys,
@@ -51,7 +49,7 @@ var CmdKeys = &cli.Command{
 	},
 }

-func runKeys(ctx context.Context, c *cli.Command) error {
+func runKeys(c *cli.Context) error {
 	if !c.IsSet("username") {
 		return errors.New("No username provided")
 	}
@@ -70,6 +68,9 @@ func runKeys(ctx context.Context, c *cli.Command) error {
 		return errors.New("No key type and content provided")
 	}

+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))

 	authorizedString, extra := private.AuthorizedPublicKeyByContent(ctx, content)
@@ -77,6 +78,6 @@ func runKeys(ctx context.Context, c *cli.Command) error {
 	if extra.Error != nil {
 		return extra.Error
 	}
-	_, _ = fmt.Fprintln(c.Root().Writer, strings.TrimSpace(authorizedString.Text))
+	_, _ = fmt.Fprintln(c.App.Writer, strings.TrimSpace(authorizedString.Text))
 	return nil
 }
--- a/cmd/mailer.go
+++ b/cmd/mailer.go
@@ -4,18 +4,24 @@
 package cmd

 import (
-	"context"
 	"fmt"

 	"code.gitea.io/gitea/modules/private"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-func runSendMail(ctx context.Context, c *cli.Command) error {
+func runSendMail(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setting.MustInstalled()

+	if err := argsSet(c, "title"); err != nil {
+		return err
+	}
+
 	subject := c.String("title")
 	confirmSkiped := c.Bool("force")
 	body := c.String("content")
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -4,40 +4,36 @@
 package cmd

 import (
-	"context"
 	"fmt"
-	"io"
 	"os"
 	"strings"

 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

-var cliHelpPrinterOld = cli.HelpPrinter
-
-func init() {
-	cli.HelpPrinter = cliHelpPrinterNew
-}
-
-// cliHelpPrinterNew helps to print "DEFAULT CONFIGURATION" for the following cases ( "-c" can apper in any position):
-// * ./gitea -c /dev/null -h
-// * ./gitea -c help /dev/null help
-// * ./gitea help -c /dev/null
-// * ./gitea help -c /dev/null web
-// * ./gitea help web -c /dev/null
-// * ./gitea web help -c /dev/null
-// * ./gitea web -h -c /dev/null
-func cliHelpPrinterNew(out io.Writer, templ string, data any) {
-	cmd, _ := data.(*cli.Command)
-	if cmd != nil {
-		prepareWorkPathAndCustomConf(cmd)
-	}
-	cliHelpPrinterOld(out, templ, data)
-	if setting.CustomConf != "" {
-		_, _ = fmt.Fprintf(out, `
+// cmdHelp is our own help subcommand with more information
+// Keep in mind that the "./gitea help"(subcommand) is different from "./gitea --help"(flag), the flag doesn't parse the config or output "DEFAULT CONFIGURATION:" information
+func cmdHelp() *cli.Command {
+	c := &cli.Command{
+		Name:      "help",
+		Aliases:   []string{"h"},
+		Usage:     "Shows a list of commands or help for one command",
+		ArgsUsage: "[command]",
+		Action: func(c *cli.Context) (err error) {
+			lineage := c.Lineage() // The order is from child to parent: help, doctor, Gitea, {Command:nil}
+			targetCmdIdx := 0
+			if c.Command.Name == "help" {
+				targetCmdIdx = 1
+			}
+			if lineage[targetCmdIdx+1].Command != nil {
+				err = cli.ShowCommandHelp(lineage[targetCmdIdx+1], lineage[targetCmdIdx].Command.Name)
+			} else {
+				err = cli.ShowAppHelp(c)
+			}
+			_, _ = fmt.Fprintf(c.App.Writer, `
 DEFAULT CONFIGURATION:
   AppPath:    %s
   WorkPath:   %s
@@ -45,71 +41,94 @@ DEFAULT CONFIGURATION:
   ConfigFile: %s

 `, setting.AppPath, setting.AppWorkPath, setting.CustomPath, setting.CustomConf)
+			return err
+		},
+	}
+	return c
+}
+
+func appGlobalFlags() []cli.Flag {
+	return []cli.Flag{
+		// make the builtin flags at the top
+		cli.HelpFlag,
+
+		// shared configuration flags, they are for global and for each sub-command at the same time
+		// eg: such command is valid: "./gitea --config /tmp/app.ini web --config /tmp/app.ini", while it's discouraged indeed
+		// keep in mind that the short flags like "-C", "-c" and "-w" are globally polluted, they can't be used for sub-commands anymore.
+		&cli.StringFlag{
+			Name:    "custom-path",
+			Aliases: []string{"C"},
+			Usage:   "Set custom path (defaults to '{WorkPath}/custom')",
+		},
+		&cli.StringFlag{
+			Name:    "config",
+			Aliases: []string{"c"},
+			Value:   setting.CustomConf,
+			Usage:   "Set custom config file (defaults to '{WorkPath}/custom/conf/app.ini')",
+		},
+		&cli.StringFlag{
+			Name:    "work-path",
+			Aliases: []string{"w"},
+			Usage:   "Set Gitea's working path (defaults to the Gitea's binary directory)",
+		},
 	}
 }

-func prepareSubcommandWithGlobalFlags(originCmd *cli.Command) {
-	originBefore := originCmd.Before
-	originCmd.Before = func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
-		prepareWorkPathAndCustomConf(cmd)
-		if originBefore != nil {
-			return originBefore(ctx, cmd)
+func prepareSubcommandWithConfig(command *cli.Command, globalFlags []cli.Flag) {
+	command.Flags = append(append([]cli.Flag{}, globalFlags...), command.Flags...)
+	command.Action = prepareWorkPathAndCustomConf(command.Action)
+	command.HideHelp = true
+	if command.Name != "help" {
+		command.Subcommands = append(command.Subcommands, cmdHelp())
+	}
+	for i := range command.Subcommands {
+		prepareSubcommandWithConfig(command.Subcommands[i], globalFlags)
+	}
+}
+
+// prepareWorkPathAndCustomConf wraps the Action to prepare the work path and custom config
+// It can't use "Before", because each level's sub-command's Before will be called one by one, so the "init" would be done multiple times
+func prepareWorkPathAndCustomConf(action cli.ActionFunc) func(ctx *cli.Context) error {
+	return func(ctx *cli.Context) error {
+		var args setting.ArgWorkPathAndCustomConf
+		// from children to parent, check the global flags
+		for _, curCtx := range ctx.Lineage() {
+			if curCtx.IsSet("work-path") && args.WorkPath == "" {
+				args.WorkPath = curCtx.String("work-path")
+			}
+			if curCtx.IsSet("custom-path") && args.CustomPath == "" {
+				args.CustomPath = curCtx.String("custom-path")
+			}
+			if curCtx.IsSet("config") && args.CustomConf == "" {
+				args.CustomConf = curCtx.String("config")
+			}
 		}
-		return ctx, nil
+		setting.InitWorkPathAndCommonConfig(os.Getenv, args)
+		if ctx.Bool("help") || action == nil {
+			// the default behavior of "urfave/cli": "nil action" means "show help"
+			return cmdHelp().Action(ctx)
+		}
+		return action(ctx)
 	}
 }

-// prepareWorkPathAndCustomConf tries to prepare the work path, custom path and custom config from various inputs:
-// command line flags, environment variables, config file
-func prepareWorkPathAndCustomConf(cmd *cli.Command) {
-	var args setting.ArgWorkPathAndCustomConf
-	if cmd.IsSet("work-path") {
-		args.WorkPath = cmd.String("work-path")
-	}
-	if cmd.IsSet("custom-path") {
-		args.CustomPath = cmd.String("custom-path")
-	}
-	if cmd.IsSet("config") {
-		args.CustomConf = cmd.String("config")
-	}
-	setting.InitWorkPathAndCommonConfig(os.Getenv, args)
-}
-
 type AppVersion struct {
 	Version string
 	Extra   string
 }

-func NewMainApp(appVer AppVersion) *cli.Command {
-	app := &cli.Command{}
-	app.Name = "gitea" // must be lower-cased because it appears in the "USAGE" section like "gitea doctor [command [command options]]"
+func NewMainApp(appVer AppVersion) *cli.App {
+	app := cli.NewApp()
+	app.Name = "Gitea"
+	app.HelpName = "gitea"
 	app.Usage = "A painless self-hosted Git service"
 	app.Description = `Gitea program contains "web" and other subcommands. If no subcommand is given, it starts the web server by default. Use "web" subcommand for more web server arguments, use other subcommands for other purposes.`
 	app.Version = appVer.Version + appVer.Extra
-	app.EnableShellCompletion = true
-	app.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:      "work-path",
-			Aliases:   []string{"w"},
-			TakesFile: true,
-			Usage:     "Set Gitea's working path (defaults to the Gitea's binary directory)",
-		},
-		&cli.StringFlag{
-			Name:      "config",
-			Aliases:   []string{"c"},
-			TakesFile: true,
-			Value:     setting.CustomConf,
-			Usage:     "Set custom config file (defaults to '{WorkPath}/custom/conf/app.ini')",
-		},
-		&cli.StringFlag{
-			Name:      "custom-path",
-			Aliases:   []string{"C"},
-			TakesFile: true,
-			Usage:     "Set custom path (defaults to '{WorkPath}/custom')",
-		},
-	}
-	// these sub-commands need to use a config file
+	app.EnableBashCompletion = true
+
+	// these sub-commands need to use config file
 	subCmdWithConfig := []*cli.Command{
+		cmdHelp(), // the "help" sub-command was used to show the more information for "work path" and "custom config"
 		CmdWeb,
 		CmdServ,
 		CmdHook,
@@ -128,18 +147,20 @@ func NewMainApp(appVer AppVersion) *cli.Command {

 	// these sub-commands do not need the config file, and they do not depend on any path or environment variable.
 	subCmdStandalone := []*cli.Command{
-		cmdCert(),
+		CmdCert,
 		CmdGenerate,
 		CmdDocs,
 	}

-	// TODO: we should eventually drop the default command,
-	// but not sure whether it would break Windows users who used to double-click the EXE to run.
 	app.DefaultCommand = CmdWeb.Name

+	globalFlags := appGlobalFlags()
+	app.Flags = append(app.Flags, cli.VersionFlag)
+	app.Flags = append(app.Flags, globalFlags...)
+	app.HideHelp = true // use our own help action to show helps (with more information like default config)
 	app.Before = PrepareConsoleLoggerLevel(log.INFO)
 	for i := range subCmdWithConfig {
-		prepareSubcommandWithGlobalFlags(subCmdWithConfig[i])
+		prepareSubcommandWithConfig(subCmdWithConfig[i], globalFlags)
 	}
 	app.Commands = append(app.Commands, subCmdWithConfig...)
 	app.Commands = append(app.Commands, subCmdStandalone...)
@@ -148,10 +169,8 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 	return app
 }

-func RunMainApp(app *cli.Command, args ...string) error {
-	ctx, cancel := installSignals()
-	defer cancel()
-	err := app.Run(ctx, args)
+func RunMainApp(app *cli.App, args ...string) error {
+	err := app.Run(args)
 	if err == nil {
 		return nil
 	}
--- a/cmd/main_test.go
+++ b/cmd/main_test.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -17,7 +16,7 @@ import (
 	"code.gitea.io/gitea/modules/test"

 	"github.com/stretchr/testify/assert"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 func TestMain(m *testing.M) {
@@ -28,10 +27,10 @@ func makePathOutput(workPath, customPath, customConf string) string {
 	return fmt.Sprintf("WorkPath=%s\nCustomPath=%s\nCustomConf=%s", workPath, customPath, customConf)
 }

-func newTestApp(testCmdAction cli.ActionFunc) *cli.Command {
+func newTestApp(testCmdAction func(ctx *cli.Context) error) *cli.App {
 	app := NewMainApp(AppVersion{})
 	testCmd := &cli.Command{Name: "test-cmd", Action: testCmdAction}
-	prepareSubcommandWithGlobalFlags(testCmd)
+	prepareSubcommandWithConfig(testCmd, appGlobalFlags())
 	app.Commands = append(app.Commands, testCmd)
 	app.DefaultCommand = testCmd.Name
 	return app
@@ -43,7 +42,7 @@ type runResult struct {
 	ExitCode int
 }

-func runTestApp(app *cli.Command, args ...string) (runResult, error) {
+func runTestApp(app *cli.App, args ...string) (runResult, error) {
 	outBuf := new(strings.Builder)
 	errBuf := new(strings.Builder)
 	app.Writer = outBuf
@@ -66,7 +65,7 @@ func TestCliCmd(t *testing.T) {
 	defaultCustomConf := filepath.Join(defaultCustomPath, "conf/app.ini")

 	cli.CommandHelpTemplate = "(command help template)"
-	cli.RootCommandHelpTemplate = "(app help template)"
+	cli.AppHelpTemplate = "(app help template)"
 	cli.SubcommandHelpTemplate = "(subcommand help template)"

 	cases := []struct {
@@ -74,56 +73,12 @@ func TestCliCmd(t *testing.T) {
 		cmd string
 		exp string
 	}{
-		// help commands
-		{
-			cmd: "./gitea -h",
-			exp: "DEFAULT CONFIGURATION:",
-		},
+		// main command help
 		{
 			cmd: "./gitea help",
 			exp: "DEFAULT CONFIGURATION:",
 		},

