vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Add browser auth, contributor access, and gated CI

6c84d387e5f608360e30484a1a5b1cff41076850 · Keenan Nemetz · 16d ago · parent c36d5073

Add browser auth, contributor access, and gated CI

Browser sign-in now uses passkeys. Enrollment links are one-time, sessions are hashed in users.db, and issue/comment/approval writes use the session account. HTTPS public_url is required for WebAuthn.

Add the contributor role between read and maintain. Contributors can discuss and open change requests, and may push only refs/heads/contrib/<account-id>/. Contributor CI is held per commit until a maintainer allows the exact tip from the repository page.

Rename the write role to maintain. write remains accepted as the historical spelling, and access.Write remains as a Go alias so existing callers and ACL rows keep working.

Update the web, CLI, queue schema, and guides for the new flows, and cover the role, namespace, auth, and CI-gating paths in tests.

docs/ci.md +19−1

@@ -39,6 +39,24 @@ Triggers work like this:
	39	39	When a push starts a job, Vole remembers the exact commit and the exact workflow
	40	40	file. Editing the workflow later does not change a job that is already queued.
	41	41
		42	## Contributor branches
		43
		44	A push to `refs/heads/contrib/<account-id>/...` queues no work by itself. Those
		45	branches contain code from outside the project's maintainer group, and running a
		46	workflow executes it on a runner. CI is held until a maintainer or admin opens the
		47	repository page and chooses Allow CI for this tip next to the contributor
		48	branch.
		49
		50	The approval is keyed by the exact commit, not by the branch. A new commit or a
		51	force-push is a new decision, so the contributor cannot push once and inherit
		52	approval forever. The approval is stored in the CI queue database, so a
		53	reconciliation or a temporary queue outage does not silently run an unapproved
		54	tip.
		55
		56	Allowing CI queues every workflow that applies to the branch. Workflows with no
		57	`on.push.branches` filter run on every branch, including names with slashes such
		58	as contributor branches.
		59
	42	60	You can check workflows locally before pushing:
	43	61
	44	62	```sh
@@ -110,7 +128,7 @@ vole admin acl runners demo --remove ci-runner-1 # remove one account
	110	128	vole admin acl runners demo --clear # back to admins only
	111	129	```
	112	130
	113		Admins always count. For everyone else, a writer running CI on their laptop does
		131	Admins always count. For everyone else, a maintainer running CI on their laptop does
	114	132	not turn a required check green. The result is still recorded, and the run page
	115	133	says whether it counts.
	116	134