vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add browser auth, contributor access, and gated CI

6c84d387e5f608360e30484a1a5b1cff41076850 · Keenan Nemetz · 16d ago · parent c36d5073

Add browser auth, contributor access, and gated CI

Browser sign-in now uses passkeys. Enrollment links are one-time, sessions are hashed in users.db, and issue/comment/approval writes use the session account. HTTPS public_url is required for WebAuthn.

Add the contributor role between read and maintain. Contributors can discuss and open change requests, and may push only refs/heads/contrib/<account-id>/. Contributor CI is held per commit until a maintainer allows the exact tip from the repository page.

Rename the write role to maintain. write remains accepted as the historical spelling, and access.Write remains as a Go alias so existing callers and ACL rows keep working.

Update the web, CLI, queue schema, and guides for the new flows, and cover the role, namespace, auth, and CI-gating paths in tests.

ci/workflow.go +8

@@ -129,8 +129,16 @@ func (w *Workflow) AppliesToTag(tag string) bool {
	129	129	}
	130	130
	131	131	// Applies reports whether this workflow should run for a push to branch.
		132	//
		133	// "*" means every branch, including names with slashes. path.Match would treat it
		134	// as one path segment, which silently excluded contributor branches such as
		135	// contrib/<account-id>/fix. Other patterns keep path.Match's one-segment rule, so
		136	// "release/*" does not accidentally become "release/anything/at/all".
	132	137	func (w *Workflow) Applies(branch string) bool {
	133	138	for _, pattern := range w.Branches {
		139	if pattern == "*" {
		140	return true
		141	}
	134	142	if ok, err := path.Match(pattern, branch); err == nil && ok {
	135	143	return true
	136	144	}