-		{
-			cmd: "./gitea -c /dev/null -h",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null help",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea help -c /dev/null",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null test-cmd -h",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd -c /dev/null -h",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd -h -c /dev/null",
-			exp: "ConfigFile: /dev/null",
-		},
-
-		{
-			cmd: "./gitea -c /dev/null test-cmd help",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd -c /dev/null help",
-			exp: "ConfigFile: /dev/null",
-		},
-		{
-			cmd: "./gitea test-cmd help -c /dev/null",
-			exp: "ConfigFile: /dev/null",
-		},
-
 		// parse paths
 		{
 			cmd: "./gitea test-cmd",
@@ -154,12 +109,12 @@ func TestCliCmd(t *testing.T) {
 		},
 	}

+	app := newTestApp(func(ctx *cli.Context) error {
+		_, _ = fmt.Fprint(ctx.App.Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
+		return nil
+	})
 	for _, c := range cases {
 		t.Run(c.cmd, func(t *testing.T) {
-			app := newTestApp(func(ctx context.Context, cmd *cli.Command) error {
-				_, _ = fmt.Fprint(cmd.Root().Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
-				return nil
-			})
 			for k, v := range c.env {
 				t.Setenv(k, v)
 			}
@@ -173,28 +128,28 @@ func TestCliCmd(t *testing.T) {
 }

 func TestCliCmdError(t *testing.T) {
-	app := newTestApp(func(ctx context.Context, cmd *cli.Command) error { return errors.New("normal error") })
+	app := newTestApp(func(ctx *cli.Context) error { return errors.New("normal error") })
 	r, err := runTestApp(app, "./gitea", "test-cmd")
 	assert.Error(t, err)
 	assert.Equal(t, 1, r.ExitCode)
 	assert.Empty(t, r.Stdout)
 	assert.Equal(t, "Command error: normal error\n", r.Stderr)

-	app = newTestApp(func(ctx context.Context, cmd *cli.Command) error { return cli.Exit("exit error", 2) })
+	app = newTestApp(func(ctx *cli.Context) error { return cli.Exit("exit error", 2) })
 	r, err = runTestApp(app, "./gitea", "test-cmd")
 	assert.Error(t, err)
 	assert.Equal(t, 2, r.ExitCode)
 	assert.Empty(t, r.Stdout)
 	assert.Equal(t, "exit error\n", r.Stderr)

-	app = newTestApp(func(ctx context.Context, cmd *cli.Command) error { return nil })
+	app = newTestApp(func(ctx *cli.Context) error { return nil })
 	r, err = runTestApp(app, "./gitea", "test-cmd", "--no-such")
 	assert.Error(t, err)
 	assert.Equal(t, 1, r.ExitCode)
-	assert.Empty(t, r.Stdout)
-	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n\n", r.Stderr)
+	assert.Equal(t, "Incorrect Usage: flag provided but not defined: -no-such\n\n", r.Stdout)
+	assert.Empty(t, r.Stderr) // the cli package's strange behavior, the error message is not in stderr ....

-	app = newTestApp(func(ctx context.Context, cmd *cli.Command) error { return nil })
+	app = newTestApp(func(ctx *cli.Context) error { return nil })
 	r, err = runTestApp(app, "./gitea", "test-cmd")
 	assert.NoError(t, err)
 	assert.Equal(t, -1, r.ExitCode) // the cli.OsExiter is not called
--- a/cmd/manager.go
+++ b/cmd/manager.go
@@ -4,13 +4,12 @@
 package cmd

 import (
-	"context"
 	"os"
 	"time"

 	"code.gitea.io/gitea/modules/private"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
@@ -19,7 +18,7 @@ var (
 		Name:        "manager",
 		Usage:       "Manage the running gitea process",
 		Description: "This is a command for managing the running gitea process",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			subcmdShutdown,
 			subcmdRestart,
 			subcmdReloadTemplates,
@@ -109,31 +108,46 @@ var (
 	}
 )

-func runShutdown(ctx context.Context, c *cli.Command) error {
+func runShutdown(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	extra := private.Shutdown(ctx)
 	return handleCliResponseExtra(extra)
 }

-func runRestart(ctx context.Context, c *cli.Command) error {
+func runRestart(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	extra := private.Restart(ctx)
 	return handleCliResponseExtra(extra)
 }

-func runReloadTemplates(ctx context.Context, c *cli.Command) error {
+func runReloadTemplates(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	extra := private.ReloadTemplates(ctx)
 	return handleCliResponseExtra(extra)
 }

-func runFlushQueues(ctx context.Context, c *cli.Command) error {
+func runFlushQueues(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	extra := private.FlushQueues(ctx, c.Duration("timeout"), c.Bool("non-blocking"))
 	return handleCliResponseExtra(extra)
 }

-func runProcesses(ctx context.Context, c *cli.Command) error {
+func runProcesses(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	extra := private.Processes(ctx, os.Stdout, c.Bool("flat"), c.Bool("no-system"), c.Bool("stacktraces"), c.Bool("json"), c.String("cancel"))
 	return handleCliResponseExtra(extra)
--- a/cmd/manager_logging.go
+++ b/cmd/manager_logging.go
@@ -4,7 +4,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -12,7 +11,7 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/private"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 var (
@@ -61,7 +60,7 @@ var (
 	subcmdLogging = &cli.Command{
 		Name:  "logging",
 		Usage: "Adjust logging commands",
-		Commands: []*cli.Command{
+		Subcommands: []*cli.Command{
 			{
 				Name:  "pause",
 				Usage: "Pause logging (Gitea will buffer logs up to a certain point and will drop them after that point)",
@@ -105,7 +104,7 @@ var (
 			}, {
 				Name:  "add",
 				Usage: "Add a logger",
-				Commands: []*cli.Command{
+				Subcommands: []*cli.Command{
 					{
 						Name:  "file",
 						Usage: "Add a file logger",
@@ -119,6 +118,7 @@ var (
 								Name:    "rotate",
 								Aliases: []string{"r"},
 								Usage:   "Rotate logs",
+								Value:   true,
 							},
 							&cli.Int64Flag{
 								Name:    "max-size",
@@ -129,6 +129,7 @@ var (
 								Name:    "daily",
 								Aliases: []string{"d"},
 								Usage:   "Rotate logs daily",
+								Value:   true,
 							},
 							&cli.IntFlag{
 								Name:    "max-days",
@@ -139,6 +140,7 @@ var (
 								Name:    "compress",
 								Aliases: []string{"z"},
 								Usage:   "Compress rotated logs",
+								Value:   true,
 							},
 							&cli.IntFlag{
 								Name:    "compression-level",
@@ -193,7 +195,10 @@ var (
 	}
 )

-func runRemoveLogger(ctx context.Context, c *cli.Command) error {
+func runRemoveLogger(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	logger := c.String("logger")
 	if len(logger) == 0 {
@@ -205,7 +210,10 @@ func runRemoveLogger(ctx context.Context, c *cli.Command) error {
 	return handleCliResponseExtra(extra)
 }

-func runAddConnLogger(ctx context.Context, c *cli.Command) error {
+func runAddConnLogger(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	vals := map[string]any{}
 	mode := "conn"
@@ -229,10 +237,13 @@ func runAddConnLogger(ctx context.Context, c *cli.Command) error {
 	if c.IsSet("reconnect-on-message") {
 		vals["reconnectOnMsg"] = c.Bool("reconnect-on-message")
 	}
-	return commonAddLogger(ctx, c, mode, vals)
+	return commonAddLogger(c, mode, vals)
 }

-func runAddFileLogger(ctx context.Context, c *cli.Command) error {
+func runAddFileLogger(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	vals := map[string]any{}
 	mode := "file"
@@ -259,10 +270,10 @@ func runAddFileLogger(ctx context.Context, c *cli.Command) error {
 	if c.IsSet("compression-level") {
 		vals["compressionLevel"] = c.Int("compression-level")
 	}
-	return commonAddLogger(ctx, c, mode, vals)
+	return commonAddLogger(c, mode, vals)
 }

-func commonAddLogger(ctx context.Context, c *cli.Command, mode string, vals map[string]any) error {
+func commonAddLogger(c *cli.Context, mode string, vals map[string]any) error {
 	if len(c.String("level")) > 0 {
 		vals["level"] = log.LevelFromString(c.String("level")).String()
 	}
@@ -289,33 +300,46 @@ func commonAddLogger(ctx context.Context, c *cli.Command, mode string, vals map[
 	if c.IsSet("writer") {
 		writer = c.String("writer")
 	}
+	ctx, cancel := installSignals()
+	defer cancel()

 	extra := private.AddLogger(ctx, logger, writer, mode, vals)
 	return handleCliResponseExtra(extra)
 }

-func runPauseLogging(ctx context.Context, c *cli.Command) error {
+func runPauseLogging(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	userMsg := private.PauseLogging(ctx)
 	_, _ = fmt.Fprintln(os.Stdout, userMsg)
 	return nil
 }

-func runResumeLogging(ctx context.Context, c *cli.Command) error {
+func runResumeLogging(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	userMsg := private.ResumeLogging(ctx)
 	_, _ = fmt.Fprintln(os.Stdout, userMsg)
 	return nil
 }

-func runReleaseReopenLogging(ctx context.Context, c *cli.Command) error {
+func runReleaseReopenLogging(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setup(ctx, c.Bool("debug"))
 	userMsg := private.ReleaseReopenLogging(ctx)
 	_, _ = fmt.Fprintln(os.Stdout, userMsg)
 	return nil
 }

-func runSetLogSQL(ctx context.Context, c *cli.Command) error {
+func runSetLogSQL(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
 	setup(ctx, c.Bool("debug"))

 	extra := private.SetLogSQL(ctx, !c.Bool("off"))
--- a/cmd/migrate.go
+++ b/cmd/migrate.go
@@ -11,7 +11,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/services/versioned_migration"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdMigrate represents the available migrate sub-command.
@@ -22,8 +22,11 @@ var CmdMigrate = &cli.Command{
 	Action:      runMigrate,
 }

-func runMigrate(ctx context.Context, c *cli.Command) error {
-	if err := initDB(ctx); err != nil {
+func runMigrate(ctx *cli.Context) error {
+	stdCtx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(stdCtx); err != nil {
 		return err
 	}

--- a/cmd/migrate_storage.go
+++ b/cmd/migrate_storage.go
@@ -22,7 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/storage"
 	"code.gitea.io/gitea/services/versioned_migration"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdMigrateStorage represents the available migrate storage sub-command.
@@ -213,8 +213,11 @@ func migrateActionsArtifacts(ctx context.Context, dstStorage storage.ObjectStora
 	})
 }

-func runMigrateStorage(ctx context.Context, cmd *cli.Command) error {
-	if err := initDB(ctx); err != nil {
+func runMigrateStorage(ctx *cli.Context) error {
+	stdCtx, cancel := installSignals()
+	defer cancel()
+
+	if err := initDB(stdCtx); err != nil {
 		return err
 	}

@@ -235,51 +238,51 @@ func runMigrateStorage(ctx context.Context, cmd *cli.Command) error {

 	var dstStorage storage.ObjectStorage
 	var err error
-	switch strings.ToLower(cmd.String("storage")) {
+	switch strings.ToLower(ctx.String("storage")) {
 	case "":
 		fallthrough
 	case string(setting.LocalStorageType):
-		p := cmd.String("path")
+		p := ctx.String("path")
 		if p == "" {
 			log.Fatal("Path must be given when storage is local")
 			return nil
 		}
 		dstStorage, err = storage.NewLocalStorage(
-			ctx,
+			stdCtx,
 			&setting.Storage{
 				Path: p,
 			})
 	case string(setting.MinioStorageType):
 		dstStorage, err = storage.NewMinioStorage(
-			ctx,
+			stdCtx,
 			&setting.Storage{
 				MinioConfig: setting.MinioStorageConfig{
-					Endpoint:           cmd.String("minio-endpoint"),
-					AccessKeyID:        cmd.String("minio-access-key-id"),
-					SecretAccessKey:    cmd.String("minio-secret-access-key"),
-					Bucket:             cmd.String("minio-bucket"),
-					Location:           cmd.String("minio-location"),
-					BasePath:           cmd.String("minio-base-path"),
-					UseSSL:             cmd.Bool("minio-use-ssl"),
-					InsecureSkipVerify: cmd.Bool("minio-insecure-skip-verify"),
-					ChecksumAlgorithm:  cmd.String("minio-checksum-algorithm"),
-					BucketLookUpType:   cmd.String("minio-bucket-lookup-type"),
+					Endpoint:           ctx.String("minio-endpoint"),
+					AccessKeyID:        ctx.String("minio-access-key-id"),
+					SecretAccessKey:    ctx.String("minio-secret-access-key"),
+					Bucket:             ctx.String("minio-bucket"),
+					Location:           ctx.String("minio-location"),
+					BasePath:           ctx.String("minio-base-path"),
+					UseSSL:             ctx.Bool("minio-use-ssl"),
+					InsecureSkipVerify: ctx.Bool("minio-insecure-skip-verify"),
+					ChecksumAlgorithm:  ctx.String("minio-checksum-algorithm"),
+					BucketLookUpType:   ctx.String("minio-bucket-lookup-type"),
 				},
 			})
 	case string(setting.AzureBlobStorageType):
 		dstStorage, err = storage.NewAzureBlobStorage(
-			ctx,
+			stdCtx,
 			&setting.Storage{
 				AzureBlobConfig: setting.AzureBlobStorageConfig{
-					Endpoint:    cmd.String("azureblob-endpoint"),
-					AccountName: cmd.String("azureblob-account-name"),
-					AccountKey:  cmd.String("azureblob-account-key"),
-					Container:   cmd.String("azureblob-container"),
-					BasePath:    cmd.String("azureblob-base-path"),
+					Endpoint:    ctx.String("azureblob-endpoint"),
+					AccountName: ctx.String("azureblob-account-name"),
+					AccountKey:  ctx.String("azureblob-account-key"),
+					Container:   ctx.String("azureblob-container"),
+					BasePath:    ctx.String("azureblob-base-path"),
 				},
 			})
 	default:
-		return fmt.Errorf("unsupported storage type: %s", cmd.String("storage"))
+		return fmt.Errorf("unsupported storage type: %s", ctx.String("storage"))
 	}
 	if err != nil {
 		return err
@@ -296,14 +299,14 @@ func runMigrateStorage(ctx context.Context, cmd *cli.Command) error {
 		"actions-artifacts": migrateActionsArtifacts,
 	}

