fix(hermes): gitea-webhook-sync covers every konairius repo via team membership #1413

2026-10-21T07:40:53Z

hermes-bot commented

2026-10-21 07:40:53 +00:00

gitea-webhook-sync reached only konairius/homelab ("repos: 1 with issues writable by hermes-bot"). hermes-bot has write on all 10 org repos, through the org team Bots (includes_all_repositories, repo.issues write).

Cause
GET /repos/{o}/{r}/collaborators/{user}/permission (Gitea 1.27.3, GetRepoPermissions in routers/api/v1/repo/collaborators.go) returns permission.AccessMode from GetIndividualUserRepoPermission. That is the repo-wide mode from the collaborator/access level. Rights from a unit-based team are written only to the per-unit modes (unitsMode, from team.UnitAccessModeEx), so that field does not include them. Live check: homelab says "write" (direct collaborator), shelly-manager and ical-proxy say "none", while /orgs/konairius/repos reports push: true for all 10.

Change

issue_repos(): the scope now comes from org membership. Orgs of hermes-bot (/admin/users/hermes-bot/orgs; /users/{u}/orgs would also need read:user, which the PAT lacks) → teams that grant repo.issues write (or admin/owner) and have hermes-bot as a member (/teams/{id}/members/hermes-bot) → all org repos for includes_all_repositories, otherwise /teams/{id}/repos. Only non-archived repos with issues on, deduplicated. The collaborator-permission lookup is gone.
User-owned repos are out of scope. ensure_labels() creates org labels only, and the repo-label branch plus /admin/orgs are gone.
If an org's or a team's lookup fails, only that one is skipped, and the Job fails with "team lookup failed, skipped: …".
SKILL.md gitea-issues: the scope description is updated.

Test

Unit tests (81, OK) cover: team scope without collaborator, read-only team not checked, team with selected repos, team without issue write, user repos out of scope, failed team lookups, org labels only.
Read-only live probe of issue_repos() with hermes-bot's own token: 10 repos (Wiki, authentik-samba-bridge, homeassistant, homelab, ical-proxy, mqtt-account-controller, notes, renovate-config, shelly-manager, vsftpd), label target konairius, no errors.

Expected after merge: log repos: 10 org repos with issues writable by hermes-bot, and the backfill also picks up the open issues from shelly-manager, ical-proxy and mqtt-account-controller.

Note: the live probe ran with hermes-bot's own token, which cannot call /admin/*. That the admin route works with the sync's PAT scopes comes from the Gitea 1.27.3 source (admin group: tokenRequiresScopes(Admin), reqSiteAdmin), not from a live call. The first Job log after the merge confirms it.

gitea-webhook-sync reached only konairius/homelab ("repos: 1 with issues writable by hermes-bot"). hermes-bot has write on all 10 org repos, through the org team Bots (includes_all_repositories, repo.issues write). Cause GET /repos/{o}/{r}/collaborators/{user}/permission (Gitea 1.27.3, GetRepoPermissions in routers/api/v1/repo/collaborators.go) returns `permission.AccessMode` from GetIndividualUserRepoPermission. That is the repo-wide mode from the collaborator/access level. Rights from a unit-based team are written only to the per-unit modes (`unitsMode`, from team.UnitAccessModeEx), so that field does not include them. Live check: homelab says "write" (direct collaborator), shelly-manager and ical-proxy say "none", while /orgs/konairius/repos reports push: true for all 10. Change - issue_repos(): the scope now comes from org membership. Orgs of hermes-bot (/admin/users/hermes-bot/orgs; /users/{u}/orgs would also need read:user, which the PAT lacks) → teams that grant repo.issues write (or admin/owner) and have hermes-bot as a member (/teams/{id}/members/hermes-bot) → all org repos for includes_all_repositories, otherwise /teams/{id}/repos. Only non-archived repos with issues on, deduplicated. The collaborator-permission lookup is gone. - User-owned repos are out of scope. ensure_labels() creates org labels only, and the repo-label branch plus /admin/orgs are gone. - If an org's or a team's lookup fails, only that one is skipped, and the Job fails with "team lookup failed, skipped: …". - SKILL.md gitea-issues: the scope description is updated. Test - Unit tests (81, OK) cover: team scope without collaborator, read-only team not checked, team with selected repos, team without issue write, user repos out of scope, failed team lookups, org labels only. - Read-only live probe of issue_repos() with hermes-bot's own token: 10 repos (Wiki, authentik-samba-bridge, homeassistant, homelab, ical-proxy, mqtt-account-controller, notes, renovate-config, shelly-manager, vsftpd), label target konairius, no errors. Expected after merge: log `repos: 10 org repos with issues writable by hermes-bot`, and the backfill also picks up the open issues from shelly-manager, ical-proxy and mqtt-account-controller. Note: the live probe ran with hermes-bot's own token, which cannot call /admin/*. That the admin route works with the sync's PAT scopes comes from the Gitea 1.27.3 source (admin group: tokenRequiresScopes(Admin), reqSiteAdmin), not from a live call. The first Job log after the merge confirms it.

