mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

framework tools/git: grant-reviewer.sh — grant a reviewer seat repo access via an org team #1415

New Issue
Closed
opened 2026-08-25 01:29:44 +00:00 by fred · 0 comments
fred commented 2026-08-25 01:29:44 +00:00
Collaborator
Copy Link
Copy Source

What

Add `packages/mosaic/framework/tools/git/grant-reviewer.sh`: an idempotent admin tool that grants a reviewer seat read+review access to a repo through a Gitea org team, so a reviewer-cannot-read-the-repo block (gate 16 dependency) is a one-command fix instead of a hand-built API sequence.

Field origin: a reviewer seat had no read access to a private repo, which blocked an independent review for days across sessions. The grant needed a team create + member add + repo add sequence assembled by hand under an org-admin token. A generalized operator-tree version now exists and works; this issue proposes the firewall-clean framework port.

Behavior

  • `grant-reviewer.sh -u [-r /] [-t ]`
    • `-r` defaults to the current repo's origin; owner must be an org (teams are org-scoped)
    • `-t` defaults to `fleet-reviewers`
  • Gitea only. On `PLATFORM=github`, exit with a clear "Gitea only" error (GitHub collaborator invites are a different model; out of scope).
  • Host and token resolve exactly like the other wrappers: source `detect-platform.sh`, use the tea-login helpers (`get_gitea_login_for_host` etc.), honor `GITEA_LOGIN` override. No hardcoded hosts, no token files of its own.
  • Idempotent: team looked up first, created only if missing with `permission: read` and `units_map {repo.code: read, repo.issues: write, repo.pulls: write}`; member add and repo add are PUTs, safe to repeat.
  • Verify by read-back and fail closed: after the PUTs, GET the team members and team repos and assert the reviewer and repo are present (same fail-closed read-back discipline as `issue-comment.sh`).
  • The acting token needs org admin; a 403 must surface as "org admin required on ", not a silent partial grant.

Notes

  • `framework-manifest.txt`: confirm `tools/git/**` is already framework-owned (expected; no manifest change if so).
  • Reference implementation exists in an operator tree; port the logic, not the operator pins.
## What Add \`packages/mosaic/framework/tools/git/grant-reviewer.sh\`: an idempotent admin tool that grants a reviewer seat read+review access to a repo through a Gitea org team, so a reviewer-cannot-read-the-repo block (gate 16 dependency) is a one-command fix instead of a hand-built API sequence. Field origin: a reviewer seat had no read access to a private repo, which blocked an independent review for days across sessions. The grant needed a team create + member add + repo add sequence assembled by hand under an org-admin token. A generalized operator-tree version now exists and works; this issue proposes the firewall-clean framework port. ## Behavior - \`grant-reviewer.sh -u <reviewer-login> [-r <owner>/<repo>] [-t <team>]\` - \`-r\` defaults to the current repo's origin; owner must be an org (teams are org-scoped) - \`-t\` defaults to \`fleet-reviewers\` - Gitea only. On \`PLATFORM=github\`, exit with a clear "Gitea only" error (GitHub collaborator invites are a different model; out of scope). - Host and token resolve exactly like the other wrappers: source \`detect-platform.sh\`, use the tea-login helpers (\`get_gitea_login_for_host\` etc.), honor \`GITEA_LOGIN\` override. No hardcoded hosts, no token files of its own. - Idempotent: team looked up first, created only if missing with \`permission: read\` and \`units_map {repo.code: read, repo.issues: write, repo.pulls: write}\`; member add and repo add are PUTs, safe to repeat. - Verify by read-back and fail closed: after the PUTs, GET the team members and team repos and assert the reviewer and repo are present (same fail-closed read-back discipline as \`issue-comment.sh\`). - The acting token needs org admin; a 403 must surface as "org admin required on <org>", not a silent partial grant. ## Notes - \`framework-manifest.txt\`: confirm \`tools/git/**\` is already framework-owned (expected; no manifest change if so). - Reference implementation exists in an operator tree; port the logic, not the operator pins.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1415