sean/platform-seanfarm
Watch
1
0
Fork
You've already forked platform-seanfarm
 0
Code Issues Pull requests 1 Projects Releases 177 Packages Wiki Activity
177 releases 177 tags
  • v780297243f40 780297243f

    v780297243f40 Stable

    pipeline-bot released this 2026-07-31 10:09:02 +00:00 | 51 commits to trunk since this release

    All notable changes to platform-seanfarm — the Crossplane platform APIs (XRDs + Compositions + instances). Releasing promotes the Unreleased section into a dated release section (see sean/pipelines docs/RELEASING.md). This repo is a versioned gitops-flux pipeline project: a plain merge validates; pipectl release platform-seanfarm cuts a vX.Y.Z tag + ff's main, and the main push deploys (flux reconcile). Contributors append bullets under the Unreleased heading.

    • Stop embedding the Codeberg credential in the repo-import URL. apis/forgejo/composition.yaml
      built the clone URL as https://${CODEBERG_USERNAME}:${CODEBERG_PASSWORD}@codeberg.org/... and
      then echoed it. That is not a transient exposure: git PERSISTS remote URLs, so git clone --bare,
      git remote add and git remote set-url each wrote the password into the imported repository's
      .git/config on the Forgejo PVC, and the progress line put it in pod logs on every run. A scan of
      the live PVC found one of 34 repositories already carrying an embedded credential this way.
      The credential now travels beside the URL and is applied by a git credential helper, so the URL
      that gets persisted and printed is clean by construction. The helper reads the secret from the
      environment at call time rather than from the git command line, so it is not visible to ps
      either. tests/check-url-credentials.sh keeps it that way.
    • Stop handing contributors a routine flow that cannot work. The README's two-line recipe told
      you to git push forgejo feat/x — which the laptop credential is deliberately read-only for —
      and then make land, a target that has been a tombstone exiting 1 since it became make merge. Both lines now name what actually works: make push-branch (the in-cluster bot pushes
      on your behalf) then make merge. Also corrects the changelog header, which cited a
      SHIPPING.md renamed to RELEASING.md and a pipectl ship verb that now errors.

    Included changes (vf7cbf0e2b515 -> v780297243f40)

    • f1390e9c1be4 fix(forgejo): the import credential was written to disk and to logs
    • 2182fc35e102 docs: the documented routine flow could not work
    • 21c6cb1dd5de feat(gitmirror): birth bytey — hello world in C, the zero-payload overhead-measurement repo
    • cc8d69651ab1 fix(forgejo): grant pipeline-bot write on sean/olly
    Downloads