Repository templates ignoring .gitea/template and including everything

[andrewimeson]

Description

Given a repository template (demonstration template) with a .gitea/template file populated according to the documentation, Gitea is ignoring the .gitea/template file and just including all files when you create from template (demonstration template deploy repo). In the linked example files other than README.md and .pre-commit-config.yaml are included when deploying the template, which they shouldn't be.

Gitea Version

1.20.4

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Linux / Kubernetes

How are you running Gitea?

Official Helm Chart v9.4.0

Database

PostgreSQL

[delvh]

Hmm… I mean, I can see a security aspect as to why it might be excluded:
Who looks thoroughly through a template repo before using it?
Basically no one, especially if the template repo is large.
How do you guarantee then that the template does not contain malicious actions (for example, issue config is another example for it)?
I.e. actions that leak your secrets?

[jolheiser]

.gitea/template is only for specifying which files should be subject to variable expansion, not whether they should be included at all.

[andrewimeson]

I misunderstood the purpose. Re-reading the documentation, I understand now. I think the docs could be a little more clear to avoid confusion. I might be able to submit a PR later to reword the docs a little.