Skip to content

Fix: persist and expose repository gatePack setting - #719

Merged
JSONbored merged 2 commits into
mainfrom
codex/fix-gatepack-settings-write-vulnerability
Jun 14, 2026
Merged

Fix: persist and expose repository gatePack setting#719
JSONbored merged 2 commits into
mainfrom
codex/fix-gatepack-settings-write-vulnerability

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • A recently added gatePack setting (values gittensor | oss-anti-slop) was used by gate logic but not fully wired into settings write paths, causing API-updated or existing DB rows to silently keep the default gittensor value.
  • This made API-configured oss-anti-slop ineffective for existing rows and allowed non-confirmed authors to avoid intended deterministic gate failures in some configurations.

Description

  • Add gatePack to the internal repository settings request schema so API callers can provide the field (src/api/routes.ts).
  • Forward the parsed gatePack value from the internal settings endpoint to upsertRepositorySettings (src/api/routes.ts).
  • Persist gatePack in the upsert conflict-update set so existing repository settings rows can change packs (src/db/repositories.ts).
  • Add regression coverage to verify DB round-trip updates and internal-API behavior (test/unit/data-spine.test.ts, test/integration/api.test.ts).

Testing

  • Ran the targeted Vitest suites with npx vitest run test/unit/data-spine.test.ts test/integration/api.test.ts --reporter dot and all tests passed.
  • Type checking was run with npm run typecheck (calls tsc --noEmit) and succeeded.

Codex Task

@ghost

ghost commented Jun 14, 2026

Copy link
Copy Markdown

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal Result Evidence Action
Gate result ⚠️ Skipped #719 is no longer open. No action.

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

@ghost ghost added the gittensory:reviewed label Jun 14, 2026
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@ghost

ghost commented Jun 14, 2026

Copy link
Copy Markdown

gittensory · advisory review

Reviewed 4 changed file(s) — two independent AI reviewers.

Suggested action: 🛠️ Request changes. (reviewers split: request changes / merge) Address the suggestions below before merging.

Reviewer A · gpt-oss-120b — recommends 🛠️ request changes
The PR introduces a new repository setting gatePack with enum values, updates the API schema, persistence layer, and adds tests for round‑tripping and defaults. The change is otherwise clean but adds a new column to the repository settings without a corresponding database migration.

Suggestions

  • Add a D1 migration that creates the gatePack column (default "gittensor") in the repository settings table.
  • Update the TypeScript RepositorySettings type to include the optional gatePack field if not already present.
  • Document the new gatePack field in the API reference and any relevant README.
  • Add a test that verifies the default value is returned when the field is absent in the DB.

Worth double-checking

  • Runtime DB errors if the new column is missing.
  • Clients may break if they rely on the previous shape of the settings response.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds a new repository setting gatePack (with options 'gittensor' and 'oss-anti-slop') to the API schema, database layer, and updates integration and unit tests. The change is minimal, follows existing patterns for similar settings (like gateCheckMode), and includes appropriate test coverage for default values and updates. No forbidden public terms are introduced, as the setting values are internal configuration strings.

Worth double-checking

  • Verify that the repository settings endpoint (/v1/repos/:owner/:repo/settings) is not publicly accessible without authentication, as it returns this setting. While the setting itself is safe, ensure it aligns with the public/private boundary.

@ghost ghost added the gittensory-review label Jun 14, 2026
@dosubot dosubot Bot added the size:XS label Jun 14, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jun 14, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
gittensory-ui ed602db Commit Preview URL

Branch Preview URL
Jun 14 2026, 02:15 PM

@JSONbored
JSONbored merged commit a3781c1 into main Jun 14, 2026
11 checks passed
@JSONbored
JSONbored deleted the codex/fix-gatepack-settings-write-vulnerability branch June 14, 2026 14:26
@github-project-automation github-project-automation Bot moved this from Todo to Done in gittensory - v1 roadmap Jun 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

No open projects
Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant