bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make Veles feedback issues publicly readable

Browse Source
This commit is contained in:
jenkins 2026-06-29 16:11:20 -03:00
parent c8e91312fb
commit 25f3b31d00
2 changed files with 36 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
View File

@ -1,6 +1,7 @@
# services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml # services/gitea/oneoffs/veles-feedback-acl-ensure-job.yaml
# One-off job for gitea/veles-feedback-acl-ensure-2. # One-off job for gitea/veles-feedback-acl-ensure-2.
# Purpose: keep Veles testers on the feedback repo without granting source access. # Purpose: keep Veles feedback anonymously readable while limiting write access
# to testers/admins and avoiding source-code repository access.
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: Job
metadata: metadata:

36
services/gitea/scripts/veles_feedback_acl_ensure.sh
View File

@ -49,11 +49,41 @@ end $$;
update gitea.team team update gitea.team team
set authorize = 1, set authorize = 1,
includes_all_repositories = true, includes_all_repositories = false,
can_create_org_repo = false can_create_org_repo = false
from veles_acl_ids ids from veles_acl_ids ids
where team.id = ids.team_id; where team.id = ids.team_id;
update gitea."user" org
set visibility = 0
from veles_acl_ids ids
where org.id = ids.org_id;
update gitea.repository repo
set is_private = false
from veles_acl_ids ids
where repo.id = ids.repo_id;
delete from gitea.repo_unit unit
using veles_acl_ids ids
where unit.repo_id = ids.repo_id
and unit.type in (1, 3, 4, 5, 6, 7, 8, 9, 10);
insert into gitea.repo_unit (repo_id, type, config, created_unix, everyone_access_mode)
select
ids.repo_id,
2,
'{"EnableTimetracker":false,"AllowOnlyContributorsToTrackTime":true,"EnableDependencies":true}',
extract(epoch from now())::bigint,
0
from veles_acl_ids ids
where not exists (
select 1
from gitea.repo_unit existing
where existing.repo_id = ids.repo_id
and existing.type = 2
);
insert into gitea.team_repo (org_id, team_id, repo_id) insert into gitea.team_repo (org_id, team_id, repo_id)
select ids.org_id, ids.team_id, ids.repo_id select ids.org_id, ids.team_id, ids.repo_id
from veles_acl_ids ids from veles_acl_ids ids
@ -67,7 +97,7 @@ where not exists (
delete from gitea.team_unit unit delete from gitea.team_unit unit
using veles_acl_ids ids using veles_acl_ids ids
where unit.team_id = ids.team_id where unit.team_id = ids.team_id
and unit.type in (1, 2, 3, 4, 5, 8, 9, 10); and unit.type in (1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
insert into gitea.team_unit (org_id, team_id, type, access_mode) insert into gitea.team_unit (org_id, team_id, type, access_mode)
select ids.org_id, ids.team_id, desired.type, desired.access_mode select ids.org_id, ids.team_id, desired.type, desired.access_mode
@ -79,6 +109,8 @@ cross join (
(3, 0), (3, 0),
(4, 0), (4, 0),
(5, 0), (5, 0),
(6, 0),
(7, 0),
(8, 0), (8, 0),
(9, 0), (9, 0),
(10, 0) (10, 0)