fix(serve): compat fallback for incoming push when receive-pack is disabled

mizchi · mizchi · commit 787551508689 · 2026-02-25T13:09:59.000+09:00
diff --git a/docs/ci-trigger-spec-ja.md b/docs/ci-trigger-spec-ja.md
@@ -22,6 +22,8 @@ incoming ref は `POST /git/<session_id>/git-receive-pack` の request body か
 - `RELAY_TRIGGER_WEBHOOK_URL` が設定されている
 - incoming ref が設定済みプレフィックスのいずれかに一致する
 - `git-receive-pack` の relay 応答ステータスが 2xx である
+- host が `receive-pack not enabled` を返した場合でも、`refs/relay/incoming/...` push については
+  relay が互換レスポンス（2xx）に変換できる
 
 設定値:
 
@@ -35,6 +37,7 @@ incoming ref は `POST /git/<session_id>/git-receive-pack` の request body か
 - 2xx は成功
 - 非 2xx とネットワークエラーは trigger dispatch failure としてログ記録
 - `git-receive-pack` 応答が非 2xx の場合、incoming-ref webhook は送信しない
+- 互換変換が適用された incoming push は 2xx として扱われ、incoming-ref webhook を送信する
 
 ## 3. 送信 Webhook Payload
 
diff --git a/docs/ci-trigger-spec.md b/docs/ci-trigger-spec.md
@@ -22,6 +22,8 @@ Relay dispatches a webhook only when all of the following are true:
 - `RELAY_TRIGGER_WEBHOOK_URL` is configured
 - Incoming ref matches one of configured prefixes
 - Relay responded to `git-receive-pack` with a 2xx status
+- Even if the host returns `receive-pack not enabled`, relay may translate that into a synthetic 2xx
+  for `refs/relay/incoming/...` pushes
 
 Configuration:
 
@@ -35,6 +37,7 @@ Dispatch result behavior:
 - Any 2xx is treated as success
 - Non-2xx or network errors are logged as trigger dispatch failures
 - If `git-receive-pack` returns non-2xx, relay does not emit incoming-ref webhooks
+- Incoming push compatibility translation is treated as 2xx and emits incoming-ref webhooks
 
 ## 3. Outbound Webhook Payload
 
diff --git a/docs/usage-guide-ja.md b/docs/usage-guide-ja.md
@@ -194,6 +194,9 @@ bit relay sync push relay+https://bit-relay.mizchi.workers.dev
 | `--auto-fetch`        | feature broadcast 検知時に自動 fetch                              |
 | `--repo <name>`       | リポジトリ名を指定（名前付きセッションを有効化）                  |
 
+互換モードとして、host 側が `receive-pack not enabled` を返す環境でも `refs/relay/incoming/...` への
+push は relay 側で受理できる（CI トリガー用途）。
+
 ### relay URL 形式
 
 | 形式                    | 動作                                           |
diff --git a/docs/usage-guide.md b/docs/usage-guide.md
@@ -198,6 +198,9 @@ Once verified, relay sessions use named paths (e.g., `alice/my-repo`) instead of
 | `--auto-fetch`        | Auto-fetch when feature broadcasts are detected              |
 | `--repo <name>`       | Advertise a repository name (enables named sessions)         |
 
+As a compatibility behavior, even when the host returns `receive-pack not enabled`, relay can still
+accept pushes to `refs/relay/incoming/...` for CI triggering.
+
 ### Relay URL Formats
 
 | Format                  | Behavior                                        |
diff --git a/src/git_serve_session.ts b/src/git_serve_session.ts
@@ -7,6 +7,7 @@ interface PendingGitRequest {
   headers: Record<string, string>;
   bodyBase64: string | null;
   incomingRefs: string[];
+  allRelayRefs: string[];
   resolve: (response: Response) => void;
   timeoutId: ReturnType<typeof setTimeout>;
   createdAt: number;
@@ -28,6 +29,10 @@ export interface GitServeSessionState {
 const REQUEST_TIMEOUT_MS = 60_000;
 const POLL_TIMEOUT_MS = 30_000;
 export const DEFAULT_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+const RECEIVE_PACK_DISABLED_MESSAGE = 'receive-pack not enabled';
+const ZERO_OID = '0000000000000000000000000000000000000000';
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
 
