fix(git-tools): admin-gated --no-ci-expected merge assertion for CI-less repositories

Conversation 1 Commits 2 Files Changed 6

+578 -11

2 Commits

Author	SHA1	Message	Date
code-be-01	187d70be12	fix(git-tools): refuse no-ci assertion without an attributable identity ci/woodpecker/pr/ci Pipeline was successful Details The --no-ci-expected admin-success path accepted an asserted-by=unknown pass when MOSAIC_GIT_IDENTITY was unset or empty, so the queue-clear assertion and its NO_CI_ASSERTED audit record named no one. Refuse such callers with a distinct ASSERTION_UNATTRIBUTABLE outcome (exit 78, audit recorded) before queue-clear and before the permission lookup, so an unattributable caller never triggers that network call. Document exit 78 in the usage text and the tools reference; pin the path with a regression case (admin stub + env -u MOSAIC_GIT_IDENTITY).	2026-08-23 12:52:44 -05:00
code-be-01	28f4002a70	fix(git-tools): add admin-gated --no-ci-expected merge assertion to ci-queue-wait A repository with no CI configured has no sanctioned wrapper merge path: the queue guard fails closed on zero status contexts for purpose=merge (exit 3). That fail-closed default stays correct, because at merge time no-status may also mean CI has not reported yet; but it left CI-less repos unmergeable without the break-glass override, which makes the override a gap rather than an exception. --no-ci-expected reclassifies only the zero-context case for merge as queue-clear, and only when the acting token holds repository admin. The elevation check reads the repository object's permissions.admin: the branch-head and combined-status responses the guard already fetches carry no permissions object at all. The assertion prints its own audit line (purpose, branch, asserting identity, reason) and writes a NO_CI_ASSERTED JSONL record to the existing audit sink; an unauditable pass is refused (exit 70). A non-admin caller is refused with exit 77 (ASSERTION_REFUSED, own text, audited), kept distinct from ASSERTED_NOT_READY's exit 3; an unavailable permissions lookup holds as CANNOT_ASSERT exit 75. --require-status contradicts the flag and is a usage error; a pending or failed context still holds or fails exactly as before; push behavior is unchanged. pr-merge.sh gains a pass-through --no-ci-expected that only forwards the flag to the guard invocation. PowerShell twins are unchanged: no existing test exercises their guard path (pr-merge.ps1 only runs with -SkipQueueGuard; ci-queue-wait.ps1 has no test). Closes #1372	2026-08-23 12:34:11 -05:00

Author

SHA1

Message

Date

code-be-01

187d70be12

fix(git-tools): refuse no-ci assertion without an attributable identity

ci/woodpecker/pr/ci Pipeline was successful

Details

The --no-ci-expected admin-success path accepted an asserted-by=unknown
pass when MOSAIC_GIT_IDENTITY was unset or empty, so the queue-clear
assertion and its NO_CI_ASSERTED audit record named no one. Refuse such
callers with a distinct ASSERTION_UNATTRIBUTABLE outcome (exit 78, audit
recorded) before queue-clear and before the permission lookup, so an
unattributable caller never triggers that network call. Document exit 78
in the usage text and the tools reference; pin the path with a
regression case (admin stub + env -u MOSAIC_GIT_IDENTITY).

2026-08-23 12:52:44 -05:00

code-be-01

28f4002a70

fix(git-tools): add admin-gated --no-ci-expected merge assertion to ci-queue-wait

A repository with no CI configured has no sanctioned wrapper merge
path: the queue guard fails closed on zero status contexts for
purpose=merge (exit 3). That fail-closed default stays correct, because
at merge time no-status may also mean CI has not reported yet; but it
left CI-less repos unmergeable without the break-glass override, which
makes the override a gap rather than an exception.

--no-ci-expected reclassifies only the zero-context case for merge as
queue-clear, and only when the acting token holds repository admin.
The elevation check reads the repository object's permissions.admin:
the branch-head and combined-status responses the guard already
fetches carry no permissions object at all. The assertion prints its
own audit line (purpose, branch, asserting identity, reason) and
writes a NO_CI_ASSERTED JSONL record to the existing audit sink; an
unauditable pass is refused (exit 70). A non-admin caller is refused
with exit 77 (ASSERTION_REFUSED, own text, audited), kept distinct
from ASSERTED_NOT_READY's exit 3; an unavailable permissions lookup
holds as CANNOT_ASSERT exit 75. --require-status contradicts the flag
and is a usage error; a pending or failed context still holds or
fails exactly as before; push behavior is unchanged.

pr-merge.sh gains a pass-through --no-ci-expected that only forwards
the flag to the guard invocation. PowerShell twins are unchanged: no
existing test exercises their guard path (pr-merge.ps1 only runs with
-SkipQueueGuard; ci-queue-wait.ps1 has no test).

Closes #1372

2026-08-23 12:34:11 -05:00

fix(git-tools): admin-gated --no-ci-expected merge assertion for CI-less repositories #1373