fix(binjovi): scope the write integration to sean/outline #737

Merged

binjovi-bot merged 1 commit from fix/outline-write-integration into trunk

2026-09-14 13:33:10 +00:00

sean commented

2026-09-14 13:32:22 +00:00

Owner

Outline's builds are green and not one binjovi/ci status has ever been written. The trunk protection requires that context, so the pull request cannot merge and every release dies. Measured 2026-09-14 on sean/outline pull request 1; the delivery answer is {:http_status, 403}:

[warning] Forgejo status delivery failed: {:http_status, 403}

The collaborator grant is not the whole grant. binjovi-bot writes commit statuses through a short-lived JWT whose repository scopes are rows in Forgejo's own database, seeded by this Job. outline was created by create_repository on 2026-09-13 and never got a row — the one repository of 33 missing. A build needs no status to succeed, so nothing went red.

The roster cannot grow by itself

tests/binjovi.sh held a hand-written list of repositories to check for, introduced with the comment "the short-lived write integration must include every repository that grants binjovi-bot write access". That sentence is the invariant, and the set it names is already declared once, in the collaborator grant: every <repo>-binjovi-bot name in service-legacy-access.yaml IS a write grant.

The guard now derives it instead of repeating it, and fails with the missing names. Measured red on exactly this bug before the fix:

FAIL: these repositories grant binjovi-bot write access but have no
      repository scope in the short-lived write integration: outline
      Builds will succeed and every commit status will 403.

33 collaborator writers derived, 32 already scoped, outline the only gap.

Job generation

A Job template is immutable, so the generation moves with it: v31 → v32 in all four places (Job, ServiceAccount, RoleBinding subject, serviceAccountName), and the three pins re-pinned — count, retired range seq 1 31, fingerprint 915627282 18830.

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

Outline's builds are green and **not one `binjovi/ci` status has ever been written**. The trunk protection requires that context, so the pull request cannot merge and every release dies. Measured 2026-09-14 on sean/outline pull request 1; the delivery answer is `{:http_status, 403}`: ``` [warning] Forgejo status delivery failed: {:http_status, 403} ``` The collaborator grant is not the whole grant. `binjovi-bot` writes commit statuses through a short-lived JWT whose repository scopes are rows in Forgejo's own database, seeded by this Job. `outline` was created by `create_repository` on 2026-09-13 and never got a row — the one repository of 33 missing. A build needs no status to succeed, so nothing went red. ## The roster cannot grow by itself `tests/binjovi.sh` held a hand-written list of repositories to check for, introduced with the comment *"the short-lived write integration must include every repository that grants binjovi-bot write access"*. That sentence is the invariant, and the set it names is **already declared once**, in the collaborator grant: every `<repo>-binjovi-bot` name in `service-legacy-access.yaml` IS a write grant. The guard now derives it instead of repeating it, and fails with the missing names. Measured red on exactly this bug before the fix: ``` FAIL: these repositories grant binjovi-bot write access but have no repository scope in the short-lived write integration: outline Builds will succeed and every commit status will 403. ``` 33 collaborator writers derived, 32 already scoped, `outline` the only gap. ## Job generation A Job template is immutable, so the generation moves with it: `v31` → `v32` in all four places (Job, ServiceAccount, RoleBinding subject, serviceAccountName), and the three pins re-pinned — count, retired range `seq 1 31`, fingerprint `915627282 18830`. https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

sean added 1 commit

2026-09-14 13:32:22 +00:00

fix(binjovi): scope the write integration to sean/outline

binjovi/ci Binjovi will not build this: its base branch must be trunk. Retarget the pull request.

f7d9ea3e9b

Outline's builds are green and NOT ONE `binjovi/ci` status has ever been
written. The trunk protection requires that context, so the pull request
cannot merge and every release dies. Measured 2026-09-14 on sean/outline
pull request 1; the delivery answer is `{:http_status, 403}`.

The collaborator grant is not the whole grant. binjovi-bot writes commit
statuses through a short-lived JWT whose repository scopes are rows in
Forgejo's own database, seeded by this Job. outline was created by
create_repository on 2026-09-13 and never got a row -- the one repository
of 33 missing. A build needs no status to succeed, so nothing went red.

THE ROSTER CANNOT GROW BY ITSELF. tests/binjovi.sh held a hand-written
list of repositories to check for, introduced with the comment "the
short-lived write integration must include every repository that grants
binjovi-bot write access". That sentence is the invariant, and the set it
names is ALREADY declared once, in the collaborator grant: every
`<repo>-binjovi-bot` name in service-legacy-access.yaml IS a write grant.
The guard now derives it instead of repeating it, and fails with the
missing names. Measured red on exactly this bug before the fix.

A Job template is immutable, so the generation moves with it: v31 -> v32
in all four places, and the three pins re-pinned (count, retired range,
fingerprint 915627282 18830).

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

binjovi-bot merged commit f7d9ea3e9b into trunk

2026-09-14 13:33:10 +00:00

binjovi-bot deleted branch fix/outline-write-integration

2026-09-14 13:33:10 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!737

No description provided.

Rows
Columns