-	tp := strings.ToLower(cmd.String("type"))
+	tp := strings.ToLower(ctx.String("type"))
 	if m, ok := migratedMethods[tp]; ok {
-		if err := m(ctx, dstStorage); err != nil {
+		if err := m(stdCtx, dstStorage); err != nil {
 			return err
 		}
 		log.Info("%s files have successfully been copied to the new storage.", tp)
 		return nil
 	}

-	return fmt.Errorf("unsupported storage: %s", cmd.String("type"))
+	return fmt.Errorf("unsupported storage: %s", ctx.String("type"))
 }
--- a/cmd/migrate_storage_test.go
+++ b/cmd/migrate_storage_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/packages"
 	"code.gitea.io/gitea/models/unittest"
 	user_model "code.gitea.io/gitea/models/user"
@@ -29,7 +30,7 @@ func TestMigratePackages(t *testing.T) {
 	assert.NoError(t, err)
 	defer buf.Close()

-	v, f, err := packages_service.CreatePackageAndAddFile(t.Context(), &packages_service.PackageCreationInfo{
+	v, f, err := packages_service.CreatePackageAndAddFile(db.DefaultContext, &packages_service.PackageCreationInfo{
 		PackageInfo: packages_service.PackageInfo{
 			Owner:       creator,
 			PackageType: packages.TypeGeneric,
--- a/cmd/restore_repo.go
+++ b/cmd/restore_repo.go
@@ -4,13 +4,12 @@
 package cmd

 import (
-	"context"
 	"strings"

 	"code.gitea.io/gitea/modules/private"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // CmdRestoreRepository represents the available restore a repository sub-command.
@@ -49,7 +48,10 @@ wiki, issues, labels, releases, release_assets, milestones, pull_requests, comme
 	},
 }

-func runRestoreRepository(ctx context.Context, c *cli.Command) error {
+func runRestoreRepository(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	setting.MustInstalled()
 	var units []string
 	if s := c.String("units"); s != "" {
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -19,7 +20,7 @@ import (
 	asymkey_model "code.gitea.io/gitea/models/asymkey"
 	git_model "code.gitea.io/gitea/models/git"
 	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/lfstransfer"
@@ -33,7 +34,15 @@ import (

 	"github.com/golang-jwt/jwt/v5"
 	"github.com/kballard/go-shellquote"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
+)
+
+const (
+	verbUploadPack      = "git-upload-pack"
+	verbUploadArchive   = "git-upload-archive"
+	verbReceivePack     = "git-receive-pack"
+	verbLfsAuthenticate = "git-lfs-authenticate"
+	verbLfsTransfer     = "git-lfs-transfer"
 )

 // CmdServ represents the available serv sub-command.
@@ -41,7 +50,6 @@ var CmdServ = &cli.Command{
 	Name:        "serv",
 	Usage:       "(internal) Should only be called by SSH shell",
 	Description: "Serv provides access auth for repositories",
-	Hidden:      true, // Internal commands shouldn't be visible in help
 	Before:      PrepareConsoleLoggerLevel(log.FATAL),
 	Action:      runServ,
 	Flags: []cli.Flag{
@@ -65,11 +73,27 @@ func setup(ctx context.Context, debug bool) {
 		_ = fail(ctx, "Unable to access repository path", "Unable to access repository path %q, err: %v", setting.RepoRootPath, err)
 		return
 	}
-	if err := git.InitSimple(); err != nil {
+	if err := git.InitSimple(context.Background()); err != nil {
 		_ = fail(ctx, "Failed to init git", "Failed to init git, err: %v", err)
 	}
 }

+var (
+	// keep getAccessMode() in sync
+	allowedCommands = container.SetOf(
+		verbUploadPack,
+		verbUploadArchive,
+		verbReceivePack,
+		verbLfsAuthenticate,
+		verbLfsTransfer,
+	)
+	allowedCommandsLfs = container.SetOf(
+		verbLfsAuthenticate,
+		verbLfsTransfer,
+	)
+	alphaDashDotPattern = regexp.MustCompile(`[^\w-\.]`)
+)
+
 // fail prints message to stdout, it's mainly used for git serv and git hook commands.
 // The output will be passed to git client and shown to user.
 func fail(ctx context.Context, userMessage, logMsgFmt string, args ...any) error {
@@ -115,20 +139,19 @@ func handleCliResponseExtra(extra private.ResponseExtra) error {

 func getAccessMode(verb, lfsVerb string) perm.AccessMode {
 	switch verb {
-	case git.CmdVerbUploadPack, git.CmdVerbUploadArchive:
+	case verbUploadPack, verbUploadArchive:
 		return perm.AccessModeRead
-	case git.CmdVerbReceivePack:
+	case verbReceivePack:
 		return perm.AccessModeWrite
-	case git.CmdVerbLfsAuthenticate, git.CmdVerbLfsTransfer:
+	case verbLfsAuthenticate, verbLfsTransfer:
 		switch lfsVerb {
-		case git.CmdSubVerbLfsUpload:
+		case "upload":
 			return perm.AccessModeWrite
-		case git.CmdSubVerbLfsDownload:
+		case "download":
 			return perm.AccessModeRead
 		}
 	}
 	// should be unreachable
-	setting.PanicInDevOrTesting("unknown verb: %s %s", verb, lfsVerb)
 	return perm.AccessModeNone
 }

@@ -153,7 +176,10 @@ func getLFSAuthToken(ctx context.Context, lfsVerb string, results *private.ServC
 	return "Bearer " + tokenString, nil
 }

-func runServ(ctx context.Context, c *cli.Command) error {
+func runServ(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	// FIXME: This needs to internationalised
 	setup(ctx, c.Bool("debug"))

@@ -204,37 +230,41 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		log.Debug("SSH_ORIGINAL_COMMAND: %s", os.Getenv("SSH_ORIGINAL_COMMAND"))
 	}

-	sshCmdArgs, err := shellquote.Split(cmd)
+	words, err := shellquote.Split(cmd)
 	if err != nil {
 		return fail(ctx, "Error parsing arguments", "Failed to parse arguments: %v", err)
 	}

-	if len(sshCmdArgs) < 2 {
+	if len(words) < 2 {
 		if git.DefaultFeatures().SupportProcReceive {
 			// for AGit Flow
 			if cmd == "ssh_info" {
-				fmt.Print(`{"type":"agit","version":1}`)
+				fmt.Print(`{"type":"gitea","version":1}`)
 				return nil
 			}
 		}
 		return fail(ctx, "Too few arguments", "Too few arguments in cmd: %s", cmd)
 	}

-	repoPath := strings.TrimPrefix(sshCmdArgs[1], "/")
-	repoPathFields := strings.SplitN(repoPath, "/", 2)
-	if len(repoPathFields) != 2 {
+	verb := words[0]
+	repoPath := strings.TrimPrefix(words[1], "/")
+
+	var lfsVerb string
+
+	rr := strings.SplitN(repoPath, "/", 2)
+	if len(rr) != 2 {
 		return fail(ctx, "Invalid repository path", "Invalid repository path: %v", repoPath)
 	}

-	username := repoPathFields[0]
-	reponame := strings.TrimSuffix(repoPathFields[1], ".git") // “the-repo-name" or "the-repo-name.wiki"
+	username := rr[0]
+	reponame := strings.TrimSuffix(rr[1], ".git")

 	// LowerCase and trim the repoPath as that's how they are stored.
 	// This should be done after splitting the repoPath into username and reponame
 	// so that username and reponame are not affected.
 	repoPath = strings.ToLower(strings.TrimSpace(repoPath))

-	if !repo.IsValidSSHAccessRepoName(reponame) {
+	if alphaDashDotPattern.MatchString(reponame) {
 		return fail(ctx, "Invalid repo name", "Invalid repo name: %s", reponame)
 	}

@@ -256,23 +286,22 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		}()
 	}

-	verb, lfsVerb := sshCmdArgs[0], ""
-	if !git.IsAllowedVerbForServe(verb) {
+	if allowedCommands.Contains(verb) {
+		if allowedCommandsLfs.Contains(verb) {
+			if !setting.LFS.StartServer {
+				return fail(ctx, "LFS Server is not enabled", "")
+			}
+			if verb == verbLfsTransfer && !setting.LFS.AllowPureSSH {
+				return fail(ctx, "LFS SSH transfer is not enabled", "")
+			}
+			if len(words) > 2 {
+				lfsVerb = words[2]
+			}
+		}
+	} else {
 		return fail(ctx, "Unknown git command", "Unknown git command %s", verb)
 	}

-	if git.IsAllowedVerbForServeLfs(verb) {
-		if !setting.LFS.StartServer {
-			return fail(ctx, "LFS Server is not enabled", "")
-		}
-		if verb == git.CmdVerbLfsTransfer && !setting.LFS.AllowPureSSH {
-			return fail(ctx, "LFS SSH transfer is not enabled", "")
-		}
-		if len(sshCmdArgs) > 2 {
-			lfsVerb = sshCmdArgs[2]
-		}
-	}
-
 	requestedMode := getAccessMode(verb, lfsVerb)

 	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
@@ -281,7 +310,7 @@ func runServ(ctx context.Context, c *cli.Command) error {
 	}

 	// LFS SSH protocol
-	if verb == git.CmdVerbLfsTransfer {
+	if verb == verbLfsTransfer {
 		token, err := getLFSAuthToken(ctx, lfsVerb, results)
 		if err != nil {
 			return err
@@ -290,7 +319,7 @@ func runServ(ctx context.Context, c *cli.Command) error {
 	}

 	// LFS token authentication
-	if verb == git.CmdVerbLfsAuthenticate {
+	if verb == verbLfsAuthenticate {
 		url := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, url.PathEscape(results.OwnerName), url.PathEscape(results.RepoName))

 		token, err := getLFSAuthToken(ctx, lfsVerb, results)
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -28,7 +28,7 @@ import (
 	"code.gitea.io/gitea/routers/install"

 	"github.com/felixge/fgprof"
-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // PIDFile could be set from build tag
@@ -130,19 +130,19 @@ func showWebStartupMessage(msg string) {
 	}
 }

-func serveInstall(cmd *cli.Command) error {
+func serveInstall(ctx *cli.Context) error {
 	showWebStartupMessage("Prepare to run install page")

 	routers.InitWebInstallPage(graceful.GetManager().HammerContext())

 	// Flag for port number in case first time run conflict
-	if cmd.IsSet("port") {
-		if err := setPort(cmd.String("port")); err != nil {
+	if ctx.IsSet("port") {
+		if err := setPort(ctx.String("port")); err != nil {
 			return err
 		}
 	}
-	if cmd.IsSet("install-port") {
-		if err := setPort(cmd.String("install-port")); err != nil {
+	if ctx.IsSet("install-port") {
+		if err := setPort(ctx.String("install-port")); err != nil {
 			return err
 		}
 	}
@@ -163,7 +163,7 @@ func serveInstall(cmd *cli.Command) error {
 	return nil
 }

-func serveInstalled(c *cli.Command) error {
+func serveInstalled(ctx *cli.Context) error {
 	setting.InitCfgProvider(setting.CustomConf)
 	setting.LoadCommonSettings()
 	setting.MustInstalled()
@@ -218,8 +218,8 @@ func serveInstalled(c *cli.Command) error {
 	setting.AppDataTempDir("").RemoveOutdated(3 * 24 * time.Hour)

 	// Override the provided port number within the configuration
-	if c.IsSet("port") {
-		if err := setPort(c.String("port")); err != nil {
+	if ctx.IsSet("port") {
+		if err := setPort(ctx.String("port")); err != nil {
 			return err
 		}
 	}
@@ -236,27 +236,22 @@ func serveInstalled(c *cli.Command) error {
 }

 func servePprof() {
-	// FIXME: it shouldn't use the global DefaultServeMux, and it should use a proper context
 	http.DefaultServeMux.Handle("/debug/fgprof", fgprof.Handler())
-	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
-	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
+	_, _, finished := process.GetManager().AddTypedContext(context.Background(), "Web: PProf Server", process.SystemProcessType, true)
+	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment it's not worth to introduce a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
 	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", nil))
 	finished()
 }

-func runWeb(ctx context.Context, cmd *cli.Command) error {
+func runWeb(ctx *cli.Context) error {
 	defer func() {
 		if panicked := recover(); panicked != nil {
 			log.Fatal("PANIC: %v\n%s", panicked, log.Stack(2))
 		}
 	}()

-	if subCmdName, valid := isValidDefaultSubCommand(cmd); !valid {
-		return fmt.Errorf("unknown command: %s", subCmdName)
-	}
-
-	managerCtx, cancel := context.WithCancel(ctx)
+	managerCtx, cancel := context.WithCancel(context.Background())
 	graceful.InitManager(managerCtx)
 	defer cancel()

