Error sync if a private repo is not marked as private in team

sync-team/src/github/api/mod.rs

@@ -329,6 +329,7 @@ pub(crate) struct Repo {
     pub(crate) description: String,
     pub(crate) homepage: Option<String>,
     pub(crate) archived: bool,
+    pub(crate) private: bool,
     #[serde(default)]
     pub(crate) allow_auto_merge: Option<bool>,
 }

sync-team/src/github/api/read.rs

@@ -298,6 +298,7 @@ impl GithubRead for GitHubApiRead {
                     description
                     homepageUrl
                     isArchived
+                    isPrivate
                 }
             }
         "#;
@@ -317,6 +318,7 @@ impl GithubRead for GitHubApiRead {
             description: Option<String>,
             homepage_url: Option<String>,
             is_archived: bool,
+            is_private: bool,
         }
 
         let result: Option<Wrapper> = self
@@ -339,6 +341,7 @@ impl GithubRead for GitHubApiRead {
             archived: repo_response.is_archived,
             homepage: repo_response.homepage_url,
             org: org.to_string(),
+            private: repo_response.is_private,
         });
 
         Ok(repo)

sync-team/src/github/api/write.rs

@@ -250,6 +250,7 @@ impl GitHubWrite {
                 description: settings.description.clone(),
                 homepage: settings.homepage.clone(),
                 archived: false,
+                private: false,
                 allow_auto_merge: Some(settings.auto_merge_enabled),
             })
         } else {

sync-team/src/github/mod.rs

@@ -398,6 +398,14 @@ impl SyncGitHub {
             }
         };
 
+        if !expected_repo.private && actual_repo.private {
+            return Err(anyhow::anyhow!(
+                "Repository `{}/{}` is private on GitHub, but not marked as private in team. This can be a security concern!",
+                actual_repo.org,
+                actual_repo.name
+            ));
+        }
+
         let permission_diffs = self.diff_permissions(expected_repo)?;
 
         let branch_protection_diffs = self.diff_branch_protections(&actual_repo, expected_repo)?;

sync-team/src/github/tests/test_utils.rs

@@ -140,6 +140,7 @@ impl DataModel {
                     description: repo.description.clone(),
                     homepage: repo.homepage.clone(),
                     archived: false,
+                    private: false,
                     allow_auto_merge: None,
                 },
             );