Allow issue-comment posting for Gitea author/reviewer profiles #137

New Issue

2026-07-05T00:59:17-05:00

jcwalker3 commented

2026-07-05 00:59:17 -05:00

Problem

The MCP issue-comment tool exists (#126), but active profiles cannot use it.

Confirmed blocker from the audit workflow:

Target issue: Scaled-Tech-Consulting/mcp-control-plane issue Document closed-not-merged PR reconciliation rules (#51)
prgs-reviewer / sysadmin: authenticated, but issue-comment posting unavailable
prgs-author / jcwalker3: authenticated, but gitea_create_issue_comment returned:
- success=false
- performed=false
- reason: profile is not allowed to gitea.issue.comment

This prevents LLM audit findings from being posted to discussion issues. Instead, LLMs can only report findings to the screen, which breaks the project workflow.

Goal

Allow appropriate Gitea MCP profiles to post issue comments through the gated gitea_create_issue_comment tool.

Requirements

Review current Gitea profile permissions.
Determine which profiles should allow gitea.issue.comment.
At minimum, enable issue-comment posting for:
- prgs-author
- prgs-reviewer
Preserve separation of duties:
- granting issue comments must not grant issue close/reopen unless already intended
- granting issue comments must not grant PR approve/merge to author profiles
- granting issue comments must not grant branch/commit permissions to reviewer profiles
Update example/profile documentation if needed:
- profile examples
- operator guide
- skill registry / issue-comment workflow docs
Add tests proving:
- author profile may post issue comments if configured
- reviewer profile may post issue comments if configured
- profile without gitea.issue.comment still fails closed
- issue-comment permission does not imply issue close, PR review, PR merge, branch push, or repo commit
- failure message remains clear when permission is missing
If live profile config is outside the repo, document the required operator config change:
- add gitea.issue.comment to the intended profile operation list
- reconnect/reload MCP after config change

Acceptance criteria

gitea_create_issue_comment succeeds for profiles explicitly granted gitea.issue.comment.
Profiles without gitea.issue.comment still fail closed.
LLMs can post audit findings directly to discussion issue threads when using the correct profile.
No review/merge/authoring permissions are broadened accidentally.
No secrets, tokens, keychain IDs, raw service URLs, or private config values are exposed.
No production changes.
No tags/releases.

## Problem The MCP issue-comment tool exists (#126), but active profiles cannot use it. Confirmed blocker from the audit workflow: - Target issue: `Scaled-Tech-Consulting/mcp-control-plane` issue #51 - `prgs-reviewer` / `sysadmin`: authenticated, but issue-comment posting unavailable - `prgs-author` / `jcwalker3`: authenticated, but `gitea_create_issue_comment` returned: - `success=false` - `performed=false` - reason: `profile is not allowed to gitea.issue.comment` This prevents LLM audit findings from being posted to discussion issues. Instead, LLMs can only report findings to the screen, which breaks the project workflow. ## Goal Allow appropriate Gitea MCP profiles to post issue comments through the gated `gitea_create_issue_comment` tool. ## Requirements 1. Review current Gitea profile permissions. 2. Determine which profiles should allow `gitea.issue.comment`. 3. At minimum, enable issue-comment posting for: - `prgs-author` - `prgs-reviewer` 4. Preserve separation of duties: - granting issue comments must not grant issue close/reopen unless already intended - granting issue comments must not grant PR approve/merge to author profiles - granting issue comments must not grant branch/commit permissions to reviewer profiles 5. Update example/profile documentation if needed: - profile examples - operator guide - skill registry / issue-comment workflow docs 6. Add tests proving: - author profile may post issue comments if configured - reviewer profile may post issue comments if configured - profile without `gitea.issue.comment` still fails closed - issue-comment permission does not imply issue close, PR review, PR merge, branch push, or repo commit - failure message remains clear when permission is missing 7. If live profile config is outside the repo, document the required operator config change: - add `gitea.issue.comment` to the intended profile operation list - reconnect/reload MCP after config change ## Acceptance criteria - `gitea_create_issue_comment` succeeds for profiles explicitly granted `gitea.issue.comment`. - Profiles without `gitea.issue.comment` still fail closed. - LLMs can post audit findings directly to discussion issue threads when using the correct profile. - No review/merge/authoring permissions are broadened accidentally. - No secrets, tokens, keychain IDs, raw service URLs, or private config values are exposed. - No production changes. - No tags/releases.

jcwalker3 added the status:in-progress label 2026-07-05 01:07:44 -05:00

jcwalker3 referenced this issue from a commit

2026-07-05 01:10:23 -05:00

feat: allow gitea.issue.comment for author and reviewer profiles (#137)

jcwalker3 referenced a pull request that will close this issue

2026-07-05 01:10:25 -05:00

feat: allow gitea.issue.comment for author/reviewer profiles (#137) #138

sysadmin referenced this issue

2026-07-05 01:14:22 -05:00

feat: allow gitea.issue.comment for author/reviewer profiles (#137) #138

sysadmin closed this issue

2026-07-05 01:14:38 -05:00