From 9458a413ed5042f73bae9c053cfe5887a61d9823 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Ber=C3=A1nek?= <berykubik@gmail.com>
Date: Thu, 26 Feb 2026 11:14:21 +0100
Subject: [PATCH] Error sync if a private repo is not marked as private in team

---
 sync-team/src/github/api/mod.rs          | 1 +
 sync-team/src/github/api/read.rs         | 3 +++
 sync-team/src/github/api/write.rs        | 1 +
 sync-team/src/github/mod.rs              | 8 ++++++++
 sync-team/src/github/tests/test_utils.rs | 1 +
 5 files changed, 14 insertions(+)

diff --git a/sync-team/src/github/api/mod.rs b/sync-team/src/github/api/mod.rs
index debac26ca..df4720365 100644
--- a/sync-team/src/github/api/mod.rs
+++ b/sync-team/src/github/api/mod.rs
@@ -329,6 +329,7 @@ pub(crate) struct Repo {
     pub(crate) description: String,
     pub(crate) homepage: Option<String>,
     pub(crate) archived: bool,
+    pub(crate) private: bool,
     #[serde(default)]
     pub(crate) allow_auto_merge: Option<bool>,
 }
diff --git a/sync-team/src/github/api/read.rs b/sync-team/src/github/api/read.rs
index bef860a53..d7e6184b1 100644
--- a/sync-team/src/github/api/read.rs
+++ b/sync-team/src/github/api/read.rs
@@ -298,6 +298,7 @@ impl GithubRead for GitHubApiRead {
                     description
                     homepageUrl
                     isArchived
+                    isPrivate
                 }
             }
         "#;
@@ -317,6 +318,7 @@ impl GithubRead for GitHubApiRead {
             description: Option<String>,
             homepage_url: Option<String>,
             is_archived: bool,
+            is_private: bool,
         }
 
         let result: Option<Wrapper> = self
@@ -339,6 +341,7 @@ impl GithubRead for GitHubApiRead {
             archived: repo_response.is_archived,
             homepage: repo_response.homepage_url,
             org: org.to_string(),
+            private: repo_response.is_private,
         });
 
         Ok(repo)
diff --git a/sync-team/src/github/api/write.rs b/sync-team/src/github/api/write.rs
index f24f6d741..24f0b54a5 100644
--- a/sync-team/src/github/api/write.rs
+++ b/sync-team/src/github/api/write.rs
@@ -250,6 +250,7 @@ impl GitHubWrite {
                 description: settings.description.clone(),
                 homepage: settings.homepage.clone(),
                 archived: false,
+                private: false,
                 allow_auto_merge: Some(settings.auto_merge_enabled),
             })
         } else {
diff --git a/sync-team/src/github/mod.rs b/sync-team/src/github/mod.rs
index b3bf215bf..b6f0ef822 100644
--- a/sync-team/src/github/mod.rs
+++ b/sync-team/src/github/mod.rs
@@ -398,6 +398,14 @@ impl SyncGitHub {
             }
         };
 
+        if !expected_repo.private && actual_repo.private {
+            return Err(anyhow::anyhow!(
+                "Repository `{}/{}` is private on GitHub, but not marked as private in team. This can be a security concern!",
+                actual_repo.org,
+                actual_repo.name
+            ));
+        }
+
         let permission_diffs = self.diff_permissions(expected_repo)?;
 
         let branch_protection_diffs = self.diff_branch_protections(&actual_repo, expected_repo)?;
diff --git a/sync-team/src/github/tests/test_utils.rs b/sync-team/src/github/tests/test_utils.rs
index 36cdb83e7..3a00eb6aa 100644
--- a/sync-team/src/github/tests/test_utils.rs
+++ b/sync-team/src/github/tests/test_utils.rs
@@ -140,6 +140,7 @@ impl DataModel {
                     description: repo.description.clone(),
                     homepage: repo.homepage.clone(),
                     archived: false,
+                    private: false,
                     allow_auto_merge: None,
                 },
             );