@@ -267,12 +262,12 @@ func runWeb(ctx context.Context, cmd *cli.Command) error {
 	}

 	// Set pid file setting
-	if cmd.IsSet("pid") {
-		createPIDFile(cmd.String("pid"))
+	if ctx.IsSet("pid") {
+		createPIDFile(ctx.String("pid"))
 	}

 	if !setting.InstallLock {
-		if err := serveInstall(cmd); err != nil {
+		if err := serveInstall(ctx); err != nil {
 			return err
 		}
 	} else {
@@ -283,7 +278,7 @@ func runWeb(ctx context.Context, cmd *cli.Command) error {
 		go servePprof()
 	}

-	return serveInstalled(cmd)
+	return serveInstalled(ctx)
 }

 func setPort(port string) error {
--- a/cmd/web_graceful.go
+++ b/cmd/web_graceful.go
@@ -23,6 +23,12 @@ func NoHTTPRedirector() {
 	graceful.GetManager().InformCleanup()
 }

+// NoMainListener tells our cleanup routine that we will not be using a possibly provided listener
+// for our main HTTP/HTTPS service
+func NoMainListener() {
+	graceful.GetManager().InformCleanup()
+}
+
 // NoInstallListener tells our cleanup routine that we will not be using a possibly provided listener
 // for our install HTTP/HTTPS service
 func NoInstallListener() {
--- a/contrib/autocompletion/README
+++ b/contrib/autocompletion/README
@@ -0,0 +1,17 @@
+Bash and Zsh completion
+=======================
+
+From within the gitea root run:
+
+```bash
+source contrib/autocompletion/bash_autocomplete
+```
+
+or for zsh run:
+
+```bash
+source contrib/autocompletion/zsh_autocomplete
+```
+
+These scripts will check if gitea is on the path and if so add autocompletion for `gitea`. Or if not autocompletion will work for `./gitea`.
+If gitea has been installed as a different program pass in the `PROG` environment variable to set the correct program name.
--- a/contrib/autocompletion/bash_autocomplete
+++ b/contrib/autocompletion/bash_autocomplete
@@ -0,0 +1,30 @@
+#! /bin/bash
+# Heavily inspired by https://github.com/urfave/cli
+
+_cli_bash_autocomplete() {
+  if [[ "${COMP_WORDS[0]}" != "source" ]]; then
+    local cur opts base
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    if [[ "$cur" == "-"* ]]; then
+      opts=$( ${COMP_WORDS[@]:0:$COMP_CWORD} ${cur} --generate-bash-completion )
+    else
+      opts=$( ${COMP_WORDS[@]:0:$COMP_CWORD} --generate-bash-completion )
+    fi
+    COMPREPLY=( $(compgen -W "${opts}" -- ${cur}) )
+    return 0
+  fi
+}
+
+if [ -z "$PROG" ] && [ ! "$(command -v gitea &> /dev/null)" ] ; then
+  complete -o bashdefault -o default -o nospace -F _cli_bash_autocomplete gitea
+elif [ -z "$PROG" ]; then
+  complete -o bashdefault -o default -o nospace -F _cli_bash_autocomplete ./gitea
+  complete -o bashdefault -o default -o nospace -F _cli_bash_autocomplete "$PWD/gitea"
+else
+  complete -o bashdefault -o default -o nospace -F _cli_bash_autocomplete "$PROG"
+  unset PROG
+fi
+
+
+
--- a/contrib/autocompletion/zsh_autocomplete
+++ b/contrib/autocompletion/zsh_autocomplete
@@ -0,0 +1,30 @@
+#compdef ${PROG:=gitea}
+
+
+# Heavily inspired by https://github.com/urfave/cli
+
+_cli_zsh_autocomplete() {
+
+  local -a opts
+  local cur
+  cur=${words[-1]}
+  if [[ "$cur" == "-"* ]]; then
+    opts=("${(@f)$(_CLI_ZSH_AUTOCOMPLETE_HACK=1 ${words[@]:0:#words[@]-1} ${cur} --generate-bash-completion)}")
+  else
+    opts=("${(@f)$(_CLI_ZSH_AUTOCOMPLETE_HACK=1 ${words[@]:0:#words[@]-1} --generate-bash-completion)}")
+  fi
+
+  if [[ "${opts[1]}" != "" ]]; then
+    _describe 'values' opts
+  else
+    _files
+  fi
+
+  return
+}
+
+if [ -z $PROG ] ; then
+  compdef _cli_zsh_autocomplete gitea
+else
+  compdef _cli_zsh_autocomplete $(basename $PROG)
+fi
--- a/contrib/backport/backport.go
+++ b/contrib/backport/backport.go
@@ -1,7 +1,7 @@
 // Copyright 2023 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT

-//nolint:forbidigo // use of print functions is allowed in cli
+//nolint:forbidigo
 package main

 import (
@@ -12,19 +12,21 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
+	"os/signal"
 	"path"
 	"strconv"
 	"strings"
+	"syscall"

-	"github.com/google/go-github/v74/github"
-	"github.com/urfave/cli/v3"
+	"github.com/google/go-github/v61/github"
+	"github.com/urfave/cli/v2"
 	"gopkg.in/yaml.v3"
 )

 const defaultVersion = "v1.18" // to backport to

 func main() {
-	app := &cli.Command{}
+	app := cli.NewApp()
 	app.Name = "backport"
 	app.Usage = "Backport provided PR-number on to the current or previous released version"
 	app.Description = `Backport will look-up the PR in Gitea's git log and attempt to cherry-pick it on the current version`
@@ -89,7 +91,7 @@ func main() {
 			Usage: "Set this flag to continue from a git cherry-pick that has broken",
 		},
 	}
-	cli.RootCommandHelpTemplate = `NAME:
+	cli.AppHelpTemplate = `NAME:
 	{{.Name}} - {{.Usage}}
 USAGE:
 	{{.HelpName}} {{if .VisibleFlags}}[options]{{end}} {{if .ArgsUsage}}{{.ArgsUsage}}{{else}}[arguments...]{{end}}
@@ -103,12 +105,16 @@ OPTIONS:
 `

 	app.Action = runBackport
-	if err := app.Run(context.Background(), os.Args); err != nil {
+
+	if err := app.Run(os.Args); err != nil {
 		fmt.Fprintf(os.Stderr, "Unable to backport: %v\n", err)
 	}
 }

-func runBackport(ctx context.Context, c *cli.Command) error {
+func runBackport(c *cli.Context) error {
+	ctx, cancel := installSignals()
+	defer cancel()
+
 	continuing := c.Bool("continue")

 	var pr string
@@ -337,8 +343,8 @@ func determineRemote(ctx context.Context, forkUser string) (string, string, erro
 		fmt.Fprintf(os.Stderr, "Unable to list git remotes:\n%s\n", string(out))
 		return "", "", fmt.Errorf("unable to determine forked remote: %w", err)
 	}
-	lines := strings.SplitSeq(string(out), "\n")
-	for line := range lines {
+	lines := strings.Split(string(out), "\n")
+	for _, line := range lines {
 		fields := strings.Split(line, "\t")
 		name, remote := fields[0], fields[1]
 		// only look at pushers
@@ -356,12 +362,12 @@ func determineRemote(ctx context.Context, forkUser string) (string, string, erro
 		if !strings.Contains(remote, forkUser) {
 			continue
 		}
-		if after, ok := strings.CutPrefix(remote, "git@github.com:"); ok {
-			forkUser = after
-		} else if after, ok := strings.CutPrefix(remote, "https://github.com/"); ok {
-			forkUser = after
-		} else if after, ok := strings.CutPrefix(remote, "https://www.github.com/"); ok {
-			forkUser = after
+		if strings.HasPrefix(remote, "git@github.com:") {
+			forkUser = strings.TrimPrefix(remote, "git@github.com:")
+		} else if strings.HasPrefix(remote, "https://github.com/") {
+			forkUser = strings.TrimPrefix(remote, "https://github.com/")
+		} else if strings.HasPrefix(remote, "https://www.github.com/") {
+			forkUser = strings.TrimPrefix(remote, "https://www.github.com/")
 		} else if forkUser == "" {
 			return "", "", fmt.Errorf("unable to extract forkUser from remote %s: %s", name, remote)
 		}
@@ -454,3 +460,25 @@ func determineSHAforPR(ctx context.Context, prStr, accessToken string) (string,

 	return "", nil
 }
+
+func installSignals() (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		// install notify
+		signalChannel := make(chan os.Signal, 1)
+
+		signal.Notify(
+			signalChannel,
+			syscall.SIGINT,
+			syscall.SIGTERM,
+		)
+		select {
+		case <-signalChannel:
+		case <-ctx.Done():
+		}
+		cancel()
+		signal.Reset()
+	}()
+
+	return ctx, cancel
+}
--- a/contrib/environment-to-ini/environment-to-ini.go
+++ b/contrib/environment-to-ini/environment-to-ini.go
@@ -4,17 +4,16 @@
 package main

 import (
-	"context"
 	"os"

 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 func main() {
-	app := cli.Command{}
+	app := cli.NewApp()
 	app.Name = "environment-to-ini"
 	app.Usage = "Use provided environment to update configuration ini"
 	app.Description = `As a helper to allow docker users to update the gitea configuration
@@ -73,13 +72,13 @@ func main() {
 		},
 	}
 	app.Action = runEnvironmentToIni
-	err := app.Run(context.Background(), os.Args)
+	err := app.Run(os.Args)
 	if err != nil {
 		log.Fatal("Failed to run app with %s: %v", os.Args, err)
 	}
 }

-func runEnvironmentToIni(_ context.Context, c *cli.Command) error {
+func runEnvironmentToIni(c *cli.Context) error {
 	// the config system may change the environment variables, so get a copy first, to be used later
 	env := append([]string{}, os.Environ()...)
 	setting.InitWorkPathAndCfgProvider(os.Getenv, setting.ArgWorkPathAndCustomConf{
--- a/contrib/upgrade.sh
+++ b/contrib/upgrade.sh
@@ -85,7 +85,7 @@ fi
 # confirm update
 echo "Checking currently installed version..."
 current=$(giteacmd --version | cut -d ' ' -f 3)
-[[ "$current" == "$giteaversion" ]] && echo "$current is already installed, stopping." && exit 0
+[[ "$current" == "$giteaversion" ]] && echo "$current is already installed, stopping." && exit 1
 if [[ -z "${no_confirm:-}"  ]]; then
  echo "Make sure to read the changelog first: https://github.com/go-gitea/gitea/blob/main/CHANGELOG.md"
  echo "Are you ready to update Gitea from ${current} to ${giteaversion}? (y/N)"
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -186,13 +186,17 @@ RUN_USER = ; git
 ;; If you intend to use the AuthorizedPrincipalsCommand functionality then you should turn this off.
 ;SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE = true
 ;;
-;; For the builtin SSH server, choose the supported ciphers/key-exchange-algorithms/MACs for SSH connections.
-;; The supported names are listed in https://github.com/golang/crypto/blob/master/ssh/common.go.
-;; Leave them empty to use the Golang crypto's recommended default values.
-;; For system SSH (non-builtin SSH server), this setting has no effect.
-;SSH_SERVER_CIPHERS =
-;SSH_SERVER_KEY_EXCHANGES =
-;SSH_SERVER_MACS =
+;; For the built-in SSH server, choose the ciphers to support for SSH connections,
+;; for system SSH this setting has no effect
+;SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
+;;
+;; For the built-in SSH server, choose the key exchange algorithms to support for SSH connections,
+;; for system SSH this setting has no effect
+;SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1
+;;
+;; For the built-in SSH server, choose the MACs to support for SSH connections,
+;; for system SSH this setting has no effect
+;SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1
 ;;
 ;; For the built-in SSH server, choose the keypair to offer as the host key
 ;; The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub
@@ -1186,24 +1190,17 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;; GPG or SSH key to use to sign commits, Defaults to the default - that is the value of git config --get user.signingkey
-;; Depending on the value of SIGNING_FORMAT this is either:
-;; - openpgp: the GPG key ID
-;; - ssh: the path to the ssh public key "/path/to/key.pub": where "/path/to/key" is the private key, use ssh-keygen -t ed25519 to generate a new key pair without password
+;; GPG key to use to sign commits, Defaults to the default - that is the value of git config --get user.signingkey
 ;; run in the context of the RUN_USER
 ;; Switch to none to stop signing completely
 ;SIGNING_KEY = default
 ;;
-;; If a SIGNING_KEY ID is provided and is not set to default, use the provided Name and Email address as the signer and the signing format.
+;; If a SIGNING_KEY ID is provided and is not set to default, use the provided Name and Email address as the signer.
 ;; These should match a publicized name and email address for the key. (When SIGNING_KEY is default these are set to
-;; the results of git config --get user.name, git config --get user.email and git config --default openpgp --get gpg.format respectively and can only be overridden
+;; the results of git config --get user.name and git config --get user.email respectively and can only be overridden
 ;; by setting the SIGNING_KEY ID to the correct ID.)
 ;SIGNING_NAME =
 ;SIGNING_EMAIL =
-;; SIGNING_FORMAT can be one of:
-;; - openpgp (default): use GPG to sign commits
-;; - ssh: use SSH to sign commits
-;SIGNING_FORMAT = openpgp
 ;;
 ;; Sets the default trust model for repositories. Options are: collaborator, committer, collaboratorcommitter
 ;DEFAULT_TRUST_MODEL = collaborator
@@ -1230,13 +1227,6 @@ LEVEL = Info
 ;; - commitssigned: require that all the commits in the head branch are signed.
 ;; - approved: only sign when merging an approved pr to a protected branch
 ;MERGES = pubkey, twofa, basesigned, commitssigned
-;;
-;; Determines which additional ssh keys are trusted for all signed commits regardless of the user
-;; This is useful for ssh signing key rotation.
-;; Exposes the provided SIGNING_NAME and SIGNING_EMAIL as the signer, regardless of the SIGNING_FORMAT value.
-;; Multiple keys should be comma separated.
-;; E.g."ssh-<algorithm> <key>". or "ssh-<algorithm> <key1>, ssh-<algorithm> <key2>".
-;TRUSTED_SSH_KEYS =

