Audit Log

In the modern-day dynamic world, managing data and change-induced implications is crucial. Keeping up with the need for ample data management, we have now introduced the Audit Log feature in the Gitea Enterprise. This comprehensive feature emphasizes providing an in-depth history of activities happening within your Gitea instances. Our latest feature captures a wide range of events like logging in/out, cloning a repository (including through SSH, HTTP), downloading the source code, downloading packages and so on.

Why the Audit Log Feature?​

Audit Log feature for Gitea Enterprise offers a comprehensive logging solution that allows system administrators to keep track of various activities and changes. It ensures improved data security, compliance, accountability, and traceability.

User interface for Audit Log​

Audit Log feature offers a neatly organized interface where you can easily access all the logs.

Let's talk about the content and organization of these records.

1. Opeartion Time: This column displays the exact date and time at which an activity occurred. The details recorded can help track the sequence of operations and also aid in pinpointing activities within a specific timeline.
2. Operation Type: Here you can find tags for different activities, like, 'user:sign_in', 'user:sign_out', 'repo:clone', etc. This column helps to identify the sort of task executed.
3. Operator: This column records the Gitea username of the individual who performed the operation. This aids in accountability and backtracking of any unauthorized changes done.
4. Repository: The Repository column indicates the specific repository related to the operation. This is particularly useful in identifying the source/object related to the performed operation.
5. Owner: The Owner column does not necessarily denote the owner of the repository in question; it refers to the entity that owns the object involved in the operation. Depending on the operation type, the owner could differ. In case of opeartion like 'Download package', where a package does not expressly belong to any repository but has an independent owner, this field will capture that owner's details.
6. Target: Specifically, this denotes the specific object or individual that an operation was directed at. For example, in a file download situation, the target would be the file name.
7. IP Address*: The IP address from where the operation was performed is also logged. This can provide extra security measures as it allows the tracing of the geographical location of operation execution.

What operations are logged in the audit log?​

Almost every user operations will be recorded. Below is the behaviors we recorded.

