First request to origin is made without login in first #42

New issue

Open

opened 2026-01-04 09:07:10 +00:00 by NickP · 1 comment

NickP commented

2026-01-04 09:07:10 +00:00

The functions are called as follows, and the behavior would be easy to change. Unfortunately, I'm not really familiar with Bash, and I'm not sure how you would write a test to prevent the same behavior in the future; otherwise I would open a PR myself.

Thank you for all the work you put into Forgejo and its tools.

main
  finalize_options
    set_git_url origin
    set_origin_head
      sanity_check_pr_or_ref
      origin_sanity_check
        pr_get_origin
          repo_curl
            forgejo-curl.sh  <-- FIRST API CALL (unauthenticated)
    set_destination_head
    set_git_url destination
  run
    repo_login origin       <-- FIRST AUTHENTICATED ACTION
    repo_login destination
    run_origin_pr
      pr_state
        pr_get_origin       <-- NOW authenticated
      checkout
      update
      upsert_destination_pr
      comment_origin_pr
      wait_destination_ci

Edit:
The function get_status in cascading-pr-lib.sh is also making requests without authentification. It is using the forgejo-curl.sh directly instead of the repo_curl function from cascading-pr.sh.

I've tried to use this action on a self‑hosted Forgejo instance with a private origin and destination repository. Unfortunately, the action always failed to get the PR data in the function pr_get_origin. After some time, I realized that this API call is made before the login function is called. While this is not an issue with a public repo, it is a problem with a private one and since a token is supplied, the behavior is also quite unexpected. The functions are called as follows, and the behavior would be easy to change. Unfortunately, I'm not really familiar with Bash, and I'm not sure how you would write a test to prevent the same behavior in the future; otherwise I would open a PR myself. Thank you for all the work you put into Forgejo and its tools. ``` main finalize_options set_git_url origin set_origin_head sanity_check_pr_or_ref origin_sanity_check pr_get_origin repo_curl forgejo-curl.sh <-- FIRST API CALL (unauthenticated) set_destination_head set_git_url destination run repo_login origin <-- FIRST AUTHENTICATED ACTION repo_login destination run_origin_pr pr_state pr_get_origin <-- NOW authenticated checkout update upsert_destination_pr comment_origin_pr wait_destination_ci ``` Edit: The function get_status in cascading-pr-lib.sh is also making requests without authentification. It is using the forgejo-curl.sh directly instead of the repo_curl function from cascading-pr.sh.

viceice commented

2026-02-10 20:19:04 +00:00

Owner

it's not a bug. this action was designed to be used with public repos

viceice added the

Kind/Enhancement

label

2026-02-10 20:19:13 +00:00

viceice changed title from ~~bug: First request to origin is made without login in first~~ to First request to origin is made without login in first

2026-02-10 20:19:21 +00:00