Repository: go-gitea/gitea
File: routers/web/repo/githttp.go (Go)

Code before:
			return nil
		}

		environ = []string{
			repo_module.EnvRepoUsername + "=" + username,
			repo_module.EnvRepoName + "=" + reponame,
			repo_module.EnvPusherName + "=" + ctx.Doer.Name,
			repo_module.EnvPusherID + fmt.Sprintf("=%d", ctx.Doer.ID),
			repo_module.EnvAppURL + "=" + setting.AppURL,
		}

		if repoExist {
			// Because of special ref "refs/for" .. , need delay write permission check
			if git.DefaultFeatures().SupportProcReceive {
				accessMode = perm.AccessModeRead
			}

			if ctx.Data["IsActionsToken"] == true {
				taskID := ctx.Data["ActionsTaskID"].(int64)
				task, err := actions_model.GetTaskByID(ctx, taskID)
				if err != nil {
					ctx.ServerError("GetTaskByID", err)
					return nil
				}
				if task.RepoID != repo.ID {
					taskRepo, exist, err := db.GetByID[repo_model.Repository](ctx, task.RepoID)
					if err != nil {
						ctx.ServerError("Load task repository", err)
						return nil
					}
					if !exist {
						ctx.NotFound(errors.New("task repo not found"))
						return nil
					}
					actionsCfg := repo.MustGetUnit(ctx, unit.TypeActions).ActionsConfig()
					if !actionsCfg.IsCollaborativeOwner(taskRepo.OwnerID) || !taskRepo.IsPrivate {
						// The task repo can access the current repo only if the task repo is private and
						// the owner of the task repo is a collaborative owner of the current repo.
						ctx.PlainText(http.StatusForbidden, "User permission denied")
						return nil
					}
				}

				if task.IsForkPullRequest {
					if accessMode > perm.AccessModeRead {
						ctx.PlainText(http.StatusForbidden, "User permission denied")
						return nil
					}
					environ = append(environ, fmt.Sprintf("%s=%d", repo_module.EnvActionPerm, perm.AccessModeRead))
				} else {
					if accessMode > perm.AccessModeWrite {

Review comment (security):
Is write access needed? This could be abused, by workflow code referencing ${{ gitea.token }} to modify action code.

```suggestion
					if accessMode > perm.AccessModeRead {
						ctx.PlainText(http.StatusForbidden, "User permission denied")
						return nil
					}
					taskRepo, exist, err := db.GetByID[repo_model.Repository](ctx, task.RepoID)
```

~~What about PRs from fork? Should they get read access?, They could reupload your private repos, if you ignore the workflow approval protection.~~

~~_I think that having this feature for public repos would be a big advantage over GitHub Actions, while they do not grant github.token this power and use other, inaccessible for user code except ram dumps, tokens inside the runner for this purpose_~~

**EDIT** Sounds like private repo only, like GitHub. Large parts are invalidated

Code after:
		environ = []string{
			repo_module.EnvRepoUsername + "=" + username,
			repo_module.EnvRepoName + "=" + reponame,
			repo_module.EnvPusherName + "=" + ctx.Doer.Name,
			repo_module.EnvPusherID + fmt.Sprintf("=%d", ctx.Doer.ID),
			repo_module.EnvAppURL + "=" + setting.AppURL,
		}

		if repoExist {
			// Because of special ref "refs/for" .. , need delay write permission check
			if git.DefaultFeatures().SupportProcReceive {
				accessMode = perm.AccessModeRead
			}

			if ctx.Data["IsActionsToken"] == true {
				taskID := ctx.Data["ActionsTaskID"].(int64)
				p, err := access_model.GetActionsUserRepoPermission(ctx, repo, ctx.Doer, taskID)
				if err != nil {
					ctx.ServerError("GetActionsUserRepoPermission", err)
					return nil
				}

				if !p.CanAccess(accessMode, unitType) {
					ctx.PlainText(http.StatusNotFound, "Repository not found")
					return nil
				}
				environ = append(environ, fmt.Sprintf("%s=%d", repo_module.EnvActionPerm, p.UnitAccessMode(unitType)))
			} else {
				p, err := access_model.GetUserRepoPermission(ctx, repo, ctx.Doer)
				if err != nil {
					ctx.ServerError("GetUserRepoPermission", err)
					return nil
				}

				if !p.CanAccess(accessMode, unitType) {
					ctx.PlainText(http.StatusNotFound, "Repository not found")
					return nil
				}
			}

			if !isPull && repo.IsMirror {
				ctx.PlainText(http.StatusForbidden, "mirror repository is read-only")
				return nil
			}
		}

		if !ctx.Doer.KeepEmailPrivate {
			environ = append(environ, repo_module.EnvPusherEmail+"="+ctx.Doer.Email)
		}

		if isWiki {