novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

gitea: the merging account writes every repository that builds a registered module, read from the indexer's modules (issue 1945)

Browse Source 
car-hunter #2 was approved and its commit status refused 403: mesh-tools only read the
repositories of a user. It is now a write collaborator on each repository the indexer's
modules state names (watched over the bus: at the start and on each registration), read
back and said as gitea.repo.writable; the operator's other repositories stay read-only.
gitea_grant_write and gitea_unwritable_repos do and show it by hand; gitea_commit_statuses
answers merge.writes.
This commit is contained in:
jschoubben
2026-10-26 16:36:50 +01:00
parent 6b6d5cba71
commit 52de4c320e
7 changed files with 382 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/gitea/tools/index.ts
+12 -2
View File
@@ -492,7 +492,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
},
{
name: "gitea_commit_statuses",
description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success; for a pull request, also the forge's own mergeable (false while it is in conflict with its base or the forge is still working that out). Reads only.",
description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success; for a pull request, also the forge's own mergeable (false while it is in conflict with its base or the forge is still working that out); and merge.writes, whether the mesh's merging account may write the repository at all (false: its statuses and its merge are refused until gitea_grant_write). Reads only.",
input: {
owner: { type: "string", description: "the repository owner" },
repo: { type: "string", description: "the repository name" },
@@ -528,8 +528,18 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
} catch (err) {
unreadable = err instanceof Error ? err.message : String(err);
}
// Whether this account may write the repository at all (issue 1945): a commit status and a merge need it, and a
// repository of a user it only reads refuses both 403. Not said when the forge would not answer.
let writes: boolean | undefined;
try {
writes = (await gitea.getRepo(owner, repo)).writes;
} catch {
writes = undefined;
}
const merge = mergeableUnder(base, rule, statuses, unreadable);
return { commit: combined.sha || ref, pull, combined: combined.state, statuses,
merge: mergeableUnder(base, rule, statuses, unreadable) };
merge: writes === undefined ? merge : { ...merge, writes,
...(writes ? {} : { cannot_write: `the forge account cannot write ${owner}/${repo}: gitea_grant_write` }) } };
},
},
{