From e0ae13b51e78897d6ac36b725782dc68b547fed7 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 3 Nov 2026 08:42:54 +0000 Subject: [PATCH] Upgrade notes: a request naming the role `reader` gets the built-in one Migration 0013 renames an administrator's role `reader` to `reader-` and creates the built-in `reader`, which reads every repository. The admin API resolves a role given by name at request time, so a 2.1 script that assigns `{"role": "reader"}` now gives its accounts read on every repository without an error. Say so in the 2.2.0 upgrade notes, with the 409 a script creating the role now meets, and how to find the renamed role. Fixes #822 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012e6DJbzZtA6Cmowfnd4LLw --- docs/changes/2.2.0/822.upgrade.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 docs/changes/2.2.0/822.upgrade.md diff --git a/docs/changes/2.2.0/822.upgrade.md b/docs/changes/2.2.0/822.upgrade.md new file mode 100644 index 00000000..8b741660 --- /dev/null +++ b/docs/changes/2.2.0/822.upgrade.md @@ -0,0 +1,13 @@ +From the upgrade on, a request that names the role `reader` gets the +built-in `reader`, which reads every repository, and no longer the role an +administrator had named `reader`, now `reader-`. Nothing errors: +`PUT /admin/users/{id}/roles` with `{"role": "reader"}` succeeds and gives +the account read on every repository, so a script, Terraform module or +runbook written for 2.1 that assigns that role by name, or looks its id up +by name in `GET /admin/roles`, widens what its accounts read. Creating a +role named `reader` (`POST /admin/roles`) answers 409, since the built-in +role holds the name; a script that takes the 409 for "the role exists" +goes on with the built-in one. Before upgrading, change such requests to +pass the role's `role_id`, which the upgrade keeps, or after it to name +`reader-`. `GET /admin/roles` and **Admin → Roles** list the renamed +role under its new name.