heavy-duty/rig
7
0
Fork 1
Code Issues 10 Pull requests Projects Releases 3 Packages Wiki Activity Actions

feat: Forgejo-native CI — a ci-box tenant and a forgejo-runner command family #110

Merged
andres merged 9 commits from build/109-forgejo-ci-box into main 2026-07-28 19:58:37 +00:00
Conversation 40 Commits 9 Files changed 18 +25 -3
2 changed files with 25 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 6c3b08117f - Show all commits

12
README.md
View file

@ -486,8 +486,13 @@ records which source actually served the converge.
> credential-less `curl` succeeds. Forgejo with `REQUIRE_SIGNIN_VIEW=true` > credential-less `curl` succeeds. Forgejo with `REQUIRE_SIGNIN_VIEW=true`
> answers **404 for a repo it reports as public**, which is exactly what a > answers **404 for a repo it reports as public**, which is exactly what a
> wrong ref looks like; the refusal names this case rather than leaving you > wrong ref looks like; the refusal names this case rather than leaving you
> hunting for a typo. Set `FORGEJO__service__REQUIRE_SIGNIN_VIEW=false` on the > hunting for a typo. `FORGEJO__service__REQUIRE_SIGNIN_VIEW=false` is what
> instance before hosting a registry there. > makes an instance usable as a registry host.
>
> Verified on `forgejo.heavyduty.builders` (2026-07-27): a credential-less
> `templates_resolve` against `RIG_TEMPLATES_HOST=https://forgejo.heavyduty.builders`
> fetches and extracts a real repository archive. The mint-time path works
> there today.
**The security trade — in bold, not a footnote.** **A main-tracked **The security trade — in bold, not a footnote.** **A main-tracked
rig-templates repo means every merged PR there executes as root inside every rig-templates repo means every merged PR there executes as root inside every
@ -1216,6 +1221,9 @@ FORGEJO__actions__DEFAULT_ACTIONS_URL=https://code.forgejo.org
> >
> This affects only the *registry* fetch. `rig forgejo-runner` itself > This affects only the *registry* fetch. `rig forgejo-runner` itself
> authenticates with a token and works either way. > authenticates with a token and works either way.
>
> On `forgejo.heavyduty.builders` this is **already set** — verified
> 2026-07-27 by resolving a registry from it with no credentials at all.
### `rig users apply --file <path>` ### `rig users apply --file <path>`

16
docs/plans/2026-07-27-forgejo-ci-box.md
View file

@ -59,7 +59,21 @@ means every existing caller behaves exactly as before.
install-time cache. It gets the same knob, from the same environment variable, install-time cache. It gets the same knob, from the same environment variable,
so the snapshot and the live fetch cannot disagree about where the registry is. so the snapshot and the live fetch cannot disagree about where the registry is.
### The blocker this exposes ### The blocker this exposed — since cleared
**Resolved 2026-07-27, after this was written.** The operator set
`REQUIRE_SIGNIN_VIEW=false`, and the mint-time path was then verified live: a
credential-less `templates_resolve` with
`RIG_TEMPLATES_HOST=https://forgejo.heavyduty.builders` fetches and extracts a
real archive. Piece 1 is proven end to end on the target instance, not merely
argued.
The requirement below stands for *any* instance hosting a registry, and the
refusal text still names it — it is a property of the mint's creds-free
contract, not of one server's configuration. What follows is the original
analysis, kept because it is why the knob exists.
### The blocker, as originally measured
`templates_resolve` documents a hard contract: `templates_resolve` documents a hard contract: