2 months ago
a540657Installing tripwire on an open-git repo did nothing. The installation delivery arrived, the normalizer returned null, and processEvent logged 'event kind not ingested'. The repo only appeared later, when its first pull request forced a lazy upsert — so an install looked like it had silently failed. open-git's installation events cannot become a NormalizedEvent: they carry no actor, and they name repositories by BARE UUID. Forcing them into that shape means inventing both. They are handled before that step instead, with credentials, which normalization deliberately has none of. The api does return owner and name, so the worker asks — authenticated with the bot jwt, since there is no repo yet to mint an installation token against. getInstallationOrg defaults its forge to github. Called without one it looked for a GitHub claim, found none, and left every repo unclaimed — the repo row existed but stayed invisible in the dash, which is exactly the symptom this was meant to fix. Both call sites now pass the forge. syncInstallationRepos took the same treatment: it hardcoded forge github and wrote unfindable rows. Never guesses. No org until someone claims the installation, and rows land private because open-git reports no visibility — the fail-closed side, since the 10 public run page must not open for a repo nobody confirmed is public. Verified live: deleting every opengit repo row and replaying one installation.repos_changed recreated BOTH repos the installation grants, bound to the claiming org.
Parent815381f
