From 05ac1a1e7708182d4af922a6790329f0bc644596 Mon Sep 17 00:00:00 2001
From: Michal Konecny <mkonecny@redhat.com>
Date: Fri, 12 Jun 2026 15:25:15 +0200
Subject: [PATCH] [bodhi2] Add script to make flatpak repos public

The repos created through docker push are created as private by default.
This script will run every hour and sets any private repo visibility to
public.

This should be next step to finish
https://forge.fedoraproject.org/infra/tickets/issues/11543

Signed-off-by: Michal Konecny <mkonecny@redhat.com>
---
 .../files/flatpak_quayio_repo_publisher.py    | 78 +++++++++++++++++++
 roles/bodhi2/backend/tasks/main.yml           | 22 ++++++
 .../flatpak_quayio_repo_publisher.cron.j2     |  7 ++
 3 files changed, 107 insertions(+)
 create mode 100644 roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py
 create mode 100644 roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2

diff --git a/roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py b/roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py
new file mode 100644
index 0000000000..8f0cdbb125
--- /dev/null
+++ b/roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py
@@ -0,0 +1,78 @@
+#!/usr/bin/python3
+# Set new flatpak repositories on quay.io public.
+# See https://forge.fedoraproject.org/infra/tickets/issues/11543#issuecomment-705742
+# Author: Michal Konecny <mkonecny@redhat.com>
+import json
+import os
+import requests
+
+QUAYIO_URL = "https://quay.io/"
+
+def get_private_repos(quayio_token:str, quayio_namespace:str) -> list:
+    """
+    Retrieve all the repositories that are private.
+    """
+    repos = []
+
+    # Request parameters and headers
+    header = {
+        "Content-Type": "application/json",
+        "Authorization": "Bearer " + quayio_token
+    }
+    params = {
+        "namespace": quayio_namespace
+    }
+
+    url = f"{QUAYIO_URL}api/v1/repository"
+
+    next_page = True
+
+    while next_page:
+        response = requests.get(url, headers=header, params=params)
+
+        if response.status_code != 200:
+            print(f"Couldn't reach {url}. Status code: {response.status_code}")
+            print(response.text)
+            return repos
+
+        # Add private repositories to list of repositories
+        repos.extend(
+            [repo["name"] for repo in response.json().get("repositories",[]) if not repo["is_public"]]
+        )
+
+        next_page = response.json().get("next_page")
+        if next_page:
+            params["next_page"] = next_page
+
+    return repos
+
+def set_repo_public(quayio_token:str, repo:str, quayio_namespace:str) -> None:
+    """
+    Set repository visibility to public.
+    """
+    header = {
+        "Content-Type": "application/json",
+        "Authorization": "Bearer " + quayio_token
+    }
+
+    data = {"visibility": "public"}
+
+    url = f"{QUAYIO_URL}api/v1/repository/{quayio_namespace}/{repo}/changevisibility" 
+
+    response = requests.post(
+        url,
+        headers=header,
+        json=data
+    )
+
+    if response.status_code != 200:
+        print(f"Couldn't reach {url}. Status code: {response.status_code}")
+        print(response.text)
+
+
+if __name__ == "__main__":
+    quayio_namespace = os.environ["QUAYIO_NAMESPACE"]
+    quayio_token = os.environ["QUAYIO_OAUTH_TOKEN"]
+    repos = get_private_repos(quayio_token, quayio_namespace)
+    for repo in repos:
+        set_repo_public(quayio_token, repo, quayio_namespace)
diff --git a/roles/bodhi2/backend/tasks/main.yml b/roles/bodhi2/backend/tasks/main.yml
index 9505f3a9e9..1ed1ac76ee 100644
--- a/roles/bodhi2/backend/tasks/main.yml
+++ b/roles/bodhi2/backend/tasks/main.yml
@@ -285,6 +285,28 @@
   - bodhi
   - cron
 
+#
+# cron job that sets newly created flatpak repositories as public
+#
+- name: Put flatpak_quayio_repo_publisher in place
+  ansible.builtin.copy:
+    src: flatpak_quayio_repo_publisher.py
+    dest: /usr/local/bin/flatpak_quayio_repo_publisher.py
+    mode: "0755"
+  tags:
+  - config
+  - bodhi
+  - cron
+
+- name: Set the flatpak_quayio_repo_publisher cron job
+  ansible.builtin.template:
+    src: flatpak_quayio_repo_publisher.cron.j2
+    dest: /etc/cron.d/flatpak_quayio_repo_publisher
+  tags:
+  - config
+  - bodhi
+  - cron
+
 - name: Install production.ini
   ansible.builtin.template:
     src: "{{ roles_path }}/bodhi2/base/templates/production.ini.j2"
diff --git a/roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2 b/roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2
new file mode 100644
index 0000000000..89532d34b5
--- /dev/null
+++ b/roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2
@@ -0,0 +1,7 @@
+MAILTO=root@fedoraproject.org
+{% if env == "staging" %}
+0 * * * * bodhi QUAYIO_NAMESPACE=fedora-flatpaks-staging QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth_stg }} /usr/local/bin/flatpak_quayio_repo_publisher.py
+{% else %}
+0 * * * * bodhi QUAYIO_NAMESPACE=fedora-flatpaks QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth }} /usr/local/bin/flatpak_quayio_repo_publisher.py
+{% endif %}
+