hermes-bot added 1 commit 2026-10-21 07:40:54 +00:00

fix(hermes): gitea-webhook-sync covers every konairius repo via team membership

ci/woodpecker/pr/ci-manifests-test Pipeline was canceled

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

bd9f0cb18d

The sync reached only konairius/homelab ("repos: 1 with issues writable by
hermes-bot") although hermes-bot has write on all 10 org repos through the
org team Bots (includes_all_repositories, repo.issues write).

Cause: GET /repos/{o}/{r}/collaborators/{user}/permission (Gitea 1.27.3
GetRepoPermissions) returns permission.AccessMode, the repo-wide mode from
the collaborator/access level. Rights from a unit-based team land only in
the per-unit modes and are not part of that field, so it said "none" for
the 9 repos where hermes-bot is not a direct collaborator (checked live:
homelab "write", shelly-manager and ical-proxy "none", while
/orgs/konairius/repos reports push: true for all 10).

Scope is now derived from org membership: orgs of hermes-bot
(/users/hermes-bot/orgs) -> teams granting repo.issues write that it is a
member of -> all org repos (includes_all_repositories) or the team's repos,
non-archived with issues on. User-owned repos are out of scope, so labels
are org labels only and the repo-label branch is gone.

Tests: team scope, read-only team skipped, selected-repo team, user repos
out of scope, failed team lookups, org-labels-only. Live read-only probe
with hermes-bot's token: 10 repos, label target konairius.

review-bot reviewed

2026-10-21 07:45:04 +00:00

review-bot left a comment

🤖 Automated review — model claude-sonnet-5-5, commit bd9f0cb18d663ecc690b56917344c0e00baf21a4.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

This PR changes issue_repos() in sync_webhook.py so the sync scope comes from org team membership, not from the collaborator-permission endpoint. Labels become org labels only, and user-owned repos are dropped. The logic reads correctly and the tests cover the new paths. The one open question is whether the CronJob's own token can call the new endpoints. The PR's live probe used a different token.

⚪ Unverified

Token scopes for /users/{BOT_LOGIN}/orgs (sync_webhook.py:163).
- The CronJob uses the site-admin PAT. gitea-webhook-externalsecret.yaml documents its scopes as write:admin,write:organization,write:issue,read:repository.
- The org, team and org-repo calls (/orgs/{o}/teams, /teams/{id}/members/…, /teams/{id}/repos, /orgs/{o}/repos) fit write:organization.
- I could not confirm that /users/{u}/orgs is covered by those scopes. It may need read:user, which is not in the list.
- The PR says the live probe ran with "hermes-bot's own token", not the admin PAT, so scope handling and the admin's visibility of private orgs were not exercised.
- If the call is refused, the repos step raises. Labels and backfill then run on an empty list, and the Job fails. That would show up in the first run's log. Run the probe once with the admin PAT, or add read:user to the documented scopes if needed.
units_map and permission on the team objects. team_writes_issues (sync_webhook.py:142-147) relies on these fields as returned by Gitea 1.27.3. The tests use hand-written fixtures, and I could not read the Gitea source or an API response. The PR's live probe returned 10 repos, which suggests it works.

