vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
Phase 4: only allowed runners green-light a branch
852c067d5fb8226a46574c82077c2fc10bba2eb4 · Keenan Nemetz · 17d ago · parent 5d6db024
Phase 4: only allowed runners green-light a branch Signing made a result attributable; this makes the attribution matter. A required check is a claim about a commit, and until now any admin of the repository could satisfy it — which is exactly the party the check exists to constrain. `acl.runners` is an allowlist of the accounts whose CI results count for a repository, and the gate's rule is: a green run counts only when its attestation names an account on that list. Admins are implicit, because they can rewrite the list and a protected branch already lets them land anything with no checks at all — so the list is about everybody else. A writer running CI on their laptop gets their result recorded and not counted, and the run page says which, so the answer to "why is my green run not gating?" is where somebody looks for it rather than only in a refusal. It is deliberately not a role. Read/write answers "may this account touch the repository"; this answers "may this account's build be believed about it", and conflating them would make every writer trusted about builds. The same list decides who may lease a job, since running one executes the repository's code: the answer arrives before the build rather than after it. That also loosens the old lease rule, which required admin — a named runner needs no write access at all. `vole acl runners <repo>` shows the list, bare names replace it, `+name` adds, and `none` clears it. There is no `-name`: revoking trust is the operation where being made to state the whole list is a feature, and the list is printed after every change so a dropped name is visible at once. Fixed on the way: the new "skip non-successful runs" test would have dereferenced a nil run for the no-run case, which TestMissingRunBlocksWithAHint caught as a panic in the hook rather than a message. Verified: TestOnlyAllowedRunnersGreenLightABranch walks the whole rule — an unlisted writer is given no work, and the run page and the refusal both explain it; naming them a runner lets them lease, run and report (attested to them); revoking the runner refuses the merge naming the account and the command that would allow it, with the run page saying "does not count as a check"; allowing them again lets the same green result land, with nothing else changed. TestACLRunnersEditsTheList covers show, +add, replacement and the unknown-account refusal. internal/acl tests pin the rule itself: admins implicit, listed accounts count, read-only accounts do not, and an empty account never does; plus list normalisation and the round trip through the ref it is stored on. scripts/ci.sh green (gofmt, vet, build, markdown links, go test -race ./...).
internal/hook/checks.go +42−1
| @@ -4,6 +4,7 @@ import ( | |||
| 4 | 4 | "fmt" | |
| 5 | 5 | "strings" | |
| 6 | 6 | ||
| 7 | "github.com/rodent-software/vole/internal/acl" | ||
| 7 | 8 | "github.com/rodent-software/vole/internal/gitx" | |
| 8 | 9 | "github.com/rodent-software/vole/internal/runs" | |
| 9 | 10 | "github.com/rodent-software/vole/internal/workflow" | |
| @@ -14,7 +15,11 @@ import ( | |||
| 14 | 15 | // The question is asked of the commit being landed — the approved head — not of | |
| 15 | 16 | // the merge commit a person may be pushing, because CI runs on what was reviewed; | |
| 16 | 17 | // a merge commit is a new object nobody built. | |
| 17 | func checkGaps(g *gitx.Repo, runsDB, repo, sha, branch string) ([]string, error) { | ||
| 18 | // checkGaps reports what a protected branch is still waiting for. A green run only | ||
| 19 | // counts when the host has allowed the account that reported it: a required check is | ||
| 20 | // a claim about a commit, and without that rule any writer could satisfy it by | ||
| 21 | // running CI on their own machine and saying it passed. | ||
| 22 | func checkGaps(g *gitx.Repo, runsDB, repo, sha, branch string, a *acl.ACL, names func(string) string) ([]string, error) { | ||
| 18 | 23 | wfs, problems := workflow.At(g, sha) | |
| 19 | 24 | if len(problems) > 0 { | |
| 20 | 25 | return nil, fmt.Errorf("cannot read the workflows at %s: %s", short(sha), strings.Join(problems, "; ")) | |
| @@ -62,7 +67,43 @@ func checkGaps(g *gitx.Repo, runsDB, repo, sha, branch string) ([]string, error) | |||
| 62 | 67 | gaps = append(gaps, fmt.Sprintf( | |
| 63 | 68 | "%s: job %q is %s for %s; wait for it to finish", wf.Path, job.ID, run.Status, short(sha))) | |
| 64 | 69 | } | |
| 70 | if run == nil || run.Status != runs.StatusSuccess { | ||
| 71 | continue | ||
| 72 | } | ||
| 73 | // The result has to be attributable to somebody the host allowed, or it | ||
| 74 | // is a green light from a party with nothing at stake in this branch. | ||
| 75 | att, err := store.Attestation(run.ID) | ||
| 76 | if err != nil { | ||
| 77 | return nil, fmt.Errorf("cannot read who reported the run for %s: %w", short(sha), err) | ||
| 78 | } | ||
| 79 | switch { | ||
| 80 | case att == nil: | ||
| 81 | gaps = append(gaps, fmt.Sprintf( | ||
| 82 | "%s: job %q passed for %s but the result is unsigned, so it cannot count as a check; "+ | ||
| 83 | "re-run it with a current `vole runner`", wf.Path, job.ID, short(sha))) | ||
| 84 | case a != nil && !a.CanReport(att.Signer): | ||
| 85 | gaps = append(gaps, fmt.Sprintf( | ||
| 86 | "%s: job %q passed for %s, but %s reported it and is not a runner for this "+ | ||
| 87 | "repository (runners: %s) — so the result is recorded and does not count. "+ | ||
| 88 | "An admin can allow that account with `vole acl runners %s +%s`, "+ | ||
| 89 | "or a permitted runner can run the job", | ||
| 90 | wf.Path, job.ID, short(sha), names(att.Signer), | ||
| 91 | runnerSummary(a, names), repo, att.Signer)) | ||
| 92 | } | ||
| 65 | 93 | } | |
| 66 | 94 | } | |
| 67 | 95 | return gaps, nil | |
| 68 | 96 | } | |
| 97 | |||
| 98 | // runnerSummary renders the allowlist for a message. Admins are named as implicit | ||
| 99 | // because an operator reading the refusal needs to know who already counts. | ||
| 100 | func runnerSummary(a *acl.ACL, names func(string) string) string { | ||
| 101 | if len(a.Runners) == 0 { | ||
| 102 | return "none named, so only admins" | ||
| 103 | } | ||
| 104 | out := make([]string, 0, len(a.Runners)) | ||
| 105 | for _, r := range a.Runners { | ||
| 106 | out = append(out, names(r)) | ||
| 107 | } | ||
| 108 | return strings.Join(out, ", ") + " and admins" | ||
| 109 | } | ||