4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	5c4fa43f8b	Leave no package-registry credential or clone userinfo in the workspace a check mounts (issue 462) ... A build wrote .npmrc into its source tree and never removed it, and its clone recorded the URL's userinfo; a later check's container mounts the workspace as HOME. The .npmrc and the tree now go when the build ends, clones record their URL without userinfo, and a check first removes any .npmrc an older builder left.	2026-10-11 11:24:58 +02:00
jschoubben	6ac9013d6e	builder: a clone may offer the forge's credential, through git's own store ... A private repository could not be built: the builder clones anonymously, and had no way to say who it is. It already holds exactly one credential to exactly the right place — the package-registry binding and its sealed secret, one gitea user whose password answers npm and git alike — so a clone now offers that, and nothing new is minted or carried. Offered, never pushed: the credential is written as a git credential-store file (0600, in the workspace, never argv) and named with -c credential.helper, so git itself decides when it applies — only on an authentication challenge, and only for the URL it was written for, scheme, host and port included. A public repository clones exactly as before; a repository on any other host is never shown it. The same store rides along on an artifact's own context clone, so a private module with a private context builds too.	2026-09-25 21:47:32 +02:00
jschoubben	6a7e701629	Write the package credential only into a build that asks for it ... A per-run .npmrc in every build context put a changing credential in COPY . . of modules that resolve no mesh package — a non-deterministic image (a needless rollout every build, which recreated the control plane) and a credential in a build stage. Now it is written only for a package artifact or an image whose Dockerfile names .npmrc. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 12:45:18 +02:00
jschoubben	4b9bc50aad	The builder resolves the SDK from the mesh registry, and can publish packages ... A new 'package' artifact kind builds a module's own code on a public base image and publishes it to the mesh's package registry by version (hq ADR 0076) — the SDK above all, which the toolchain is built from and so cannot be built in the toolchain. The credential a build needs to resolve or publish packages is rendered as an .npmrc (basic auth, hq ADR 0048) and given to an image build as a buildkit secret, never a layer, so a token is not baked into the toolchain image. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx	2026-09-16 10:27:26 +02:00