forge.requireci turns away a tree without a verified pass and takes one with it; a review branch's preview is served and goes away with the branch, and gc frees its files; a staged backup restores into an empty root with hooks, keys, refs, review logs and comments intact.
- commit
- f97fd9844137ebdb7d4126e3cbe528c33da004df
- parent
- 9ca2d2565203f3b066d1fed0f50662b3bc360c9f
- author
- cat <admin@dev.site>
- kind
- test risk score 0.1 of 3, Jev's estimate
| A | test/ | 23 | ++++++++++++++++++++++ |
| A | test/ | 20 | +++++++++++++++++++ |
| A | test/ | 32 | ++++++++++++++++++++++++++++++ |
@@ -0,0 +1,23 @@
1+# A staged backup restores into an empty root whole: hooks, keys, refs,2+# review logs and comments, and the forge state that can't be rebuilt.3+. "$(dirname "$0")/../lib.sh"4+user dami5+user ana6+repo dami/greet7+clone dami dami/greet "$T/w/d"8+at "$T/w/d" commit "first"9+push_as dami "$T/w/d" origin main10+clone ana dami/greet "$T/w/a"11+at "$T/w/a" commit "idea"12+push_as ana "$T/w/a" origin HEAD:ana/idea13+echo "looks fine" | ssh_as dami comment dami/greet 1 >"$T_LOG" 2>&1 || fail "comment failed"14+exists "$FORGE_ROOT/dami/greet.git/forge/comments/1/1"15+ok forge backup --dry-run16+r=$T/restored17+ok env FORGE_ROOT="$r" FORGE_WWW="$r/.forge/www" "$FORGE" restore --from "$FORGE_ROOT/.forge/backup/stage"18+exists "$r/dami/greet.git/hooks/pre-receive"19+has "$r/.ssh/authorized_keys" 'shell ana"'20+ok diff -r "$FORGE_ROOT/dami/greet.git/forge" "$r/dami/greet.git/forge"21+eq "$(git --git-dir="$r/dami/greet.git" for-each-ref | wc -l)" "$(git --git-dir="$FORGE_ROOT/dami/greet.git" for-each-ref | wc -l)"22+ok git --git-dir="$r/dami/greet.git" fsck --no-dangling --no-progress23+exists "$r/.forge/www/dami/greet/index.html"@@ -0,0 +1,20 @@
1+# forge.requireci tip: main moves only to a tree with a verified passing2+# attestation, signed by a registered key; a failing one is turned away.3+. "$(dirname "$0")/../lib.sh"4+user dami5+repo dami/greet6+git --git-dir="$FORGE_ROOT/dami/greet.git" config forge.requireci tip7+clone dami dami/greet "$T/w/d"8+mkdir -p "$T/w/d/.forge"9+printf '#!/bin/sh\ntest -f ok\n' >"$T/w/d/.forge/ci"10+chmod +x "$T/w/d/.forge/ci"11+at "$T/w/d" commit "ci script, no ok file yet"12+export FORGE_USER=dami13+fails_with "has no verified passing CI attestation" push_as dami "$T/w/d" origin main14+fails at "$T/w/d" "$FORGE" attest15+fails_with "has no verified passing CI attestation" push_as dami "$T/w/d" origin main refs/notes/ci16+at "$T/w/d" commit "add ok" ok17+ok at "$T/w/d" "$FORGE" attest18+ok at "$T/w/d" "$FORGE" verify19+ok push_as dami "$T/w/d" origin main refs/notes/ci20+eq "$(git --git-dir="$FORGE_ROOT/dami/greet.git" rev-parse main)" "$(git -C "$T/w/d" rev-parse HEAD)"@@ -0,0 +1,32 @@
1+# A site deploy is a ref whose tree is served; a branch gets a preview,2+# which goes away with the branch. Only the owner deploys refs/sites.3+. "$(dirname "$0")/../lib.sh"4+user dami5+user ana6+repo dami/greet7+clone dami dami/greet "$T/w/d"8+at "$T/w/d" commit "first"9+push_as dami "$T/w/d" origin main10+export FORGE_USER=dami11+mkdir -p "$T/site" && printf '<h1>docs v1</h1>\n' >"$T/site/index.html"12+ok at "$T/w/d" "$FORGE" site push "$T/site" docs13+has "$FORGE_WWW/sites/dami/greet/docs/index.html" 'docs v1'14+15+clone ana dami/greet "$T/w/a"16+at "$T/w/a" git switch -q -c ana/tweak17+at "$T/w/a" commit "tweak"18+push_as ana "$T/w/a" origin ana/tweak19+printf '<h1>docs v2</h1>\n' >"$T/site/index.html"20+FORGE_USER=ana ok at "$T/w/a" "$FORGE" site push "$T/site" docs21+has "$FORGE_WWW/previews/dami/greet/docs/ana~tweak/index.html" 'docs v2'22+has "$FORGE_WWW/sites/dami/greet/docs/index.html" 'docs v1'23+at "$T/w/a" git update-ref refs/sites/docs "$(git -C "$T/w/a" rev-parse refs/site-previews/docs/ana/tweak)"24+fails_with "only dami can update this" push_as ana "$T/w/a" origin +refs/sites/docs25+26+ok push_as ana "$T/w/a" origin :ana/tweak27+missing "$FORGE_WWW/previews/dami/greet/docs/ana~tweak"28+fails git --git-dir="$FORGE_ROOT/dami/greet.git" rev-parse -q --verify refs/site-previews/docs/ana/tweak29+# gc frees the preview's files and keeps the live site's.30+ok forge gc --age 031+output | grep -q '^removed store' || fail "gc removed no store tree"32+has "$FORGE_WWW/sites/dami/greet/docs/index.html" 'docs v1'