Backport #10508

* Add frontend/backend make targets, fix source release

- Add 'make backend' and 'make frontend' make targets which are used to
  build go and js/css/svg files respectively.

- The 'backend' target can be invoked without requiring Node.js to be
  present on the system if pre-built frontend assets are present like
  in the release source tarballs.

- Fix source releases missing 'dist' folders inside 'node_modules' which
  were erronously excluded from tar.

- Store VERSION in file VERSION for the release tarballs and prefer that
  file over git-derived version.

* fix release task

* fix typo

* fix another typo

Fixes: https://github.com/go-gitea/gitea/issues/10253

* make: add release-sources

* make: release-sources exclude .git and make_evidence

* fix: skip exclude MAKE_EVIDENCE_DIR not present in 1.11

* ci: use docker image for golangci-lint (#9737)

* ci: re-ordering Drone CI for optimizing time (#9719)

* ci: try re-ordering for optimizing time

* ci: try re-ordering for optimizing time

* ci: try re-ordering for optimizing time

* ci: try re-ordering for optimizing time

* ci: try re-ordering for optimizing time

* ci: try re-ordering for optimizing time

* ci: try offloading mysql8 to arm64

* Revert "ci: try offloading mysql8 to arm64"

This reverts commit c60de5db1c.

* ci: try offloading pgsql to arm64

* ci: activate ldap on arm64

* ci: test mysql8 in place pgsql arm64

* chore: clean un-needed move

* typo

* ci: revert runnning mysql on arm64

* ci: run compliance on arm

* chore: limit change

* chore: readd maybe need for release fetch-tags

* ci: remove docker-linux-amd64-dry-run

* ci: remove docker-linux-amd64-dry-run

* Revert "ci: remove docker-linux-amd64-dry-run"

This reverts commit 0715f65b11.

Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

* ci: use new mssql image (#9720)

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

* ci: run notify on arm64 (#9762)

* ci: run notify on arm64

Free one jobs on amrd64

* Update .drone.yml

* Update .drone.yml

* Update .drone.yml

Based on: https://github.com/appleboy/drone-discord/blob/master/.drone.yml#L339

* improve trigger

Co-authored-by: techknowlogick <matti@mdranta.net>

* ci: move some integration tests on arm64 (#9747)

* tests: configure github remaining limit + read token (#9800)

* ci: configure remaining github limmit

* prepend with github since package is common to all migrations

* add RefreshRate

* Update github.go

* add missing space

* go fmt

* Read env variable GITHUB_READ_TOKEN for token

* Update .drone.yml

* ci: simplify tag/release by always running coverage (#9774)

* ci: simplify tag/release by always running coverage

* use mod and vendor for unit test coverage

* remove not needed lfs for unit test

* use arm drone agent for docs (#9776)

* run translations pipeline on arm server (#9865)

* add git-check to Makefile

Co-authored-by: Antoine GIRARD <sapk@users.noreply.github.com>
Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: techknowlogick <matti@mdranta.net>

* introduce "make help"

* fix + add more routienes

* Update Makefile

* add make vet

Co-authored-by: techknowlogick <matti@mdranta.net>

* Add os specific sed for FreeBSD.

* Replace hardcoded "make" with $(MAKE)

Some systems don't use GNU make by default, and use something like
gnumake or gmake. Respect that when determining the make version.

* Combine Drone release steps

Fixes missing JS/CSS because drone did unwanted parallelization of the
js/css task and the generate task. Combined the tasks into one and made
'make release' work standalone.

Fixes: https://github.com/go-gitea/gitea/issues/9324
Fixes: https://github.com/go-gitea/gitea/issues/9362

* move js/css to generate dependencies

* remove unneccessary go-all target

* remove go target as well

* prebuild CSS/JS before xgo release binaries

* Update .drone.yml

* Update Makefile

* update per @lafriks feedback

* Remove more explicit 'generate' calls

`generate` is now implicit during `build` since #9114, it is no longer
necessary or desired to specify it explicitely.

* add js,css,generate dependencies to release task

* remove generate warning as per @lunny

This results in around 4kB saving in CSS size and also resolves with a
particular issue on git bash which had issues with the format of the
lessc arguments.

- Added Node.js as build dependency and removes build files from git.
- Added version checks for both Go and Node.js.
- Overhauled the js/css make target to only run when needed.
- Merged the `generate` make target into `build` as per suggestion.

Fixes: https://github.com/go-gitea/gitea/issues/6782
Fixes: https://github.com/go-gitea/gitea/issues/9216

Signed-off-by: Gary Kim <gary@garykim.dev>

* Move index.js to web_src and use webpack

* Fix initHeatMap

* update eslint and move webpack to devDependencies

* update index.js

* add eslint env node

* add issue subscriber API

* subscribers return []user.APIFormat

* add comments

* more meaningfull description

* without "reqToken()" api works ...
 * should be still secure beause ctx.user has to be there or nothing will hapen

* FIX: getIssueWatchers() get only aktive suscriber

* add return avter error on right position

* Revert "FIX: getIssueWatchers() get only aktive suscriber"

This reverts commit 5eca929185.

* Update routers/api/v1/repo/issue.go

Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>

* test go linter again

* update swagger

* GetIssueWatchers -> GetIssueSubscribers

part one

Co-Authored-By: guillep2k <18600385+guillep2k@users.noreply.github.com>

* GetIssueWatchers -> GetIssueSubscribers
part two

* Revert "test go linter again"

This reverts commit bab1235622.