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1755186698,
-        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
+        "lastModified": 1739214665,
+        "narHash": "sha256-26L8VAu3/1YRxS8MHgBOyOM8xALdo6N0I04PgorE7UM=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
+        "rev": "64e75cd44acf21c7933d61d7721e812eac1b5a0a",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -11,58 +11,33 @@
        pkgs = nixpkgs.legacyPackages.${system};
      in
      {
-        devShells.default =
-          with pkgs;
-          let
-            # only bump toolchain versions here
-            go = go_1_25;
-            nodejs = nodejs_24;
-            python3 = python312;
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            # generic
+            git
+            git-lfs
+            gnumake
+            gnused
+            gnutar
+            gzip

-            # Platform-specific dependencies
-            linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
-              glibc.static
-            ];
+            # frontend
+            nodejs_22

-            linuxOnlyEnv = lib.optionalAttrs pkgs.stdenv.isLinux {
-              CFLAGS = "-I${glibc.static.dev}/include";
-              LDFLAGS = "-L ${glibc.static}/lib";
-            };
-          in
-          pkgs.mkShell (
-            {
-              buildInputs = [
-                # generic
-                git
-                git-lfs
-                gnumake
-                gnused
-                gnutar
-                gzip
-                zip
+            # linting
+            python312
+            poetry

-                # frontend
-                nodejs
-
-                # linting
-                python3
-                uv
-
-                # backend
-                go
-                gofumpt
-                sqlite
-              ]
-              ++ linuxOnlyInputs;
-
-              GO = "${go}/bin/go";
-              GOROOT = "${go}/share/go";
-
-              TAGS = "sqlite sqlite_unlock_notify";
-              STATIC = "true";
-            }
-            // linuxOnlyEnv
-          );
+            # backend
+            go_1_24
+            gofumpt
+            sqlite
+          ];
+          shellHook = ''
+            export GO="${pkgs.go_1_24}/bin/go"
+            export GOROOT="${pkgs.go_1_24}/share/go"
+          '';
+        };
      }
    );
 }
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module code.gitea.io/gitea

-go 1.24.6
+go 1.24

 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate."
 // But some CAs use negative serial number, just relax the check. related:
@@ -10,7 +10,7 @@ godebug x509negativeserial=1
 require (
 	code.gitea.io/actions-proto-go v0.4.1
 	code.gitea.io/gitea-vet v0.2.3
-	code.gitea.io/sdk/gitea v0.22.0
+	code.gitea.io/sdk/gitea v0.21.0
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
 	connectrpc.com/connect v1.18.1
 	gitea.com/go-chi/binding v0.0.0-20240430071103-39a851e106ed
@@ -19,28 +19,28 @@ require (
 	gitea.com/go-chi/session v0.0.0-20240316035857-16768d98ec96
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
-	github.com/42wim/httpsig v1.2.3
-	github.com/42wim/sshsig v0.0.0-20250502153856-5100632e8920
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.0
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2
+	github.com/42wim/httpsig v1.2.2
+	github.com/42wim/sshsig v0.0.0-20240818000253-e3a6333df815
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.0
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358
-	github.com/ProtonMail/go-crypto v1.3.0
+	github.com/ProtonMail/go-crypto v1.2.0
 	github.com/PuerkitoBio/goquery v1.10.3
-	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0
-	github.com/alecthomas/chroma/v2 v2.20.0
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.32.2
+	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.7.3
+	github.com/alecthomas/chroma/v2 v2.17.0
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.67
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.28.2
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/blevesearch/bleve/v2 v2.5.3
+	github.com/blevesearch/bleve/v2 v2.5.0
 	github.com/bohde/codel v0.2.0
 	github.com/buildkite/terminal-to-html/v3 v3.16.8
-	github.com/caddyserver/certmagic v0.24.0
+	github.com/caddyserver/certmagic v0.23.0
 	github.com/charmbracelet/git-lfs-transfer v0.2.0
 	github.com/chi-middleware/proxy v1.1.1
 	github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21
 	github.com/djherbis/buffer v1.2.0
 	github.com/djherbis/nio/v3 v3.0.1
-	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
+	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5
 	github.com/dustin/go-humanize v1.0.1
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.3
 	github.com/emersion/go-imap v1.2.1
@@ -49,25 +49,26 @@ require (
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/gliderlabs/ssh v0.3.8
-	github.com/go-ap/activitypub v0.0.0-20250810115208-cb73b20a1742
+	github.com/go-ap/activitypub v0.0.0-20250409143848-7113328b1f3d
 	github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73
-	github.com/go-chi/chi/v5 v5.2.3
-	github.com/go-chi/cors v1.2.2
+	github.com/go-chi/chi/v5 v5.2.1
+	github.com/go-chi/cors v1.2.1
 	github.com/go-co-op/gocron v1.37.0
 	github.com/go-enry/go-enry/v2 v2.9.2
 	github.com/go-git/go-billy/v5 v5.6.2
-	github.com/go-git/go-git/v5 v5.16.2
+	github.com/go-git/go-git/v5 v5.16.0
 	github.com/go-ldap/ldap/v3 v3.4.11
 	github.com/go-redsync/redsync/v4 v4.13.0
-	github.com/go-sql-driver/mysql v1.9.3
-	github.com/go-webauthn/webauthn v0.13.4
+	github.com/go-sql-driver/mysql v1.9.2
+	github.com/go-swagger/go-swagger v0.31.0
+	github.com/go-webauthn/webauthn v0.12.3
 	github.com/gobwas/glob v0.2.3
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
-	github.com/golang-jwt/jwt/v5 v5.3.0
-	github.com/google/go-github/v74 v74.0.0
+	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/google/go-github/v61 v61.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6
+	github.com/google/pprof v0.0.0-20250422154841-e1f9c1950416
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
@@ -79,103 +80,104 @@ require (
 	github.com/json-iterator/go v1.1.12
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/klauspost/compress v1.18.0
-	github.com/klauspost/cpuid/v2 v2.3.0
+	github.com/klauspost/cpuid/v2 v2.2.10
 	github.com/lib/pq v1.10.9
-	github.com/markbates/goth v1.82.0
+	github.com/markbates/goth v1.81.0
 	github.com/mattn/go-isatty v0.0.20
-	github.com/mattn/go-sqlite3 v1.14.32
-	github.com/meilisearch/meilisearch-go v0.33.2
-	github.com/mholt/archives v0.1.3
+	github.com/mattn/go-sqlite3 v1.14.28
+	github.com/meilisearch/meilisearch-go v0.31.0
+	github.com/mholt/archiver/v3 v3.5.1
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/microsoft/go-mssqldb v1.9.3
-	github.com/minio/minio-go/v7 v7.0.95
+	github.com/microsoft/go-mssqldb v1.8.0
+	github.com/minio/minio-go/v7 v7.0.91
 	github.com/msteinert/pam v1.2.0
 	github.com/nektos/act v0.2.63
-	github.com/niklasfasching/go-org v1.9.1
+	github.com/niklasfasching/go-org v1.7.0
 	github.com/olivere/elastic/v7 v7.0.32
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pkg/errors v0.9.1
-	github.com/pquerna/otp v1.5.0
-	github.com/prometheus/client_golang v1.23.0
+	github.com/pquerna/otp v1.4.0
+	github.com/prometheus/client_golang v1.22.0
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.12.1
+	github.com/redis/go-redis/v9 v9.7.3
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
 	github.com/sassoftware/go-rpmutils v0.4.0
-	github.com/sergi/go-diff v1.4.0
-	github.com/stretchr/testify v1.11.1
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
+	github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92
+	github.com/stretchr/testify v1.10.0
 	github.com/syndtr/goleveldb v1.0.0
 	github.com/tstranex/u2f v1.0.0
-	github.com/ulikunitz/xz v0.5.15
-	github.com/urfave/cli-docs/v3 v3.0.0-alpha6
-	github.com/urfave/cli/v3 v3.4.1
+	github.com/ulikunitz/xz v0.5.12
+	github.com/urfave/cli/v2 v2.27.6
 	github.com/wneessen/go-mail v0.6.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/yohcop/openid-go v1.0.1
-	github.com/yuin/goldmark v1.7.13
+	github.com/yuin/goldmark v1.7.10
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	github.com/yuin/goldmark-meta v1.1.0
-	gitlab.com/gitlab-org/api/client-go v0.142.4
-	golang.org/x/crypto v0.41.0
-	golang.org/x/image v0.30.0
-	golang.org/x/net v0.43.0
-	golang.org/x/oauth2 v0.30.0
-	golang.org/x/sync v0.16.0
-	golang.org/x/sys v0.35.0
-	golang.org/x/text v0.28.0
-	google.golang.org/grpc v1.75.0
-	google.golang.org/protobuf v1.36.8
+	gitlab.com/gitlab-org/api/client-go v0.127.0
+	golang.org/x/crypto v0.37.0
+	golang.org/x/image v0.26.0
+	golang.org/x/net v0.39.0
+	golang.org/x/oauth2 v0.29.0
+	golang.org/x/sync v0.13.0
+	golang.org/x/sys v0.32.0
+	golang.org/x/text v0.24.0
+	golang.org/x/tools v0.32.0
+	google.golang.org/grpc v1.72.0
+	google.golang.org/protobuf v1.36.6
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v3 v3.0.1
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20191008002943-06d1c002b251
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.3.10
+	xorm.io/xorm v1.3.9
 )

 require (
-	cloud.google.com/go/compute/metadata v0.8.0 // indirect
-	dario.cat/mergo v1.0.2 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	dario.cat/mergo v1.0.1 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
 	github.com/DataDog/zstd v1.5.7 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/RoaringBitmap/roaring/v2 v2.10.0 // indirect
-	github.com/STARRY-S/zip v0.2.1 // indirect
-	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.4.5 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
-	github.com/aws/aws-sdk-go-v2 v1.38.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 // indirect
-	github.com/aws/smithy-go v1.23.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.36.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
+	github.com/aws/smithy-go v1.22.3 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.24.0 // indirect
-	github.com/blevesearch/bleve_index_api v1.2.9 // indirect
-	github.com/blevesearch/geo v0.2.4 // indirect
+	github.com/bits-and-blooms/bitset v1.22.0 // indirect
+	github.com/blevesearch/bleve_index_api v1.2.8 // indirect
+	github.com/blevesearch/geo v0.2.0 // indirect
 	github.com/blevesearch/go-faiss v1.0.25 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.0.4 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.3.11 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.3.10 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
 	github.com/blevesearch/vellum v1.1.0 // indirect
-	github.com/blevesearch/zapx/v11 v11.4.2 // indirect
-	github.com/blevesearch/zapx/v12 v12.4.2 // indirect
-	github.com/blevesearch/zapx/v13 v13.4.2 // indirect
-	github.com/blevesearch/zapx/v14 v14.4.2 // indirect
-	github.com/blevesearch/zapx/v15 v15.4.2 // indirect
-	github.com/blevesearch/zapx/v16 v16.2.4 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
-	github.com/bodgit/plumbing v1.3.0 // indirect
-	github.com/bodgit/sevenzip v1.6.0 // indirect
-	github.com/bodgit/windows v1.0.1 // indirect
-	github.com/boombuler/barcode v1.1.0 // indirect
+	github.com/blevesearch/zapx/v11 v11.4.1 // indirect
+	github.com/blevesearch/zapx/v12 v12.4.1 // indirect
+	github.com/blevesearch/zapx/v13 v13.4.1 // indirect
+	github.com/blevesearch/zapx/v14 v14.4.1 // indirect
+	github.com/blevesearch/zapx/v15 v15.4.1 // indirect
+	github.com/blevesearch/zapx/v16 v16.2.3 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
+	github.com/boombuler/barcode v1.0.2 // indirect
 	github.com/bradfitz/gomemcache v0.0.0-20250403215159-8d39553ac7cf // indirect
 	github.com/caddyserver/zerossl v0.1.3 // indirect
 	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
@@ -184,7 +186,7 @@ require (
 	github.com/couchbase/go-couchbase v0.1.1 // indirect
 	github.com/couchbase/gomemcached v0.3.3 // indirect
 	github.com/couchbase/goutils v0.1.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
@@ -192,15 +194,28 @@ require (
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
-	github.com/go-ap/errors v0.0.0-20250527110557-c8db454e53fd // indirect
+	github.com/go-ap/errors v0.0.0-20250409143711-5686c11ae650 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
 	github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/go-webauthn/x v0.1.24 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/inflect v0.21.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-webauthn/x v0.1.20 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
@@ -211,58 +226,69 @@ require (
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/flatbuffers v25.2.10+incompatible // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/go-tpm v0.9.5 // indirect
+	github.com/google/go-tpm v0.9.3 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
+	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/jessevdk/go-flags v1.6.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/kevinburke/ssh_config v1.4.0 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
-	github.com/libdns/libdns v1.1.1 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/libdns/libdns v1.0.0-beta.1 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mholt/acmez/v3 v3.1.2 // indirect
-	github.com/miekg/dns v1.1.68 // indirect
-	github.com/mikelolasagasti/xz v1.0.1 // indirect
-	github.com/minio/crc64nvme v1.1.1 // indirect
+	github.com/miekg/dns v1.1.65 // indirect
+	github.com/minio/crc64nvme v1.0.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minlz v1.0.0 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nwaples/rardecode/v2 v2.1.0 // indirect
-	github.com/olekukonko/cat v0.0.0-20250817074551-3280053e4e00 // indirect
-	github.com/olekukonko/errors v1.1.0 // indirect
-	github.com/olekukonko/ll v0.1.0 // indirect
-	github.com/olekukonko/tablewriter v1.0.9 // indirect
+	github.com/nwaples/rardecode v1.1.3 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
-	github.com/philhofer/fwd v1.2.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
-	github.com/pjbgf/sha1cd v0.4.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.65.0 // indirect
-	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rhysd/actionlint v1.7.7 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.9.0 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/sorairolake/lzip-go v0.3.5 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.14.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/viper v1.20.1 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
-	github.com/tinylib/msgp v1.4.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/toqueteos/webbrowser v1.2.0 // indirect
 	github.com/unknwon/com v1.0.1 // indirect
 	github.com/valyala/fastjson v1.6.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -270,32 +296,35 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	github.com/zeebo/assert v1.3.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.etcd.io/bbolt v1.4.3 // indirect
+	go.etcd.io/bbolt v1.4.0 // indirect
+	go.mongodb.org/mongo-driver v1.17.3 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
-	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250422160041-2d3770c4ea7f // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