 export interface GitServeSessionOptions {
   sessionTtlMs?: number;
@@ -38,6 +43,7 @@ export interface GitServeSessionOptions {
 }
 
 const INCOMING_REF_PATTERN = /refs\/relay\/incoming\/[A-Za-z0-9._/-]{1,255}/g;
+const RELAY_REF_PATTERN = /refs\/[A-Za-z0-9._/-]{1,255}/g;
 
 function generateRequestId(): string {
   return crypto.randomUUID();
@@ -71,7 +77,7 @@ function fromBase64(b64: string): Uint8Array {
 }
 
 function extractIncomingRefs(bodyBytes: Uint8Array): string[] {
-  const decoded = new TextDecoder().decode(bodyBytes);
+  const decoded = textDecoder.decode(bodyBytes);
   const matches = decoded.match(INCOMING_REF_PATTERN);
   if (!matches || matches.length === 0) return [];
   const seen = new Set<string>();
@@ -84,10 +90,88 @@ function extractIncomingRefs(bodyBytes: Uint8Array): string[] {
   return refs;
 }
 
+function extractAllRelayRefs(bodyBytes: Uint8Array): string[] {
+  const decoded = textDecoder.decode(bodyBytes);
+  const matches = decoded.match(RELAY_REF_PATTERN);
+  if (!matches || matches.length === 0) return [];
+  const seen = new Set<string>();
+  const refs: string[] = [];
+  for (const ref of matches) {
+    if (seen.has(ref)) continue;
+    seen.add(ref);
+    refs.push(ref);
+  }
+  return refs;
+}
+
 function isSuccessfulHttpStatus(status: number): boolean {
   return status >= 200 && status < 300;
 }
 
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  const copied = new Uint8Array(bytes.byteLength);
+  copied.set(bytes);
+  return copied.buffer;
+}
+
+function toPktLine(payload: string): string {
+  const length = textEncoder.encode(payload).byteLength + 4;
+  return length.toString(16).padStart(4, '0') + payload;
+}
+
+function buildReceivePackAdvertisementBody(): ArrayBuffer {
+  const capabilities = [
+    'report-status',
+    'report-status-v2',
+    'delete-refs',
+    'ofs-delta',
+    'atomic',
+    'quiet',
+  ];
+  const firstRef = `${ZERO_OID} capabilities^{}\0${capabilities.join(' ')}\n`;
+  const body = `${toPktLine('# service=git-receive-pack\n')}0000${toPktLine(firstRef)}0000`;
+  return toArrayBuffer(textEncoder.encode(body));
+}
+
+function buildReceivePackResultBody(incomingRefs: string[]): ArrayBuffer {
+  let body = toPktLine('unpack ok\n');
+  for (const ref of incomingRefs) {
+    body += toPktLine(`ok ${ref}\n`);
+  }
+  body += '0000';
+  return toArrayBuffer(textEncoder.encode(body));
+}
+
+function splitPath(pathWithQuery: string): { pathname: string; search: string } {
+  const [pathname, search = ''] = pathWithQuery.split('?', 2);
+  return { pathname, search };
+}
+
+function isReceivePackInfoRefsPath(pathWithQuery: string): boolean {
+  const { pathname, search } = splitPath(pathWithQuery);
+  if (pathname !== '/info/refs') return false;
+  const params = new URLSearchParams(search);
+  return params.get('service') === 'git-receive-pack';
+}
+
+function isReceivePackRpcPath(pathWithQuery: string): boolean {
+  const { pathname } = splitPath(pathWithQuery);
+  return pathname === '/git-receive-pack';
+}
+
+function shouldCompatAcceptIncomingOnlyPush(pending: PendingGitRequest): boolean {
+  if (!isReceivePackRpcPath(pending.path)) return false;
+  if (pending.incomingRefs.length === 0) return false;
+  if (pending.allRelayRefs.length === 0) return false;
+  return pending.allRelayRefs.every((ref) => ref.startsWith('refs/relay/incoming/'));
+}
+
+function isReceivePackDisabledBody(responseBody: ArrayBuffer | null): boolean {
+  if (!responseBody) return false;
+  const bodyText = textDecoder.decode(new Uint8Array(responseBody)).trim().toLowerCase();
+  return bodyText === RECEIVE_PACK_DISABLED_MESSAGE;
+}
+
 export interface PersistableSessionState {
   active: boolean;
   sessionToken: string;
@@ -230,6 +314,10 @@ export function createGitServeSession(options?: GitServeSessionOptions): {
         bodyBytes !== null
       ? extractIncomingRefs(bodyBytes)
       : [];
+    const allRelayRefs = request.method === 'POST' && gitPath.endsWith('/git-receive-pack') &&
+        bodyBytes !== null
+      ? extractAllRelayRefs(bodyBytes)
+      : [];
 
