feat(apply-repo-settings): add opt-in collaborators section - #88
Open
nsheaps-oura wants to merge 4 commits into
Open
feat(apply-repo-settings): add opt-in collaborators section#88nsheaps-oura wants to merge 4 commits into
nsheaps-oura wants to merge 4 commits into
Conversation
PUT /repos/{owner}/{repo}/collaborators/{username} for each
{username, permission} entry in settings.yml's collaborators: list,
matching the rulesets/repository implementation's style and its
non-destructive philosophy (never revokes access absent from the list).
Opt-in only: unlike repository/rulesets, "collaborators" is not added
to the default `sections` input, since granting repo access is a
higher-consequence, easier-to-miss change than a ruleset tweak.
No bats/shellspec harness exists yet for this repo's composite actions, so this adds a self-contained bash test.sh that stubs curl and asserts on the PUT calls (or lack thereof) action.sh makes, covering: applying entries, opt-in-only default behavior, no-op when absent, missing-field validation, and API-error propagation. Wires it into `mise run test` (new task) and a new CI job in check.yaml so the suite actually runs on every push/PR, not just locally. Adds mikefarah/yq to mise.toml as a dev/test dependency (the same yq flavor action.sh requires at runtime, already installed ad hoc inside the composite action itself for consumers).
Documents the new collaborators section: PUT semantics, non-destructive behavior, the opt-in sections default decision and why, and the outputs/summary key. Also notes that the existing GitHub App manifest (administration:write) already covers the collaborators PUT call per GitHub's docs, so no app permission change is needed.
Triggered by: b4a403e Workflow run: https://github.com/nsheaps/github-actions/actions/runs/29777349915
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
collaborators:section to theapply-repo-settingscomposite action: for each{username, permission}entry insettings.yml, it callsPUT /repos/{owner}/{repo}/collaborators/{username}, matching the existingrepository/rulesetssections' style and their non-destructive philosophy — access for usernames not present in the list is never revoked.collaboratorsis intentionally left out of the action's defaultsectionsinput, unlikerepository/rulesets. Granting push/admin access to a person is a higher-consequence, easier-to-miss change than a ruleset tweak, so callers must explicitly opt in rather than getting it silently applied by a default run.Administration:writeon the GitHub App, which the automation app already has — confirmed via GitHub's own docs for this endpoint, so no app manifest/permission change is required to use this.test.sh, a self-contained bash test harness (no bats/shellspec exists yet for this repo's composite actions) that stubscurland asserts on the PUT calls action.sh makes or doesn't make, covering: applying entries, opt-in-only default behavior, no-op when the section is absent, missing-field validation, and API-error propagation. Wired into a newmise run testtask and a new CI job incheck.yamlso it runs on every push/PR.Test plan
test.shsuite covers apply/opt-in/no-op/validation/error-propagation cases (seetest(apply-repo-settings): add test coverage for collaborators)check.yamljob — verify it's green on this PRsections) decision matches expectations before merge, since this is the one part of this change with real access-control consequences