-replace github.com/jaytaylor/html2text => github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347
-
 replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1

-replace github.com/nektos/act => gitea.com/gitea/act v0.261.6
+replace github.com/shurcooL/vfsgen => github.com/lunny/vfsgen v0.0.0-20220105142115-2c99e1ffdfa0
+
+replace github.com/nektos/act => gitea.com/gitea/act v0.261.4

 // TODO: the only difference is in `PutObject`: the fork doesn't use `NewVerifyingReader(r, sha256.New(), oid, expectedSize)`, need to figure out why
 replace github.com/charmbracelet/git-lfs-transfer => gitea.com/gitea/git-lfs-transfer v0.2.0

+// TODO: This could be removed after https://github.com/mholt/archiver/pull/396 merged
+replace github.com/mholt/archiver/v3 => github.com/anchore/archiver/v3 v3.5.2
+
 replace git.sr.ht/~mariusor/go-xsd-duration => gitea.com/gitea/go-xsd-duration v0.0.0-20220703122237-02e73435a078

 exclude github.com/gofrs/uuid v3.2.0+incompatible
--- a/go.sum
+++ b/go.sum
--- a/main.go
+++ b/main.go
@@ -21,7 +21,7 @@ import (
 	_ "code.gitea.io/gitea/modules/markup/markdown"
 	_ "code.gitea.io/gitea/modules/markup/orgmode"

-	"github.com/urfave/cli/v3"
+	"github.com/urfave/cli/v2"
 )

 // these flags will be set by the build flags
--- a/models/actions/run.go
+++ b/models/actions/run.go
@@ -16,7 +16,6 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
@@ -166,24 +165,12 @@ func (run *ActionRun) GetPullRequestEventPayload() (*api.PullRequestPayload, err
 	return nil, fmt.Errorf("event %s is not a pull request event", run.Event)
 }

-func (run *ActionRun) GetWorkflowRunEventPayload() (*api.WorkflowRunPayload, error) {
-	if run.Event == webhook_module.HookEventWorkflowRun {
-		var payload api.WorkflowRunPayload
-		if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
-			return nil, err
-		}
-		return &payload, nil
-	}
-	return nil, fmt.Errorf("event %s is not a workflow run event", run.Event)
-}
-
 func (run *ActionRun) IsSchedule() bool {
 	return run.ScheduleID > 0
 }

 func updateRepoRunsNumbers(ctx context.Context, repo *repo_model.Repository) error {
 	_, err := db.GetEngine(ctx).ID(repo.ID).
-		NoAutoTime().
 		SetExpr("num_action_runs",
 			builder.Select("count(*)").From("action_run").
 				Where(builder.Eq{"repo_id": repo.ID}),
@@ -282,81 +269,86 @@ func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID strin
 // InsertRun inserts a run
 // The title will be cut off at 255 characters if it's longer than 255 characters.
 func InsertRun(ctx context.Context, run *ActionRun, jobs []*jobparser.SingleWorkflow) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		index, err := db.GetNextResourceIndex(ctx, "action_run_index", run.RepoID)
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return err
+	}
+	defer committer.Close()
+
+	index, err := db.GetNextResourceIndex(ctx, "action_run_index", run.RepoID)
+	if err != nil {
+		return err
+	}
+	run.Index = index
+	run.Title = util.EllipsisDisplayString(run.Title, 255)
+
+	if err := db.Insert(ctx, run); err != nil {
+		return err
+	}
+
+	if run.Repo == nil {
+		repo, err := repo_model.GetRepositoryByID(ctx, run.RepoID)
 		if err != nil {
 			return err
 		}
-		run.Index = index
-		run.Title = util.EllipsisDisplayString(run.Title, 255)
+		run.Repo = repo
+	}

-		if err := db.Insert(ctx, run); err != nil {
+	if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
+		return err
+	}
+
+	runJobs := make([]*ActionRunJob, 0, len(jobs))
+	var hasWaiting bool
+	for _, v := range jobs {
+		id, job := v.Job()
+		needs := job.Needs()
+		if err := v.SetJob(id, job.EraseNeeds()); err != nil {
 			return err
 		}
-
-		if run.Repo == nil {
-			repo, err := repo_model.GetRepositoryByID(ctx, run.RepoID)
-			if err != nil {
-				return err
-			}
-			run.Repo = repo
+		payload, _ := v.Marshal()
+		status := StatusWaiting
+		if len(needs) > 0 || run.NeedApproval {
+			status = StatusBlocked
+		} else {
+			hasWaiting = true
 		}
+		job.Name = util.EllipsisDisplayString(job.Name, 255)
+		runJobs = append(runJobs, &ActionRunJob{
+			RunID:             run.ID,
+			RepoID:            run.RepoID,
+			OwnerID:           run.OwnerID,
+			CommitSHA:         run.CommitSHA,
+			IsForkPullRequest: run.IsForkPullRequest,
+			Name:              job.Name,
+			WorkflowPayload:   payload,
+			JobID:             id,
+			Needs:             needs,
+			RunsOn:            job.RunsOn(),
+			Status:            status,
+		})
+	}
+	if err := db.Insert(ctx, runJobs); err != nil {
+		return err
+	}

-		if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
+	// if there is a job in the waiting status, increase tasks version.
+	if hasWaiting {
+		if err := IncreaseTaskVersion(ctx, run.OwnerID, run.RepoID); err != nil {
 			return err
 		}
+	}

-		runJobs := make([]*ActionRunJob, 0, len(jobs))
-		var hasWaiting bool
-		for _, v := range jobs {
-			id, job := v.Job()
-			needs := job.Needs()
-			if err := v.SetJob(id, job.EraseNeeds()); err != nil {
-				return err
-			}
-			payload, _ := v.Marshal()
-			status := StatusWaiting
-			if len(needs) > 0 || run.NeedApproval {
-				status = StatusBlocked
-			} else {
-				hasWaiting = true
-			}
-			job.Name = util.EllipsisDisplayString(job.Name, 255)
-			runJobs = append(runJobs, &ActionRunJob{
-				RunID:             run.ID,
-				RepoID:            run.RepoID,
-				OwnerID:           run.OwnerID,
-				CommitSHA:         run.CommitSHA,
-				IsForkPullRequest: run.IsForkPullRequest,
-				Name:              job.Name,
-				WorkflowPayload:   payload,
-				JobID:             id,
-				Needs:             needs,
-				RunsOn:            job.RunsOn(),
-				Status:            status,
-			})
-		}
-		if err := db.Insert(ctx, runJobs); err != nil {
-			return err
-		}
-
-		// if there is a job in the waiting status, increase tasks version.
-		if hasWaiting {
-			if err := IncreaseTaskVersion(ctx, run.OwnerID, run.RepoID); err != nil {
-				return err
-			}
-		}
-		return nil
-	})
+	return committer.Commit()
 }

-func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, error) {
+func GetRunByID(ctx context.Context, id int64) (*ActionRun, error) {
 	var run ActionRun
-	has, err := db.GetEngine(ctx).Where("id=? AND repo_id=?", runID, repoID).Get(&run)
+	has, err := db.GetEngine(ctx).Where("id=?", id).Get(&run)
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, fmt.Errorf("run with id %d: %w", runID, util.ErrNotExist)
+		return nil, fmt.Errorf("run with id %d: %w", id, util.ErrNotExist)
 	}

 	return &run, nil
@@ -427,10 +419,17 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {

 	if run.Status != 0 || slices.Contains(cols, "status") {
 		if run.RepoID == 0 {
-			setting.PanicInDevOrTesting("RepoID should not be 0")
+			run, err = GetRunByID(ctx, run.ID)
+			if err != nil {
+				return err
+			}
 		}
-		if err = run.LoadRepo(ctx); err != nil {
-			return err
+		if run.Repo == nil {
+			repo, err := repo_model.GetRepositoryByID(ctx, run.RepoID)
+			if err != nil {
+				return err
+			}
+			run.Repo = repo
 		}
 		if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
 			return err
--- a/models/actions/run_job.go
+++ b/models/actions/run_job.go
@@ -51,7 +51,7 @@ func (job *ActionRunJob) Duration() time.Duration {

 func (job *ActionRunJob) LoadRun(ctx context.Context) error {
 	if job.Run == nil {
-		run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+		run, err := GetRunByID(ctx, job.RunID)
 		if err != nil {
 			return err
 		}
@@ -142,7 +142,7 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 	{
 		// Other goroutines may aggregate the status of the run and update it too.
 		// So we need load the run and its jobs before updating the run.
-		run, err := GetRunByRepoAndID(ctx, job.RepoID, job.RunID)
+		run, err := GetRunByID(ctx, job.RunID)
 		if err != nil {
 			return 0, err
 		}
@@ -185,12 +185,12 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
 		return StatusSuccess
 	case hasCancelled:
 		return StatusCancelled
+	case hasFailure:
+		return StatusFailure
 	case hasRunning:
 		return StatusRunning
 	case hasWaiting:
 		return StatusWaiting
-	case hasFailure:
-		return StatusFailure
 	case hasBlocked:
 		return StatusBlocked
 	default:
--- a/models/actions/run_job_list.go
+++ b/models/actions/run_job_list.go
@@ -80,31 +80,22 @@ type FindRunJobOptions struct {
 func (opts FindRunJobOptions) ToConds() builder.Cond {
 	cond := builder.NewCond()
 	if opts.RunID > 0 {
-		cond = cond.And(builder.Eq{"`action_run_job`.run_id": opts.RunID})
+		cond = cond.And(builder.Eq{"run_id": opts.RunID})
 	}
 	if opts.RepoID > 0 {
-		cond = cond.And(builder.Eq{"`action_run_job`.repo_id": opts.RepoID})
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	if opts.OwnerID > 0 {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.CommitSHA != "" {
-		cond = cond.And(builder.Eq{"`action_run_job`.commit_sha": opts.CommitSHA})
+		cond = cond.And(builder.Eq{"commit_sha": opts.CommitSHA})
 	}
 	if len(opts.Statuses) > 0 {
-		cond = cond.And(builder.In("`action_run_job`.status", opts.Statuses))
+		cond = cond.And(builder.In("status", opts.Statuses))
 	}
 	if opts.UpdatedBefore > 0 {
-		cond = cond.And(builder.Lt{"`action_run_job`.updated": opts.UpdatedBefore})
+		cond = cond.And(builder.Lt{"updated": opts.UpdatedBefore})
 	}
 	return cond
 }
-
-func (opts FindRunJobOptions) ToJoins() []db.JoinFunc {
-	if opts.OwnerID > 0 {
-		return []db.JoinFunc{
-			func(sess db.Engine) error {
-				sess.Join("INNER", "repository", "repository.id = repo_id AND repository.owner_id = ?", opts.OwnerID)
-				return nil
-			},
-		}
-	}
-	return nil
-}
--- a/models/actions/run_job_status_test.go
+++ b/models/actions/run_job_status_test.go
@@ -58,14 +58,14 @@ func TestAggregateJobStatus(t *testing.T) {
 		{[]Status{StatusCancelled, StatusRunning}, StatusCancelled},
 		{[]Status{StatusCancelled, StatusBlocked}, StatusCancelled},

