Skip to content

fix(tgit): correct REST auth scheme and rename TGit token to TGIT_TOKEN - #210

Merged
jeff-r2026 merged 1 commit into
Tencent:mainfrom
m0Nst3r873:fix/tgit-rest-auth-token-rename
Jul 20, 2026
Merged

fix(tgit): correct REST auth scheme and rename TGit token to TGIT_TOKEN#210
jeff-r2026 merged 1 commit into
Tencent:mainfrom
m0Nst3r873:fix/tgit-rest-auth-token-rename

Conversation

@m0Nst3r873

@m0Nst3r873 m0Nst3r873 commented Jul 20, 2026

Copy link
Copy Markdown
Collaborator

Problem

The TeamAI MR knowledge-extract CI pipeline failed on every run. Root causes, verified live against git.woa.com/api/v3:

  1. Wrong auth scheme. All TGit REST calls sent Authorization: Bearer, but a git.woa.com Personal Access Token only authenticates via PRIVATE-TOKEN/private_token (Bearer → 401/403). OAuth tokens are the opposite.
  2. Nonexistent gf commands. fetchTGitMR called gf mr desc / gf mr diff — neither exists, and the gf CLI cannot return an MR diff at all.
  3. Wrong diff endpoint/payload. Needed singular merge_request/{globalId}/changes; this TGit version returns the diff under files[], not changes[]; merged_at is not returned.

Changes

  • New src/providers/tgit/rest-auth.ts — centralized tgitFetch(): PRIVATE-TOKEN for a PAT (TGIT_TOKEN env), Bearer for an OAuth token (~/.netrc), with a one-shot 401/403 scheme fallback + process-level cache.
  • mr-fetch.ts → REST-only — removed the dead gf branch; fixed the diff endpoint (singular path, read files[]/changes[]), merged_at → resolved_at → updated_at fallback, and an always-true MR match.
  • Routed all TGit REST callers (gf-cli, mr-comment, read-rejections, extract-mr, gf-org, mr-hint) through the helper.
  • Renamed the TGit token env var TAI_PAT_TOKEN → TGIT_TOKEN (TGit usages only; iWiki's TAI_PAT_TOKEN is a different token and is left untouched).
  • CI examples: consolidate repo config into a top-level env: block and add the GitHub-Actions example. Supersedes refactor(ci): extract repo config as env vars in CI examples #195 (folds in its refactor, reconciled to TGIT_TOKEN).
  • Added rest-auth unit tests; made the gf-org no-credentials test env-independent.

Test Plan

  • npx tsc --noEmit — clean
  • npm run build — success
  • npx vitest run — 1680 passed
  • Real E2E against MR 206: fetched title / author / description / 50KB diff / merged timestamp via both the PAT (TGIT_TOKEN) path and the OAuth (~/.netrc) fallback path — the exact step that previously 401'd.

Note for deployers: the ZhiYan pipeline secret must be renamed TAI_PAT_TOKEN → TGIT_TOKEN and pointed at a valid git.woa.com PAT (with api scope + write to the knowledge repo).

🤖 Generated with Claude Code

@m0Nst3r873 m0Nst3r873 mentioned this pull request Jul 20, 2026
Closed
3 tasks
@m0Nst3r873
m0Nst3r873 force-pushed the fix/tgit-rest-auth-token-rename branch from b76867f to fc23999 Compare July 20, 2026 09:41
@m0Nst3r873 @claude
fix(tgit): correct REST auth scheme and rename TGit token to TGIT_TOKEN
20aecde 
The TeamAI MR knowledge-extract CI pipeline failed on every run because
TGit REST calls sent `Authorization: Bearer`, but a git.woa.com Personal
Access Token only authenticates via `PRIVATE-TOKEN`/`private_token`
(Bearer → 401/403). Verified live against git.woa.com/api/v3.

