mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekay
bc3da4c82b
The binary was gitea and admin work was `gitea admin ...`. Nothing in this fork
is Gitea, so the daemon is now `gitd`: EXECUTABLE, /app/gitd/gitd, the
/usr/local/bin/gitd wrapper, the s6 service, the CLI's own name, and the delegate
each repository's git hooks execute.
The delegate is the whole risk. Every repo on disk carries
hooks/<hook>.d/<binary> containing setting.AppPath verbatim, and the outer
hooks/<hook> runs EVERY executable in <hook>.d/ and rejects the push if any exits
non-zero. So this rename is a migration, not a rename, and it is safe only
because both halves move together:
* AppPath moves (/usr/local/bin/gitea -> /usr/local/bin/gitd), which is what
makes routers.syncAppConfForGit re-run SyncRepositoryHooks over every
repository on the first boot after the upgrade — and it runs inside
InitWebInstalled, i.e. before the listener opens, so no push can ever meet a
stale hook. `gitd admin regenerate hooks` remains the manual lever.
* createDelegateHooks now deletes legacyDelegateHookNames. Without it each repo
would keep BOTH hooks/<hook>.d/gitea and .../gitd, the stale one would exit
127, and every push would fail forever. It deletes LAST: dying midway leaves
two delegates and a loud failure, where deleting first would leave none and
silently bypass every server-side check.
* checkDelegateHooks reports a surviving legacy delegate before any other
check, so `doctor --fix` heals a repo the sync missed.
Anything OUTSIDE this repo that invokes the binary by absolute path must move in
the same change that bumps the image tag — today that is the oauth-sync init
container in hanzoai/universe, which runs /app/gitea/gitea.
Deleted rather than renamed: snap/ (published a snap literally named gitea),
contrib/service/* and contrib/fhs-compliant-script (service units for a gitea
binary we no longer build) and contrib/upgrade.sh (fetched upstream Gitea from
dl.gitea.com and installed it OVER ours). We ship one artifact, the container.
Deliberately untouched: /data/gitea, gitea.db, /var/lib/gitea, /etc/gitea. Those
are the durable volume layout of a live server, and moving them is a data
migration with nothing to do with the binary's name.
110 lines
3.8 KiB
YAML
110 lines
3.8 KiB
YAML
name: compliance
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
files-changed:
|
|
uses: ./.hanzo/workflows/files-changed.yml
|
|
|
|
lint-backend:
|
|
if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
|
|
needs: files-changed
|
|
runs-on: hanzo-build-linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
- uses: ./.github/actions/go-setup
|
|
with:
|
|
lint-cache: "true"
|
|
- run: make deps-backend deps-tools
|
|
- run: TAGS="bindata" make generate-go # lint-go also lints with "bindata" tags which requires "_bindata.go"
|
|
- run: make lint-backend
|
|
|
|
lint-on-demand:
|
|
needs: files-changed
|
|
runs-on: hanzo-build-linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
- uses: ./.github/actions/go-setup
|
|
with:
|
|
cache: "false"
|
|
- uses: ./.github/actions/node-setup
|
|
with:
|
|
cache: "false"
|
|
|
|
- run: make lint-spell
|
|
|
|
- if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
|
|
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
|
|
with:
|
|
python-version: 3.14
|
|
- if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
|
|
run: make deps-py lint-templates lint-yaml
|
|
|
|
- if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.swagger == 'true' || needs.files-changed.outputs.json == 'true'
|
|
run: make deps-frontend lint-md lint-swagger lint-json
|
|
|
|
- if: needs.files-changed.outputs.actions == 'true'
|
|
run: make lint-actions
|
|
|
|
- if: needs.files-changed.outputs.shell == 'true'
|
|
run: make lint-shell
|
|
|
|
checks-backend:
|
|
if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
|
|
needs: files-changed
|
|
runs-on: hanzo-build-linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
- uses: ./.github/actions/go-setup
|
|
- run: make deps-backend deps-tools
|
|
- run: make --always-make checks-backend # ensure the "go-licenses" make target runs
|
|
|
|
frontend:
|
|
if: needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
|
|
needs: files-changed
|
|
runs-on: hanzo-build-linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
- uses: ./.github/actions/node-setup
|
|
- run: make deps-frontend
|
|
- run: make lint-frontend
|
|
- run: make checks-frontend
|
|
- run: make test-frontend
|
|
- run: make frontend
|
|
|
|
backend:
|
|
if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
|
|
needs: files-changed
|
|
runs-on: hanzo-build-linux-amd64
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
- uses: ./.github/actions/go-setup
|
|
- run: make deps-backend generate-go
|
|
# no frontend build here as backend should be able to build, even without any frontend files
|
|
# CGO is not used when cross-compile, so these steps also test if the code is compatible with CGO disabled
|
|
- name: build-backend-arm64
|
|
run: go build -o gitd_linux_arm64
|
|
env:
|
|
GOOS: linux
|
|
GOARCH: arm64
|
|
TAGS: bindata gogit
|
|
- name: build-backend-windows
|
|
run: go build -o gitd_windows
|
|
env:
|
|
GOOS: windows
|
|
GOARCH: amd64
|
|
TAGS: bindata gogit
|
|
- name: build-backend-386
|
|
run: go build -o gitd_linux_386
|
|
env:
|
|
GOOS: linux
|
|
GOARCH: 386
|