Merge branch 'main' into pr/4861

server/api/login.go

@@ -210,6 +210,7 @@ func HandleAuth(c *gin.Context) {
 		// insert the user into the database
 		if err := _store.CreateUser(user); err != nil {
 			log.Error().Err(err).Msgf("cannot insert %s", user.Login)
+			log.Trace().Msgf("user was: %#v", user)
 			c.Redirect(http.StatusSeeOther, server.Config.Server.RootPath+"/login?error=internal_error")
 			return
 		}

server/forge/bitbucket/parse.go

@@ -56,7 +56,7 @@ func parseHook(r *http.Request) (*model.Repo, *model.Pipeline, error) {
 }
 
 // parsePushHook parses a push hook and returns the Repo and Pipeline details.
-// If the commit type is unsupported nil values are returned.
+// If the commit type is unsupported it returns an ErrIgnoreEvent error.
 func parsePushHook(payload []byte) (*model.Repo, *model.Pipeline, error) {
 	hook := internal.PushHook{}
 
@@ -71,7 +71,7 @@ func parsePushHook(payload []byte) (*model.Repo, *model.Pipeline, error) {
 		}
 		return convertRepo(&hook.Repo, &internal.RepoPerm{}), convertPushHook(&hook, &change), nil
 	}
-	return nil, nil, nil
+	return nil, nil, &types.ErrIgnoreEvent{Event: "push", Reason: "BB reports no Changes"}
 }
 
 // parsePullHook parses a pull request hook and returns the Repo and Pipeline

server/forge/bitbucket/parse_test.go

@@ -107,7 +107,7 @@ func Test_parseHook(t *testing.T) {
 		r, b, err := parseHook(req)
 		assert.Nil(t, r)
 		assert.Nil(t, b)
-		assert.NoError(t, err)
+		assert.ErrorIs(t, err, &types.ErrIgnoreEvent{})
 	})
 
 	t.Run("push hook", func(t *testing.T) {

server/forge/bitbucketdatacenter/parse.go

@@ -6,6 +6,7 @@ import (
 
 	bb "github.com/neticdk/go-bitbucket/bitbucket"
 
+	"go.woodpecker-ci.org/woodpecker/v3/server/forge/types"
 	"go.woodpecker-ci.org/woodpecker/v3/server/model"
 )
 
@@ -35,7 +36,7 @@ func parseHook(r *http.Request, baseURL string) (*HookResult, error) {
 		result.Repo = convertRepo(&e.PullRequest.Target.Repository, nil, "")
 		result.Pipeline = convertPullRequestEvent(e, baseURL)
 	default:
-		return nil, fmt.Errorf("unsupported webhook event type: %T", e)
+		return nil, &types.ErrIgnoreEvent{Event: fmt.Sprintf("%T", e), Reason: "unsupported webhook event type"}
 	}
 
 	return result, nil

server/forge/gitea/gitea.go

@@ -120,16 +120,16 @@ func (c *Gitea) Login(ctx context.Context, req *forge_types.OAuthRequest) (*mode
 
 	token, err := config.Exchange(oauth2Ctx, req.Code)
 	if err != nil {
-		return nil, redirectURL, err
+		return nil, redirectURL, fmt.Errorf("oauth2 config exchange failed: %w", err)
 	}
 
 	client, err := c.newClientToken(ctx, token.AccessToken)
 	if err != nil {
-		return nil, redirectURL, err
+		return nil, redirectURL, fmt.Errorf("client creation with new access token failed: %w", err)
 	}
 	account, _, err := client.GetMyUserInfo()
 	if err != nil {
-		return nil, redirectURL, err
+		return nil, redirectURL, fmt.Errorf("fetching user info failed: %w", err)
 	}
 
 	return &model.User{

server/forge/github/github.go

@@ -633,7 +633,7 @@ func (c *client) Hook(ctx context.Context, r *http.Request) (*model.Repo, *model
 		if err != nil {
 			return nil, nil, err
 		}
-	} else if pipeline.Event == model.EventPush {
+	} else if pipeline != nil && pipeline.Event == model.EventPush {
 		// GitHub has removed commit summaries from Events API payloads from 7th October 2025 onwards.
 		pipeline, err = c.loadChangedFilesFromCommits(ctx, repo, pipeline, prevCommit, currCommit)
 		if err != nil {

server/forge/setup/setup.go

@@ -127,15 +127,9 @@ func setupGitLab(forge *model.Forge) (forge.Forge, error) {
 }
 
 func setupGitHub(forge *model.Forge) (forge.Forge, error) {
-	mergeRef, ok := forge.AdditionalOptions["merge-ref"].(bool)
-	if !ok {
-		return nil, fmt.Errorf("missing merge-ref")
-	}
-
-	publicOnly, ok := forge.AdditionalOptions["public-only"].(bool)
-	if !ok {
-		return nil, fmt.Errorf("missing public-only")
-	}
+	// get additional config and be false by default
+	mergeRef, _ := forge.AdditionalOptions["merge-ref"].(bool)
+	publicOnly, _ := forge.AdditionalOptions["public-only"].(bool)
 
 	opts := github.Opts{
 		URL:               forge.URL,

server/grpc/filter.go

@@ -50,7 +50,11 @@ func createFilterFunc(agentFilter rpc.Filter) queue.FilterFn {
 			// all task labels are required to be present for an agent to match
 			agentLabelValue, ok := agentFilter.Labels[taskLabel]
 			if !ok {
-				return false, 0
+				// Check for required label
+				agentLabelValue, ok = agentFilter.Labels["!"+taskLabel]
+				if !ok {
+					return false, 0
+				}
 			}
 
 			switch agentLabelValue {

server/grpc/filter_test.go

@@ -119,6 +119,17 @@ func TestCreateFilterFunc(t *testing.T) {
 			wantMatched: true,
 			wantScore:   2,
 		},
+		{
+			name: "Required label matches without shebang",
+			agentFilter: rpc.Filter{
+				Labels: map[string]string{"!org-id": "123", "platform": "linux", "extra": "value"},
+			},
+			task: &model.Task{
+				Labels: map[string]string{"org-id": "123", "platform": "linux", "empty": ""},
+			},
+			wantMatched: true,
+			wantScore:   20,
+		},
 	}
 
 	for _, tt := range tests {

server/model/user.go

@@ -34,14 +34,14 @@ type User struct {
 	// required: true
 	ID int64 `json:"id" xorm:"pk autoincr 'id'"`
 
-	ForgeID int64 `json:"forge_id,omitempty" xorm:"forge_id UNIQUE(forge)"`
+	ForgeID int64 `json:"forge_id,omitempty" xorm:"forge_id UNIQUE(forge_id) UNIQUE(forge_login)"`
 
-	ForgeRemoteID ForgeRemoteID `json:"forge_remote_id" xorm:"forge_remote_id UNIQUE(forge)"`
+	ForgeRemoteID ForgeRemoteID `json:"forge_remote_id" xorm:"forge_remote_id UNIQUE(forge_id)"`
 
 	// Login is the username for this user.
 	//
 	// required: true
-	Login string `json:"login"  xorm:"UNIQUE 'login'"`
+	Login string `json:"login"  xorm:"'login' UNIQUE(forge_login)"`
 
 	// AccessToken is the oauth2 access token.
 	AccessToken string `json:"-"  xorm:"TEXT 'access_token'"`

server/store/datastore/init.go

@@ -22,7 +22,7 @@ import (
 	_ "github.com/lib/pq"
 )
 
-// Supported database drivers
+// Supported database drivers.
 const (
 	DriverMysql    = "mysql"
 	DriverPostgres = "postgres"