Pi flow doesn't work on org repos #13
Labels
No labels
dependencies
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
alex/.profile#13
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
(startsWith(forgejo.event.comment.body, '/pi ') && forgejo.event.sender.login == forgejo.repository_owner)Seems that this isn't enough to run from org/repo kind of repos
/pi let's fix it
The referenced line is the job's
if:guard:forgejo.event.sender.login == forgejo.repository_owner. On org-owned repos the "owner" is the organization, so a commenting user can never match it — the job is always skipped there. Let me verify my planned fix (API-based permission check) actually works against this Forgejo instance before wiring it into the workflow:The API check works and correctly distinguishes owner/admin from everyone else. Now let me apply the fix:Workflow is valid. Now let me update the docs to match the new authorization model and document the org-repo requirements:Both paths verified (owner → allowed, stranger → denied with a clear error). Creating the PR:Fixed in #14 — #14Root cause: the guard compared the commenting user against
forgejo.repository_owner. Onorg/reporepositories the "owner" is the organization itself, sosender.login == repository_ownercan never match and the job was always skipped.The fix:
if:now only gates on the/piprefix (issue comment, review comment, or review body — the latter also restores review-triggering dropped in6fb8f3b)./repos/{owner}/{repo}/collaborators/{sender}/permissionusingPI_TOKEN):owner/admin→ agent runs; anything else → job fails with a clear::error::annotation so unauthorized attempts are visible instead of silently skipped.user/repoandorg/repo(org owners/admins getowner/adminon org repos). Verified live against the forge: repo owner → allowed, non-collaborator → denied.docs/setup-pi-bot.mdupdated with org-repo requirements (pias site/org admin so the permission query works;PI_TOKEN+ model vars at org level) and the now-accurate access-control note.After merge,
/pion any org repo should work — worth a quick/pi pingon the org repo that was failing to confirm.View action run | Model: zai/glm-5.2 (thinking: max) | Time: 7m 17s | Tokens: 333.5K | Pi SDK v0.84.0 | Action v2.27.0-develop (develop @ ee8f1d1)