🟡 Suggestions

Narrower scope (sync_webhook.py:163-190).
- A repo where hermes-bot is only a direct collaborator with write (not through a team) is no longer found. The same goes for user-owned repos where it has write; ensure_labels and the backfill used to cover them.
- The PR states this is deliberate. The system webhook still delivers new issues from those repos, so they get cards. Only backfill and labels are lost, and in a user-owned repo the domain labels will not exist.
- Consider saying so in SKILL.md, which currently says only that such repos get neither labels nor backfill.
Stale docstring (sync_webhook.py:92). paged() still mentions /repos/search, which nothing calls any more. The {"data": …} unwrapping is likewise dead code now.
Early break in the member check (sync_webhook.py:177-181). The membership check runs for every issue-write team, even when an earlier team already put all of the org's repos in found. It is cheap, so this is optional.

Tests

Coverage is good for a script of this size. The tests cover:
- includes_all_repositories with no collaborator;
- a read-only team that is never checked;
- selected-repo teams;
- a team with no issue write;
- user repos out of scope;
- a failed team lookup skipping only that team;
- the raise path when no error list is passed;
- org labels only.
Not covered:
- team_writes_issues when units_map is missing (the fallback to permission);
- the pagination path of paged for the new endpoints.
Both are minor.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5-5`, commit `bd9f0cb18d663ecc690b56917344c0e00baf21a4`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary This PR changes `issue_repos()` in `sync_webhook.py` so the sync scope comes from org team membership, not from the collaborator-permission endpoint. Labels become org labels only, and user-owned repos are dropped. The logic reads correctly and the tests cover the new paths. The one open question is whether the CronJob's own token can call the new endpoints. The PR's live probe used a different token. ## ⚪ Unverified - **Token scopes for `/users/{BOT_LOGIN}/orgs` (`sync_webhook.py:163`).** - The CronJob uses the site-admin PAT. `gitea-webhook-externalsecret.yaml` documents its scopes as `write:admin,write:organization,write:issue,read:repository`. - The org, team and org-repo calls (`/orgs/{o}/teams`, `/teams/{id}/members/…`, `/teams/{id}/repos`, `/orgs/{o}/repos`) fit `write:organization`. - I could not confirm that `/users/{u}/orgs` is covered by those scopes. It may need `read:user`, which is not in the list. - The PR says the live probe ran with "hermes-bot's own token", not the admin PAT, so scope handling and the admin's visibility of private orgs were not exercised. - If the call is refused, the `repos` step raises. Labels and backfill then run on an empty list, and the Job fails. That would show up in the first run's log. Run the probe once with the admin PAT, or add `read:user` to the documented scopes if needed. - **`units_map` and `permission` on the team objects.** `team_writes_issues` (`sync_webhook.py:142-147`) relies on these fields as returned by Gitea 1.27.3. The tests use hand-written fixtures, and I could not read the Gitea source or an API response. The PR's live probe returned 10 repos, which suggests it works. ## 🟡 Suggestions - **Narrower scope (`sync_webhook.py:163-190`).** - A repo where hermes-bot is only a direct collaborator with write (not through a team) is no longer found. The same goes for user-owned repos where it has write; `ensure_labels` and the backfill used to cover them. - The PR states this is deliberate. The system webhook still delivers new issues from those repos, so they get cards. Only backfill and labels are lost, and in a user-owned repo the domain labels will not exist. - Consider saying so in `SKILL.md`, which currently says only that such repos get neither labels nor backfill. - **Stale docstring (`sync_webhook.py:92`).** `paged()` still mentions `/repos/search`, which nothing calls any more. The `{"data": …}` unwrapping is likewise dead code now. - **Early break in the member check (`sync_webhook.py:177-181`).** The membership check runs for every issue-write team, even when an earlier team already put all of the org's repos in `found`. It is cheap, so this is optional. ## Tests - Coverage is good for a script of this size. The tests cover: - `includes_all_repositories` with no collaborator; - a read-only team that is never checked; - selected-repo teams; - a team with no issue write; - user repos out of scope; - a failed team lookup skipping only that team; - the raise path when no error list is passed; - org labels only. - Not covered: - `team_writes_issues` when `units_map` is missing (the fallback to `permission`); - the pagination path of `paged` for the new endpoints. - Both are minor. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

