[bodhi2] Add script to make flatpak repos public #3412

Merged

zlopez merged 1 commit from zlopez/ansible:11543 into main 2026-06-24 08:01:53 +00:00

Conversation 2 Commits 1 Files changed 3 +107

zlopez commented 2026-06-12 13:27:38 +00:00

Owner

Copy link

The repos created through docker push are created as private by default.
This script will run every hour and sets any private repo visibility to
public.

This should be next step to finish
infra/tickets#11543

Signed-off-by: Michal Konecny mkonecny@redhat.com

The repos created through docker push are created as private by default. This script will run every hour and sets any private repo visibility to public. This should be next step to finish https://forge.fedoraproject.org/infra/tickets/issues/11543 Signed-off-by: Michal Konecny <mkonecny@redhat.com>

zlopez added 1 commit 2026-06-12 13:27:39 +00:00

[bodhi2] Add script to make flatpak repos public ... c5f24b101f

The repos created through docker push are created as private by default.
This script will run every hour and sets any private repo visibility to
public.

This should be next step to finish
infra/tickets#11543

Signed-off-by: Michal Konecny <mkonecny@redhat.com>

zlopez added the

ai-review-please

label 2026-06-12 13:27:44 +00:00

forgejo-actions commented 2026-06-12 13:28:16 +00:00

Copy link

AI Code Review

Detailed Code Review

The implementation correctly targets the issue of repositories defaulting to private on push. However, there is a critical Jinja2 syntax error in the cron template that will prevent authentication from working properly. Additionally, the Python script lacks necessary safeguards against API failures and hanging network connections, which are important for scripts running unattended via cron.

📂 File Reviews

📄 `roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py` - A Python script that fetches private repositories from Quay.io and changes their visibility to public.

• Major [Bug]: If the Quay.io API returns a non-200 response (e.g., 500 Internal Server Error), the script prints an error but immediately attempts to parse the response as JSON. This will likely raise a JSONDecodeError and crash the script unexpectedly.
  • Suggestion: Raise an exception or return early when encountering an unexpected HTTP status code.

        if response.status_code != 200:
            print(f"Couldn't reach {url}. Status code: {response.status_code}")
            print(response.text)
            response.raise_for_status() # Stop execution on failure

• Minor [Performance]: Network requests lack a timeout parameter. In an automated cron environment, a hanging network connection can cause the script to run indefinitely, potentially leading to overlapping executions and resource exhaustion.
  • Suggestion: Add a timeout parameter to all requests.get and requests.post calls.

        response = requests.get(url, headers=header, params=params, timeout=30)

📄 `roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2` - Jinja2 template defining the cron job for the publisher script.

• Critical [Bug]: The template uses single curly braces {variable} for the OAuth tokens instead of Ansible's Jinja2 standard double curly braces {{ variable }}. This will result in the literal string '{bodhi2_quayio_oauth}' being passed to the script rather than the actual token.
  • Suggestion: Replace {} with {{ }} for variable evaluation.

MAILTO=root@fedoraproject.org
{% if env == "staging" %}
0 * * * * QUAYIO_NAMESPACE=fedora-flatpaks-staging QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth_stg }} /usr/local/bin/flatpak_quayio_repo_publisher.py
{% else %}
0 * * * * QUAYIO_NAMESPACE=fedora-flatpaks QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth }} /usr/local/bin/flatpak_quayio_repo_publisher.py
{% endif %}

✅ Summary

• Overall Assessment: The review identified a critical templating bug that will prevent script execution, alongside major missing error handling in the Python script. These issues must be resolved before deployment.
• Priority Issues:
  • Fix Jinja2 templating syntax for OAuth tokens in flatpak_quayio_repo_publisher.cron.j2 by using {{ }} instead of {}.
  • Handle non-200 HTTP responses in get_private_repos properly to prevent JSONDecodeError exceptions during execution.
• Minor Suggestions:
  • Add strict timeouts to requests.get() and requests.post() in the Python script to prevent process hanging.

---

🤖 AI Code Review | Generated with ai-code-review | Model: gemini-3.1-pro-preview

⚠️ AI-generated suggestions may be incorrect. Verify before applying. Not a replacement for human review.

