{"record":{"id":"22ebb8db29de53ae","repo":"jdx/mise","slug":"refusing-unsafe-change-to-bootstrap-group-in","errorCode":null,"errorMessage":"refusing unsafe change to bootstrap group '{}'; inspect `mise bootstrap plan`","messagePattern":"refusing unsafe change to bootstrap group '(.+?)'; inspect `mise bootstrap plan`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/accounts.rs","lineNumber":309,"sourceCode":"            ),\n            (GroupInspection::IdCollision { gid, name }, AccountState::Present) => {\n                ResourcePlan::new(\n                    id,\n                    format!(\"absent; gid {gid} belongs to {name}\"),\n                    desired,\n                    ResourceAction::Unknown,\n                )\n            }\n            (GroupInspection::IdCollision { .. }, AccountState::Absent) => {\n                ResourcePlan::new(id, \"absent\", desired, ResourceAction::Noop)\n            }\n        }\n    }\n\n    fn action(&self) -> Result<Option<AccountAction>> {\n        match self.plan().action {\n            ResourceAction::Noop => Ok(None),\n            ResourceAction::Unknown => bail!(\n                \"refusing unsafe change to bootstrap group '{}'; inspect `mise bootstrap plan`\",\n                self.name\n            ),\n            ResourceAction::Create => Ok(Some(AccountAction::CreateGroup {\n                name: self.name.clone(),\n                gid: self.gid,\n                system: self.system,\n            })),\n            ResourceAction::Update => Ok(Some(AccountAction::UpdateGroup {\n                name: self.name.clone(),\n                gid: self.gid.expect(\"group update requires a desired gid\"),\n            })),\n            ResourceAction::Remove => Ok(Some(AccountAction::RemoveGroup {\n                name: self.name.clone(),\n            })),\n        }\n    }\n}","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/accounts.rs#L291-L327","documentation":"GroupRequest::action() converts the computed plan into an action; when the plan's ResourceAction is Unknown — mise cannot reconcile desired vs. current group state safely (for example the desired gid is already owned by a different group name, an IdCollision, while you want the group present) — it refuses to act and directs you to `mise bootstrap plan` for the details. This is a deliberate safety stop before any privileged groupmod/groupadd/groupdel.","triggerScenarios":"Bootstrap apply (or anything calling action()) where a group's desired state produces Unknown: typically gid collisions (two names claiming one gid), or inspected current state that fits no safe create/update/remove transition. `mise bootstrap plan` shows the same Unknown action with the diff.","commonSituations":"Reusing a gid that another system group already holds; importing hosts whose group database drifted from config; renaming groups while keeping gids; running apply before plan on an unfamiliar machine.","solutions":["Run `mise bootstrap plan` and read the reported current/desired state for the named group.","Resolve the collision manually: free the gid (remove/re-gid the other group) or pick a different gid in config.","If the group should not be managed at all, drop it from [bootstrap.groups].","Re-run plan until the action is a plain create/update/remove, then apply."],"exampleFix":"# before: gid 1005 already owned by group 'oldteam'\n[bootstrap.groups.deploy]\nstate = \"present\"\ngid = 1005\n# after: choose a free gid, or remove the old group first\n[bootstrap.groups.deploy]\nstate = \"present\"\ngid = 1010","handlingStrategy":"validation","validationCode":"# always plan before apply; refuse to apply when any action is unknown\nout=$(mise bootstrap plan)\nif grep -q 'refusing unsafe change' <<<\"$out\"; then\n  echo \"$out\" >&2; exit 1\nfi\nmise bootstrap apply","typeGuard":null,"tryCatchPattern":"Treat this bail as a hard stop: capture the group name from the message, run `mise bootstrap plan`, and resolve the gid/state collision; never script a retry of apply without changing state.","preventionTips":["Make `mise bootstrap plan` a required pre-apply gate in automation.","Allocate gids from a documented range to avoid collisions with system groups.","Inspect unfamiliar hosts with plan before the first apply."],"tags":["mise","bootstrap","groups","gid-collision","safety","plan"],"backgroundTag":"unsafe-change-blocked","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}