fix: send a team's permission before its units (Gitea 28), hidden private-org team reviews, long non-ASCII repo descriptions, -R NAME vs directory guard, flake fallback

Signed-off-by: bircni <bircni@icloud.com>

internal/services/teams.go

@@ -250,6 +250,7 @@ func (s Teams) Create(ctx context.Context, org string, opts TeamOptions) (Team,
 // permissions when changing access to all repositories. Gitea replaces the whole policy on edit.
 func (s Teams) Edit(ctx context.Context, id int64, opts TeamOptions) (Team, error) {
 	repositoryPolicy := opts.AllRepositories != nil && opts.Permission == nil
+	changesPermission := opts.Permission != nil
 	if repositoryPolicy || (opts.Units != nil && !opts.ReplaceUnits) {
 		current, err := s.View(ctx, id)
 		if err != nil {
@@ -274,6 +275,22 @@ func (s Teams) Edit(ctx context.Context, id int64, opts TeamOptions) (Team, erro
 			opts.Units = units
 		}
 	}
+	// Gitea 28 keeps an admin team admin when one request changes its permission and sets units_map,
+	// so change the permission alone first and then apply the units.
+	if changesPermission && opts.Units != nil {
+		first := TeamOptions{Name: opts.Name, Permission: opts.Permission}
+		if first.Name == nil {
+			current, err := s.View(ctx, id)
+			if err != nil {
+				return Team{}, err
+			}
+			first.Name = &current.Name
+		}
+		// TODO(sdk): EditTeamOption requires a name of at most 30 characters and a permission, and EditTeam should return the team.
+		if err := sendJSON(ctx, s.Client, http.MethodPatch, fmt.Sprintf("teams/%d", id), first, nil); err != nil {
+			return Team{}, err
+		}
+	}
 	var team gitea.Team
 	// TODO(sdk): EditTeamOption requires a name of at most 30 characters and a permission, and EditTeam should return the team.
 	if err := sendJSON(ctx, s.Client, http.MethodPatch, fmt.Sprintf("teams/%d", id), opts, &team); err != nil {