vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Refuse a protected-ref pattern that can never match

93c7cae8ebb7d6d853dca476851e2bd0cbe10079 · Keenan Nemetz · 18h ago · parent 2c988ecd

Refuse a protected-ref pattern that can never match

acl protect stored any string: refs/head/main read like a protected branch in
acl show while the hook compared it against refs/heads/main and matched
nothing, so approvals and required checks were off on the branch everything
lands on.

Validate the pattern in forge/access, where the rule is stored, and call it
from both acl protect add|set and the repository settings form. Only the two
shapes IsProtected understands are accepted, exact ref and one trailing
wildcard, the ref part must be a name git could store, and a singular
category is named as the typo it is.

docs/cli.md +11

@@ -179,6 +179,17 @@ and `runners set` replace the whole list; the `add` and `remove` forms change on
	179	179	entry at a time. `require-issues enable` makes a linked issue mandatory when a
	180	180	new change request is opened.
	181	181
		182	A protected ref pattern is either an exact ref (`refs/heads/main`) or a ref
		183	prefix ending in one `` (`refs/heads/release/`), the two shapes the hook
		184	understands. `protect add` and `protect set` refuse anything else, because a
		185	pattern that can never match would leave the branch open while `acl show` listed
		186	it as protected. A misspelled category is named in the refusal:
		187
		188	```console
		189	$ vole admin acl protect add demo refs/head/main
		190	vole: protected pattern "refs/head/main" cannot match any ref: did you mean "refs/heads/main"?
		191	```
		192
	182	193	See [Accounts and access](accounts-and-access.md) and
	183	194	[Runners](runner.md#who-can-run-jobs-and-report-results).
	184	195