Operation types reference​

Operation Type	Action	Description	Notes
user:sign_in	User sign in	Records a successful user sign-in.	Watch for unusual time windows or IPs.
user:sign_out	User sign out	Records a user sign-out.	Correlate with session management for long-lived sessions.
user:change_password	Change password	User changes their password in settings.	High-risk action; watch for frequent changes.
user:reset_password	Reset password	User completes a password reset flow.	Confirm it matches a reset request.
user:request_reset_password	Request password reset	User requests a password reset.	Correlate with email/verification activity.
user:enable_2fa	Enable 2FA	User enables two-factor authentication.	Security improvement; note timing.
user:disable_2fa	Disable 2FA	User disables two-factor authentication.	High-risk; verify operator identity.
user:regenerate_recovery_codes	Regenerate recovery codes	User regenerates 2FA recovery codes.	Old recovery codes are invalidated.
user:add_ssh_key	Add SSH key	User adds an SSH public key.	Affects Git SSH access.
user:remove_ssh_key	Remove SSH key	User removes an SSH public key.	May break access; verify intent.
user:add_principal_key	Add principal key	User adds an SSH principal key.	Used for certificate auth; confirm usage.
user:remove_principal_key	Remove principal key	User removes an SSH principal key.	Related certificate auth stops working.
user:add_gpg_key	Add GPG key	User adds a GPG public key.	Affects commit signature verification.
user:remove_gpg_key	Remove GPG key	User removes a GPG public key.	Existing signatures still verify; new ones cannot be created.
user:create	Create user	Creates a new user account.	Typically an admin action.
user:rename	Rename user	Changes a username.	Impacts repository paths and references.
user:delete	Delete user	Deletes a user account.	Irreversible; confirm data ownership handling.
user:activate	Activate user	Activates a user account.	Typically used after review/unlock.
user:deactivate	Deactivate user	Deactivates a user account.	Blocks login and access.
user:update	Update user	Updates user profile or settings.	Audit log should not expose sensitive values.
user:admin_reset_password	Admin reset password	Admin resets a user's password.	High-risk; ensure approval trail.
user:prohibit_login	Prohibit login	Disables user login.	Useful for incident response.
user:allow_login	Allow login	Re-enables user login.	Confirm risk is cleared.
user:add_email	Add email	User adds an email address.	Email ownership should be verified.
user:delete_email	Delete email	User removes an email address.	May affect notifications and login.
user:change_primary_email	Change primary email	User changes primary email.	Impacts notifications and identity.
user_app:create	Create user app	User creates an application integration.	Review scopes and callbacks.
user_app:delete	Delete user app	User deletes an application.	Existing grants are revoked.
user_app:update	Update user app	User updates an application.	Watch for callback or scope changes.
user_app:grant_revoke	Grant/revoke app	User grants or revokes app access.	High impact on permissions.
user_access_token:create	Create access token	User creates an access token.	Token shown once; watch for leakage.
user_access_token:delete	Delete access token	User deletes an access token.	API access stops for the token.
user_actions_secret:create	Create Actions secret	User creates an Actions secret.	Secret value is masked.
user_actions_secret:delete	Delete Actions secret	User deletes an Actions secret.	Workflows may fail afterward.
user_actions_secret:update	Update Actions secret	User updates an Actions secret.	Updated value is not shown.
user_actions_variable:create	Create Actions variable	User creates an Actions variable.	Variable value is plaintext.
user_actions_variable:delete	Delete Actions variable	User deletes an Actions variable.	Workflows may fail afterward.
user_actions_variable:update	Update Actions variable	User updates an Actions variable.	Track value changes.
user_webhook:create	Create user webhook	User creates a personal webhook.	Review callback URL and events.
user_webhook:delete	Delete user webhook	User deletes a personal webhook.	Event delivery stops.
user_webhook:update	Update user webhook	User updates a personal webhook.	Review URL/secret changes.
user_openid_uri:create	Create OpenID URI	User adds an OpenID identifier.	Affects third-party identity binding.
user_openid_uri:delete	Delete OpenID URI	User removes an OpenID identifier.	Related login method stops working.
repo:create	Create repository	Creates a new repository.	Review owner and visibility.
repo:delete	Delete repository	Deletes a repository.	Irreversible; ensure backups.
repo:archive	Archive repository	Sets repository to read-only archive.	Disables writes.
repo:unarchive	Unarchive repository	Restores repository to writable.	Confirm process compliance.
repo:clone	Clone repository	User clones a repository.	Logs protocol and IP.
repo:pull	Pull repository	User pulls from a repository.	Logs protocol and IP.
repo:push	Push repository	User pushes commits.	Audit with branch protection policies.
repo:download	Download source code	User downloads a source archive.	Watch for bulk downloads.
repo:update_settings	Update repository settings	Updates repository configuration.	Monitor visibility or permission changes.
repo:update_avatar	Update repository avatar	Updates repository avatar.	Low risk.
repo:delete_avatar	Delete repository avatar	Deletes repository avatar.	Low risk.
repo:add_push_mirror	Add push mirror	Adds a push mirror configuration.	Review mirror destination.
repo:update_push_mirror	Update push mirror	Updates push mirror configuration.	Watch for credential or URL changes.
repo:delete_push_mirror	Delete push mirror	Deletes a push mirror configuration.	Mirroring stops afterward.
repo:rename	Rename repository	Renames repository or path.	Impacts remotes and dependencies.
repo:transfer	Transfer repository	Transfers repository ownership.	Confirm permissions and asset ownership.
repo:transfer_pending	Transfer pending	Repository transfer pending acceptance.	Requires receiver confirmation.
repo:make_public	Make public	Sets repository to public.	Expands data exposure.
