fedora-infra / toddlers

#372 cleaning_packager_groups: 'The creator of a group cannot be removed'
Closed by lenkaseg. Opened by lenkaseg.

Closed
Reopen Issue

cleaning_packager_groups toddler fails to remove a user who is the creator of that distgit group.

2025-10-02 10:18:53,705 - [INFO toddlers.plugins.cleaning_packager_groups] Processing group dotnet-sig with 4 members
2025-10-02 10:18:53,705 - [INFO toddlers.plugins.cleaning_packager_groups] Found 1 members to remove from distgit and IPA group dotnet-sig
2025-10-02 10:18:53,888 - [INFO toddlers.plugins.cleaning_packager_groups] User rhea is not a sponsor of ipa group dotnet-sig, skipping sponsor removal
2025-10-02 10:18:53,888 - [INFO toddlers.plugins.cleaning_packager_groups] User rhea is not a member of ipa group dotnet-sig, skipping member removal
2025-10-02 10:18:53,888 - [INFO toddlers.plugins.cleaning_packager_groups] Removing user rhea from distgit group dotnet-sig
2025-10-02 10:18:54,085 - [ERROR toddlers.utils.pagure] Error when removing user 'rhea' from group 'dotnet-sig'. Got status_code '400'.
2025-10-02 10:18:54,085 - [ERROR toddlers.utils.pagure] Received response: {'error': 'An error occurred at the database level and prevent the action from reaching completion', 'error_code': 'EDBERROR', 'errors': ['The creator of a group cannot be removed']}
2025-10-02 10:18:54,085 - [ERROR toddlers.plugins.cleaning_packager_groups] Error while removing user rhea from distgit group dotnet-sig
Traceback (most recent call last):
  File "/opt/app-root/src/toddlers/plugins/cleaning_packager_groups.py", line 152, in _remove_from_distgit
    self.dist_git.remove_member_from_group(user, group)
  File "/opt/app-root/src/toddlers/utils/pagure.py", line 1030, in remove_member_from_group
    raise PagureError(
toddlers.exceptions.pagure_error.PagureError: Couldn't remove user 'rhea' from group 'dotnet-sig'
Request to 'https://src.fedoraproject.org/api/0/group/dotnet-sig/remove':
Response:
{'error': 'An error occurred at the database level and prevent the action from reaching completion', 'error_code': 'EDBERROR', 'errors': ['The creator of a group cannot be removed']}
Status code: 400

Metadata Update from @lenkaseg:
- Issue assigned to lenkaseg

We currently cannot remove a member from a group where this member is a group creator.
There are several ways to handle this:
1. add the API point to pagure exposing the group//give function
2. make a direct connection to the pagure database

Until we decide we have to handle the situation manually:
Get a list of all group creators in distgit and check that each of them is a packager. Output a json with the dict of "group name": "creator who is not packager" to be removed manually.

I don't think we want to try and adjust pagure at this point do we? or would it be easy to add the api end point?

Since this doesn't come up too much, perhaps we should just do the report and manually fix those ?

That's exactly what we were thinking with @abompard , but we wanted to list all the options here.

Would this solution work?

https://pagure.io/fedora-infra/toddlers/pull-request/378

It catches the exception creator of a group cannot be removed during the playtime call (I added it only to playtime call, could be in regular one as well, but I thought getting the dict once a week would be sufficient) and when the playtime call finishes, it outputs a dict of "group": "creator to be removed manually".
Perhaps would be better to send an email somewhere, not to miss it? How do you folks do it when you don't want to miss a log message?

 
The following users could not be removed automatically because they are group creators and must be removed manually:
2025-10-02 10:18:54,100 - [WARNING toddlers.plugins.cleaning_packager_groups] Manual removal required: {'dotnet-sig': 'rhea'}

Would this solution work?

https://pagure.io/fedora-infra/toddlers/pull-request/378

It catches the exception creator of a group cannot be removed during the playtime call (I added it only to playtime call, could be in regular one as well, but I thought getting the dict once a week would be sufficient) and when the playtime call finishes, it outputs a dict of "group": "creator to be removed manually".
Perhaps would be better to send an email somewhere, not to miss it? How do you folks do it when you don't want to miss a log message?

It's good to sent it to some alias or mailing list. You can either sent it to yourself or to some infra group alias.

The users that cannot be removed from a distgit group because they're are creators are now sent as an email once a week to be manually removed:

*The following users could not be removed automatically because they are group creators:

dotnet-sig: rhea
modularity-wg: karsten
openstack-sig: hguemar
sssd-maintainers: mzidek

Please remove these users manually or transfer group ownership.*

Metadata Update from @lenkaseg:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.