ci(#6701): wait for permission propagation after pool repo recreate - #6709
ci(#6701): wait for permission propagation after pool repo recreate#6709fullsend-ai-coder[bot] wants to merge 1 commit into
Conversation
After a pool repo is deleted and recreated during behaviour test allocation, the GitHub App installation's permission graph for the new repo ID is a separate consistency domain from repo visibility. awaitCreation only waits until GetRepo stops returning 404. Without a permission wait, dispatch's GetCollaboratorPermission can 404, causing the actor to be treated as RoleNone and the harness matrix to be empty. Add awaitPermissionPropagation to ensure.go, called after ensureRepoExists in doEnsure. It polls GetCollaboratorPermission for the authenticated bot user with the same bounded exponential backoff (resetMaxAttempts=5, doubling delay) that awaitCreation and awaitDeletion use. When the forge client does not implement GitHubExtensions (e.g. GitLab), the check is skipped. Unit tests cover: immediate success, retry-until-confirmed, timeout after max attempts, non-NotFound error propagation, context cancellation, and skip when GitHubExtensions is absent. Closes #6701
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
🤖 Finished Review · ✅ Success · Started 9:46 PM UTC · Completed 9:57 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.93 |
|
Risk Assessment: moderate (2/5) DetailsSmall additive change (2 files, 226 lines, 50% test ratio) by a bot author with strong test coverage, but the target files show elevated fix/revert churn (8-10 fix/revert commits in 90 days), lifting the score from low to moderate. |
|
Looks good to me |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
the
ready-for-merge
|
🤖 Finished Retro · ✅ Success · Started 5:57 PM UTC · Completed 6:11 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.73 |
Retro: PR #6709 —
|
…tall pkg The test suite's e2e installation token and dispatch's per-repo GITHUB_TOKEN are distinct credential contexts with independent permission propagation graphs. After pool repo recreation, the suite can confirm the repo exists (GetRepo) but cannot observe or predict when dispatch-side collaborator permissions are ready. This was empirically validated in fullsend-ai#6701: both a human (PR fullsend-ai#6703) and an agent (PR fullsend-ai#6709) independently attempted suite-side GetCollaboratorPermission polling and both failed. Add a package-level doc comment (doc.go) explaining the two-token model, an inline note on awaitCreation warning against permission polling, and a cross-reference in the behaviour-testing guide. Closes fullsend-ai#6757
2 participants
Summary
After pool repos are deleted and recreated during behaviour test allocation (
resetRepo), the GitHub App installation's permission graph for the new repo ID takes time to propagate — independently of repo visibility.awaitCreationonly waits untilGetRepostops returning 404. Without a permission wait, dispatch'sGetCollaboratorPermission404s on the still-propagating repo, the actor is treated asRoleNone, and the harness matrix is empty.This adds
awaitPermissionPropagationtoensure.go, called betweenensureRepoExistsandinstallFullsendindoEnsure. It pollsGetCollaboratorPermissionfor the authenticated bot user with the same bounded exponential backoff (resetMaxAttempts=5, doubling delay fromresetRetryDelay) used byawaitCreationandawaitDeletion. When the forge client does not implementGitHubExtensions(e.g. GitLab), the check is skipped gracefully.Related Issue
Closes #6701
Changes
awaitPermissionPropagationmethod on*repoEnsurerwith exponential backoff polling ofGetCollaboratorPermissiondoEnsureafterensureRepoExists(step 2b) and beforeinstallFullsendGetAuthenticatedUserandGitHubExtensionsmethods tostubClienttest double so existingdoEnsuretests pass through the new step transparentlycountingPermissionClienttest doubleTesting
ensure_test.gotests pass (permission check is transparent viastubClientdefaults)awaitPermissionPropagationunit tests passgo vetpassesgofmtcleanCloses #6701
Post-script verification
agent/6701-await-permission-propagation)96d46c802d4ad44bfea7989835dafb68eeb46195..HEAD)