From 98456abae596f152effce5a950e2a34573ba50fd Mon Sep 17 00:00:00 2001 From: "Molecule AI Dev Engineer A (Kimi)" Date: Wed, 27 May 2026 14:36:38 +0000 Subject: [PATCH 1/2] fix(ci): distinguish all-403 token-provisioning failures in review-check.sh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the Gitea token owner is not a member of the qa/security team, every team-membership probe returns 403. Previously the final error message said "none are in team", which misled ops into verifying the team roster when the real issue was token provisioning (Bug C). Add tracking for all-403 vs mixed-response scenarios. When every candidate returns 403, emit an explicit error naming the root cause and the remediation (add token owner to team or switch tokens). No behavior change — still fail-closed; only the diagnostic message is improved. Co-Authored-By: Claude Opus 4.7 --- .gitea/scripts/review-check.sh | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.gitea/scripts/review-check.sh b/.gitea/scripts/review-check.sh index a63c983ee..86b78febd 100755 --- a/.gitea/scripts/review-check.sh +++ b/.gitea/scripts/review-check.sh @@ -296,7 +296,15 @@ fi # 403 → token owner is not in this team (Gitea 1.22.6 'Must be a team # member' constraint — see follow-up issue for token-provisioning) # 404 → not a member +# Track whether every candidate returned 403 (token owner not in team). +# When this happens the root cause is a token-provisioning issue, not a +# reviewer-eligibility issue — surface it clearly so ops don't waste time +# verifying team roster (Bug C / RFC#324 follow-up). +_ALL_CANDIDATES_403="yes" +_CANDIDATE_COUNT=0 + for U in $CANDIDATES; do + _CANDIDATE_COUNT=$((_CANDIDATE_COUNT + 1)) CODE=$(curl -sS -o "$TEAM_PROBE_TMP" -w '%{http_code}' \ -K "$CURL_AUTH_FILE" "${API}/teams/${TEAM_ID}/members/${U}") debug "probe ${U} in team ${TEAM} (id=${TEAM_ID}) → HTTP ${CODE}" @@ -317,14 +325,20 @@ for U in $CANDIDATES; do continue ;; 404) + _ALL_CANDIDATES_403="no" debug "${U} not a member of ${TEAM}" ;; *) + _ALL_CANDIDATES_403="no" echo "::warning::team-probe for ${U} in ${TEAM} returned unexpected HTTP ${CODE}" cat "$TEAM_PROBE_TMP" >&2 ;; esac done -echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (candidates: $(echo "$CANDIDATES" | tr '\n' ',' | sed 's/,$//') — none are in team)" +if [ "$_ALL_CANDIDATES_403" = "yes" ] && [ "$_CANDIDATE_COUNT" -gt 0 ]; then + echo "::error::${TEAM}-review FAILED — every candidate returned 403 (token owner is not a member of the ${TEAM} team). This is a TOKEN PROVISIONING issue, not a reviewer-eligibility issue. Add the token owner to the '${TEAM}' Gitea team (id=${TEAM_ID}) or use a token whose owner is already in that team." +else + echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (candidates: $(echo "$CANDIDATES" | tr '\n' ',' | sed 's/,$//') — none are in team)" +fi exit 1 -- 2.52.0 From dfa46cc368ef462857436f8832161d09cd506cee Mon Sep 17 00:00:00 2001 From: "Molecule AI Dev Engineer A (Kimi)" Date: Wed, 27 May 2026 14:44:14 +0000 Subject: [PATCH 2/2] docs(sop-checklist): sync issue_comment trigger comment with workflow reality MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sop-checklist.yml workflow subscribes only to issue_comment:[created] (consolidated in PR #1345 / issue #1280 to reduce runner-slot occupancy). The script header still claimed [created, edited, deleted], which could mislead future maintainers into thinking edited/deleted events are handled. No behavior change — comment-only. Co-Authored-By: Claude Opus 4.7 --- .gitea/scripts/sop-checklist.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/scripts/sop-checklist.py b/.gitea/scripts/sop-checklist.py index 40e3b81f6..a066a4578 100644 --- a/.gitea/scripts/sop-checklist.py +++ b/.gitea/scripts/sop-checklist.py @@ -6,8 +6,8 @@ # RFC#351 Step 2 of 6 (implementation MVP). # # Invoked by .gitea/workflows/sop-checklist.yml on: -# - pull_request_target: [opened, edited, synchronize, reopened] -# - issue_comment: [created, edited, deleted] +# - pull_request_target: [opened, edited, synchronize, reopened, labeled, unlabeled] +# - issue_comment: [created] # edited/deleted omitted (Gitea 1.22.6 job-parsing quirk) # # Flow: # 1. Load .gitea/sop-checklist-config.yaml (from BASE ref — trusted). -- 2.52.0