fix(updater): network restrictions not enabled

[avallete]

Summary

Mitigates workflow failures caused by 400 responses from network restrictions endpoints when projects are not entitled to manage restrictions and local config has db.network_restrictions.enabled = false or not set.

The fix ensures we only read/update network restrictions when local config explicitly enables the feature, while preserving strict failure behavior when it is enabled.

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

Release Notes

• Optimizations

  • Network restriction configuration processing now skips when disabled, eliminating unnecessary API calls and improving performance.

• Tests

  • Added test coverage for network restriction configuration behavior, including disabled state handling and error response scenarios.

Walkthrough

The changes add an optimization to the UpdateDbNetworkRestrictionsConfig function by introducing an early return when the network restriction feature is disabled locally. When n.Enabled is false, the function exits immediately without making any API calls or update operations. A corresponding test suite was added to verify this behavior, including test cases for the disabled state (ensuring no requests are made) and error handling when the remote API returns a 400 status code while the feature is enabled.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pkg/config/updater_test.go (1)

334-398: ⚠️ Potential issue | 🔴 Critical

TestUpdateRemoteConfig will fail — unconsumed gock mock for network restrictions.

The db value passed to UpdateRemoteConfig (lines 370-374) leaves NetworkRestrictions at its zero value, so Enabled == false. With the new early return in UpdateDbNetworkRestrictionsConfig, the GET /v1/projects/test-project/network-restrictions request is never made. The gock mock registered at lines 334-338 is never consumed, so gock.IsDone() (line 397) returns false and the assertion fails.

Remove the unconsumed mock (simplest fix):

🐛 Proposed fix

-		// Network config
-		gock.New(server).
-			Get("/v1/projects/test-project/network-restrictions").
-			Reply(http.StatusOK).
-			JSON(v1API.V1GetNetworkRestrictionsResponse{})

Or, if the test should also cover the network-restrictions update path, set Enabled: true on the db config:

 		Db: db{
 			Settings: settings{
 				MaxConnections: cast.Ptr(cast.IntToUint(100)),
 			},
+			NetworkRestrictions: networkRestrictions{
+				Enabled: true,
+			},
 		},

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pkg/config/updater_test.go` around lines 334 - 398, TestUpdateRemoteConfig
fails because an unused gock mock for GET
/v1/projects/test-project/network-restrictions is registered but
UpdateDbNetworkRestrictionsConfig now early-returns when
NetworkRestrictions.Enabled is false; either remove the
gock.New(...).Get("/v1/projects/test-project/network-restrictions") mock from
the test or change the test input passed into UpdateRemoteConfig so
db.Settings.NetworkRestrictions.Enabled = true (i.e., set the
NetworkRestrictions struct on the db/settings in the baseConfig) so the
network-restrictions path is exercised and the mock is consumed.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@pkg/config/updater_test.go`:
- Around line 334-398: TestUpdateRemoteConfig fails because an unused gock mock
for GET /v1/projects/test-project/network-restrictions is registered but
UpdateDbNetworkRestrictionsConfig now early-returns when
NetworkRestrictions.Enabled is false; either remove the
gock.New(...).Get("/v1/projects/test-project/network-restrictions") mock from
the test or change the test input passed into UpdateRemoteConfig so
db.Settings.NetworkRestrictions.Enabled = true (i.e., set the
NetworkRestrictions struct on the db/settings in the baseConfig) so the
network-restrictions path is exercised and the mock is consumed.

---

ℹ️ Review info

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Cache: Disabled due to Reviews > Disable Cache setting

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 3b68bf2 and 028590d.

📒 Files selected for processing (2)

• pkg/config/updater.go
• pkg/config/updater_test.go

[coveralls]

Pull Request Test Coverage Report for Build 22321003063

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 5 unchanged lines in 1 file lost coverage.
• Overall coverage decreased (-0.02%) to 61.771%

---

Files with Coverage Reduction	New Missed Lines	%
internal/utils/git.go	5	57.14%

Totals
Change from base Build 22309119178:	-0.02%
Covered Lines:	7714
Relevant Lines:	12488

---

💛 - Coveralls