Upgrade Gitea to 28.3.0, Actions runner to 5.2.4

Gitea 28.1.0 -> 28.3.0 (skipping 28.2.0). Both are maintenance releases
with no breaking changes and no app.ini changes. They carry a large set of
security fixes: token scope enforcement across many API and web routes,
OAuth2 ACCOUNT_LINKING=auto account takeover, review-triggered Actions
workflows running with repository secrets, stored XSS via Actions artifact
Content-Encoding, SSH certificate principal confusion, OpenID association
CSRF, and several private-data leaks in feeds, profiles, project boards and
issue timelines.

Behavior changes to be aware of, none requiring a cookbook change:
git maintenance now defaults to the gc strategy; profile pages treat token
requests as anonymous and user/org RSS/Atom feeds require read:user or
read:organization; the API rejects changes to issues, labels, milestones
and releases of archived repositories; review-triggered workflows run on
the pull request head; the gitea-vscode OAuth2 application is
pre-registered; email validation is relaxed to what Go's mail.ParseAddress
accepts.

Gitea Actions runner 5.2.2 -> 5.2.4. No config.yaml changes were required.
5.2.4 fixes the v4 artifact API in exec mode so upload-artifact v4 and
later work; 5.2.3 fixes the action header group, dry runs touching the
Docker daemon, and damaged shared action cache trees.

Checksums verified against the published binaries.

site-cookbooks/kosmos_gitea/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.5
+
+- Upgrade Gitea from 28.1.0 to 28.3.0, skipping 28.2.0. Both are maintenance
+  releases with no breaking changes and no `app.ini` changes; no configuration
+  updates were required.
+- Security fixes included: token scope enforcement on many API and web routes
+  (public-only tokens could read private data and, for admins, create
+  administrators), OAuth2 `ACCOUNT_LINKING = auto` account takeover, review
+  triggered Actions workflows running with repository secrets, stored XSS via
+  Actions artifact `Content-Encoding`, SSH certificate principal confusion,
+  OpenID association CSRF, and several private-data leaks in feeds, profiles,
+  project boards and issue timelines.
+- Behavior changes to be aware of (no cookbook change): `git maintenance` now
+  defaults to the `gc` strategy; profile pages treat token requests as
+  anonymous and user/org RSS/Atom feeds require `read:user` /
+  `read:organization`; the API rejects changes to issues, labels, milestones
+  and releases of archived repositories; review-triggered workflows run on the
+  pull request head; the `gitea-vscode` OAuth2 application is pre-registered;
+  email address validation is relaxed to what Go's `mail.ParseAddress` accepts.
+- Upgrade the Gitea Actions runner from 5.2.2 to 5.2.4. No `config.yaml`
+  changes were required. 5.2.4 fixes the v4 artifact API in `exec` mode so
+  `upload-artifact` v4 and later work, and 5.2.3 fixes the action header group,
+  dry runs touching the Docker daemon, and damaged shared action cache trees.
+
 # 0.3.4
 
 - Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "28.1.0"
-node.default["gitea"]["checksum"] = "ea93cfa4a300564ac457d3903469fea49ec5a4da37d0cebaa435f8e329ea64d0"
+node.default["gitea"]["version"] = "28.3.0"
+node.default["gitea"]["checksum"] = "5f834e8f04986f3b9206cf14743b5a6e6996ceddc238dac6409866ebda2a0686"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.2.2"
-node.default["gitea"]["runner"]["checksum"] = "5a2639fd2a57feeba29a9b1fb0e941489f092a4fa681c7c333c0372731248b63"
+node.default["gitea"]["runner"]["version"] = "5.2.4"
+node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {

site-cookbooks/kosmos_gitea/metadata.rb

@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.4'
+version '0.3.5'
 chef_version '>= 14.0'
 
 depends "firewall"