vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add browser auth, contributor access, and gated CI

6c84d387e5f608360e30484a1a5b1cff41076850 · Keenan Nemetz · 16d ago · parent c36d5073

Add browser auth, contributor access, and gated CI

Browser sign-in now uses passkeys. Enrollment links are one-time, sessions are hashed in users.db, and issue/comment/approval writes use the session account. HTTPS public_url is required for WebAuthn.

Add the contributor role between read and maintain. Contributors can discuss and open change requests, and may push only refs/heads/contrib/<account-id>/. Contributor CI is held per commit until a maintainer allows the exact tip from the repository page.

Rename the write role to maintain. write remains accepted as the historical spelling, and access.Write remains as a Go alias so existing callers and ACL rows keep working.

Update the web, CLI, queue schema, and guides for the new flows, and cover the role, namespace, auth, and CI-gating paths in tests.

docs/change-requests.md +13

@@ -14,6 +14,15 @@ requests/<ulid>/approvals/<account-id>.md # one approval per account
	14	14
	15	15	## Opening and landing a request
	16	16
		17	A contributor opens a request from the web after pushing a branch under
		18	`refs/heads/contrib/<account-id>/`. The Open change request form on the
		19	repository's change-request page lists their namespaced branches; the browser
		20	builds the request from the branch's current commit. A contributor cannot name an
		21	arbitrary commit or another account's branch. CI for that commit is held until a
		22	maintainer allows the exact tip from the repository page.
		23
		24	Maintainers can still use the CLI:
		25
	17	26	```sh
	18	27	# The author pushes a branch and opens a request.
	19	28	git push origin feature:refs/heads/feature
@@ -46,6 +55,10 @@ A protected branch only accepts an update if the new tip is the approved commit,
	46	55	or a merge of that commit with the current branch. That is why "merge, then push"
	47	56	works, but adding an extra commit after approval does not.
	48	57
		58	An approval can also be recorded from the request page in the browser when the
		59	signed-in account has maintain access. The approver is the session's account id, not
		60	a name from the page.
		61
	49	62	An approval is stored at `approvals/<account-id>.md`. Only the account named in
	50	63	that path can create, change, or remove it. The `author` field on a request is for
	51	64	display and carries no authority. An admin can repair an approval, and the