From 582b5cf83df3d561d0b38b369d076d0350d0d700 Mon Sep 17 00:00:00 2001 From: damocles Date: Wed, 19 Aug 2026 14:16:34 +0200 Subject: [PATCH] fix(#3500): make the swarm-controller forge account a site admin --- nix/host-modules/hive-forge/default.nix | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index f85eb089..87d1a50d 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -991,12 +991,22 @@ in set -euo pipefail # Idempotent by query, same reasoning as the SSO unit: assert - # the effect, not the command's exit code. + # the effect, not the command's exit code. `--admin`: the + # controller creates repos in the agents org on the swarm's + # behalf, which needs org-admin standing to do at all. Only + # applies to a fresh account — `forgejo admin` has no + # in-place "promote to admin" verb (checked: `admin user` + # offers create/list/change-password/delete/ + # generate-access-token/must-change-password/reset-mfa and + # nothing else), and mara's call was not to delete+recreate + # an already-provisioned non-admin account to work around + # that (every hive from before this fix has one) — she + # promotes those by hand instead. if ! forgejo admin user list | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then forgejo admin user create \ --username ${lib.escapeShellArg swarmControllerForgeUser} \ --email ${lib.escapeShellArg "${swarmControllerForgeUser}@hyperhive.local"} \ - --random-password --must-change-password=false + --admin --random-password --must-change-password=false echo "created forge account ${swarmControllerForgeUser}" fi if ! forgejo admin user list | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then