-		// failure with other status, usually fail fast, but "running" wins to match GitHub's behavior
-		// another reason that we can't make "failure" wins over "running": it would cause a weird behavior that user cannot cancel a workflow or get current running workflows correctly by filter after a job fail.
+		// failure with other status, fail fast
+		// Should "running" win? Maybe no: old code does make "running" win, but GitHub does fail fast.
 		{[]Status{StatusFailure}, StatusFailure},
 		{[]Status{StatusFailure, StatusSuccess}, StatusFailure},
 		{[]Status{StatusFailure, StatusSkipped}, StatusFailure},
 		{[]Status{StatusFailure, StatusCancelled}, StatusCancelled},
-		{[]Status{StatusFailure, StatusWaiting}, StatusWaiting},
-		{[]Status{StatusFailure, StatusRunning}, StatusRunning},
+		{[]Status{StatusFailure, StatusWaiting}, StatusFailure},
+		{[]Status{StatusFailure, StatusRunning}, StatusFailure},
 		{[]Status{StatusFailure, StatusBlocked}, StatusFailure},

 		// skipped with other status
--- a/models/actions/run_list.go
+++ b/models/actions/run_list.go
@@ -72,50 +72,39 @@ type FindRunOptions struct {
 	TriggerEvent  webhook_module.HookEventType
 	Approved      bool // not util.OptionalBool, it works only when it's true
 	Status        []Status
-	CommitSHA     string
 }

 func (opts FindRunOptions) ToConds() builder.Cond {
 	cond := builder.NewCond()
 	if opts.RepoID > 0 {
-		cond = cond.And(builder.Eq{"`action_run`.repo_id": opts.RepoID})
+		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	}
+	if opts.OwnerID > 0 {
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
 	if opts.WorkflowID != "" {
-		cond = cond.And(builder.Eq{"`action_run`.workflow_id": opts.WorkflowID})
+		cond = cond.And(builder.Eq{"workflow_id": opts.WorkflowID})
 	}
 	if opts.TriggerUserID > 0 {
-		cond = cond.And(builder.Eq{"`action_run`.trigger_user_id": opts.TriggerUserID})
+		cond = cond.And(builder.Eq{"trigger_user_id": opts.TriggerUserID})
 	}
 	if opts.Approved {
-		cond = cond.And(builder.Gt{"`action_run`.approved_by": 0})
+		cond = cond.And(builder.Gt{"approved_by": 0})
 	}
 	if len(opts.Status) > 0 {
-		cond = cond.And(builder.In("`action_run`.status", opts.Status))
+		cond = cond.And(builder.In("status", opts.Status))
 	}
 	if opts.Ref != "" {
-		cond = cond.And(builder.Eq{"`action_run`.ref": opts.Ref})
+		cond = cond.And(builder.Eq{"ref": opts.Ref})
 	}
 	if opts.TriggerEvent != "" {
-		cond = cond.And(builder.Eq{"`action_run`.trigger_event": opts.TriggerEvent})
-	}
-	if opts.CommitSHA != "" {
-		cond = cond.And(builder.Eq{"`action_run`.commit_sha": opts.CommitSHA})
+		cond = cond.And(builder.Eq{"trigger_event": opts.TriggerEvent})
 	}
 	return cond
 }

-func (opts FindRunOptions) ToJoins() []db.JoinFunc {
-	if opts.OwnerID > 0 {
-		return []db.JoinFunc{func(sess db.Engine) error {
-			sess.Join("INNER", "repository", "repository.id = repo_id AND repository.owner_id = ?", opts.OwnerID)
-			return nil
-		}}
-	}
-	return nil
-}
-
 func (opts FindRunOptions) ToOrders() string {
-	return "`action_run`.`id` DESC"
+	return "`id` DESC"
 }

 type StatusInfo struct {
--- a/models/actions/runner.go
+++ b/models/actions/runner.go
@@ -5,7 +5,6 @@ package actions

 import (
 	"context"
-	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -299,23 +298,6 @@ func DeleteRunner(ctx context.Context, id int64) error {
 	return err
 }

-// DeleteEphemeralRunner deletes a ephemeral runner by given ID.
-func DeleteEphemeralRunner(ctx context.Context, id int64) error {
-	runner, err := GetRunnerByID(ctx, id)
-	if err != nil {
-		if errors.Is(err, util.ErrNotExist) {
-			return nil
-		}
-		return err
-	}
-	if !runner.Ephemeral {
-		return nil
-	}
-
-	_, err = db.DeleteByID[ActionRunner](ctx, id)
-	return err
-}
-
 // CreateRunner creates new runner.
 func CreateRunner(ctx context.Context, t *ActionRunner) error {
 	if t.OwnerID != 0 && t.RepoID != 0 {
--- a/models/actions/runner_token_test.go
+++ b/models/actions/runner_token_test.go
@@ -6,6 +6,7 @@ package actions
 import (
 	"testing"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/unittest"

 	"github.com/stretchr/testify/assert"
@@ -14,16 +15,16 @@ import (
 func TestGetLatestRunnerToken(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	token := unittest.AssertExistsAndLoadBean(t, &ActionRunnerToken{ID: 3})
-	expectedToken, err := GetLatestRunnerToken(t.Context(), 1, 0)
+	expectedToken, err := GetLatestRunnerToken(db.DefaultContext, 1, 0)
 	assert.NoError(t, err)
 	assert.Equal(t, expectedToken, token)
 }

 func TestNewRunnerToken(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	token, err := NewRunnerToken(t.Context(), 1, 0)
+	token, err := NewRunnerToken(db.DefaultContext, 1, 0)
 	assert.NoError(t, err)
-	expectedToken, err := GetLatestRunnerToken(t.Context(), 1, 0)
+	expectedToken, err := GetLatestRunnerToken(db.DefaultContext, 1, 0)
 	assert.NoError(t, err)
 	assert.Equal(t, expectedToken, token)
 }
@@ -32,8 +33,8 @@ func TestUpdateRunnerToken(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	token := unittest.AssertExistsAndLoadBean(t, &ActionRunnerToken{ID: 3})
 	token.IsActive = true
-	assert.NoError(t, UpdateRunnerToken(t.Context(), token))
-	expectedToken, err := GetLatestRunnerToken(t.Context(), 1, 0)
+	assert.NoError(t, UpdateRunnerToken(db.DefaultContext, token))
+	expectedToken, err := GetLatestRunnerToken(db.DefaultContext, 1, 0)
 	assert.NoError(t, err)
 	assert.Equal(t, expectedToken, token)
 }
--- a/models/actions/schedule.go
+++ b/models/actions/schedule.go
@@ -56,54 +56,65 @@ func CreateScheduleTask(ctx context.Context, rows []*ActionSchedule) error {
 		return nil
 	}

-	return db.WithTx(ctx, func(ctx context.Context) error {
-		// Loop through each schedule row
-		for _, row := range rows {
-			row.Title = util.EllipsisDisplayString(row.Title, 255)
-			// Create new schedule row
-			if err := db.Insert(ctx, row); err != nil {
+	// Begin transaction
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return err
+	}
+	defer committer.Close()
+
+	// Loop through each schedule row
+	for _, row := range rows {
+		row.Title = util.EllipsisDisplayString(row.Title, 255)
+		// Create new schedule row
+		if err = db.Insert(ctx, row); err != nil {
+			return err
+		}
+
+		// Loop through each schedule spec and create a new spec row
+		now := time.Now()
+
+		for _, spec := range row.Specs {
+			specRow := &ActionScheduleSpec{
+				RepoID:     row.RepoID,
+				ScheduleID: row.ID,
+				Spec:       spec,
+			}
+			// Parse the spec and check for errors
+			schedule, err := specRow.Parse()
+			if err != nil {
+				continue // skip to the next spec if there's an error
+			}
+
+			specRow.Next = timeutil.TimeStamp(schedule.Next(now).Unix())
+
+			// Insert the new schedule spec row
+			if err = db.Insert(ctx, specRow); err != nil {
 				return err
 			}
-
-			// Loop through each schedule spec and create a new spec row
-			now := time.Now()
-
-			for _, spec := range row.Specs {
-				specRow := &ActionScheduleSpec{
-					RepoID:     row.RepoID,
-					ScheduleID: row.ID,
-					Spec:       spec,
-				}
-				// Parse the spec and check for errors
-				schedule, err := specRow.Parse()
-				if err != nil {
-					continue // skip to the next spec if there's an error
-				}
-
-				specRow.Next = timeutil.TimeStamp(schedule.Next(now).Unix())
-
-				// Insert the new schedule spec row
-				if err = db.Insert(ctx, specRow); err != nil {
-					return err
-				}
-			}
 		}
-		return nil
-	})
+	}
+
+	// Commit transaction
+	return committer.Commit()
 }

 func DeleteScheduleTaskByRepo(ctx context.Context, id int64) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		if _, err := db.GetEngine(ctx).Delete(&ActionSchedule{RepoID: id}); err != nil {
-			return err
-		}
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return err
+	}
+	defer committer.Close()

-		if _, err := db.GetEngine(ctx).Delete(&ActionScheduleSpec{RepoID: id}); err != nil {
-			return err
-		}
+	if _, err := db.GetEngine(ctx).Delete(&ActionSchedule{RepoID: id}); err != nil {
+		return err
+	}

-		return nil
-	})
+	if _, err := db.GetEngine(ctx).Delete(&ActionScheduleSpec{RepoID: id}); err != nil {
+		return err
+	}
+
+	return committer.Commit()
 }

 func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository) ([]*ActionRunJob, error) {
--- a/models/actions/status.go
+++ b/models/actions/status.go
@@ -4,8 +4,6 @@
 package actions

 import (
-	"slices"
-
 	"code.gitea.io/gitea/modules/translation"

 	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
@@ -90,7 +88,12 @@ func (s Status) IsBlocked() bool {

 // In returns whether s is one of the given statuses
 func (s Status) In(statuses ...Status) bool {
-	return slices.Contains(statuses, s)
+	for _, v := range statuses {
+		if s == v {
+			return true
+		}
+	}
+	return false
 }

 func (s Status) AsResult() runnerv1.Result {
--- a/models/actions/task.go
+++ b/models/actions/task.go
@@ -278,13 +278,14 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 		return nil, false, err
 	}

-	parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
-	if err != nil {
+	var workflowJob *jobparser.Job
+	if gots, err := jobparser.Parse(job.WorkflowPayload); err != nil {
 		return nil, false, fmt.Errorf("parse workflow of job %d: %w", job.ID, err)
-	} else if len(parsedWorkflows) != 1 {
+	} else if len(gots) != 1 {
 		return nil, false, fmt.Errorf("workflow of job %d: not single workflow", job.ID)
+	} else { //nolint:revive
+		_, workflowJob = gots[0].Job()
 	}
-	_, workflowJob := parsedWorkflows[0].Job()

 	if _, err := e.Insert(task); err != nil {
 		return nil, false, err
@@ -335,11 +336,6 @@ func UpdateTask(ctx context.Context, task *ActionTask, cols ...string) error {
 		sess.Cols(cols...)
 	}
 	_, err := sess.Update(task)
-
-	// Automatically delete the ephemeral runner if the task is done
-	if err == nil && task.Status.IsDone() && util.SliceContainsString(cols, "status") {
-		return DeleteEphemeralRunner(ctx, task.RunnerID)
-	}
 	return err
 }

@@ -352,70 +348,78 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 		stepStates[v.Id] = v
 	}

-	return db.WithTx2(ctx, func(ctx context.Context) (*ActionTask, error) {
-		e := db.GetEngine(ctx)
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer committer.Close()

-		task := &ActionTask{}
-		if has, err := e.ID(state.Id).Get(task); err != nil {
-			return nil, err
-		} else if !has {
-			return nil, util.ErrNotExist
-		} else if runnerID != task.RunnerID {
-			return nil, errors.New("invalid runner for task")
-		}
+	e := db.GetEngine(ctx)

-		if task.Status.IsDone() {
-			// the state is final, do nothing
-			return task, nil
-		}
-
-		// state.Result is not unspecified means the task is finished
-		if state.Result != runnerv1.Result_RESULT_UNSPECIFIED {
-			task.Status = Status(state.Result)
-			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
-			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
-				return nil, err
-			}
-			if _, err := UpdateRunJob(ctx, &ActionRunJob{
-				ID:      task.JobID,
-				Status:  task.Status,
-				Stopped: task.Stopped,
-			}, nil); err != nil {
-				return nil, err
-			}
-		} else {
-			// Force update ActionTask.Updated to avoid the task being judged as a zombie task
-			task.Updated = timeutil.TimeStampNow()
-			if err := UpdateTask(ctx, task, "updated"); err != nil {
-				return nil, err
-			}
-		}
-
-		if err := task.LoadAttributes(ctx); err != nil {
-			return nil, err
-		}
-
-		for _, step := range task.Steps {
-			var result runnerv1.Result
-			if v, ok := stepStates[step.Index]; ok {
-				result = v.Result
-				step.LogIndex = v.LogIndex
-				step.LogLength = v.LogLength
-				step.Started = convertTimestamp(v.StartedAt)
-				step.Stopped = convertTimestamp(v.StoppedAt)
-			}
-			if result != runnerv1.Result_RESULT_UNSPECIFIED {
-				step.Status = Status(result)
-			} else if step.Started != 0 {
-				step.Status = StatusRunning
-			}
-			if _, err := e.ID(step.ID).Update(step); err != nil {
-				return nil, err
-			}
-		}
+	task := &ActionTask{}
+	if has, err := e.ID(state.Id).Get(task); err != nil {
+		return nil, err
+	} else if !has {
+		return nil, util.ErrNotExist
+	} else if runnerID != task.RunnerID {
+		return nil, errors.New("invalid runner for task")
+	}

