vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Test the merge result before landing it

e5478085e5b53a2892d0649d6f07c6f0a5653378 · Keenan Nemetz · 11d ago · parent db5e4382

Test the merge result before landing it

A protected branch could receive a non-fast-forward landing whose tree was
never built: the gate asked for checks on the request head, and the merge
commit was made at landing time. A pushed merge with the right parents but
extra content was accepted too.

Publish the merge commit under refs/vole/candidates/, test it as the base
branch, and make the gate require its results. Approvals name the head and
the base branch, so a moved base retests without a new approval. A merger
who clicks while that run is still going waits for it instead of clicking
again. A pushed merge commit now has to carry exactly the tree a clean merge
would produce.

Closes: 01M61QQ56TESQ1HTMB1Z5C3733

docs/workflows.md +14

@@ -50,6 +50,20 @@ When a push starts a job, Vole remembers the exact commit, the exact workflow
	50	50	file, and the exact image definition. Editing any of them later does not change a
	51	51	job that is already queued.
	52	52
		53	## Combined results
		54
		55	A change request that cannot fast-forward needs a merge commit before it can land.
		56	Vole builds that merge and runs the jobs that apply to the base branch against it,
		57	so the tree that lands is the tree that was tested. The run is queued automatically
		58	when the head is pushed, and again when the base moves for a request that is under
		59	review or waiting to merge. It uses the workflow files at the merge, so a workflow
		60	change on the base applies to the landing, and it does not deploy the repository's
		61	site.
		62
		63	A combined result derived from a contributor branch is untrusted code. It runs only
		64	after a maintainer allowed that exact head, and it uses the contributor's cache
		65	namespace rather than the one a protected branch builds into.
		66
	53	67	## Images
	54	68
	55	69	A job can name a registry image directly: