ipcr/ipcr-forge
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IPCR Forge: org-root image names and per-repository push credentials

Browse Source 
Short names: the public repositories of one Gitea organisation (IPCR_ROOT_ORG,
then the admin page; metadec on our boxes) are also published at the root of
the forge's name, so ipcr.localhost:4767/ipns/metadec.eth/ipcr-hello:1.0.0
works. Collisions (a user/org of that name, another owner's folder) are
skipped and explained.

Push credentials: the staging registry now sits behind forge-gate
(ipcr-forge-bridge gate), in the CI daemon's network namespace, with the
registry on a unix socket and no network. Each publishing repository logs in
as <owner>/<repo> with an IPCR_PUSH_TOKEN Actions secret the bridge sets, and
may push its own name only; IPCR logs in with a credential it generates.
Workflows need a docker/login-action step (example and page updated).

ipcr 1.4.0: allow.aliases with per-pass alias sync; unpublish/retag on every
path; IMPORT_AUTH_GENERATE; names this node publishes resolve via
name/resolve --nocache (Kubo's resolve cache lagged, and the generic resolve
ignores nocache).

bridge 0.3.0: gate, push credentials (rotate in the admin page), root
organisation setting, setup creates the org and the example in it; the
Radicle description carries the Gitea path (identical documents gave the same
RID); OAuth2 app updated only when hosts change, keeping the new secret.
Admin page: tabs, one-line keys, name-check feedback, per-tag docker pull
commands (IPFS, IPNS, ENS, short path first).

Verified on holyhorse (docs/forge.md).
This commit is contained in:
Worph
2026-10-05 11:37:33 +00:00
parent b65bb867c9
commit c961d74e0e
15 changed files with 1275 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files
forge/bridge_test.go
+19 -6
View File
@@ -171,7 +171,8 @@ func TestExampleEmbedded(t *testing.T) {
}
}
b, _ := exampleFiles.ReadFile("example/.gitea/workflows/build.yml")
if !strings.Contains(string(b), "localhost:5000/${{ github.repository }}") || !strings.Contains(string(b), "network=host") {
if !strings.Contains(string(b), "localhost:5000/${{ github.repository }}") || !strings.Contains(string(b), "network=host") ||
!strings.Contains(string(b), "secrets.IPCR_PUSH_TOKEN") {
t.Error("example workflow lost its staging registry lines")
}
}
@@ -408,7 +409,7 @@ func TestCallback(t *testing.T) {
}
}
func TestAllowlist(t *testing.T) {
func TestPlan(t *testing.T) {
mk := func(name string, f func(*repo)) repo {
r := repo{FullName: name}
if f != nil {
@@ -421,10 +422,22 @@ func TestAllowlist(t *testing.T) {
mk("owner/off", nil),
mk("owner/secret", func(r *repo) { r.Private = true }),
mk("owner/fork", func(r *repo) { r.Fork = true }),
mk("org/thing", nil),
mk("Metadec/Hello", nil),
mk("metadec/owner", nil), // short path /owner is owner/'s folder
mk("metadec/bob", nil), // a Gitea user is named bob
mk("metadec/off2", nil),
}
got := strings.Join(allowlist(repos, []string{"owner/off"}), ",")
if got != "org/thing,owner/app" {
t.Errorf("allowlist = %s", got)
p := plan(repos, []string{"owner/off", "metadec/off2"}, "metadec", func(n string) bool { return n == "bob" })
if got := strings.Join(p.Repos, ","); got != "metadec/bob,metadec/hello,metadec/owner,owner/app" {
t.Errorf("repos = %s", got)
}
if len(p.Aliases) != 1 || strings.Join(p.Aliases["metadec/hello"], ",") != "hello" {
t.Errorf("aliases = %v", p.Aliases)
}
if p.Collisions["metadec/owner"] == "" || p.Collisions["metadec/bob"] == "" || len(p.Collisions) != 2 {
t.Errorf("collisions = %v", p.Collisions)
}
if q := plan(repos, nil, "", nil); len(q.Aliases) != 0 {
t.Errorf("no root organisation, aliases %v", q.Aliases)
}
}