fix: spell out Forgejo token scopes + defensive onboarding handler #7

Merged

joshtronic merged 1 commit from devel into master

2026-05-16 21:01:33 +00:00

joshtronic commented

2026-05-16 21:01:24 +00:00

Owner

Two related fixes from the first deploy:

Token scope docs were misleading. Said "scopes for: read:user,
repository (issue, PR, comment, label, assign)" implying that
repository covers issue operations. It doesn't. Forgejo splits
write:repository (content/PR ops) and write:issue (issue
create/comment/label/assign/close) into separate scopes. The
actually-required set is three scopes:
- read:user
- write:repository
- write:issue
Missing write:issue is what blew up the first onboarding-ticket
attempt with a 403. docs/setup.md and .env.example both updated
to spell this out explicitly so the next operator doesn't repeat
the mistake.
handle_onboarding_failure killing the tick on any internal API
error. If filing the onboarding ticket failed (token scope, repo
permissions, issues-disabled), the whole tick exited non-zero and
the harness lost the rest of discovery. Wrapping the call site
with || log "warning ..." so one bad repo logs and continues
rather than blowing up everything.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Two related fixes from the first deploy: 1. Token scope docs were misleading. Said "scopes for: read:user, repository (issue, PR, comment, label, assign)" implying that `repository` covers issue operations. It doesn't. Forgejo splits `write:repository` (content/PR ops) and `write:issue` (issue create/comment/label/assign/close) into separate scopes. The actually-required set is three scopes: - read:user - write:repository - write:issue Missing write:issue is what blew up the first onboarding-ticket attempt with a 403. docs/setup.md and .env.example both updated to spell this out explicitly so the next operator doesn't repeat the mistake. 2. handle_onboarding_failure killing the tick on any internal API error. If filing the onboarding ticket failed (token scope, repo permissions, issues-disabled), the whole tick exited non-zero and the harness lost the rest of discovery. Wrapping the call site with `|| log "warning ..."` so one bad repo logs and continues rather than blowing up everything. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

joshtronic added 1 commit

2026-05-16 21:01:24 +00:00

fix: spell out Forgejo token scopes + defensive onboarding handler

Lint / check-sync (pull_request) Successful in 4s

Details

Lint / check-sync (push) Successful in 4s

Details

2d9d5041db

Two related fixes from the first deploy:

1. Token scope docs were misleading. Said "scopes for: read:user,
   repository (issue, PR, comment, label, assign)" implying that
   `repository` covers issue operations. It doesn't. Forgejo splits
   `write:repository` (content/PR ops) and `write:issue` (issue
   create/comment/label/assign/close) into separate scopes. The
   actually-required set is three scopes:

   - read:user
   - write:repository
   - write:issue

   Missing write:issue is what blew up the first onboarding-ticket
   attempt with a 403. docs/setup.md and .env.example both updated
   to spell this out explicitly so the next operator doesn't repeat
   the mistake.

2. handle_onboarding_failure killing the tick on any internal API
   error. If filing the onboarding ticket failed (token scope, repo
   permissions, issues-disabled), the whole tick exited non-zero and
   the harness lost the rest of discovery. Wrapping the call site
   with `|| log "warning ..."` so one bad repo logs and continues
   rather than blowing up everything.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

joshtronic scheduled this pull request to auto merge when all checks succeed

2026-05-16 21:01:30 +00:00

joshtronic merged commit 2a9fd170cb into master

2026-05-16 21:01:33 +00:00

joshtronic deleted branch devel

2026-05-16 21:01:33 +00:00

joshtronic referenced this pull request from a commit

2026-05-16 21:01:34 +00:00

Merge pull request 'fix: spell out Forgejo token scopes + defensive onboarding handler' (#7) from devel into master