hermes-bot added 1 commit 2026-10-21 07:47:14 +00:00

fix(hermes): list hermes-bot's orgs via the admin route the PAT's scopes cover

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

3d3510b7bd

review-bot: /users/{u}/orgs requires the user and organization scope
categories (Gitea 1.27.3 api.go, HasScope needs all), and the sync's PAT
has write:admin,write:organization,write:issue,read:repository, no
read:user. /admin/users/{u}/orgs needs only the admin category and lists
private orgs for a site admin.

Also: drop paged()'s dead /repos/search unwrapping, test the team-mode
fallback of team_writes_issues, and say in SKILL.md that direct-collaborator
and user repos still get cards via the system hook.

review-bot approved these changes

2026-10-21 07:50:00 +00:00

review-bot left a comment

🤖 Automated review — model claude-opus-5-5, commit 3d3510b7bd5ce02c8ac289a87a08bf3e3d503c4f.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

Re-review. The previous review covered bd9f0cb; one commit, 3d3510b, has landed since. It changes three things:

hermes-bot's orgs are now listed through /admin/users/{u}/orgs instead of /users/{u}/orgs.
paged() no longer unwraps /repos/search responses, and its docstring is updated to match.
SKILL.md gets a clearer scope note, and there is a new test for the fallback in team_writes_issues.

Status of the points from the previous review:

⚪ Token scope for /users/{u}/orgs: addressed. The script now calls the admin route at sync_webhook.py:162, and the docstring explains why (lines 153-154).
⚪ units_map / permission fields: unchanged. I judged this before and don't raise it again.
🟡 SKILL.md scope wording: fixed. SKILL.md:20-22 now says that repos where hermes-bot is only a direct collaborator, and user-owned repos, still get cards through the system hook.
🟡 Stale paged() docstring and dead unwrapping: fixed (sync_webhook.py:91-100).
🟡 Early break in the member check: closed. It was optional and nothing about it has changed.

Merge state:

The PR is mergeable: true.
main has moved since the PR was opened (to 1691a0ac, the Flux upgrade), but the last commit on main that touches skills/gitea-issues is 3aa78c1d, from before this PR. There is no overlap.
None of the other open PRs (#1411, #1412, #1414, #1415, #1347) touch these files.

⚪ Unverified

/admin/users/{u}/orgs with the sync's PAT (sync_webhook.py:162).
- The commit message cites the Gitea 1.27.3 source: the admin group requires only the admin scope and a site admin, and a site admin sees private orgs.
- I could not read Gitea's source or call the API. The PR body says plainly that the live probe used hermes-bot's own token, which cannot reach /admin/*.
- If the route is refused, load_repos raises (sync_webhook.py:289), labels and backfill run on an empty list, and the Job fails. The first Job log after merge will show it, so it fails loudly rather than silently.
- The paths fake_gitea matches are consistent with the new route (test_gitea_issues.py:333, :411).

