sean/seanfarm
Watch
1
0
Fork
You've already forked seanfarm
 0
Code Issues Pull requests Projects Releases 386 Packages Wiki Activity

fix(binjovi): grant the outline tag-protection absence read #734

Merged
binjovi-bot merged 1 commit from feat/outline-tag-protection-grant into trunk 2026-09-14 13:11:32 +00:00
Conversation 0 Commits 1 Files changed 3 +12 -3
sean commented 2026-09-14 13:07:31 +00:00
Owner
Copy link

binjovictl authority outline answers provider_guarded · blocked · invalid_tag_protection_response, so release-candidates answers 503 and no release of sean/outline can start. Measured 2026-09-14 on sean/outline pull request 1.

Forgejo.Authority.check/2 reads trunk, then main, then the tag protections, and requires a ** rule whitelisting binjovi-bot. It asks that of EVERY provider-guarded project: the check proves that nobody but binjovi-bot can move a ref in the repository, which is a different claim from "this project publishes tags". Outline's onboarding declared the two branch protections and left tags out on the reasoning that a wiki ships no tags. The branch reads passed; the tag read had nothing to return.

This is the seanfarm half: the scoped get that lets the service worker tell an ABSENT legacy ForgejoTagProtection/outline-tags from a DENIED read. A name that is not in this list answers 403, every create fails denied, and the operation is terminal after five attempts. No CR of this name has ever existed — outline came from create_repository — so the read answers 404 and the worker may act. The policy row that makes it act is sean/binjovi's half.

Count pin 35 → 36. tests/binjovi-service-handoff.sh goes red without the grant and green with it.

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

`binjovictl authority outline` answers `provider_guarded · blocked · invalid_tag_protection_response`, so `release-candidates` answers 503 and no release of sean/outline can start. Measured 2026-09-14 on sean/outline pull request 1. `Forgejo.Authority.check/2` reads trunk, then main, then the tag protections, and requires a `**` rule whitelisting `binjovi-bot`. It asks that of EVERY provider-guarded project: the check proves that nobody but `binjovi-bot` can move a ref in the repository, which is a different claim from "this project publishes tags". Outline's onboarding declared the two branch protections and left tags out on the reasoning that a wiki ships no tags. The branch reads passed; the tag read had nothing to return. This is the seanfarm half: the scoped `get` that lets the service worker tell an ABSENT legacy `ForgejoTagProtection/outline-tags` from a DENIED read. A name that is not in this list answers 403, every create fails `denied`, and the operation is terminal after five attempts. No CR of this name has ever existed — outline came from `create_repository` — so the read answers 404 and the worker may act. The policy row that makes it act is sean/binjovi's half. Count pin 35 → 36. `tests/binjovi-service-handoff.sh` goes red without the grant and green with it. https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
fix(binjovi): grant the outline tag-protection absence read
Some checks failed
binjovi/ci Binjovi will not build this: its base branch must be trunk. Retarget the pull request.
dbc1ddea11
 
`binjovictl authority outline` answers `provider_guarded · blocked ·
invalid_tag_protection_response`, so `release-candidates` answers 503 and
no release can start. Measured 2026-09-14 on sean/outline pull request 1.

Forgejo.Authority.check/2 reads trunk, then main, then the tag
protections, and requires a `**` rule whitelisting binjovi-bot. It asks
that of EVERY provider-guarded project: the check proves that nobody but
binjovi-bot can move a ref in the repository, which is a different claim
from "this project publishes tags". Outline's onboarding declared the two
branch protections and left tags out on the reasoning that a wiki ships no
tags. The branch reads passed; the tag read had nothing to return.

This is the seanfarm half: the scoped `get` that lets the service worker
tell an ABSENT legacy ForgejoTagProtection/outline-tags from a DENIED
read. A name that is not in this list answers 403, every create fails
`denied`, and the operation is terminal after five attempts. No CR of
this name has ever existed -- outline came from create_repository -- so
the read answers 404 and the worker may act. The policy row that makes it
act is sean/binjovi's half.

Count pin 35 -> 36.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
binjovi-bot deleted branch feat/outline-tag-protection-grant 2026-09-14 13:11:32 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/seanfarm!734
No description provided.