gitea: gate and judge every trunk the gate's source names, not main alone

The operator, 2026-10-28: the gates and trunk_rule apply to every trunk,
the branches the mesh installs from, and later there may be more than
main. The trunks are read at the call from mesh-delivery-gate's source,
in one function (trunksOf), and fall back to main, said, only when it
names none. A force-push onto any trunk is refused, and trunk_rule says
whether the branch asked is a trunk.

modules/gitea/test/protection-full.test.ts

@@ -23,6 +23,7 @@ beforeEach(() => {
     enable_status_check: false, status_check_contexts: [], block_admin_merge_override: false, required_approvals: 0,
     enable_push_whitelist: false, push_whitelist_deploy_keys: false, enable_force_push: false, enable_force_push_allowlist: false,
     force_push_allowlist_deploy_keys: false, merge_whitelist_teams: [] }];
+  source = {};
   repoState = { full_name: "novox/de-spiegel", default_branch: "master", description: "", has_wiki: true };
   sent = [];
 });
@@ -87,7 +88,11 @@ await new Promise<void>((r) => server.listen(0, "127.0.0.1", () => r()));
 after(() => new Promise<void>((r) => server.close(() => r())));
 const { port } = server.address() as { port: number };
 const url = `http://127.0.0.1:${port}`;
-const tools = getGiteaTools(new GiteaClient(url, new ConfiguredToken("tools-token")), () => new GiteaAdmin(url, "mesh-admin", "secret"));
+// The gate's source as the tools read it (mesh-delivery-gate.source): one key per trunk, each naming the repositories
+// installed from it. A test sets it; empty is a source that names no trunk of de-spiegel.
+let source: Record<string, { heads: Record<string, string> }> = {};
+const readSource = async () => source;
+const tools = getGiteaTools(new GiteaClient(url, new ConfiguredToken("tools-token")), () => new GiteaAdmin(url, "mesh-admin", "secret"), readSource);
 const setRepo = (args: Record<string, unknown>) =>
   tools.find((t) => t.name === "gitea_repo_settings_set_full")!.run({ owner: "novox", repo: "de-spiegel", why: "L2", ...args });
 const setFull = (args: Record<string, unknown>) =>
@@ -214,10 +219,32 @@ test("a force-push onto a rule covering main is refused, nothing sent; on anothe
   for (const args of [{ enable_force_push: true }, { enable_force_push: true, enable_force_push_allowlist: true },
     { force_push_allowlist_usernames: ["jschoubben"] }, { force_push_allowlist_teams: ["owners"] },
     { branch: "ma*", enable_force_push: true }, { branch: "**", force_push_allowlist_usernames: ["x"] }]) {
-    await assert.rejects(setFull(args), /force-push to main is the operator's/, JSON.stringify(args));
+    await assert.rejects(setFull(args), /force-push to a trunk is the operator's/, JSON.stringify(args));
   }
   assert.deepEqual(sent, []);
   await setFull({ branch: "release/*", enable_force_push: true });
   const tight: any = await setFull({ enable_force_push: false, force_push_allowlist_usernames: [] });
   assert.equal(tight.trunk_rule.holds, false, "trunk_rule is in the answer");
 });
+
+// The operator, 2026-10-28 16:5x: the gates and trunk_rule apply to every trunk, the branches the mesh installs from, as
+// the gate's source names them; "main" only when it names none, and said.
+test("a trunk the gate's source names, beta, is gated and judged as main is; main is then no trunk of the repository", async () => {
+  source = { main: { heads: { "novox/okioki": "a1" } }, beta: { heads: { "novox/de-spiegel": "b2" } } };
+  await assert.rejects(setFull({ branch: "beta", enable_force_push: true }), /force-push to a trunk is the operator's/);
+  await assert.rejects(setFull({ branch: "b*", force_push_allowlist_usernames: ["x"] }), /covers beta/);
+  assert.deepEqual(sent, []);
+  const main: any = await setFull({ enable_force_push: true });
+  assert.deepEqual(main.trunks, { names: ["beta"], from: "mesh-delivery-gate.source" });
+  assert.equal(main.trunk_rule.is_trunk, false);
+  const beta: any = await setFull({ branch: "beta", enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"], block_admin_merge_override: true });
+  assert.equal(beta.trunk_rule.is_trunk, true);
+  assert.equal(beta.trunk_rule.holds, true, beta.trunk_rule.why);
+});
+
+test("a source that names no trunk of the repository falls back to main, and says so", async () => {
+  const out: any = await setFull({ block_admin_merge_override: true });
+  assert.equal(out.trunks.names[0], "main");
+  assert.match(out.trunks.from, /names no trunk of novox\/de-spiegel: main assumed/);
+  assert.equal(out.trunk_rule.is_trunk, true);
+});