## AI Code Review ### Detailed Code Review The implementation correctly targets the issue of repositories defaulting to private on push. However, there is a critical Jinja2 syntax error in the cron template that will prevent authentication from working properly. Additionally, the Python script lacks necessary safeguards against API failures and hanging network connections, which are important for scripts running unattended via cron. #### 📂 File Reviews <details> <summary><strong>📄 `roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py`</strong> - A Python script that fetches private repositories from Quay.io and changes their visibility to public.</summary> - **Major** [Bug]: If the Quay.io API returns a non-200 response (e.g., 500 Internal Server Error), the script prints an error but immediately attempts to parse the response as JSON. This will likely raise a `JSONDecodeError` and crash the script unexpectedly. - *Suggestion:* Raise an exception or return early when encountering an unexpected HTTP status code. ```` if response.status_code != 200: print(f"Couldn't reach {url}. Status code: {response.status_code}") print(response.text) response.raise_for_status() # Stop execution on failure ```` - **Minor** [Performance]: Network requests lack a `timeout` parameter. In an automated cron environment, a hanging network connection can cause the script to run indefinitely, potentially leading to overlapping executions and resource exhaustion. - *Suggestion:* Add a timeout parameter to all `requests.get` and `requests.post` calls. ```` response = requests.get(url, headers=header, params=params, timeout=30) ```` </details> <details> <summary><strong>📄 `roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2`</strong> - Jinja2 template defining the cron job for the publisher script.</summary> - **Critical** [Bug]: The template uses single curly braces `{variable}` for the OAuth tokens instead of Ansible's Jinja2 standard double curly braces `{{ variable }}`. This will result in the literal string '{bodhi2_quayio_oauth}' being passed to the script rather than the actual token. - *Suggestion:* Replace `{}` with `{{ }}` for variable evaluation. ```` MAILTO=root@fedoraproject.org {% if env == "staging" %} 0 * * * * QUAYIO_NAMESPACE=fedora-flatpaks-staging QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth_stg }} /usr/local/bin/flatpak_quayio_repo_publisher.py {% else %} 0 * * * * QUAYIO_NAMESPACE=fedora-flatpaks QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth }} /usr/local/bin/flatpak_quayio_repo_publisher.py {% endif %} ```` </details> ### ✅ Summary - **Overall Assessment:** The review identified a critical templating bug that will prevent script execution, alongside major missing error handling in the Python script. These issues must be resolved before deployment. - **Priority Issues:** - Fix Jinja2 templating syntax for OAuth tokens in `flatpak_quayio_repo_publisher.cron.j2` by using `{{ }}` instead of `{}`. - Handle non-200 HTTP responses in `get_private_repos` properly to prevent `JSONDecodeError` exceptions during execution. - **Minor Suggestions:** - Add strict timeouts to `requests.get()` and `requests.post()` in the Python script to prevent process hanging. --- 🤖 **AI Code Review** | Generated with [ai-code-review](https://gitlab.com/redhat/edge/ci-cd/ai-code-review) | **Model:** `gemini-3.1-pro-preview` ⚠️ *AI-generated suggestions may be incorrect. Verify before applying. Not a replacement for human review.*

zlopez referenced this pull request from infra/tickets 2026-06-12 13:28:51 +00:00

Migration of registry.fedoraproject.org to quay.io #11543

zlopez force-pushed 11543 from c5f24b101f to 70db1df8bd 2026-06-12 13:31:35 +00:00 Compare

forgejo-actions commented 2026-06-12 13:32:19 +00:00

Copy link

AI Code Review

Detailed Code Review

The merge request implements a straightforward Python script and accompanying Ansible tasks to automate the visibility of Quay.io repositories. The logic for interacting with the Quay.io API is sound and handles pagination correctly.

However, there is a critical issue in the system cron job configuration. Files placed in /etc/cron.d/ require a username field before the command, which is currently missing. Without this, the cron daemon will fail to execute the script. Additionally, it is highly recommended to add basic timeout parameters to the network requests in the Python script to prevent the cron job from hanging indefinitely if the Quay API is unresponsive.

📂 File Reviews

📄 `roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2` - Adds a template for the cron job that runs the publisher script hourly.

• Critical [Bug]: Cron files placed in /etc/cron.d/ require a username field (e.g., root or bodhi) between the time specification and the command. Without it, cron will interpret QUAYIO_NAMESPACE... as the username and fail to execute.
  • Suggestion: Add the executing user (likely root or bodhi) after the time schedule.

