team: stop spurious edits that fail Gitea 1.26 permission validation #62

2026-08-09T12:31:46+10:00

unkinben commented

2026-08-09 12:31:46 +10:00

Why

terraform-git's apply fails on every non-owner gitea_team (docker, terraform, rpmbuild, puppet, pybuild, forgebot, agents) with Error: permission mode invalid, blocking the whole apply including the unkin-agent rollout (pipeline 135 on main).
The go-gitea/gitea provider's SDK rejects a team permission of none on any CreateTeam/EditTeam: only read/write/admin/owner are accepted client-side (CreateTeamOption.Validate/EditTeamOption.Validate). This check is identical in SDK v0.21.0 (provider 0.7.0) and v0.25.1 (provider 0.8.1, already on main via #61), so the provider version is not the lever -- the bump to 0.8.1 was already merged and does not fix this.
The team module's units and repositories drift on provider representation alone (the server returns units as an unordered space-separated string that never matches the provider's comma-ordered default; state repositories are sorted and include_all_repositories populates every repo), so every apply plans an in-place update for every team.
Each update calls EditTeam, which replays the stored permission=none (kept by ignore_changes) and fails validation. Owners (owner->admin) is the only team that passes.

Change

Add units and repositories to the team ignore_changes so provider representation churn no longer triggers a doomed EditTeam call.
Preserve each team's current on-server permission and repository membership; no access change.

Note for review

These teams were changed write->none in commit 1b12794; that permission: none is preserved here, and the apply is unblocked. While a team stays none, its units/repositories cannot be edited through the provider (the SDK rejects any EditTeam on a none team).
Follow-up if per-team repo/unit management is wanted: model the none-permission teams with units_map plus a valid coarse permission (read/write/admin). That is a separate access-policy change.

## Why - terraform-git's apply fails on every non-owner `gitea_team` (docker, terraform, rpmbuild, puppet, pybuild, forgebot, agents) with `Error: permission mode invalid`, blocking the whole apply including the unkin-agent rollout (pipeline 135 on main). - The go-gitea/gitea provider's SDK rejects a team permission of `none` on any CreateTeam/EditTeam: only `read`/`write`/`admin`/`owner` are accepted client-side (`CreateTeamOption.Validate`/`EditTeamOption.Validate`). This check is identical in SDK v0.21.0 (provider 0.7.0) and v0.25.1 (provider 0.8.1, already on main via #61), so the provider version is not the lever -- the bump to 0.8.1 was already merged and does not fix this. - The team module's `units` and `repositories` drift on provider representation alone (the server returns `units` as an unordered space-separated string that never matches the provider's comma-ordered default; state `repositories` are sorted and `include_all_repositories` populates every repo), so every apply plans an in-place update for every team. - Each update calls EditTeam, which replays the stored `permission=none` (kept by `ignore_changes`) and fails validation. Owners (owner->admin) is the only team that passes. ## Change - Add `units` and `repositories` to the team `ignore_changes` so provider representation churn no longer triggers a doomed EditTeam call. - Preserve each team's current on-server permission and repository membership; no access change. ## Note for review - These teams were changed write->none in commit 1b12794; that `permission: none` is preserved here, and the apply is unblocked. While a team stays `none`, its `units`/`repositories` cannot be edited through the provider (the SDK rejects any EditTeam on a `none` team). - Follow-up if per-team repo/unit management is wanted: model the `none`-permission teams with `units_map` plus a valid coarse `permission` (read/write/admin). That is a separate access-policy change.

unkinben added 1 commit 2026-08-09 12:31:46 +10:00

team: stop spurious edits that fail Gitea 1.26 permission validation

ci/woodpecker/pr/plan Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

df118383da

Why:
- The go-gitea/gitea provider's SDK (v0.25.1, already shipped in provider
  0.8.1 on main) rejects a team permission of `none` on every EditTeam with
  "permission mode invalid"; it only accepts read/write/admin/owner
  client-side. The same check exists in the older 0.21.0 SDK, so the provider
  version is not the lever here.
- The team module's `units` (server returns an unordered space-separated
  string that never matches the provider's comma-ordered default) and
  `repositories` (provider sorts state; `include_all_repositories` populates
  every repo) drift on representation alone, so every apply plans an in-place
  update for every team.
- Each update calls EditTeam, which replays the stored `permission=none` kept
  by `ignore_changes` and fails, blocking apply for every non-owner team
  (docker/terraform/rpmbuild/puppet/pybuild/forgebot/agents) and the whole
  terraform-git apply, including the unkin-agent rollout.

Change:
- Add `units` and `repositories` to the team `ignore_changes` so provider
  representation churn no longer triggers an EditTeam call.
- Preserve each team's current on-server permission and repository membership
  (no access change).

benvin merged commit 62596a8086 into main

2026-08-10 23:05:52 +10:00

benvin deleted branch benvin/gitea-provider-1.26

2026-08-10 23:05:52 +10:00

unkinben referenced this issue from a commit

2026-08-11 21:01:21 +10:00

branch_protection: stop whitelist representation churn planning every run

~~unkinben referenced this pull request 2026-08-11 21:01:31 +10:00~~

repository: stop migration_mirror_interval planning an update every run #65

Sign in to join this conversation.