vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Store CI run records in the database, not the repository

b312e1660ac3d570fc35350a22b3514c56ab466f · Keenan Nemetz · 11d ago · parent db5e4382

Store CI run records in the database, not the repository

A finished attempt was a set of files on the vole branch: a record, step
ranges, and artifact pointers, pushed as a commit. At 959 files, CI records
were 849 of them, and every human metadata write had to carry them.

The runner now sends the record with its finish message over the SSH channel
that holds the lease. The server checks the account, the job, and the log and
artifact pointers, then writes the attempt, steps, artifacts, attestation, and
run result in one transaction in data/runs.db. A tagged build still pushes its
release pointers to the branch after the record is stored.

Pre-receive refuses a new runs/ file. vole admin index rebuild imports records
still on an old branch; records written since are never deleted by a rebuild.
The run page reads the stored attempt, and runs.db is now a source that must be
backed up.

This stops new CI history from entering Git. Existing commits keep the records
they already have; removing those would require rewriting the protected vole
branch, which this change does not do.

server/hook/hook.go +1−2

@@ -361,8 +361,7 @@ func PreReceive(cfg Config) int {
	361	361	// the runner that ran the job, and the gate's question about them is who was
	362	362	// allowed to. See records.go.
	363	363	if c.ref == metadata.Ref {
	364		problems = append(problems, recordFindings(g, c, a, actor,
	365		m.Name, cfg.UsersDB, cfg.RunsDB)...)
		364	problems = append(problems, recordFindings(g, c)...)
	366	365	}
	367	366	if c.ref == metadata.Ref && c.new != git.ZeroSHA {
	368	367	for _, prob := range metadata.ValidateIssues(g, c.new) {