[SergK]

Summary

Every request resolved credentials before it checked provider support. A Gerrit GitServer Secret holds an SSH key and no token, so every Gerrit request failed with 500 git provider token is empty. The organization warm-up stopped on the same error, for all GitServers.

GitServerService.Resolve now checks support before it reads the Secret:

 <Area>Service.X(gitServerName)
-  GetGitProviderSettings(name)          GitServer CR → Secret → token (500 for Gerrit)
-  MultiProvider.X(settings)             provider lookup → 400 unsupported
+  Resolve(name, multiProvider.CheckX)
+    GitServer CR                        404 if absent
+    CheckX(gitProvider)                 400 unsupported; Secret never read
+    Secret → token                      strict for every provider
+  MultiProvider.X(settings)             same lookup as CheckX

• Each multi-provider service owns one lookup per operation, used by both dispatch and Check<Operation>. There is no central registry.
• TriggerPipeline is an optional PipelineTrigger capability, like PipelineJobsProvider. The GitHub and Bitbucket stubs that only returned "unsupported" are deleted.
• Caches (60 s): the GitServer CR per name and the token per Secret name. Settings are built from the current CR, so the provider the check approves is the provider dispatch uses.
• The warm-up moves out of the constructor into OrganizationsService.WarmUp, started by BuildHandler. It skips unsupported GitServers and continues past failing ones.
• The API does not change. Unsupported operations keep status 400 and the same problem response; the log line names the provider and the operationId: provider gerrit does not support listRepositories: unsupported operation.

Supersedes #98. This PR reuses its buildServer extraction, its all-routes API test and its Gerrit SSH-key Secret fixture, but it replaces the Gerrit token exception with the support check.

Evidence

kind testbed, 9 routes × 6 GitServers, sent from an in-cluster pod:

GitServer	Routes	Before (0.8.0-SNAPSHOT.1)	After
Gerrit, SSH-key Secret	all 9	500	400, log names the route's operationId
Gerrit, Secret absent	all 9	500	400 (Secret not read)
GitHub, no token	trigger / jobs / trace	500	400
GitHub, no token	6 supported	500	500 (unchanged)
GitLab (live)	6 supported	200	200 (unchanged)
absent GitServer	all 9	404	404 (unchanged)

Warm-up log:

• Before: Failed to get git provider settings ... GitServer tst-gerrit: git provider token is empty (no GitServer warmed)
• After: Gerrit skipped (debug), tst-github-notoken logged, Warmed up organization cache ... gitServerName=gitlab

Provider change while the token is cached (on the cluster):

jobs on github server            → 400 github/listPipelineJobs   (caches CR)
pull-requests on github server   → caches token
patch GitServer to gitlab, wait for CR cache expiry
jobs                             → request goes to the GitLab URL (before: stale 400 github)

Tests: make test passes (lint 0 issues, CRAP gate passed) and go test -race ./... passes.

Merge Danger

Door: two-way

No data or schema migration. Revert the PR or roll back the image to undo it.

Blast Radius: API-consumers

• Gerrit GitServers and GitHub/Bitbucket pipeline trigger/jobs/trace requests answer 400 instead of 500. The Portal maps the status only, so it shows its generic error text instead of "Contact your administrator". The Portal needs no code change.
• GitServerService.GetGitProviderSettings and GetGitProviderSettingsList are removed. Both are internal to gitfusion.
• Error log text changes from unsupported provider gerrit to provider gerrit does not support <operationId>: unsupported operation.

[epmd-edp]

Pipeline review-gitfusion-main-vzfs5 — ✓ Passed

Status	Task	Duration
✓ Passed	github-set-pending-status	24s
✓ Passed	fetch-repository	29s
✓ Passed	init-values	6s
✓ Passed	get-cache	1m50s
✓ Passed	commit-validate	5s
✓ Passed	dockerfile-lint	21s
✓ Passed	helm-lint	16s
✓ Passed	helm-docs	8s
✓ Passed	build	1m27s
✓ Passed	sonar	20s
✓ Passed	buildkit-verify	13s
✓ Passed	save-cache	26s
✓ Passed	github-report-pipeline-status	8s

Pushing new commits re-runs this pipeline automatically.
To re-run it without new commits, comment /recheck.