From df118383daf5f7f5d09f3e0811cbe67365f58b89 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 9 Aug 2026 12:31:19 +1000 Subject: [PATCH] team: stop spurious edits that fail Gitea 1.26 permission validation Why: - The go-gitea/gitea provider's SDK (v0.25.1, already shipped in provider 0.8.1 on main) rejects a team permission of `none` on every EditTeam with "permission mode invalid"; it only accepts read/write/admin/owner client-side. The same check exists in the older 0.21.0 SDK, so the provider version is not the lever here. - The team module's `units` (server returns an unordered space-separated string that never matches the provider's comma-ordered default) and `repositories` (provider sorts state; `include_all_repositories` populates every repo) drift on representation alone, so every apply plans an in-place update for every team. - Each update calls EditTeam, which replays the stored `permission=none` kept by `ignore_changes` and fails, blocking apply for every non-owner team (docker/terraform/rpmbuild/puppet/pybuild/forgebot/agents) and the whole terraform-git apply, including the unkin-agent rollout. Change: - Add `units` and `repositories` to the team `ignore_changes` so provider representation churn no longer triggers an EditTeam call. - Preserve each team's current on-server permission and repository membership (no access change). --- modules/gitea_instance/modules/team/main.tf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/gitea_instance/modules/team/main.tf b/modules/gitea_instance/modules/team/main.tf index a305bf5..c3a9fb3 100644 --- a/modules/gitea_instance/modules/team/main.tf +++ b/modules/gitea_instance/modules/team/main.tf @@ -8,7 +8,8 @@ resource "gitea_team" "this" { repositories = var.repositories lifecycle { - ignore_changes = [permission] + # Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail. + ignore_changes = [permission, units, repositories] } }