+	if task.Status.IsDone() {
+		// the state is final, do nothing
 		return task, nil
-	})
+	}
+
+	// state.Result is not unspecified means the task is finished
+	if state.Result != runnerv1.Result_RESULT_UNSPECIFIED {
+		task.Status = Status(state.Result)
+		task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
+		if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
+			return nil, err
+		}
+		if _, err := UpdateRunJob(ctx, &ActionRunJob{
+			ID:      task.JobID,
+			Status:  task.Status,
+			Stopped: task.Stopped,
+		}, nil); err != nil {
+			return nil, err
+		}
+	} else {
+		// Force update ActionTask.Updated to avoid the task being judged as a zombie task
+		task.Updated = timeutil.TimeStampNow()
+		if err := UpdateTask(ctx, task, "updated"); err != nil {
+			return nil, err
+		}
+	}
+
+	if err := task.LoadAttributes(ctx); err != nil {
+		return nil, err
+	}
+
+	for _, step := range task.Steps {
+		var result runnerv1.Result
+		if v, ok := stepStates[step.Index]; ok {
+			result = v.Result
+			step.LogIndex = v.LogIndex
+			step.LogLength = v.LogLength
+			step.Started = convertTimestamp(v.StartedAt)
+			step.Stopped = convertTimestamp(v.StoppedAt)
+		}
+		if result != runnerv1.Result_RESULT_UNSPECIFIED {
+			step.Status = Status(result)
+		} else if step.Started != 0 {
+			step.Status = StatusRunning
+		}
+		if _, err := e.ID(step.ID).Update(step); err != nil {
+			return nil, err
+		}
+	}
+
+	if err := committer.Commit(); err != nil {
+		return nil, err
+	}
+
+	return task, nil
 }

 func StopTask(ctx context.Context, taskID int64, status Status) error {
--- a/models/actions/task_list.go
+++ b/models/actions/task_list.go
@@ -48,7 +48,6 @@ func (tasks TaskList) LoadAttributes(ctx context.Context) error {
 type FindTaskOptions struct {
 	db.ListOptions
 	RepoID        int64
-	JobID         int64
 	OwnerID       int64
 	CommitSHA     string
 	Status        Status
@@ -62,9 +61,6 @@ func (opts FindTaskOptions) ToConds() builder.Cond {
 	if opts.RepoID > 0 {
 		cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
 	}
-	if opts.JobID > 0 {
-		cond = cond.And(builder.Eq{"job_id": opts.JobID})
-	}
 	if opts.OwnerID > 0 {
 		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}
--- a/models/actions/tasks_version.go
+++ b/models/actions/tasks_version.go
@@ -73,29 +73,33 @@ func increaseTasksVersionByScope(ctx context.Context, ownerID, repoID int64) err
 }

 func IncreaseTaskVersion(ctx context.Context, ownerID, repoID int64) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		// 1. increase global
-		if err := increaseTasksVersionByScope(ctx, 0, 0); err != nil {
-			log.Error("IncreaseTasksVersionByScope(Global): %v", err)
+	ctx, committer, err := db.TxContext(ctx)
+	if err != nil {
+		return err
+	}
+	defer committer.Close()
+
+	// 1. increase global
+	if err := increaseTasksVersionByScope(ctx, 0, 0); err != nil {
+		log.Error("IncreaseTasksVersionByScope(Global): %v", err)
+		return err
+	}
+
+	// 2. increase owner
+	if ownerID > 0 {
+		if err := increaseTasksVersionByScope(ctx, ownerID, 0); err != nil {
+			log.Error("IncreaseTasksVersionByScope(Owner): %v", err)
 			return err
 		}
+	}

-		// 2. increase owner
-		if ownerID > 0 {
-			if err := increaseTasksVersionByScope(ctx, ownerID, 0); err != nil {
-				log.Error("IncreaseTasksVersionByScope(Owner): %v", err)
-				return err
-			}
+	// 3. increase repo
+	if repoID > 0 {
+		if err := increaseTasksVersionByScope(ctx, 0, repoID); err != nil {
+			log.Error("IncreaseTasksVersionByScope(Repo): %v", err)
+			return err
 		}
+	}

-		// 3. increase repo
-		if repoID > 0 {
-			if err := increaseTasksVersionByScope(ctx, 0, repoID); err != nil {
-				log.Error("IncreaseTasksVersionByScope(Repo): %v", err)
-				return err
-			}
-		}
-
-		return nil
-	})
+	return committer.Commit()
 }
--- a/models/actions/utils.go
+++ b/models/actions/utils.go
@@ -82,22 +82,3 @@ func calculateDuration(started, stopped timeutil.TimeStamp, status Status) time.
 	}
 	return timeSince(s).Truncate(time.Second)
 }
-
-// best effort function to convert an action schedule to action run, to be used in GenerateGiteaContext
-func (s *ActionSchedule) ToActionRun() *ActionRun {
-	return &ActionRun{
-		Title:         s.Title,
-		RepoID:        s.RepoID,
-		Repo:          s.Repo,
-		OwnerID:       s.OwnerID,
-		WorkflowID:    s.WorkflowID,
-		TriggerUserID: s.TriggerUserID,
-		TriggerUser:   s.TriggerUser,
-		Ref:           s.Ref,
-		CommitSHA:     s.CommitSHA,
-		Event:         s.Event,
-		EventPayload:  s.EventPayload,
-		Created:       s.Created,
-		Updated:       s.Updated,
-	}
-}
--- a/models/activities/action.go
+++ b/models/activities/action.go
@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"net/url"
 	"path"
-	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -126,7 +125,12 @@ func (at ActionType) String() string {
 }

 func (at ActionType) InActions(actions ...string) bool {
-	return slices.Contains(actions, at.String())
+	for _, action := range actions {
+		if action == at.String() {
+			return true
+		}
+	}
+	return false
 }

 // Action represents user operation type and other information to
@@ -187,7 +191,7 @@ func (a *Action) LoadActUser(ctx context.Context) {
 		return
 	}
 	var err error
-	a.ActUser, err = user_model.GetPossibleUserByID(ctx, a.ActUserID)
+	a.ActUser, err = user_model.GetUserByID(ctx, a.ActUserID)
 	if err == nil {
 		return
 	} else if user_model.IsErrUserNotExist(err) {
@@ -320,7 +324,7 @@ func (a *Action) GetCommentHTMLURL(ctx context.Context) string {
 		return "#"
 	}

-	return a.Issue.HTMLURL(ctx)
+	return a.Issue.HTMLURL()
 }

 // GetCommentLink returns link to action comment.
@@ -526,7 +530,7 @@ func ActivityQueryCondition(ctx context.Context, opts GetFeedsOptions) (builder.

 	if opts.RequestedTeam != nil {
 		env := repo_model.AccessibleTeamReposEnv(organization.OrgFromUser(opts.RequestedUser), opts.RequestedTeam)
-		teamRepoIDs, err := env.RepoIDs(ctx)
+		teamRepoIDs, err := env.RepoIDs(ctx, 1, opts.RequestedUser.NumRepos)
 		if err != nil {
 			return nil, fmt.Errorf("GetTeamRepositories: %w", err)
 		}
--- a/models/activities/action_test.go
+++ b/models/activities/action_test.go
@@ -25,7 +25,7 @@ func TestAction_GetRepoPath(t *testing.T) {
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
 	action := &activities_model.Action{RepoID: repo.ID}
-	assert.Equal(t, path.Join(owner.Name, repo.Name), action.GetRepoPath(t.Context()))
+	assert.Equal(t, path.Join(owner.Name, repo.Name), action.GetRepoPath(db.DefaultContext))
 }

 func TestAction_GetRepoLink(t *testing.T) {
@@ -37,9 +37,9 @@ func TestAction_GetRepoLink(t *testing.T) {
 	defer test.MockVariableValue(&setting.AppURL, "https://try.gitea.io/suburl/")()
 	defer test.MockVariableValue(&setting.AppSubURL, "/suburl")()
 	expected := path.Join(setting.AppSubURL, owner.Name, repo.Name)
-	assert.Equal(t, expected, action.GetRepoLink(t.Context()))
-	assert.Equal(t, repo.HTMLURL(), action.GetRepoAbsoluteLink(t.Context()))
-	assert.Equal(t, comment.HTMLURL(t.Context()), action.GetCommentHTMLURL(t.Context()))
+	assert.Equal(t, expected, action.GetRepoLink(db.DefaultContext))
+	assert.Equal(t, repo.HTMLURL(), action.GetRepoAbsoluteLink(db.DefaultContext))
+	assert.Equal(t, comment.HTMLURL(db.DefaultContext), action.GetCommentHTMLURL(db.DefaultContext))
 }

 func TestActivityReadable(t *testing.T) {
@@ -91,37 +91,37 @@ func TestConsistencyUpdateAction(t *testing.T) {
 	unittest.AssertExistsAndLoadBean(t, &activities_model.Action{
 		ID: int64(id),
 	})
-	_, err := db.GetEngine(t.Context()).Exec(`UPDATE action SET created_unix = '' WHERE id = ?`, id)
+	_, err := db.GetEngine(db.DefaultContext).Exec(`UPDATE action SET created_unix = '' WHERE id = ?`, id)
 	assert.NoError(t, err)
 	actions := make([]*activities_model.Action, 0, 1)
 	//
 	// XORM returns an error when created_unix is a string
 	//
-	err = db.GetEngine(t.Context()).Where("id = ?", id).Find(&actions)
+	err = db.GetEngine(db.DefaultContext).Where("id = ?", id).Find(&actions)
 	if assert.Error(t, err) {
 		assert.Contains(t, err.Error(), "type string to a int64: invalid syntax")
 	}
 	//
 	// Get rid of incorrectly set created_unix
 	//
-	count, err := activities_model.CountActionCreatedUnixString(t.Context())
+	count, err := activities_model.CountActionCreatedUnixString(db.DefaultContext)
 	assert.NoError(t, err)
 	assert.EqualValues(t, 1, count)
-	count, err = activities_model.FixActionCreatedUnixString(t.Context())
+	count, err = activities_model.FixActionCreatedUnixString(db.DefaultContext)
 	assert.NoError(t, err)
 	assert.EqualValues(t, 1, count)

-	count, err = activities_model.CountActionCreatedUnixString(t.Context())
+	count, err = activities_model.CountActionCreatedUnixString(db.DefaultContext)
 	assert.NoError(t, err)
 	assert.EqualValues(t, 0, count)
-	count, err = activities_model.FixActionCreatedUnixString(t.Context())
+	count, err = activities_model.FixActionCreatedUnixString(db.DefaultContext)
 	assert.NoError(t, err)
 	assert.EqualValues(t, 0, count)

 	//
 	// XORM must be happy now
 	//
-	assert.NoError(t, db.GetEngine(t.Context()).Where("id = ?", id).Find(&actions))
+	assert.NoError(t, db.GetEngine(db.DefaultContext).Where("id = ?", id).Find(&actions))
 	unittest.CheckConsistencyFor(t, &activities_model.Action{})
 }

@@ -133,19 +133,19 @@ func TestDeleteIssueActions(t *testing.T) {
 	assert.NotEqual(t, issue.ID, issue.Index) // it needs to use different ID/Index to test the DeleteIssueActions to delete some actions by IssueIndex

 	// insert a comment
-	err := db.Insert(t.Context(), &issue_model.Comment{Type: issue_model.CommentTypeComment, IssueID: issue.ID})
+	err := db.Insert(db.DefaultContext, &issue_model.Comment{Type: issue_model.CommentTypeComment, IssueID: issue.ID})
 	assert.NoError(t, err)
 	comment := unittest.AssertExistsAndLoadBean(t, &issue_model.Comment{Type: issue_model.CommentTypeComment, IssueID: issue.ID})

 	// truncate action table and insert some actions
-	err = db.TruncateBeans(t.Context(), &activities_model.Action{})
+	err = db.TruncateBeans(db.DefaultContext, &activities_model.Action{})
 	assert.NoError(t, err)
-	err = db.Insert(t.Context(), &activities_model.Action{
+	err = db.Insert(db.DefaultContext, &activities_model.Action{
 		OpType:    activities_model.ActionCommentIssue,
 		CommentID: comment.ID,
 	})
 	assert.NoError(t, err)
-	err = db.Insert(t.Context(), &activities_model.Action{
+	err = db.Insert(db.DefaultContext, &activities_model.Action{
 		OpType:  activities_model.ActionCreateIssue,
 		RepoID:  issue.RepoID,
 		Content: fmt.Sprintf("%d|content...", issue.Index),
@@ -154,6 +154,6 @@ func TestDeleteIssueActions(t *testing.T) {

 	// assert that the actions exist, then delete them
 	unittest.AssertCount(t, &activities_model.Action{}, 2)
-	assert.NoError(t, activities_model.DeleteIssueActions(t.Context(), issue.RepoID, issue.ID, issue.Index))
+	assert.NoError(t, activities_model.DeleteIssueActions(db.DefaultContext, issue.RepoID, issue.ID, issue.Index))
 	unittest.AssertCount(t, &activities_model.Action{}, 0)
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Lunny Xiao	a12b5b3640	Add release notes for 1.24.0rc0 (#34305 ) Some checks failed release-nightly / nightly-binary (push) Has been cancelled Details release-nightly / nightly-docker-rootful (push) Has been cancelled Details release-nightly / nightly-docker-rootless (push) Has been cancelled Details	2025-04-29 21:45:47 +00:00
Giteabot	834dad8cef	Fix the ci build (#34309 ) (#34310 ) Backport #34309 by @lunny Fix https://github.com/go-gitea/gitea/actions/runs/14722306878/job/41318217870 A fork has been created under https://gitea.com/gitea/go-xsd-duration Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2025-04-28 22:48:55 -07:00