     const headers: Record<string, string> = {};
     for (const [key, value] of request.headers.entries()) {
@@ -267,6 +355,7 @@ export function createGitServeSession(options?: GitServeSessionOptions): {
         headers,
         bodyBase64,
         incomingRefs,
+        allRelayRefs,
         resolve,
         timeoutId,
         createdAt: Date.now(),
@@ -382,10 +471,28 @@ export function createGitServeSession(options?: GitServeSessionOptions): {
       }
     }
 
-    if (pending.incomingRefs.length > 0 && isSuccessfulHttpStatus(status)) {
+    let finalStatus = status;
+    let finalHeaders = httpHeaders;
+    let finalBody = responseBody;
+    const receivePackDisabled = status === 403 && isReceivePackDisabledBody(responseBody);
+    if (receivePackDisabled && isReceivePackInfoRefsPath(pending.path)) {
+      finalStatus = 200;
+      finalHeaders = new Headers(httpHeaders);
+      finalHeaders.set('content-type', 'application/x-git-receive-pack-advertisement');
+      finalHeaders.set('cache-control', 'no-cache');
+      finalBody = buildReceivePackAdvertisementBody();
+    } else if (receivePackDisabled && shouldCompatAcceptIncomingOnlyPush(pending)) {
+      finalStatus = 200;
+      finalHeaders = new Headers(httpHeaders);
+      finalHeaders.set('content-type', 'application/x-git-receive-pack-result');
+      finalHeaders.set('cache-control', 'no-cache');
+      finalBody = buildReceivePackResultBody(pending.incomingRefs);
+    }
+
+    if (pending.incomingRefs.length > 0 && isSuccessfulHttpStatus(finalStatus)) {
       emitIncomingRefEvents(pending.incomingRefs);
     }
-    pending.resolve(new Response(responseBody, { status, headers: httpHeaders }));
+    pending.resolve(new Response(finalBody, { status: finalStatus, headers: finalHeaders }));
 
     return Response.json({ ok: true });
   }
diff --git a/tests/git_serve_session_test.ts b/tests/git_serve_session_test.ts
@@ -396,6 +396,133 @@ Deno.test('git-receive-pack does not emit incoming_ref events on non-2xx respons
   }
 });
 