repo:make_private	Make private	Sets repository to private.	Restricts access.
repo:delete_wiki	Delete wiki	Deletes repository wiki.	Irreversible; consider backups.
repo:add_collaborator	Add collaborator	Adds repository collaborator.	Permission change.
repo:update_collaborator	Update collaborator	Updates collaborator permissions.	Watch for privilege escalation.
repo:remove_collaborator	Remove collaborator	Removes repository collaborator.	Access is revoked.
repo:add_webhook	Add repository webhook	Adds a repository webhook.	Review callback URL and events.
repo:update_webhook	Update repository webhook	Updates a repository webhook.	Review URL/secret changes.
repo:delete_webhook	Delete repository webhook	Deletes a repository webhook.	Event delivery stops.
repo:add_protected_branch	Add protected branch	Creates a protected branch rule.	Changes push/merge permissions.
repo:update_protected_branch	Update protected branch	Updates protected branch rule.	Monitor permission changes.
repo:delete_protected_branch	Delete protected branch	Deletes protected branch rule.	Access restrictions may be relaxed.
repo:add_protected_tag	Add protected tag	Creates a protected tag rule.	Controls tag creation/deletion.
repo:update_protected_tag	Update protected tag	Updates protected tag rule.	Monitor permission changes.
repo:delete_protected_tag	Delete protected tag	Deletes protected tag rule.	Access restrictions may be relaxed.
repo:add_deploy_key	Add deploy key	Adds a repository deploy key.	Impacts automation access.
repo:delete_deploy_key	Delete deploy key	Deletes a repository deploy key.	Automation access stops.
repo:add_actions_secret	Add Actions secret	Adds a repository Actions secret.	Secret value is masked.
repo:update_actions_secret	Update Actions secret	Updates a repository Actions secret.	Updated value is not shown.
repo:delete_actions_secret	Delete Actions secret	Deletes a repository Actions secret.	Workflows may fail afterward.
repo:add_actions_variable	Add Actions variable	Adds a repository Actions variable.	Variable value is plaintext.
repo:update_actions_variable	Update Actions variable	Updates a repository Actions variable.	Track value changes.
repo:delete_actions_variable	Delete Actions variable	Deletes a repository Actions variable.	Workflows may fail afterward.
repo:enable_security_scan	Enable security scan	Enables repository security scanning.	Consider scan scope and load.
repo:disable_security_scan	Disable security scan	Disables repository security scanning.	Reduces vulnerability detection.
repo:update_security_scan_branch	Update scan branch	Updates the target branch for scanning.	Ensure critical branches are covered.
repo:cleanup_security_scan	Cleanup scan data	Cleans up security scan history.	History is removed and unrecoverable.
repo_label:create	Create label	Creates a repository label.	Affects issue/PR categorization.
repo_label:update	Update label	Updates a repository label.	Watch for name/color changes.
repo_label:delete	Delete label	Deletes a repository label.	Affects label associations.
repo_milestone:create	Create milestone	Creates a repository milestone.	Impacts planning.
repo_milestone:update	Update milestone	Updates a repository milestone.	Track due date changes.
repo_milestone:delete	Delete milestone	Deletes a repository milestone.	Affects statistics and tracking.
repo_project:create	Create project	Creates a repository project board.	Impacts project workflow.
repo_project:update	Update project	Updates a repository project board.	Watch column or permission changes.
repo_project:close	Close project	Closes a repository project board.	Becomes read-only.
repo_project:reopen	Reopen project	Reopens a repository project board.	Restores write access.
repo_project:delete	Delete project	Deletes a repository project board.	Irreversible.
reference:create	Create reference	Creates a Git reference (branch/tag).	Record target reference name.
reference:delete	Delete reference	Deletes a Git reference (branch/tag).	Reference is removed.
release:create	Create release	Creates a repository release.	Tied to tags and assets.
release:update	Update release	Updates a repository release.	Watch asset or description changes.
release:delete	Delete release	Deletes a repository release.	Assets become unavailable.
package:download	Download package	Downloads a package artifact.	Track package name/version/owner.
package:upload	Upload package	Uploads a package artifact.	Verify permissions and source.
package:create	Create package	Creates a package record.	Usually with upload.
package:delete	Delete package	Deletes a package record.	Package becomes unavailable.
issue:create	Create issue/PR	Creates an issue or PR.	Record repository and author.
issue:update	Update issue/PR	Updates an issue or PR.	Track state/assignee/label changes.
issue:close	Close issue/PR	Closes an issue or PR.	Review close reason or automation.
issue:reopen	Reopen issue/PR	Reopens an issue or PR.	Confirm the issue is still valid.
issue:delete	Delete issue/PR	Deletes an issue or PR.	Irreversible.
issue:lock	Lock issue/PR	Locks issue or PR comments.	Used for moderation.
issue:unlock	Unlock issue/PR	Unlocks issue or PR comments.	Restores commenting.
issue_comment:create	Create comment	Creates an issue/PR comment.	Comment content is recorded.
issue_comment:update	Update comment	Updates an issue/PR comment.	Track edit history.
issue_comment:delete	Delete comment	Deletes an issue/PR comment.	Irreversible.
pull:create	Create PR	Creates a pull request.	Record source/target branches.
pull:wip	Mark WIP	Marks a PR as WIP.	Affects merge readiness.
pull:remove_wip	Remove WIP	Removes WIP status from a PR.	Restores normal review flow.
pull:change_target_branch	Change target branch	Changes PR target branch.	Impacts review and merge policy.
pull:create_review_request	Request review	Creates a review request for a PR.	Assigns review responsibility.
pull:remove_review_request	Remove review request	Removes a review request.	Affects review flow.
pull:merge	Merge PR	Merges a pull request.	High risk; check branch protection.
pull_request_review:submit	Submit review	Submits a PR review.	Records review outcome and notes.
pull_request_review:dismiss	Dismiss review	Dismisses a PR review.	Confirm dismissal reason.
org:create	Create organization	Creates a new organization.	Impacts resource ownership.
