vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2287): use is_conflict (409-only) for team create, supply explicit units

Browse source
This commit is contained in:
atlas 2026-07-10 01:19:53 +02:00 • committed by mara
commit beaa220dc2
1 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

30
hive-c0re/src/forge/repos.rs
View file

@ -561,7 +561,7 @@ async fn ensure_mirror_repo(
/// merge/approval whitelist; the operator adds herself as a member via the
/// forge UI / hivectl. `includes_all_repositories` so the gate applies to
/// every repo in the org; `write` is enough to approve + merge. hive-c0re
/// never manages membership. Idempotent (422/409 = already exists).
/// never manages membership. Idempotent (409 = already exists).
///
/// Must run for BOTH [`AGENTS_ORG`] and [`CONFIG_ORG`]: Gitea teams are
/// org-scoped, so a config-repo branch-protection rule referencing
@ -569,14 +569,33 @@ async fn ensure_mirror_repo(
/// there 422'd every `apply_config_repo_branch_protection`, leaving config
/// repos unprotected — operator-merged config PRs then bypassed the deploy
/// pipeline and silently didn't apply.
///
/// Uses `is_conflict` (409 only) — NOT `is_already_exists` (which also
/// folds 422 into "already exists"). A 422 from `org_create_team` is a
/// real validation error (bad request shape, missing units, etc.) that
/// must surface so it can be fixed; the previous 422-swallowing hid the
/// true cause and left the team silently uncreated every boot.
pub(super) async fn ensure_operators_team(org: &str, token: &str) -> Result<()> {
// Explicit units so Forgejo doesn't reject a null/absent units field.
// A `write`-permission team needs at minimum repo.code and repo.pulls
// to review and merge PRs. Include the full standard set so members
// can see the whole repo surface.
let units = Some(vec![
"repo.code".to_owned(),
"repo.issues".to_owned(),
"repo.pulls".to_owned(),
"repo.releases".to_owned(),
"repo.wiki".to_owned(),
"repo.projects".to_owned(),
"repo.packages".to_owned(),
]);
let team = CreateTeamOption {
can_create_org_repo: Some(false),
description: Some("hyperhive operators — merge gate for agent repos".to_owned()),
includes_all_repositories: Some(true),
name: OPERATORS_TEAM.to_owned(),
permission: Some(CreateTeamOptionPermission::Write),
units: None,
units,
units_map: None,
};
match api(token)?.org_create_team(org, team).await {
@ -584,10 +603,15 @@ pub(super) async fn ensure_operators_team(org: &str, token: &str) -> Result<()>
tracing::info!(%org, "forge: created {OPERATORS_TEAM} team");
Ok(())
}
Err(e) if is_already_exists(&e) => {
// 409: team already exists — idempotent.
Err(e) if is_conflict(&e) => {
tracing::debug!(%org, "forge: {OPERATORS_TEAM} team already exists");
Ok(())
}
// 422 and any other error: surface it — don't mask a real failure
// as "already exists". A 422 here typically means the request body
// is invalid (e.g. Forgejo rejected the units list or another
// field); it will repeat every boot until fixed.
Err(e) => Err(e).with_context(|| format!("create team {org}/{OPERATORS_TEAM}")),
}
}