gate the actions unit on org repos (#37 / #125 M4) #169

Sammanfogat

supernaut sammanfogade 1 incheckning från feat/37-org-actions-gate in i main

2026-07-20 14:06:28 +00:00

supernaut kommenterad

2026-07-20 11:34:24 +00:00

Ägare

set_repo_actions now takes a users|orgs listing kind (the PATCH path is repos/<owner>/<repo> either way), and the org loop calls it: first-party/exempt orgs keep Actions on (they run the platform's own CI, ADR 0019); tenant orgs are default-denied until org-scoped runner entitlement automation lands (section 5). The per-org log line now shows the intended actions state.

Rendered + bash -n + ansible-lint clean. ⚠️ Touches gitborg-reconciler.sh.j2 (org-loop region) — #166 touches the members() region of the same file; whichever merges second rebases.

Closes #37; addresses #125 M4. Only user-owned repos were reconciled for Forgejo Actions; org repos were never touched, so a tenant org's repos kept CI (real OpenStack runner cost) indefinitely — a permanent default-deny bypass. `set_repo_actions` now takes a `users|orgs` listing kind (the PATCH path is `repos/<owner>/<repo>` either way), and the org loop calls it: first-party/exempt orgs keep Actions on (they run the platform's own CI, ADR 0019); tenant orgs are default-denied until org-scoped runner entitlement automation lands (section 5). The per-org log line now shows the intended actions state. Rendered + `bash -n` + ansible-lint clean. ⚠️ Touches `gitborg-reconciler.sh.j2` (org-loop region) — #166 touches the members() region of the same file; whichever merges second rebases.

supernaut tvångsskickade feat/37-org-actions-gate från 76d4da00c3

ci / ci (pull_request) Successful in 3m4s

Detaljer

till 0dd7d10611

ci / ci (pull_request) Has been cancelled

Detaljer

2026-07-20 12:09:51 +00:00

Jämför

supernaut tvångsskickade feat/37-org-actions-gate från 0dd7d10611

ci / ci (pull_request) Has been cancelled

Detaljer

till 91a8434655