vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add packaging, a CI workflow, and containerised local runs

3b39a84c913cabe15bfa6a60dd176ff2dd28d241 · Keenan Nemetz · 14d ago · parent 30a72490

Add packaging, a CI workflow, and containerised local runs

A v* tag now builds a .deb and a .rpm for amd64 and arm64 with nfpm and attaches them, with checksums, to the release. The package ships the systemd unit, a config at /etc/vole/vole.toml, and a postinstall that creates the service account and prepares the instance that config names; `vole admin init --config` is what makes that possible, and the binary's version is stamped from the tag instead of the source tree.

scripts/ci.sh becomes .vole/workflows/ci.yaml, so `vole workflow run ci` executes exactly what a push runs, and the Markdown link check moves to scripts/check-links.py. Local runs now always execute in the job image and share ci/container with the runner; --no-container is gone, because a run in a different environment proves nothing about CI.

The runner mounts a per-repository namespace at /cache and sets no variable for it: a job opts in through its image's env or the new job-level env, which is pinned with the queue and delivered with the lease. Whole namespaces are evicted least-recently-written first so a module cache is never half-deleted, and contributor branches get their own namespace so an untrusted tip cannot seed the cache a protected branch builds into.

Running the suite in that container found four bugs worth naming: /tmp was mounted noexec, which broke `go test` and `go run`; the read-only root is gone, because images make toolchain directories world-writable deliberately and the mount set is what protects the host; OpenSSH needs a passwd entry for the job's uid; and a lost metadata push reported as "cannot lock ref" was not classified as a race, so concurrent CLI writes gave up on the first collision. That retry now backs off exponentially with jitter.

scripts/check-links.py +40

@@ -0,0 +1,40 @@
	1	#!/usr/bin/env python3
	2	"""Fail when a Markdown file links to a relative path that does not exist.
	3
	4	Absolute URLs, mail links, and fragments are left alone: only links that claim to
	5	point at a file in this checkout are checked, which is what a reorganisation
	6	quietly breaks.
	7	"""
	8
	9	import os
	10	import re
	11	import sys
	12
	13	SKIP_DIRS = {".git", "data", "dist"}
	14
	15
	16	def main() -> int:
	17	bad = []
	18	for root, dirs, files in os.walk("."):
	19	dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
	20	for name in files:
	21	if not name.endswith(".md"):
	22	continue
	23	path = os.path.join(root, name)
	24	with open(path, encoding="utf-8") as f:
	25	text = f.read()
	26	for match in re.finditer(r"\]\(([^)#][^)]*)\)", text):
	27	target = match.group(1)
	28	if target.startswith(("http://", "https://", "mailto:")):
	29	continue
	30	resolved = os.path.normpath(os.path.join(root, target.split("#")[0]))
	31	if not os.path.exists(resolved):
	32	bad.append(f"{path}: {target}")
	33	if bad:
	34	print("\n".join(bad))
	35	return 1
	36	return 0
	37
	38
	39	if __name__ == "__main__":
	40	sys.exit(main())