vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Test the merge result before landing it

e5478085e5b53a2892d0649d6f07c6f0a5653378 · Keenan Nemetz · 11d ago · parent db5e4382

Test the merge result before landing it

A protected branch could receive a non-fast-forward landing whose tree was
never built: the gate asked for checks on the request head, and the merge
commit was made at landing time. A pushed merge with the right parents but
extra content was accepted too.

Publish the merge commit under refs/vole/candidates/, test it as the base
branch, and make the gate require its results. Approvals name the head and
the base branch, so a moved base retests without a new approval. A merger
who clicks while that run is still going waits for it instead of clicking
again. A pushed merge commit now has to carry exactly the tree a clean merge
would produce.

Closes: 01M61QQ56TESQ1HTMB1Z5C3733

ci/validate_test.go +6−1

@@ -2,13 +2,15 @@ package ci
	2	2
	3	3	import "testing"
	4	4
	5		func TestValidRefOnlyAcceptsBranchesAndTags(t *testing.T) {
		5	func TestValidRefOnlyAcceptsBranchesTagsAndCombinedResults(t *testing.T) {
	6	6	t.Parallel()
	7	7	for _, ok := range []string{
	8	8	"refs/heads/main",
	9	9	"refs/heads/feature/one",
	10	10	"refs/heads/contrib/alice/patch",
	11	11	"refs/tags/v1.0.0",
		12	"refs/vole/candidates/01M5JR2JK29KKMAA1T9MDNTR01/main-abc",
		13	"refs/vole/candidates/contrib/alice/01M5JR2JK29KKMAA1T9MDNTR01/main-abc",
	12	14	} {
	13	15	if !ValidRef(ok) {
	14	16	t.Fatalf("ValidRef(%q) = false", ok)
@@ -35,6 +37,9 @@ func TestValidRefOnlyAcceptsBranchesAndTags(t *testing.T) {
	35	37	"refs/heads/a.lock",
	36	38	"refs/heads/a.",
	37	39	"refs/tags/a@{1}",
		40	"refs/vole/acl",
		41	"refs/vole/candidates/",
		42	"refs/vole/candidates/../main",
	38	43	} {
	39	44	if ValidRef(bad) {
	40	45	t.Fatalf("ValidRef(%q) = true", bad)