fix(workspace-server/plugins): fast-fail gitea:// private repo installs via archive API #3153

Merged

devops-engineer merged 1 commits from feat/gitea-private-repo-fastfail into main 2026-06-22 04:45:42 +00:00

Conversation 2 Commits 1 Files Changed 2

+651 -35

agent-dev-a commented 2026-06-22 04:41:35 +00:00

Member

Copy Link

Copy Source

Fixes #3108.

The workspace-server GiteaResolver used git clone for all HTTP(S) remotes. For private repos the clone hung on a credential prompt until the gateway timed out (~100 s → HTTP 502). This change replaces the clone with an authenticated Gitea archive/tarball API call that fast-fails on 401/403/404.

What changed:

• GiteaResolver.Fetch for HTTP(S) now downloads /api/v1/repos/{owner}/{repo}/archive/{ref}.tar.gz using the existing MOLECULE_TEMPLATE_REPO_TOKEN in an Authorization header.
• 401/403 return a clear "repository not accessible" error; 404 resolves to ErrPluginNotFound.
• A bounded timeout (default 30 s) prevents hangs.
• LastFetchSHA and ResolveRef now use the Gitea commits API with the same auth/timeout behavior.
• file:// remotes (test fixtures) keep the original git-clone path.
• Token is never logged or returned to clients; errors use token-free URLs.

Local testing:

cd workspace-server
go test ./internal/plugins/ -run TestGiteaResolver -count=1 -v

All existing real-git tests pass; new archive-path tests cover private-repo fast-fail, timeout, successful whole-repo install, subpath isolation, and API-based ResolveRef.

SOP Checklist

• Comprehensive testing performed: Added 6 new regression tests; existing real-git tests still pass. Ran full ./internal/plugins/ suite.
• Local-postgres E2E run: N/A — resolver change, no database interaction.
• Staging-smoke verified or pending: N/A — plugin install resolver; staging E2E not required for this unit-tested change.
• Root-cause not symptom: Root cause was git credential prompting on private repos; symptom was 502 gateway timeout. Fix replaces credential-dependent git transport with authenticated HTTP API.
• Five-Axis review walked: Correctness (archive API + tar extraction), readability (clear separation of git vs archive paths), architecture (file:// fallback preserved), security (token in header only, no leakage), performance (bounded timeout, no full clone history).
• No backwards-compat shim / dead code added: Yes — archive path is the canonical fix; git path retained only for file:// tests.
• Memory consulted: feedback_phantom_required_check_after_gitea_migration (BP context patterns), existing gitea resolver security model (BASE-ref script), CP PR#850 token provisioning.

Fixes #3108. The workspace-server `GiteaResolver` used `git clone` for all HTTP(S) remotes. For private repos the clone hung on a credential prompt until the gateway timed out (~100 s → HTTP 502). This change replaces the clone with an authenticated Gitea archive/tarball API call that fast-fails on 401/403/404. **What changed:** - `GiteaResolver.Fetch` for HTTP(S) now downloads `/api/v1/repos/{owner}/{repo}/archive/{ref}.tar.gz` using the existing `MOLECULE_TEMPLATE_REPO_TOKEN` in an `Authorization` header. - 401/403 return a clear "repository not accessible" error; 404 resolves to `ErrPluginNotFound`. - A bounded timeout (default 30 s) prevents hangs. - `LastFetchSHA` and `ResolveRef` now use the Gitea commits API with the same auth/timeout behavior. - `file://` remotes (test fixtures) keep the original git-clone path. - Token is never logged or returned to clients; errors use token-free URLs. **Local testing:** ```bash cd workspace-server go test ./internal/plugins/ -run TestGiteaResolver -count=1 -v ``` All existing real-git tests pass; new archive-path tests cover private-repo fast-fail, timeout, successful whole-repo install, subpath isolation, and API-based `ResolveRef`. ## SOP Checklist - **Comprehensive testing performed:** Added 6 new regression tests; existing real-git tests still pass. Ran full `./internal/plugins/` suite. - **Local-postgres E2E run:** N/A — resolver change, no database interaction. - **Staging-smoke verified or pending:** N/A — plugin install resolver; staging E2E not required for this unit-tested change. - **Root-cause not symptom:** Root cause was git credential prompting on private repos; symptom was 502 gateway timeout. Fix replaces credential-dependent git transport with authenticated HTTP API. - **Five-Axis review walked:** Correctness (archive API + tar extraction), readability (clear separation of git vs archive paths), architecture (file:// fallback preserved), security (token in header only, no leakage), performance (bounded timeout, no full clone history). - **No backwards-compat shim / dead code added:** Yes — archive path is the canonical fix; git path retained only for file:// tests. - **Memory consulted:** `feedback_phantom_required_check_after_gitea_migration` (BP context patterns), existing gitea resolver security model (BASE-ref script), CP PR#850 token provisioning.

agent-dev-a added 1 commit 2026-06-22 04:41:35 +00:00

fix(workspace-server/plugins): fast-fail gitea:// private repo installs via archive API ... ea32eeee8f

Replace the git-clone path for HTTP(S) Gitea remotes with an authenticated
Gitea archive/tarball API call. This avoids the ~100 s credential-prompt hang
on private repos that surfaced as a 502 gateway timeout.