MAILTO=root@fedoraproject.org
{% if env == "staging" %}
0 * * * * root QUAYIO_NAMESPACE=fedora-flatpaks-staging QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth_stg }} /usr/local/bin/flatpak_quayio_repo_publisher.py
{% else %}
0 * * * * root QUAYIO_NAMESPACE=fedora-flatpaks QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth }} /usr/local/bin/flatpak_quayio_repo_publisher.py
{% endif %}

📄 `roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py` - Python script to interact with the Quay.io API to fetch private repositories and change their visibility to public.

• Major [Performance]: The requests.get and requests.post calls are missing timeout arguments. In a cron job, if the remote server becomes unresponsive, the script will hang indefinitely instead of timing out, potentially leading to overlapping overlapping cron executions.
  • Suggestion: Add a sensible timeout (e.g., 10-30 seconds) to all requests calls.

        response = requests.get(url, headers=header, params=params, timeout=30)

# ... and in set_repo_public ...

    response = requests.post(
        url,
        headers=header,
        json=data,
        timeout=30
    )

✅ Summary

• Overall Assessment: The core logic is correct, but a critical syntax error in the cron configuration will prevent execution. Please fix the cron file syntax and add timeouts to the network requests before merging.

---

🤖 AI Code Review | Generated with ai-code-review | Model: gemini-3.1-pro-preview

⚠️ AI-generated suggestions may be incorrect. Verify before applying. Not a replacement for human review.

## AI Code Review ### Detailed Code Review The merge request implements a straightforward Python script and accompanying Ansible tasks to automate the visibility of Quay.io repositories. The logic for interacting with the Quay.io API is sound and handles pagination correctly. However, there is a critical issue in the system cron job configuration. Files placed in `/etc/cron.d/` require a username field before the command, which is currently missing. Without this, the cron daemon will fail to execute the script. Additionally, it is highly recommended to add basic timeout parameters to the network requests in the Python script to prevent the cron job from hanging indefinitely if the Quay API is unresponsive. #### 📂 File Reviews <details> <summary><strong>📄 `roles/bodhi2/backend/templates/flatpak_quayio_repo_publisher.cron.j2`</strong> - Adds a template for the cron job that runs the publisher script hourly.</summary> - **Critical** [Bug]: Cron files placed in `/etc/cron.d/` require a username field (e.g., `root` or `bodhi`) between the time specification and the command. Without it, cron will interpret `QUAYIO_NAMESPACE...` as the username and fail to execute. - *Suggestion:* Add the executing user (likely `root` or `bodhi`) after the time schedule. ```` MAILTO=root@fedoraproject.org {% if env == "staging" %} 0 * * * * root QUAYIO_NAMESPACE=fedora-flatpaks-staging QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth_stg }} /usr/local/bin/flatpak_quayio_repo_publisher.py {% else %} 0 * * * * root QUAYIO_NAMESPACE=fedora-flatpaks QUAYIO_OAUTH_TOKEN={{ bodhi2_quayio_oauth }} /usr/local/bin/flatpak_quayio_repo_publisher.py {% endif %} ```` </details> <details> <summary><strong>📄 `roles/bodhi2/backend/files/flatpak_quayio_repo_publisher.py`</strong> - Python script to interact with the Quay.io API to fetch private repositories and change their visibility to public.</summary> - **Major** [Performance]: The `requests.get` and `requests.post` calls are missing timeout arguments. In a cron job, if the remote server becomes unresponsive, the script will hang indefinitely instead of timing out, potentially leading to overlapping overlapping cron executions. - *Suggestion:* Add a sensible timeout (e.g., 10-30 seconds) to all `requests` calls. ```` response = requests.get(url, headers=header, params=params, timeout=30) # ... and in set_repo_public ... response = requests.post( url, headers=header, json=data, timeout=30 ) ```` </details> ### ✅ Summary - **Overall Assessment:** The core logic is correct, but a critical syntax error in the cron configuration will prevent execution. Please fix the cron file syntax and add timeouts to the network requests before merging. --- 🤖 **AI Code Review** | Generated with [ai-code-review](https://gitlab.com/redhat/edge/ci-cd/ai-code-review) | **Model:** `gemini-3.1-pro-preview` ⚠️ *AI-generated suggestions may be incorrect. Verify before applying. Not a replacement for human review.*

zlopez force-pushed 11543 from 70db1df8bd to 9bd7038f46 2026-06-12 13:37:00 +00:00 Compare

zlopez force-pushed 11543 from 9bd7038f46 to 05ac1a1e77 2026-06-24 07:56:50 +00:00 Compare

zlopez merged commit 05ac1a1e77 into main 2026-06-24 08:01:53 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

ai-review-please

label for requesting AI code review

  

freeze-break-request

  

post-freeze

  

Backlog Status

Needs Review

Work items that have been created or updated but need review, refinement, or approval before they can be considered ready for sprint planning.

