vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Refuse a protected-ref pattern that can never match

93c7cae8ebb7d6d853dca476851e2bd0cbe10079 · Keenan Nemetz · 1d ago · parent 2c988ecd

Refuse a protected-ref pattern that can never match

acl protect stored any string: refs/head/main read like a protected branch in
acl show while the hook compared it against refs/heads/main and matched
nothing, so approvals and required checks were off on the branch everything
lands on.

Validate the pattern in forge/access, where the rule is stored, and call it
from both acl protect add|set and the repository settings form. Only the two
shapes IsProtected understands are accepted, exact ref and one trailing
wildcard, the ref part must be a name git could store, and a singular
category is named as the typo it is.

docs/accounts-and-access.md +5−1

@@ -370,7 +370,11 @@ vole admin acl runners add demo ci-runner-1
	370	370	the repository public.
	371	371	- `protect` manages the protected branch patterns. `set` replaces the list,
	372	372	`add` and `remove` change it one entry at a time, `clear` empties it, and
	373		`list` shows it. Admins can still push to protected branches directly.
		373	`list` shows it. A pattern is an exact ref (`refs/heads/main`) or a prefix
		374	ending in one `` (`refs/heads/release/`); `add` and `set` refuse anything
		375	else, because a pattern the hook can never match would leave the branch open
		376	while `acl show` listed it as protected. Admins can still push to protected
		377	branches directly.
	374	378	- `set-approvals` sets how many approvals a protected branch needs. `0` means
	375	379	admin-only.
	376	380	- `checks enable` requires CI checks to pass before a protected branch can be