Changes:
- Add src/providers/tgit/rest-auth.ts: centralized tgitFetch() that uses
  PRIVATE-TOKEN for a PAT (TGIT_TOKEN env) and Bearer for an OAuth token
  (~/.netrc), with a one-shot 401/403 scheme fallback + process cache.
- Rewrite mr-fetch.ts to REST-only: the gf CLI has no `mr desc`/`mr diff`
  commands and cannot return a diff. Fix diff endpoint to singular
  merge_request/{globalId}/changes, read files[]/changes[], fall back
  merged_at → resolved_at → updated_at, and fix an always-true MR match.
- Route all TGit REST callers (gf-cli, mr-comment, read-rejections,
  extract-mr, gf-org, mr-hint) through the helper.
- Rename the TGit token env var TAI_PAT_TOKEN → TGIT_TOKEN (TGit usages
  only; iWiki's TAI_PAT_TOKEN is a different token and is left untouched).
- CI examples: consolidate repo config into a top-level env block and add
  the github-actions example (supersedes PR Tencent#195), reconciled to TGIT_TOKEN.
- Add rest-auth unit tests; make the gf-org no-credentials test env-independent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@m0Nst3r873
m0Nst3r873 force-pushed the fix/tgit-rest-auth-token-rename branch from fc23999 to 20aecde Compare July 20, 2026 09:47
@jeff-r2026
jeff-r2026 merged commit 6d187d2 into Tencent:main Jul 20, 2026
7 checks passed
@m0Nst3r873 m0Nst3r873 mentioned this pull request Jul 20, 2026
Merged
2 tasks
m0Nst3r873 added a commit to m0Nst3r873/teamai-cli that referenced this pull request Jul 20, 2026
@m0Nst3r873 @claude
fix(tgit): authenticate git-over-HTTPS clone with a PAT (private: user)
b44d6d5 
Follow-up to Tencent#210. The MR-extract pipeline still failed at `teamai init`:
a git.woa.com Personal Access Token authenticates git-over-HTTPS only with
the username `private:` (an OAuth token uses `oauth2:`). The CLI hardcoded
`oauth2:` and routed two-segment repos to `gf repo clone`, whose own API
lookup can't use a PAT — so the existing knowledge repo was misread as
"does not exist", then create failed with 400 "Path has already been taken".
Verified live against git.woa.com.

Changes:
- rest-auth.ts: add tgitGitUser(scheme) (PAT→'private', OAuth→'oauth2') and
  tryGetTGitToken() (non-throwing token resolver).
- gf-cli.ts gfRepoClone: when a token is available, clone every repo via
  `git clone https://<user>:<token>@…` with the scheme-derived username;
  fall back to `gf repo clone` only when no token exists (interactive path,
  unchanged). Sanitizer redacts both oauth2: and private:.
- clone.ts: use the scheme-based username instead of hardcoded oauth2:.
- init.ts: a "repo already exists" create error is no longer fatal — it
  falls through to retry the clone.
- Tests for tgitGitUser and tryGetTGitToken.

CI example (examples/ci/coding-ci-mr-extract.yaml), validated end-to-end
against a live ZhiYan pipeline:
- comment stage no longer runs `teamai init` (comment mode only fetches the
  MR and posts via REST — no team-repo clone, and init's member registration
  needs an interactive TTY unavailable in CI).
- post-merge stage drops the redundant manual git config/commit/push block:
  `teamai ci extract-mr --write-mode direct` already commits and pushes with
  the git identity derived from TGIT_TOKEN's account (REST /user), which
  satisfies TGit's committer-check. The hardcoded `teamai-ci` committer was
  rejected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jeff-r2026 pushed a commit that referenced this pull request Jul 21, 2026
@m0Nst3r873 @claude
fix(tgit): authenticate git-over-HTTPS clone with a PAT (private: use…
93c903b 
…r) (#212)

Follow-up to #210. The MR-extract pipeline still failed at `teamai init`:
a git.woa.com Personal Access Token authenticates git-over-HTTPS only with
the username `private:` (an OAuth token uses `oauth2:`). The CLI hardcoded
`oauth2:` and routed two-segment repos to `gf repo clone`, whose own API
lookup can't use a PAT — so the existing knowledge repo was misread as
"does not exist", then create failed with 400 "Path has already been taken".
Verified live against git.woa.com.

Changes:
- rest-auth.ts: add tgitGitUser(scheme) (PAT→'private', OAuth→'oauth2') and
  tryGetTGitToken() (non-throwing token resolver).
- gf-cli.ts gfRepoClone: when a token is available, clone every repo via
  `git clone https://<user>:<token>@…` with the scheme-derived username;
  fall back to `gf repo clone` only when no token exists (interactive path,
  unchanged). Sanitizer redacts both oauth2: and private:.
- clone.ts: use the scheme-based username instead of hardcoded oauth2:.
- init.ts: a "repo already exists" create error is no longer fatal — it
  falls through to retry the clone.
- Tests for tgitGitUser and tryGetTGitToken.

CI example (examples/ci/coding-ci-mr-extract.yaml), validated end-to-end
against a live ZhiYan pipeline:
- comment stage no longer runs `teamai init` (comment mode only fetches the
  MR and posts via REST — no team-repo clone, and init's member registration
  needs an interactive TTY unavailable in CI).
- post-merge stage drops the redundant manual git config/commit/push block:
  `teamai ci extract-mr --write-mode direct` already commits and pushes with
  the git identity derived from TGIT_TOKEN's account (REST /user), which
  satisfies TGit's committer-check. The hardcoded `teamai-ci` committer was
  rejected.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@Eyre921 Eyre921 mentioned this pull request Jul 21, 2026
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@m0Nst3r873 @jeff-r2026