fix(git-tools): issue-comment.sh resolves API base without monolith GITEA_URL #1502

Merged

fred merged 1 commits from fix/1450-issue-comment-url-fallback-v2 into next

2026-09-11 22:50:26 +00:00

Author	SHA1	Message	Date
fredandClaude Sonnet 5	5e37bfc3bd	fix(git-tools): issue-comment.sh resolves API base without monolith GITEA_URL (#1450 ) ci/woodpecker/pr/ci Pipeline was successful Details gitea_resolve_api_for_login() failed closed with "Configured Gitea URL not found for comment read-back verification" on seat-token-only hosts: no gitea-mosaicstack/gitea-usc credentials.sh entry and no bare GITEA_URL means get_gitea_url_for_host has nothing to match. issue-create.sh's REST fallback already proves the working trust model on these hosts -- derive the API base directly from the git remote's own resolved host, never a cross-host guess. Adds a regression case (seat identity resolved purely via MOSAIC_GIT_IDENTITY's per-slot token file, no monolith credentials.json entry for the host at all) asserting: no cross-host fallback, POST/GET/exact-id read-back all attributed to the seat identity (never a host-default identity that doesn't exist here), no temp-file leak, token never in curl argv. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01XCyecc8rPcp6mVSpRtfVGE	2026-09-11 17:22:23 -05:00

Author

SHA1

Message

Date

fredandClaude Sonnet 5

5e37bfc3bd

fix(git-tools): issue-comment.sh resolves API base without monolith GITEA_URL (#1450 )

ci/woodpecker/pr/ci Pipeline was successful

Details

gitea_resolve_api_for_login() failed closed with "Configured Gitea URL not
found for comment read-back verification" on seat-token-only hosts: no
gitea-mosaicstack/gitea-usc credentials.sh entry and no bare GITEA_URL means
get_gitea_url_for_host has nothing to match. issue-create.sh's REST fallback
already proves the working trust model on these hosts -- derive the API base
directly from the git remote's own resolved host, never a cross-host guess.

Adds a regression case (seat identity resolved purely via
MOSAIC_GIT_IDENTITY's per-slot token file, no monolith credentials.json entry
for the host at all) asserting: no cross-host fallback, POST/GET/exact-id
read-back all attributed to the seat identity (never a host-default identity
that doesn't exist here), no temp-file leak, token never in curl argv.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01XCyecc8rPcp6mVSpRtfVGE

2026-09-11 17:22:23 -05:00