jschoubben
bb4a4a82dc
Review finding K1 of R4e, issue 1301 S4 (ADR 0503 §3, ADR 0513 §4: the forge requires mesh/check alone). gitea_check_status rested on "only the bridge invokes it", but node-tools invokes every tool and a tool is told no caller, so any session could set mesh/check and merge past the checker. The bridge now emits check.status on mesh.mod.mesh-delivery-forge-bridge.event. check.status, which the bus grants to its own account alone (emits), with the owed status, its key and its revision; the event id check.<key>.<rev> is the bus's dedup id. A status the bus did not take is not kept as done. OwedAct refuses mesh/check, and gitea.gitea_check_status leaves the invokes. The integration test shows the tool runner's account refused on that subject and gitea's durable consumer handed statuses emitted before it fetched.
86 lines
1.9 KiB
JSON
86 lines
1.9 KiB
JSON
{
|
|
"module": "mesh-delivery-forge-bridge",
|
|
"version": "1",
|
|
"slug": "forge-bridge",
|
|
"consumes": [
|
|
"gitea.pull.updated",
|
|
"gitea.pull.merged",
|
|
"gitea.pull.closed",
|
|
"mesh-delivery-checker.owed.written"
|
|
],
|
|
"streams": [
|
|
{ "name": "forge", "events": ["forge.**"] }
|
|
],
|
|
"state": [
|
|
{ "name": "heads", "history": 1 },
|
|
{ "name": "performed", "history": 1 }
|
|
],
|
|
"reads": [
|
|
"mesh-delivery-checker.owed",
|
|
"mesh-delivery-gate.merges",
|
|
"mesh-delivery-gate.owed"
|
|
],
|
|
"emits": [
|
|
"check.status"
|
|
],
|
|
"invokes": [
|
|
"gitea.gitea_merge_pull_request",
|
|
"gitea.gitea_commit_status",
|
|
"gitea.gitea_delivery_view",
|
|
"gitea.gitea_note_append",
|
|
"gitea.gitea_add_comment",
|
|
"gitea.gitea_open_pulls",
|
|
"gitea.gitea_commit_trees",
|
|
"gitea.gitea_get_file"
|
|
],
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-delivery-forge-bridge",
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-delivery-forge-bridge",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-delivery-forge-bridge"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-delivery-forge-bridge",
|
|
"place": ".",
|
|
"unknown": "program"
|
|
},
|
|
{
|
|
"id": "bridge",
|
|
"type": "process",
|
|
"name": "mesh-delivery-forge-bridge",
|
|
"artifact": "program",
|
|
"run": [
|
|
"./mesh-delivery-forge-bridge"
|
|
],
|
|
"env": {
|
|
"MESH_BROKER_FILE": "${dir:state}/broker"
|
|
},
|
|
"user": "mesh-delivery-forge-bridge",
|
|
"health": {
|
|
"kind": "unit"
|
|
}
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "program",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-delivery-forge-bridge",
|
|
"binary": "mesh-delivery-forge-bridge"
|
|
}
|
|
]
|
|
}
|
|
}
|