* change description for unsubscribe too

* golangci-lint timeout avter 5min

* move issueSubscription to seperate file

* dont create black entitys

* use IsWatching until refactoring

* Update License Info

* better swagger description

* Update .golangci.yml

because functions moved from issue.go to issue_subscription.go

* add IssueWatchList type

* batch tasks

* use e Engien

* add error handling

* error should be the last type when returning multiple items

* short version

* reurn empy UserList instead of nil

This PR fixes #7598 by providing a configurable way of signing commits across the Gitea instance. Per repository configurability and import/generation of trusted secure keys is not provided by this PR - from a security PoV that's probably impossible to do properly. Similarly web-signing, that is asking the user to sign something, is not implemented - this could be done at a later stage however.

## Features
- [x] If commit.gpgsign is set in .gitconfig sign commits and files created through repofiles. (merges should already have been signed.)
- [x] Verify commits signed with the default gpg as valid
- [x] Signer, Committer and Author can all be different
    - [x] Allow signer to be arbitrarily different - We still require the key to have an activated email on Gitea. A more complete implementation would be to use a keyserver and mark external-or-unactivated with an "unknown" trust level icon.
- [x] Add a signing-key.gpg endpoint to get the default gpg pub key if available
    - Rather than add a fake web-flow user I've added this as an endpoint on /api/v1/signing-key.gpg
    - [x] Try to match the default key with a user on gitea - this is done at verification time
- [x] Make things configurable?
    - app.ini configuration done
    - [x] when checking commits are signed need to check if they're actually verifiable too
- [x] Add documentation

I have decided that adjusting the docker to create a default gpg key is not the correct thing to do and therefore have not implemented this.

* Update golangci to v1.20

Signed-off-by: kolaente <k@knt.li>

* Use the timeout flag instead of deadline, move it to config

Signed-off-by: kolaente <k@knt.li>

Signed-off-by: kolaente <k@knt.li>

* improve integration tests

* fix Makefile

* improve makefile and integration docs

* use go 1.13

* use go 1.13 in gomod file

* Update Makefile

* update swagger deps

* Use vendored go-swagger

* vendor go-swagger

* revert un wanteed change

* remove un-needed GO111MODULE

* Update Makefile

Co-Authored-By: techknowlogick <matti@mdranta.net>

* update swagger to 0.20.1

* fiw swagger version for validate

this flag is not needed for Go versions >=1.10 and creates problems
while building. see https://github.com/golang/go/issues/27285#issuecomment-424382413

* use vendors when go generate

* update docs about golang minimal requirement from 1.9 to 1.11

* fix build

* workaround broken swagger

only master brach is not working, latest release seems to work

Signed-off-by: Michael Gnehr <michael@gnehr.de>

* make vendor

Signed-off-by: Michael Gnehr <michael@gnehr.de>

* Don't export GO111MODULE

* set go-swagger to fixed release version

mentioned here: https://github.com/go-gitea/gitea/pull/7362#discussion_r300831537

Signed-off-by: Michael Gnehr <michael@gnehr.de>

New CSS linter which is much more powerfull than the previous one.
Configuration is default but I had to remove a few rules that were
throwing too many or weird errors.

More importantly, the linter will exit with code 1 on errors so now our
build will fail if the CSS linter fails which should eliminate linter
errors being introduced without notice.

* add 'npm' and 'npm-update' make targets and lockfile

- `make npm` installs and updates node_modules, triggered automatically
   on `make css` and `make js` as it completes reasonably fast and
   ensures consistent modules.
- `make npm-update` updates all dependencies to their latest version,
   regenerates `node_modules` from scratch and updates
   `package-lock.json`. It uses npm modules `updates` written by yours
   truly to find the latest version of each dependency.

* add suggested make dependencies

* remove package-lock.json during npm-update

* regenerate package-lock.json

- Fix layout overflow in repo file list.
- Fix invisible status icon in file view and commit list. In file view,
  the icon was moved to the left because I could not figure out a proper
  fix because of HTML tables.
- Added title attribute to commit messages.
- Fixed two CSS linter warnings in existing CSS.
- Fixed CI variable check in 'make css'.

Fixes: https://github.com/go-gitea/gitea/issues/7180

* use vfsgen instead of go-bindata

* fix templates

* fix fmt

* vendor vsfgen

* Disable arm7 builds

As arm6 works on arm7 platforms with no noticeable performance difference

* 386

* add make targets for js,css, add javascript linter

- add `make js`, deprecating `make javascripts`
- add `make css`, deprecating `make generate-stylesheets` and
  `make stylesheets-check`
- changed the unclean css check to only run on CI
- add JS linting via eslint with basic configuration and fixed
  discovered issues
- changed autoprefixer to use official `postcss-cli` avoiding the need
  to loop in the makefile
- moved browserslist to package.json so other future tools can use it
  too.
- update documentation for new make targets and added JS section

* fix indentation

* move functions used in html to 'exported' list

* Run lessc binary without having to install anything to node_modules

* use relative paths to node bin scripts, removing npx

* Revert "use relative paths to node bin scripts, removing npx"

This reverts commit 119b725525.

* fix lessc and postcss plugins

* check for node_modules and use actual bin names

* Prevent creating empty sessions

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Update modules/setting/session.go

* Remove unnecessary option

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Add destory to list of ignored misspellings

* rename cookie.go -> virtual.go

* Delete old file

* Add test to ensure that sessions are not created without being logged in

Signed-off-by: Andrew Thornton <art27@cantab.net>

* fix tests

Signed-off-by: Andrew Thornton <art27@cantab.net>

* Update integrations/create_no_session_test.go

* Add a new Make target for running single integration test

* Use # instead of - as the delimiter

* Migrate to go modules

* make vendor

* Update mvdan.cc/xurls

* make vendor

* Update code.gitea.io/git

* make fmt-check

* Update github.com/go-sql-driver/mysql

* make vendor

Fixes: https://github.com/go-gitea/gitea/pull/6357

Fix #1173