org:delete	Delete organization	Deletes an organization.	Irreversible; confirm ownership handling.
org:rename	Rename organization	Renames an organization.	Impacts repository paths and refs.
org:update_settings	Update org settings	Updates organization configuration.	Monitor visibility and permission changes.
org:add_team	Add team	Creates an organization team.	Impacts permissions.
org:remove_team	Remove team	Deletes an organization team.	Team permissions are removed.
org:update_team	Update team	Updates an organization team.	Watch for permission changes.
org:add_team_member	Add team member	Adds a member to a team.	Changes access rights.
org:remove_team_member	Remove team member	Removes a member from a team.	Access rights are revoked.
org_app:create	Create org app	Creates an organization app.	Review scopes and callbacks.
org_app:delete	Delete org app	Deletes an organization app.	Grants are revoked.
org_app:update	Update org app	Updates an organization app.	Watch for callback changes.
org_app:grant_revoke	Grant/revoke org app	Grants or revokes org app access.	High impact on permissions.
org_webhook:create	Create org webhook	Creates an organization webhook.	Review callback URL and events.
org_webhook:delete	Delete org webhook	Deletes an organization webhook.	Event delivery stops.
org_webhook:update	Update org webhook	Updates an organization webhook.	Review URL/secret changes.
org_actions_secret:create	Create org Actions secret	Creates an organization Actions secret.	Secret value is masked.
org_actions_secret:delete	Delete org Actions secret	Deletes an organization Actions secret.	Workflows may fail afterward.
org_actions_secret:update	Update org Actions secret	Updates an organization Actions secret.	Updated value is not shown.
org_actions_variable:create	Create org Actions variable	Creates an organization Actions variable.	Variable value is plaintext.
org_actions_variable:delete	Delete org Actions variable	Deletes an organization Actions variable.	Workflows may fail afterward.
org_actions_variable:update	Update org Actions variable	Updates an organization Actions variable.	Track value changes.
org_label:create	Create org label	Creates an organization label.	Shared across org repositories.
org_label:update	Update org label	Updates an organization label.	Watch for name/color changes.
org_label:delete	Delete org label	Deletes an organization label.	Affects label associations.
org_protected_branch:create	Create org protected branch	Creates an org-level protected branch rule.	Impacts organization repository policies.
org_protected_branch:update	Update org protected branch	Updates org-level protected branch rule.	Monitor permission changes.
org_protected_branch:delete	Delete org protected branch	Deletes org-level protected branch rule.	Access restrictions may be relaxed.
org_project:create	Create org project	Creates an organization project board.	Impacts org-level planning.
org_project:update	Update org project	Updates an organization project board.	Watch column or permission changes.
org_project:close	Close org project	Closes an organization project board.	Becomes read-only.
org_project:reopen	Reopen org project	Reopens an organization project board.	Restores write access.
org_project:delete	Delete org project	Deletes an organization project board.	Irreversible.
system:update_settings	Update system settings	Updates system-level configuration.	Admin-only action.
system:update_webhook	Update system webhook	Updates a system webhook.	Review URL/secret changes.
system:run_maintenance_task	Run maintenance task	Runs a system maintenance task.	May impact performance or data.
system:update_site_announcement	Update site announcement	Updates the site announcement.	Review publish timing and content.
system:cleanup_expired_packages	Cleanup expired packages	Cleans up expired package records.	History is removed.
system:adopt_repositories	Adopt repositories	Adopts existing repositories into system management.	Impacts ownership and paths.
auth_source:create	Create auth source	Creates an auth source (LDAP/OAuth).	Affects login methods.
auth_source:update	Update auth source	Updates auth source configuration.	Validate configuration changes.
auth_source:delete	Delete auth source	Deletes an auth source configuration.	Related login method stops working.
system_app:create	Create system app	Creates a system-level application.	Scopes affect the whole instance.
system_app:delete	Delete system app	Deletes a system-level application.	Grants are revoked.
system_app:update	Update system app	Updates a system-level application.	Watch for callback changes.
system_webhook:create	Create system webhook	Creates a system webhook.	Affects global event delivery.
system_webhook:delete	Delete system webhook	Deletes a system webhook.	Global delivery stops.
system_webhook:update	Update system webhook	Updates a system webhook.	Review URL/secret changes.
system_default_webhook:create	Create default webhook	Creates a system default webhook.	Inherited by new repositories.
system_default_webhook:delete	Delete default webhook	Deletes a system default webhook.	No longer inherited.
system_default_webhook:update	Update default webhook	Updates a system default webhook.	Affects new repository defaults.
system_actions_variable:create	Create system Actions variable	Creates a system Actions variable.	Variable value is plaintext.
system_actions_variable:delete	Delete system Actions variable	Deletes a system Actions variable.	Workflows may fail afterward.
system_actions_variable:update	Update system Actions variable	Updates a system Actions variable.	Track value changes.
license:activate	Activate license	Activates the system license.	Records license changes.
license:update	Update license	Updates the system license.	Review expiry and entitlement changes.
license:delete	Delete license	Deletes the system license.	Features may be limited afterward.

Conclusion​

The new Audit Log feature brings enhanced security and operational transparency to the Gitea Enterprise. By offering an exhaustive report of who did what and when within your Gitea environment, it helps preventing unauthorized operations and ensures compliance with the necessary data protection regulations.