sean/forgejo-operator
Watch
1
0
Fork
You've already forked forgejo-operator
 0
Code Issues Pull requests 1 Projects Releases 22 Packages Wiki Activity
22 releases 42 tags
  • v0.6.10 703b79253c

    v0.6.10 Stable

    pipeline-bot released this 2026-07-07 18:55:05 +00:00 | 84 commits to main since this release

    Fixed

    • ForgejoBranchProtection: address the rule by its rule name, not the branch
      name, on the check/edit path. Forgejo keys branch_protections/{name} on
      rule_name (which only defaults to the branch name at create time), so a CR
      whose spec.ruleName differed from spec.branchName re-checked by branch name,
      404'd, re-created, and Forgejo 409'd — the resource never converged and hammered
      Forgejo every requeue. Resolve the rule name once (status → spec.ruleName →
      branch) and key GET/EDIT/DELETE on it consistently.
    • ForgejoBranchProtection: Delete now derives the rule name from spec when
      status.ruleName is unset (a created-but-status-lost rule is cleaned up instead
      of orphaned), and treats a delete 404 as success (idempotent finalizer).
    • ForgejoBranchProtection: skip the edit PATCH when the live rule already
      matches every managed field, cutting steady-state write load to Forgejo.

    Added

    • First handler-level unit tests against a fake Forgejo (httptest) — create,
      edit, rule-name idempotency, in-sync skip, error propagation, and delete
      (by-rule-name, idempotent 404, derive-from-spec, no-op) for
      ForgejoBranchProtection.
    • ForgejoToken CRD + controller: declaratively mint and rotate a Forgejo
      personal access token into a Secret. The controller authenticates as
      spec.username via HTTP Basic auth using the password in spec.authSecretRef
      (Forgejo's POST /users/{user}/tokens accepts BasicAuth only — a token cannot
      mint a token), mints a uniquely-named scoped PAT, writes it to spec.output,
      and revokes the previous one (mint-before-revoke → no credential gap). Rotation
      is controller-enforced on spec.rotateEvery (default 168h) because Forgejo 14
      PATs carry no server-side expiry; it also re-mints whenever the active token
      is missing server-side       (e.g. after a Forgejo migration wipes tokens), so the
      credential self-heals instead of silently going stale — replacing the one-shot,
      never-rotating *-token-issuer Jobs. Owns tokens by name prefix (<base> /
      <base>-<n>), prunes stragglers, and revokes on delete. Purpose-built to retire
      the fragile forgejo-admin-token / forgejo-pipeline-bot-token issuers.

    Included changes (v0.6.9 -> v0.6.10)

    • 729bd6adede9 feat(forgejotoken): CRD + controller to mint & rotate Forgejo PATs
    • f16707ea1701 fix(branchprotection): key rule ops by rule name, not branch name
    Downloads