veronica
deb4760b11
ci/woodpecker/pr/ci Pipeline failed
Port the operator-tree grant-reviewer tool into the framework suite. grant-reviewer.sh -u <user> [-r <owner>/<repo>] [-t <team>] grants a reviewer code-read plus issues/pulls-write on an org-owned Gitea repository via an org team (default fleet-reviewers). Gitea only; on a GitHub remote it refuses with a clear error. Idempotent: exact-name team lookup before create (permission read, units_map: code read, issues write, pulls write); member and repo additions are idempotent puts. Fail-closed read-back: after the writes, the single member resource and the single team-repo resource are both fetched back and must confirm the grant or the run fails — a success status is an exit code, not evidence of a durable write (#865 defect class). HTTP 403 on any step surfaces as 'org admin required on <org>', never a silent partial grant. Identity follows issue-comment.sh: GITEA_LOGIN names a tea login whose host-matched token MUST resolve (fail closed, no downgrade to the host default); otherwise the detect-platform.sh identity ladder applies. The bearer token travels via a curl config file, never argv. Documented limitation (field finding, usc/infrastructure PR 273): under branch protection with required approvals, reviews from a read-permission team are official=false and do not count toward the required total; whitelisting the team on the protected branch is an operator review-policy decision this script deliberately does not automate, and official is computed at review submission. Hermetic suite test-grant-reviewer.sh models a real server with persistent on-disk state, exact-payload validation, a substring-named decoy team, write-without-persist sabotage modes, identity-per-request assertions, and token-not-in-argv plus temp-leak checks; enumerated in test:framework-shell.