Tokens minted by stoke auth login previously got read/write on every
non-admin scope. Default to the reduced set the common issue/PR/repo
commands need (read/write issue + repository, read user + organization),
add --full-scopes to restore the old behavior and --scopes <csv> for a
custom list, and print the granted scopes after login.
Clone repositories from the configured Forgejo instance using the stored
session. The token is passed to git through GIT_CONFIG_* environment-based
config (http.<url>.extraHeader) with GIT_TERMINAL_PROMPT=0, so it never
appears in the remote URL, on the command line, in logs, or in the cloned
repository's .git/config. Git streams its own output and its exit status is
forwarded to the caller.
Supports an optional destination directory plus --branch, --depth and
--origin. Adds tests covering destination handling, exit-status
propagation, remote naming, depth validation and credential redaction.
- chmod 0644 every keyring and sources.list entry after writing: tee
inherits the caller's umask, and under e.g. umask 077 apt's
unprivileged _apt user could not read the keyring
- Tests now run the script under umask 077 and assert the 0644 modes
(mutation-checked: dropping the chmod fails a test), and remove their
temp directories on exit
- Refusal error now states that metadata was already refreshed before
concluding the existing nodesource.list is unsuitable
Verified on fresh debian:13 under umask 077: all four files 0644,
install succeeds. npm test 32/32.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Covers the scenarios codex-reviewer recommended: suitable candidate
already present (incl. epoch stripping), missing metadata healed by a
refresh, bootstrap on too-old distro nodejs, bootstrap failure, and the
refuse-to-overwrite branch for a user-managed nodesource.list. Every
scenario runs under a localized LC_ALL with an apt-cache stub that only
emits the English Candidate: label under LC_ALL=C, so locale-safe
parsing is regression-tested (mutation-checked: dropping LC_ALL=C fails
3 tests).
install-apt.sh gains STOKE_APT_ETC to redirect /etc/apt to a throwaway
directory under test, following the script's existing env-override
pattern. Real-container flow re-verified on debian:13.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- pr comment now rejects whitespace-only bodies and preserves raw body.
- pr review accepts request_changes alias in addition to request-changes.
- Add CLI-boundary regression test proving review body-file whitespace is
preserved through the CLI and sent byte-for-byte to the API.
- Update README option help text for the new alias.
- Map CLI 'approve' to Forgejo's expected 'APPROVED' event.
- Require a non-empty body for request-changes and comment events.
- Update API test expectation and add CLI tests for body validation.
Adds CLI commands for inspecting a pull request, posting a comment, and
submitting an APPROVE/REQUEST_CHANGES/COMMENT review. Includes API client
methods, CLI wiring, and tests.
Implements #1 — stoke installable with apt-get install stoke.
Packaging:
- scripts/build-deb.sh: builds dist/stoke_<version>_all.deb from a clean
staging copy (src + fresh npm ci --omit=dev), pure-JS Architecture: all,
Depends: nodejs (>= 22.12), /usr/lib/stoke payload with /usr/bin/stoke
symlink, copyright + changelog, normalized permissions. Lintian-clean.
- scripts/publish-deb.sh: uploads a .deb to the Forgejo Debian registry
(owner/distribution/component parameterized, defaults heavy-duty/
stable/main), authenticating with STOKE_TOKEN or the stoke login token.
- scripts/install-apt.sh: consumer-side one-time setup — adds the
registry key and apt source, then apt-get install stoke. Falls back to
a [trusted=yes] source when apt's sqv verifier rejects the forge's
registry signature (known upstream Forgejo signing bug; the script
prefers the signed source so setups heal once the forge is fixed).
- .forgejo/workflows/release.yml: on v* tags — test, build, publish to
the heavy-duty registry, attach the .deb to the release page. Needs a
runner and a RELEASE_TOKEN secret with org package write.
New command:
- stoke pr merge (-n, --method merge|rebase|rebase-merge|squash,
--title, --message, --delete-branch) — gap found while merging !2.
Docs and housekeeping:
- README: 'Install with apt' as the primary installation method with
manual setup and dpkg fallback, signature caveat, pr merge reference,
Packaging and releasing section with a release checklist.
- dist/ gitignored; version bumped to 1.2.0.
Verified end-to-end on this machine: built the deb (lintian-clean),
published it to the Forgejo Debian registry, installed it with
apt-get install stoke via install-apt.sh, and confirmed the installed
CLI works against the live forge. The test upload was removed from the
personal namespace afterwards; publishing under heavy-duty needs an
org-member token (401 reqPackageAccess with this restricted account).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