  

Backlog Status

Ready

Work items that have been reviewed, refined, and are ready to be committed to a sprint. These items have clear requirements and can be worked on immediately when capacity is available.

  

chore

Work that needs to be done but doesn't add new functionality or fix bugs. Maintenance tasks that keep the system running smoothly and the codebase clean.

  

documentation

Work focused on creating, updating, or improving documentation for users, developers, or system administrators.

  

points

01

A task that is simple, small, and has very little uncertainty. It should be easy enough for any team member to pick up and complete quickly, without a lot of discussion or research.

  

points

02

This is a task that is slightly more complex or larger than a "1." It might involve two or three simple steps, but the outcome is still very clear and there's little uncertainty.

  

points

03

Medium-sized task with some noticeable complexity. It might require a bit more thought or collaboration. The steps are well-defined, but it's not a trivial change.

  

points

05

A significant piece of work. It has more complexity and a higher degree of uncertainty than smaller tasks. It might require some research, a design discussion, or collaboration across multiple teams.

  

points

08

Complex task with a lot of uncertainty. It's often the largest size that a team will consider for a single sprint. It likely requires a detailed breakdown and multiple team members to complete.

  

points

13

Any task that feels like it's a "13" or more is considered an Epic. These are too large and uncertain to be worked on in a single sprint and should be broken down.

  

Priority

High

This is for work that is critical and needs to be addressed in the next sprint. It's often for urgent bugs, important features, or a major piece of technical debt that is blocking other work.

  

Priority

Low

This is for work that is good to do but not urgent. It's a candidate for being worked on when there's extra time or when it rises in importance. It can stay in the backlog for a longer period.

  

Priority

Medium

This is for important work that should be done soon, but isn't as urgent as a high-priority item. It will likely be considered for the next 1-2 sprints.

  

Sprint Status

Blocked

Work items that cannot progress due to external dependencies, blockers, or issues that need resolution.

  

Sprint Status

Done

Work items that have been completed, reviewed, and integrated. No further work is needed within the current sprint.

  

Sprint Status

In Progress

Work items currently being worked on by a team member. Active development, research, or implementation is happening.

  

Sprint Status

Review

Work items that are complete but need review, testing, or approval before being marked as done.

  

Sprint Status

To Do

Work items that are committed to the sprint but haven't been started yet. These items are ready to be picked up by team members.

  

Technical Debt

Work that addresses shortcuts, workarounds, or suboptimal implementations that were done previously to meet deadlines. These items improve code quality, maintainability, or performance without adding new features.

  

Work Item

Bug

Issues where the system is not working as intended or designed. Bugs represent deviations from expected behavior.

  

Work Item

Epic

Large initiatives that are broken down into multiple smaller work items (user stories, tasks, bugs). Epics represent significant features or projects that span multiple sprints.

  

Work Item

Spike

Time-boxed research, investigation, or proof-of-concept work to reduce uncertainty or explore solutions. Spikes help inform future development decisions.

  

Work Item

Task

Used to break down larger user stories into smaller, manageable implementation pieces. They focus on the specific technical steps needed to deliver the user story's value.

  

Work Item

User Story

User-facing features or functionality that can be framed from a user perspective, describing what someone wants to accomplish and why.

No labels

ai-review-please

freeze-break-request

post-freeze

Backlog Status

Needs Review

Backlog Status

Ready

chore

documentation

points

01

points

02

points

03

points

05

points

08

points

13

Priority

High

Priority

Low

Priority

Medium

Sprint Status

Blocked

Sprint Status

Done

Sprint Status

In Progress

Sprint Status

Review

Sprint Status

To Do

Technical Debt

Work Item

Bug

Work Item

Epic

Work Item

Spike

Work Item

Task

Work Item

User Story

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

infra/ansible!3412

No description provided.