Add declarative fork support to repository config #96

2026-09-19T15:55:28+10:00

unkin-agent commented

2026-09-19 15:55:28 +10:00

The config has no way to declare a fork, so forked repos sit outside Terraform. gitea_fork carries only the source repo and the owning organisation, so a fork's yaml cannot also set description, private, merge or mirror keys.

add an optional fork_from: "<owner>/<repo>" key to the repository yaml
create gitea_fork instead of gitea_repository when it is set
reject fork_from alongside keys a fork cannot express, naming the offending config
require the source repo name to match the config file name
move existing repositories to [0] via moved and reindex their import targets
note that gitea_fork has no archive_on_destroy, so removing a fork's yaml deletes the repo

The config has no way to declare a fork, so forked repos sit outside Terraform. gitea_fork carries only the source repo and the owning organisation, so a fork's yaml cannot also set description, private, merge or mirror keys. - add an optional `fork_from: "<owner>/<repo>"` key to the repository yaml - create `gitea_fork` instead of `gitea_repository` when it is set - reject `fork_from` alongside keys a fork cannot express, naming the offending config - require the source repo name to match the config file name - move existing repositories to `[0]` via `moved` and reindex their import targets - note that gitea_fork has no archive_on_destroy, so removing a fork's yaml deletes the repo

benvin changed target branch from benvin/gitea-mirror-repos to main

2026-09-19 15:58:02 +10:00

benvin added 1 commit 2026-09-19 15:58:02 +10:00

Add fork_from to repository config

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

9ab540719e

Express a fork as an optional fork_from key on the repository yaml, so a
forked repo is declared the same way as any other repo.

- add fork_from "<owner>/<repo>" to the repository module and object type
- create gitea_fork instead of gitea_repository when fork_from is set
- validate the source repo name matches the config file name, since a fork
  inherits the source name
- move gitea_repository.this to index 0 for the count refactor
- index existing repository import targets to match

unkin-agent commented

2026-09-19 16:00:10 +10:00

modules/gitea_instance/modules/repository/variables.tf:9-23 — fork_from has no validation against also setting private/description/default_branch/mirror/merge-setting keys; gitea_fork only supports owner/repo/organization so those values are silently dropped with no error → add a validation block rejecting fork_from combined with any repo-shaping key, or document the drop explicitly.
nit: modules/gitea_instance/modules/repository/main.tf:48-54 — gitea_fork.this has no archive_on_destroy equivalent (unavailable in the provider schema), so removing a fork_from entry deletes the repo outright instead of archiving it like the non-fork path → call this out as accepted risk or guard with lifecycle.prevent_destroy.
Atomicity: bundles (a) the new fork_from/gitea_fork feature with (b) the count+moved address migration of all ~101 existing gitea_repository.this resources and the 34-block imports.tf rewrite. (b)/(c) are mechanical and independently verifiable (0 destroy) but carry materially higher blast radius than (a) — could ship as its own PR (migration only, no behavior change) with the feature as a follow-up.

- modules/gitea_instance/modules/repository/variables.tf:9-23 — `fork_from` has no validation against also setting `private`/`description`/`default_branch`/`mirror`/merge-setting keys; `gitea_fork` only supports owner/repo/organization so those values are silently dropped with no error → add a validation block rejecting `fork_from` combined with any repo-shaping key, or document the drop explicitly. - nit: modules/gitea_instance/modules/repository/main.tf:48-54 — `gitea_fork.this` has no `archive_on_destroy` equivalent (unavailable in the provider schema), so removing a `fork_from` entry deletes the repo outright instead of archiving it like the non-fork path → call this out as accepted risk or guard with `lifecycle.prevent_destroy`. - Atomicity: bundles (a) the new `fork_from`/`gitea_fork` feature with (b) the `count`+`moved` address migration of all ~101 existing `gitea_repository.this` resources and the 34-block `imports.tf` rewrite. (b)/(c) are mechanical and independently verifiable (0 destroy) but carry materially higher blast radius than (a) — could ship as its own PR (migration only, no behavior change) with the feature as a follow-up.

unkin-agent added 1 commit 2026-09-19 16:03:48 +10:00

Reject fork_from alongside unsupported repository keys

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

8bc04e2c7d

gitea_fork can only express the source repo and owning organisation, so any
other setting in a fork's yaml is silently dropped.

- validate fork_from entries carry no other repository attributes, naming the
  offending config key and attributes
- note that gitea_fork has no archive_on_destroy

unkin-agent commented

2026-09-19 16:10:21 +10:00

No findings.

benvin merged commit 55151a8796 into main

2026-09-19 16:13:07 +10:00

benvin deleted branch benvin/gitea-fork-from

2026-09-19 16:13:07 +10:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-git#96