fix(node): make Tigris repo hydration resilient to corrupt archives & failed writes

[kevincodex1]

Repo pushes 500'd whenever a repo's Tigris archive was unreadable (corrupt or truncated) or the node was under disk pressure, because hydration was treated as fatal and a failed extraction could clobber the good local copy. Three hardening changes:

• tigris: extract archives atomically (unpack into a temp dir, swap into place only on success) so a corrupt/truncated archive can never clobber a good existing local copy.
• repo_store: acquire_fresh / acquire_write fall back to the valid local copy when a Tigris download fails, instead of hard-failing the operation; the post-write upload then re-syncs (self-heals) Tigris.
• repo_store: RepoWriteGuard::release(success) uploads to Tigris only when the write succeeded, so a half-applied / inconsistent repo is never propagated to Tigris or to other nodes.

Summary by CodeRabbit

• Bug Fixes
  • Enhanced lock management for issue creation, PR merging, and push operations to improve reliability.
  • Added fallback mechanism for repository initialization when downloads encounter transient issues.
  • Improved repository extraction atomicity to prevent corruption during updates.
  • Prevented stale locks from blocking future operations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a33dcb6-5e6f-44a4-a7e7-d47ceb3fe90a

📥 Commits

Reviewing files that changed from the base of the PR and between a2217bf and 1ccaab7.

📒 Files selected for processing (5)

• crates/gitlawb-node/src/api/issues.rs
• crates/gitlawb-node/src/api/pulls.rs
• crates/gitlawb-node/src/api/repos.rs
• crates/gitlawb-node/src/git/repo_store.rs
• crates/gitlawb-node/src/git/tigris.rs

---

📝 Walkthrough

Walkthrough

RepoWriteGuard::release gains a success: bool parameter and skips Tigris upload when false. acquire_fresh and acquire_write add a self-healing fallback that uses the local repo when Tigris download fails. decompress_repo is rewritten to extract atomically via a sibling temp directory. All four API endpoints are updated to pass result.is_ok() to guard.release.

Changes

Conditional Tigris Upload and Self-Healing Download

Layer / File(s)	Summary
RepoWriteGuard::release signature, self-healing fallback, and atomic decompress crates/gitlawb-node/src/git/repo_store.rs, crates/gitlawb-node/src/git/tigris.rs	release(self) becomes release(self, success: bool); Tigris upload is skipped and a warning is logged when success is false, while the Postgres advisory lock is always released. acquire_fresh and acquire_write catch Tigris download errors and fall back to the existing local repo when it is present. decompress_repo extracts into a sibling .tmp-extract directory and renames it atomically, deleting the temp dir on failure without touching the existing local_path.
API call sites updated to pass success predicate crates/gitlawb-node/src/api/repos.rs, crates/gitlawb-node/src/api/issues.rs, crates/gitlawb-node/src/api/pulls.rs	git_receive_pack, create_issue, close_issue, and merge_pr each change their guard.release().await calls to guard.release(result.is_ok()).await, propagating the new signature requirement.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 Hoppity-hop through the Tigris stream,
No clobbering repos — that was my dream!
A temp dir appears, an atomic swap neat,
On failure? No upload — a self-healing feat!
The lock always frees, no stale keys remain,
This bunny writes clean code again and again. 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the PR: making Tigris repo hydration resilient to corrupt archives and failed writes, which aligns with all three hardening measures in the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/tigris-disk-resilience

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}