Auto-add the actions bot to the CI/CD team on org creation (#513) #746

New Issue

2026-07-05T21:13:24Z

jmiller commented

2026-07-05 21:13:24 +00:00

Firms up #745 §3 into a concrete requirement: when a new organization is created, the actions/automation bot should be auto-added as a member of the CI/CD team so automation has team-scoped access out of the box (today the CI/CD team is created empty).

Implementation

In CreateOrganization (models/organization/org.go, after DefaultOrgTeams are inserted ~lines 471–496), once the CI/CD team exists, add the actions bot to it.
The actions bot is the system user mokogitea-actions / ActionsUserID = -2 (models/user/user_system.go). Use its user record (user_model.NewActionsUser() / fetch by id -2).

Important considerations / gotchas

System-user team membership: AddTeamMember may not currently accept the system user (id -2, negative id, IsActive/type differences). Verify it does, or add a code path that adds the bot without the normal member validations. A system user is not a normal org member.
Email-domain policy interaction (NEW, #732/#727): we just added org email-domain enforcement at the AddTeamMember choke point (services/org/team.go → ErrEmailDomainNotAllowed). The bot's email is mokogitea-actions[bot]@mokoconsulting.tech; if an org sets an email-domain policy that excludes mokoconsulting.tech, auto-adding the bot would be rejected. The auto-add must bypass the email-domain check for the system bot (system users are exempt), or add the bot before/around that enforcement. This is the key correctness detail.
Best-effort: adding the bot should not fail org creation if it errors — log and continue (consistent with how the repo-defaults notifier is best-effort).
Idempotency / existing orgs: decide whether to backfill existing orgs (a migration or admin command) or only apply to newly created orgs.

Acceptance

New org → CI/CD team has the mokogitea-actions bot as a member.
Works even when the org has a restrictive email-domain policy (bot exempt).
Org creation never fails due to the bot-add step.

Related: #745 (parent — teams/bots follow-ups), #513 (default teams), #732 (email-domain policy), #727 (org-governance).

https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

Firms up #745 §3 into a concrete requirement: when a new organization is created, the actions/automation bot should be **auto-added as a member of the CI/CD team** so automation has team-scoped access out of the box (today the CI/CD team is created empty). ## Implementation - In `CreateOrganization` (`models/organization/org.go`, after `DefaultOrgTeams` are inserted ~lines 471–496), once the **CI/CD** team exists, add the actions bot to it. - The actions bot is the system user `mokogitea-actions` / `ActionsUserID = -2` (`models/user/user_system.go`). Use its user record (`user_model.NewActionsUser()` / fetch by id -2). ## Important considerations / gotchas 1. **System-user team membership:** `AddTeamMember` may not currently accept the system user (id -2, negative id, `IsActive`/type differences). Verify it does, or add a code path that adds the bot without the normal member validations. A system user is not a normal org member. 2. **Email-domain policy interaction (NEW, #732/#727):** we just added org email-domain enforcement at the `AddTeamMember` choke point (`services/org/team.go` → `ErrEmailDomainNotAllowed`). The bot's email is `mokogitea-actions[bot]@mokoconsulting.tech`; if an org sets an email-domain policy that excludes `mokoconsulting.tech`, auto-adding the bot would be **rejected**. The auto-add must **bypass** the email-domain check for the system bot (system users are exempt), or add the bot before/around that enforcement. This is the key correctness detail. 3. **Best-effort:** adding the bot should not fail org creation if it errors — log and continue (consistent with how the repo-defaults notifier is best-effort). 4. **Idempotency / existing orgs:** decide whether to backfill existing orgs (a migration or admin command) or only apply to newly created orgs. ## Acceptance - New org → CI/CD team has the `mokogitea-actions` bot as a member. - Works even when the org has a restrictive email-domain policy (bot exempt). - Org creation never fails due to the bot-add step. Related: #745 (parent — teams/bots follow-ups), #513 (default teams), #732 (email-domain policy), #727 (org-governance). https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT

jmiller commented

2026-07-05 21:13:33 +00:00

Branch created: feature/746-auto-add-the-actions-bot-to-the-ci-cd-te

git fetch origin
git checkout feature/746-auto-add-the-actions-bot-to-the-ci-cd-te

Branch created: [`feature/746-auto-add-the-actions-bot-to-the-ci-cd-te`](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork/src/branch/feature/746-auto-add-the-actions-bot-to-the-ci-cd-te) ```bash git fetch origin git checkout feature/746-auto-add-the-actions-bot-to-the-ci-cd-te ```

jmiller referenced this issue

2026-07-05 21:23:49 +00:00

Add a dedicated system API/automation bot account (mokogitea-api) #747

Sign in to join this conversation.

Priority Medium

Type Feature

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGitea-Fork#746