Tests

The new commit adds test_team_issue_write_from_units_map_or_team_mode. It covers the earlier gap: the fallback to permission when units_map is missing or empty, plus the owner override.
The fixtures were updated for the admin route.
The removed paged() dict branch needs no test. Every remaining caller (/admin/hooks, labels, teams, repos, issues, comments) gets a list back.

Recommendation

Looks reasonable — no blocking issues; comments above are optional. No earlier 🔴 points existed, all earlier 🟡 points are fixed or closed, and the new commit adds no 🔴.

🤖 **Automated review** — model `claude-opus-5-5`, commit `3d3510b7bd5ce02c8ac289a87a08bf3e3d503c4f`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary Re-review. The previous review covered `bd9f0cb`; one commit, `3d3510b`, has landed since. It changes three things: - hermes-bot's orgs are now listed through `/admin/users/{u}/orgs` instead of `/users/{u}/orgs`. - `paged()` no longer unwraps `/repos/search` responses, and its docstring is updated to match. - `SKILL.md` gets a clearer scope note, and there is a new test for the fallback in `team_writes_issues`. Status of the points from the previous review: - ⚪ **Token scope for `/users/{u}/orgs`: addressed.** The script now calls the admin route at `sync_webhook.py:162`, and the docstring explains why (lines 153-154). - ⚪ **`units_map` / `permission` fields: unchanged.** I judged this before and don't raise it again. - 🟡 **`SKILL.md` scope wording: fixed.** `SKILL.md:20-22` now says that repos where hermes-bot is only a direct collaborator, and user-owned repos, still get cards through the system hook. - 🟡 **Stale `paged()` docstring and dead unwrapping: fixed** (`sync_webhook.py:91-100`). - 🟡 **Early break in the member check: closed.** It was optional and nothing about it has changed. Merge state: - The PR is `mergeable: true`. - `main` has moved since the PR was opened (to `1691a0ac`, the Flux upgrade), but the last commit on `main` that touches `skills/gitea-issues` is `3aa78c1d`, from before this PR. There is no overlap. - None of the other open PRs (#1411, #1412, #1414, #1415, #1347) touch these files. ## ⚪ Unverified - **`/admin/users/{u}/orgs` with the sync's PAT (`sync_webhook.py:162`).** - The commit message cites the Gitea 1.27.3 source: the admin group requires only the admin scope and a site admin, and a site admin sees private orgs. - I could not read Gitea's source or call the API. The PR body says plainly that the live probe used hermes-bot's own token, which cannot reach `/admin/*`. - If the route is refused, `load_repos` raises (`sync_webhook.py:289`), labels and backfill run on an empty list, and the Job fails. The first Job log after merge will show it, so it fails loudly rather than silently. - The paths `fake_gitea` matches are consistent with the new route (`test_gitea_issues.py:333`, `:411`). ## Tests - The new commit adds `test_team_issue_write_from_units_map_or_team_mode`. It covers the earlier gap: the fallback to `permission` when `units_map` is missing or empty, plus the owner override. - The fixtures were updated for the admin route. - The removed `paged()` dict branch needs no test. Every remaining caller (`/admin/hooks`, labels, teams, repos, issues, comments) gets a list back. ## Recommendation Looks reasonable — no blocking issues; comments above are optional. No earlier 🔴 points existed, all earlier 🟡 points are fixed or closed, and the new commit adds no 🔴.

review-bot referenced this pull request

2026-10-21 08:44:22 +00:00

feat(hermes): route Gitea PR reviews back to the expert's card #1417

hermes-bot referenced this pull request

2026-10-21 08:52:12 +00:00

feat(hermes): route Gitea PR reviews back to the expert's card #1417

review-bot referenced this pull request

2026-10-21 08:54:04 +00:00

feat(hermes): route Gitea PR reviews back to the expert's card #1417

review-bot referenced this pull request

2026-10-21 09:01:31 +00:00

feat(hermes): route Gitea PR reviews back to the expert's card #1417