sean/forgejo-operator
Watch
1
0
Fork
You've already forked forgejo-operator
 0
Code Issues Pull requests 1 Projects Releases 22 Packages Wiki Activity
22 releases 42 tags
  • v0.6.18 ad3999db2e

    v0.6.18 Stable

    pipeline-bot released this 2026-07-15 12:47:38 +00:00 | 43 commits to main since this release

    Fixed

    • ForgejoWebhook.Delete no longer leaks the remote hook (which carries a delivery secret) when
      the status id was never persisted — it recovers the id via ListRepoHooks match-by-URL, mirroring
      the other ID-keyed Delete handlers, tolerating 404 on both the list (parent repo gone) and the delete.
    • ForgejoUser admin-grant failure is no longer swallowed on the create path — a failed
      AdminEditUser now yields Degraded+requeue instead of a premature Ready reporting an account that
      was created but is not an admin (matching the exists-path).
    • ForgejoOAuthApp self-heals a lost one-time client secret. The client secret is returned only by
      create, so a swallowed secret-write (app recorded, output Secret never written) left the CR Ready
      with no usable secret and no recovery. Converge now regenerates via UpdateOauth2 when the output
      Secret is absent/empty.
    • ForgejoOAuthApp.spec.name is now immutable (self == oldSelf). The reconciler adopts the app by
      name, so an in-place rename orphaned the original app and leaked its still-valid client secret.
    • ForgejoToken re-mints on a spec.scopes change. The active token kept its create-time scopes
      forever (a tightened scope set left an over-privileged token live, reported Ready). Steady-state now
      compares spec.scopes against a new status.appliedScopes recorded at mint — a spec-vs-applied
      compare, deliberately not against Forgejo's normalized scope form, so it can't thrash-loop.
    • ForgejoOrganization visibility drift is now repaired — editing spec.visibility after create
      applies. The edit sends the full desired org state, because gitea's EditOrgOption text fields are
      value-typed and the server replaces them — so a single-field edit no longer silently wipes the
      org's FullName/Description/Website/Location (this also fixes the same latent clobber that
      already existed on the text-field edit path).

    Included changes (v0.6.17 -> v0.6.18)

    • 0f205f8076e8 fix(forgejo): r5 leak/swallow/immutability/drift cluster (6 fixes)
    Downloads