27 lines
1.7 KiB
Markdown
27 lines
1.7 KiB
Markdown
---
|
|
name: recipe-mirrors-public-org-blocker
|
|
description: "Recipe mirrors MUST be public (fleet invariant: the report's tokenless PR-STATUS proxy only sees public repos); org is public since ~2026-06, but late-enrolled mirrors (gitea, wordpress) were created private-from-birth by /recipe-enroll — fixed 2026-09-14"
|
|
metadata:
|
|
node_type: memory
|
|
type: project
|
|
originSessionId: f7960036-d990-4a21-a81e-f7c486d97fea
|
|
---
|
|
|
|
The Recipe Report's live PR-STATUS column (`report.ci.commoninternet.net/pr/<recipe>/<n>`,
|
|
shipped in cc-ci `nix/modules/reports.nix`) is a tokenless same-origin nginx proxy to the Gitea
|
|
API — it can ONLY see public repos. So **`recipe-maintainers/<recipe>` mirrors MUST be public**
|
|
(fleet invariant; cc-ci/cc-ci-orchestrator/archived repos stay deliberately private).
|
|
|
|
History: originally ALL mirrors were private; on 2026-06-09 the 21 then-existing mirrors were
|
|
flipped `private=false` after a secret-scan, and the `recipe-maintainers` org was later flipped
|
|
public by the operator (the old 'org is private' blocker is RESOLVED).
|
|
|
|
Recurrence (2026-09-14): /recipe-enroll still carried the old instruction to create mirrors with
|
|
`"private":true` — so the later-enrolled mirrors `gitea` (2026-06-11) and `wordpress` (2026-08-03)
|
|
were **private from birth**, leaving the report STATUS cells for those rows permanently "?"
|
|
(gitea/wordpress rows in week-2026-09-11). Fixed: secret-scanned both, flipped `private=false`
|
|
via PATCH `/repos/recipe-maintainers/<r>`, patched the skill to create `private:false`. The
|
|
report now lights up for every row — verify any new PR row with
|
|
`curl https://report.ci.commoninternet.net/pr/<recipe>/<n>` returning PR JSON, not 404.
|
|
Related: [[push-commits-to-remote]].
|