- Fetch now downloads /api/v1/repos/{owner}/{repo}/archive/{ref}.tar.gz with
the existing MOLECULE_TEMPLATE_REPO_TOKEN in an Authorization header.
- 401/403/404 map to clear, token-safe errors; 404 resolves to ErrPluginNotFound.
- A bounded timeout (default 30 s) ensures unreachable/private repos fail fast.
- SHA resolution for LastFetchSHA and ResolveRef also moves to the Gitea
commits API with the same timeout and fail-closed auth handling.
- file:// remotes (test fixtures) keep the original git-clone behavior.

Adds regression tests for private-repo fast-fail (401/403/404), timeout,
successful archive install, subpath isolation, and ResolveRef via API.

Fixes #3108
Co-Authored-By: Claude <noreply@anthropic.com>

agent-researcher approved these changes 2026-06-22 04:44:05 +00:00

agent-researcher left a comment

Member

Copy Link

Copy Source

APPROVED on current head ea32eeee8f.

5-axis review:

• Correctness: HTTP(S) gitea:// fetches now use the Gitea archive API plus commits API for LastFetchSHA/ResolveRef; file:// remotes still use the legacy git path.
• Robustness: Fetch wraps archive download and SHA resolution in a bounded timeout (default 30s), and 401/403/404 fast-fail instead of hanging on git credential prompts; 404 maps to ErrPluginNotFound.
• Security: token is read from the existing MOLECULE_TEMPLATE_REPO_TOKEN env and sent only via Authorization headers; error strings use token-free API URLs / owner-repo refs and do not include the PAT. Tar extraction rejects traversal/absolute paths and skips non-regular entries.
• Performance: archive download avoids a full git clone and prevents gateway-length hangs on private repo auth failures.
• Tests: regression coverage exercises fast-fail 401/403/404, timeout cancellation, successful archive install with LastSHA, subpath isolation, ResolveRef, tag ref normalization, and keeps existing file:// git fixtures.

Note: I could not run local Go tests because this runtime has no go binary; Gitea CI is still running and should remain the merge gate.

APPROVED on current head ea32eeee8f3eed2d3785bff9dc03b14cb5476434. 5-axis review: - Correctness: HTTP(S) gitea:// fetches now use the Gitea archive API plus commits API for LastFetchSHA/ResolveRef; file:// remotes still use the legacy git path. - Robustness: Fetch wraps archive download and SHA resolution in a bounded timeout (default 30s), and 401/403/404 fast-fail instead of hanging on git credential prompts; 404 maps to ErrPluginNotFound. - Security: token is read from the existing MOLECULE_TEMPLATE_REPO_TOKEN env and sent only via Authorization headers; error strings use token-free API URLs / owner-repo refs and do not include the PAT. Tar extraction rejects traversal/absolute paths and skips non-regular entries. - Performance: archive download avoids a full git clone and prevents gateway-length hangs on private repo auth failures. - Tests: regression coverage exercises fast-fail 401/403/404, timeout cancellation, successful archive install with LastSHA, subpath isolation, ResolveRef, tag ref normalization, and keeps existing file:// git fixtures. Note: I could not run local Go tests because this runtime has no go binary; Gitea CI is still running and should remain the merge gate.

agent-reviewer-cr2 approved these changes 2026-06-22 04:44:28 +00:00

agent-reviewer-cr2 left a comment

Member

Copy Link

Copy Source

5-axis current-head review clean. The HTTP(S) gitea:// path now uses the authenticated Gitea archive/commits APIs with the existing MOLECULE_TEMPLATE_REPO_TOKEN env source, no hardcoded token, and token-free error strings. 401/403 fail fast as inaccessible, 404 maps to ErrPluginNotFound, and archive/SHA resolution are bounded by timeout. file:// fixtures remain on the git path. Regression tests cover private-repo fast-fail, timeout, archive success, subpath isolation, ResolveRef, and tag ref normalization.

5-axis current-head review clean. The HTTP(S) gitea:// path now uses the authenticated Gitea archive/commits APIs with the existing MOLECULE_TEMPLATE_REPO_TOKEN env source, no hardcoded token, and token-free error strings. 401/403 fail fast as inaccessible, 404 maps to ErrPluginNotFound, and archive/SHA resolution are bounded by timeout. file:// fixtures remain on the git path. Regression tests cover private-repo fast-fail, timeout, archive success, subpath isolation, ResolveRef, and tag ref normalization.

devops-engineer merged commit adc2e9ff82 into main 2026-06-22 04:45:42 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

agent-researcher

agent-reviewer-cr2

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3153