Files

T

ci/woodpecker/pr/ci Pipeline was successful

Details

fix(#1320 ): placeholder-ize private-network topology, drop raw-curl force-merge recipe

Implements the rev-security-01 verdict on #1320 (comment 23282):

Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos
section shipped a working recipe for both failure modes the estate removes
identity that is not the actor's (a legacy shared credential path,
~/.config/mosaic/credentials/gitea.env, which no longer exists in the
credential system) and a quality gate routed around (raw curl +
force_merge:true, no queue guard, no head pin). Replaced with wrapper-only
merge guidance: protection blocks are signals to fix, not to bypass.

Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one
more than the verdict's five — the original scan missed guides/):
- skills/mosaic-portainer: Portainer URL, Docker host
- skills/mosaic-gitea: SSH resolution target
- skills/mosaic-deploy: Docker node, stack-name map (now generic example
  shape; estate mappings belong in skills-local overrides, which link with
  precedence)
- tools/coolify/README: base URL
- guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the
  RFC 5737 documentation range (192.0.2.5), the unambiguous example form

Left as-is per the verdict's split: estate DNS endpoints (e.g.
git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples.

Rescan of the whole shipped framework tree for RFC1918, estate hosts, and
stack-name patterns: zero remaining hits. The gate defect itself is filed
separately as #1321 (cross-referenced on #1320, comment 23285).

2026-08-19 15:54:44 -05:00

4.5 KiB

Raw Blame History

name, description

name	description
mosaic-gitea	Interact with Gitea repositories on git.mosaicstack.dev — create/merge/close PRs, manage issues, milestones, and CI queue waits. Use when working with Mosaic Stack git repos. Wraps scripts in ~/.config/mosaic/tools/git/. Works on both Gitea and GitHub (auto-detected via detect-platform.sh).

mosaic-gitea

Git operations via Mosaic wrapper scripts. Platform-aware (Gitea or GitHub).

Setup

Scripts auto-detect platform from git remote. Run from inside the repo directory.

For force-merge (branch protection bypass):

GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)

Or use the credentials loader:

source ~/.config/mosaic/tools/_lib/credentials.sh
load_credentials gitea-mosaicstack
# Exports: GITEA_TOKEN, GITEA_URL

Script Reference

All scripts in ~/.config/mosaic/tools/git/.

Pull Requests

Script	Purpose	Key flags
`pr-create.sh`	Create a PR	`-t "Title" [-b "Body"] [-B base] [-H head] [-i issue#]`
`pr-list.sh`	List open PRs	`[-s state]`
`pr-view.sh`	View PR details	`-n <pr#>`
`pr-merge.sh`	Squash-merge a PR	`-n <pr#> [-d]` (delete branch)
`pr-close.sh`	Close a PR	`-n <pr#>`
`pr-diff.sh`	Show PR diff	`-n <pr#>`
`pr-review.sh`	Submit a review	`-n <pr#> [-a approve\|request-changes]`
`pr-ci-wait.sh`	Wait for CI on PR	`-n <pr#>`
`pr-metadata.sh`	Get PR metadata as JSON	`-n <pr#>`

Issues

Script	Purpose	Key flags
`issue-create.sh`	Create an issue	`-t "Title" [-b "Body"] [-l labels] [-m milestone]`
`issue-list.sh`	List issues	`[-s state] [-l label]`
`issue-view.sh`	View issue	`-n <issue#>`
`issue-close.sh`	Close issue	`-n <issue#>`
`issue-comment.sh`	Add comment	`-n <issue#> -c "Comment"`
`issue-assign.sh`	Assign issue	`-n <issue#> -u username`
`issue-edit.sh`	Edit issue	`-n <issue#> [-t title] [-b body]`

Milestones

Script	Purpose	Key flags
`milestone-create.sh`	Create milestone	`-t "Title" [-d "due date"]`
`milestone-list.sh`	List milestones	—
`milestone-close.sh`	Close milestone	`-n <number>`

CI / Queue

Script	Purpose	Key flags
`ci-queue-wait.sh`	Wait for CI queue slot	`[-t timeout] [-B branch]`
`detect-platform.sh`	Detect git platform	outputs `gitea` or `github`

Common Workflows

Create PR from current branch:

cd ~/src/<repo>
~/.config/mosaic/tools/git/pr-create.sh -t "feat: my feature" -b "Description" -i <issue#>

Merge a PR (squash, with CI queue guard):

cd ~/src/<repo>
~/.config/mosaic/tools/git/pr-merge.sh -n <pr#> -d

Force-merge bypassing branch protection:

GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
curl -X POST "https://git.mosaicstack.dev/api/v1/repos/<org>/<repo>/pulls/<PR>/merge" \
  -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
  -d '{"Do":"squash","force_merge":true}'

Notes

Mosaic policy: squash merges only, targeting main
Gitea SSH: [email protected] → resolves via ~/.ssh/config to the Gitea host's SSH port (e.g. gitea.example.internal:2222)
Workers push branches and open PRs but never merge — orchestrator handles merges

4.5 KiB Raw Blame History