vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Test the merge result before landing it

e5478085e5b53a2892d0649d6f07c6f0a5653378 · Keenan Nemetz · 11d ago · parent db5e4382

Test the merge result before landing it

A protected branch could receive a non-fast-forward landing whose tree was
never built: the gate asked for checks on the request head, and the merge
commit was made at landing time. A pushed merge with the right parents but
extra content was accepted too.

Publish the merge commit under refs/vole/candidates/, test it as the base
branch, and make the gate require its results. Approvals name the head and
the base branch, so a moved base retests without a new approval. A merger
who clicks while that run is still going waits for it instead of clicking
again. A pushed merge commit now has to carry exactly the tree a clean merge
would produce.

Closes: 01M61QQ56TESQ1HTMB1Z5C3733

ci/agent/agent.go +1−4

@@ -601,10 +601,7 @@ func (s runnerSession) cacheFor(job runnerJob) []container.Mount {
	601	601	// one contributor's branch must not be able to seed another's cache or the one a
	602	602	// protected branch builds into. Namespacing by account means a contributor's
	603	603	// cache follows them across their branches and nobody else can write it.
	604		trust := "direct"
	605		if name, contributor := access.ContributorRefName(job.Ref); contributor {
	606		trust = "contrib-" + name
	607		}
		604	trust := access.TrustNamespace(job.Ref)
	608	605	ns := jobcache.Namespace(s.cacheRoot, job.Repo, trust, jobcache.ImageKey(job.ImageSHA, job.Image))
	609	606	if err := os.MkdirAll(ns, 0o755); err != nil {
	610	607	fmt.Fprintf(os.Stderr, "vole runner: cannot prepare a cache for %s: %v\n", job.Repo, err)