+Deno.test('receive-pack disabled error is translated for refs/relay/incoming push flow', async () => {
+  const seenRefs: string[] = [];
+  const session = createGitServeSession({
+    onIncomingRef(event) {
+      seenRefs.push(event.ref);
+    },
+  });
+
+  try {
+    const token = await registerSession(session);
+
+    const discoveryPromise = session.fetch(
+      new Request(`http://do/git/info/refs?service=git-receive-pack&session_token=${token}`),
+    );
+    await new Promise((r) => setTimeout(r, 10));
+    const discoveryPoll = await session.fetch(
+      new Request(`http://do/poll?timeout=1&session_token=${token}`),
+    );
+    const discoveryPollBody = await discoveryPoll.json();
+    assertEquals(discoveryPollBody.requests[0].path, '/info/refs?service=git-receive-pack');
+    await session.fetch(
+      new Request(`http://do/respond?session_token=${token}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          request_id: discoveryPollBody.requests[0].request_id,
+          status: 403,
+          headers: { 'content-type': 'text/plain; charset=utf-8' },
+          body_base64: btoa('receive-pack not enabled'),
+        }),
+      }),
+    );
+    const discoveryRes = await discoveryPromise;
+    assertEquals(discoveryRes.status, 200);
+    assertEquals(
+      discoveryRes.headers.get('content-type'),
+      'application/x-git-receive-pack-advertisement',
+    );
+    const discoveryBody = await discoveryRes.text();
+    assertEquals(discoveryBody.includes('# service=git-receive-pack'), true);
+
+    const receivePackPromise = session.fetch(
+      new Request(`http://do/git/git-receive-pack?session_token=${token}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-git-receive-pack-request' },
+        body: 'refs/relay/incoming/main/ci-compat-1',
+      }),
+    );
+    await new Promise((r) => setTimeout(r, 10));
+    const receivePackPoll = await session.fetch(
+      new Request(`http://do/poll?timeout=1&session_token=${token}`),
+    );
+    const receivePackPollBody = await receivePackPoll.json();
+    assertEquals(receivePackPollBody.requests[0].path, '/git-receive-pack');
+    await session.fetch(
+      new Request(`http://do/respond?session_token=${token}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          request_id: receivePackPollBody.requests[0].request_id,
+          status: 403,
+          headers: { 'content-type': 'text/plain; charset=utf-8' },
+          body_base64: btoa('receive-pack not enabled'),
+        }),
+      }),
+    );
+
+    const receivePackRes = await receivePackPromise;
+    assertEquals(receivePackRes.status, 200);
+    assertEquals(
+      receivePackRes.headers.get('content-type'),
+      'application/x-git-receive-pack-result',
+    );
+    const receivePackBody = await receivePackRes.text();
+    assertEquals(receivePackBody.includes('unpack ok'), true);
+    assertEquals(receivePackBody.includes('ok refs/relay/incoming/main/ci-compat-1'), true);
+    assertEquals(seenRefs, ['refs/relay/incoming/main/ci-compat-1']);
+  } finally {
+    session.cleanup();
+  }
+});
+
+Deno.test('receive-pack disabled fallback is not applied when non-incoming refs are included', async () => {
+  const seenRefs: string[] = [];
+  const session = createGitServeSession({
+    onIncomingRef(event) {
+      seenRefs.push(event.ref);
+    },
+  });
+
+  try {
+    const token = await registerSession(session);
+
+    const receivePackPromise = session.fetch(
+      new Request(`http://do/git/git-receive-pack?session_token=${token}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-git-receive-pack-request' },
+        body: 'refs/heads/main\nrefs/relay/incoming/main/ci-mixed',
+      }),
+    );
+    await new Promise((r) => setTimeout(r, 10));
+    const receivePackPoll = await session.fetch(
+      new Request(`http://do/poll?timeout=1&session_token=${token}`),
+    );
+    const receivePackPollBody = await receivePackPoll.json();
+    await session.fetch(
+      new Request(`http://do/respond?session_token=${token}`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          request_id: receivePackPollBody.requests[0].request_id,
+          status: 403,
+          headers: { 'content-type': 'text/plain; charset=utf-8' },
+          body_base64: btoa('receive-pack not enabled'),
+        }),
+      }),
+    );
+
+    const receivePackRes = await receivePackPromise;
+    assertEquals(receivePackRes.status, 403);
+    assertEquals(await receivePackRes.text(), 'receive-pack not enabled');
+    assertEquals(seenRefs, []);
+  } finally {
+    session.cleanup();
+  }
+});
+
 Deno.test('cleanup resolves pending requests with 410', async () => {
   const session = createGitServeSession();
   const token = await registerSession(session);
diff --git a/tests/trigger_incoming_ref_integration_test.ts b/tests/trigger_incoming_ref_integration_test.ts
