1.7 KiB
name, description, metadata
| name | description | metadata | ||||||
|---|---|---|---|---|---|---|---|---|
| recipe-mirrors-public-org-blocker | Recipe mirrors MUST be public (fleet invariant: the report's tokenless PR-STATUS proxy only sees public repos); org is public since ~2026-06, but late-enrolled mirrors (gitea, wordpress) were created private-from-birth by /recipe-enroll — fixed 2026-09-14 |
|
The Recipe Report's live PR-STATUS column (report.ci.commoninternet.net/pr/<recipe>/<n>,
shipped in cc-ci nix/modules/reports.nix) is a tokenless same-origin nginx proxy to the Gitea
API — it can ONLY see public repos. So recipe-maintainers/<recipe> mirrors MUST be public
(fleet invariant; cc-ci/cc-ci-orchestrator/archived repos stay deliberately private).
History: originally ALL mirrors were private; on 2026-06-09 the 21 then-existing mirrors were
flipped private=false after a secret-scan, and the recipe-maintainers org was later flipped
public by the operator (the old 'org is private' blocker is RESOLVED).
Recurrence (2026-09-14): /recipe-enroll still carried the old instruction to create mirrors with
"private":true — so the later-enrolled mirrors gitea (2026-06-11) and wordpress (2026-08-03)
were private from birth, leaving the report STATUS cells for those rows permanently "?"
(gitea/wordpress rows in week-2026-09-11). Fixed: secret-scanned both, flipped private=false
via PATCH /repos/recipe-maintainers/<r>, patched the skill to create private:false. The
report now lights up for every row — verify any new PR row with
curl https://report.ci.commoninternet.net/pr/<recipe>/<n> returning PR JSON, not 404.
Related: push-commits-to-remote.