4 Commits

Include renames

Author	SHA1	Message	Date
mesh-tools	b692a95280	Read the facts snapshot with mesh-sdk's go/facts, formats 1 and 2, and keep writing format 1 (issue 1390, 3 of 4) ... The merge gate, the build seat's check and the facts writer import the snapshot's type from mesh-sdk (go/facts), whose reader takes formats 1 and 2 and refuses a newer one. The writer keeps writing format 1 (writtenFormat); moving it to 2 is a release of its own (novox/hq ADR 0456). A test shows the writer writes format 1, carries no grants or bindings, and the reader takes both formats and refuses a newer one.	2026-10-20 09:41:16 +00:00
jschoubben	66dc501fc4	Split the unit level from the integration level in cmd, builder, link, catalogue, inventory; cheap fixtures for the archive-entry bound, the registry waits and the catalogue copy (issue 895)	2026-10-17 21:32:23 +02:00
jschoubben	5c4fa43f8b	Leave no package-registry credential or clone userinfo in the workspace a check mounts (issue 462) ... A build wrote .npmrc into its source tree and never removed it, and its clone recorded the URL's userinfo; a later check's container mounts the workspace as HOME. The .npmrc and the tree now go when the build ends, clones record their URL without userinfo, and a check first removes any .npmrc an older builder left.	2026-10-11 11:24:58 +02:00
jschoubben	c494ed03a7	Keep the forge credential out of what a check's container sees, and redact what a check publishes (issue 462) ... The toolchain container mounts the workspace as HOME, so the credential kept there, and a clone's recorded userinfo, were readable by any pull request; its output is kept on the bus for days. The credential now lives in a private directory outside the workspace only while cloning, clones record their URL without userinfo, and every line said to the build's log and the verdict passes a redactor copied from the journal tool (sharing it: issue 471).	2026-10-11 11:20:10 +02:00