Skip to content

Require one source control connection per environment - #840

Open
daniel-lxs wants to merge 1 commit into
developfrom
roomote/environment-same-connection-guard
Open

Require one source control connection per environment#840
daniel-lxs wants to merge 1 commit into
developfrom
roomote/environment-same-connection-guard

Conversation

@daniel-lxs

Copy link
Copy Markdown
Member

Problem

Environments already enforce that all repositories belong to the same GitHub App installation, but there was no analogous rule for the other providers. Task launch resolves a single provider token and base URL per run, so an environment mixing providers — or mixing self-managed instances of the same provider (e.g. two Gitea hosts) — could never authenticate against all of its repositories. Today a single instance per provider makes the host rule vacuous, but it becomes load-bearing groundwork once multiple connections per provider are supported.

Change

  • Replace getEnvironmentRepositoryInstallationError with getEnvironmentRepositoryConnectionError in @roomote/types, checking in order:
    1. all repositories share one source control provider,
    2. one GitHub App installation (unchanged behavior),
    3. one instance host (repositories.host).
  • Provider and host comparisons ignore null/undefined values, matching the existing installation check, so historical rows that predate the host backfill keep validating.
  • All existing enforcement sites now select sourceControlProvider + host and run the broader check: web environment create/update/validate commands and repository selection, MCP createEnvironment/updateEnvironment handlers, environment-definition task launch (requireSingleInstallation option renamed to requireSingleConnection), and declarative environments.

Testing

  • New unit suite packages/types/src/__tests__/environment-repository-connection.test.ts covering provider/installation/host mismatches, null-host backfill tolerance, and check precedence.
  • New wiring tests in apps/web/.../environments/index.test.ts (multi-host create rejection, mixed-provider validateConfigCommand error).
  • pnpm check-types, pnpm lint, pnpm knip all pass; targeted vitest runs for @roomote/types, @roomote/web environments commands, @roomote/api launchTask + environment write auth, and the DB-backed declarative-environments suite all green.

🤖 Generated with Claude Code

…ment

Environments already had to keep all repositories on a single GitHub App
installation, but nothing enforced the analogous invariant for the other
providers: task launch resolves one provider token and one base URL per
run, so an environment mixing providers or self-managed instances could
never authenticate against all of its repositories.

Replace getEnvironmentRepositoryInstallationError with
getEnvironmentRepositoryConnectionError, which checks in order that all
environment repositories share the same source control provider, the
same GitHub App installation, and the same instance host. Provider and
host comparisons ignore null/undefined values so historical rows that
predate host backfill keep validating. All existing enforcement sites
(web environment commands, MCP create/update environment handlers,
environment-definition task launch, declarative environments) now query
sourceControlProvider and host and run the broader check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@roomote-roomote

roomote-roomote Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

No code issues found. See task

Reviewed b962580

@roomote-roomote

Copy link
Copy Markdown
Contributor

I reviewed RooCodeInc/Roomote#840 on GitHub and found no code issues. All CI checks are passing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant