Org default teams: add Protected option + bot-account naming/auto-membership follow-ups (#513) #745

New Issue

2026-07-05T21:09:51Z

jmiller commented

2026-07-05 21:09:51 +00:00

Follow-ups discovered while reviewing the auto-created default org teams (#513). None are bugs in shipped behavior — these are enhancements to decide on later.

Current state (verified in code)

Auto-created teams on org creation (models/organization/org.go:338 DefaultOrgTeams): Developers (write), Reviewers (read), CI/CD (actions+packages write). Plus the built-in Owners team.
Only Owners is protected — IsOwnerTeam() (models/organization/team.go) blocks its deletion. Developers/Reviewers/CI/CD are ordinary teams — an org owner can rename or delete them. DefaultTeamSpec has no protection field.
No bot is auto-added to any team on org creation — the CI/CD team is created empty (no AddTeamMember for the actions/api bot in the creation flow).
Actions bot identity (models/user/user_system.go): name mokogitea-actions, id -2, email mokogitea-actions[bot]@mokoconsulting.tech, FullName "MokoGitea Actions". Legacy reserved names: gitea-actions, github-actions.

Proposed work

1. `Protected` option on default teams

Add a Protected bool (or CanBeDeleted) field to DefaultTeamSpec and enforce it at the team delete/rename choke point (extend the guard beyond IsOwnerTeam), so a chosen default team (e.g. CI/CD or a future Bots team) can be made undeletable/unrenamable like Owners. Consider a matching is_protected flag on the team model + migration if it needs to persist per-team.

2. Bot account naming (the "bots rename")

Confirm/standardize the bot account naming convention. Current is mokogitea-actions; decide whether it should be mokogitea[bot] / mokogitea-actions[bot] as the actual username (note: [/] are not normally valid Gitea usernames — GitHub's github-actions[bot] is a special-cased login, so this may need special handling), and whether a separate API/automation bot account is wanted distinct from the actions user (-2).

3. Auto-add the bot to a team (optional)

Optionally auto-add the actions/api bot to the CI/CD (or a new Bots) team on org creation, so automation has team-scoped access out of the box.

4. A dedicated `Bots` team (optional)

Whether to add a Bots default team (or rename CI/CD → Bots) for service/automation accounts — and if so, make it Protected (depends on #1).

Related: #513 (default teams), #727 org-governance series.

https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

Follow-ups discovered while reviewing the auto-created default org teams (#513). None are bugs in shipped behavior — these are enhancements to decide on later. ## Current state (verified in code) - **Auto-created teams** on org creation (`models/organization/org.go:338` `DefaultOrgTeams`): **Developers** (write), **Reviewers** (read), **CI/CD** (actions+packages write). Plus the built-in **Owners** team. - **Only `Owners` is protected** — `IsOwnerTeam()` (`models/organization/team.go`) blocks its deletion. Developers/Reviewers/**CI/CD are ordinary teams** — an org owner can rename or delete them. `DefaultTeamSpec` has **no** protection field. - **No bot is auto-added** to any team on org creation — the CI/CD team is created empty (no `AddTeamMember` for the actions/api bot in the creation flow). - **Actions bot identity** (`models/user/user_system.go`): name `mokogitea-actions`, id `-2`, email `mokogitea-actions[bot]@mokoconsulting.tech`, FullName "MokoGitea Actions". Legacy reserved names: `gitea-actions`, `github-actions`. ## Proposed work ### 1. `Protected` option on default teams Add a `Protected bool` (or `CanBeDeleted`) field to `DefaultTeamSpec` and enforce it at the team delete/rename choke point (extend the guard beyond `IsOwnerTeam`), so a chosen default team (e.g. **CI/CD** or a future **Bots** team) can be made undeletable/unrenamable like Owners. Consider a matching `is_protected` flag on the team model + migration if it needs to persist per-team. ### 2. Bot account naming (the "bots rename") Confirm/standardize the bot account naming convention. Current is `mokogitea-actions`; decide whether it should be `mokogitea[bot]` / `mokogitea-actions[bot]` as the actual username (note: `[`/`]` are not normally valid Gitea usernames — GitHub's `github-actions[bot]` is a special-cased login, so this may need special handling), and whether a **separate API/automation bot** account is wanted distinct from the actions user (-2). ### 3. Auto-add the bot to a team (optional) Optionally auto-add the actions/api bot to the CI/CD (or a new **Bots**) team on org creation, so automation has team-scoped access out of the box. ### 4. A dedicated `Bots` team (optional) Whether to add a **Bots** default team (or rename CI/CD → Bots) for service/automation accounts — and if so, make it Protected (depends on #1). Related: #513 (default teams), #727 org-governance series. https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

jmiller commented

2026-07-05 21:10:00 +00:00

Branch created: feature/745-org-default-teams-add-protected-option-b

git fetch origin
git checkout feature/745-org-default-teams-add-protected-option-b

Branch created: [`feature/745-org-default-teams-add-protected-option-b`](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork/src/branch/feature/745-org-default-teams-add-protected-option-b) ```bash git fetch origin git checkout feature/745-org-default-teams-add-protected-option-b ```

jmiller referenced this issue

2026-07-05 21:13:24 +00:00

Auto-add the actions bot to the CI/CD team on org creation (#513) #746

jmiller referenced this issue

2026-07-05 21:23:49 +00:00

Add a dedicated system API/automation bot account (mokogitea-api) #747

jmiller referenced this issue

2026-07-12 20:13:06 +00:00

Epic: MokoGitea vNext — rebase to Gitea 1.26.4 (security backports) + feature roadmap #762

Sign in to join this conversation.