214 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
unkin-agent	ac5604ec92	Protect main on the jellyfin-plugin-sso fork ... Require the PR pipeline and Owners merge approval on main, keeping owner push for upstream syncs.	2026-09-19 22:28:09 +10:00
benvin	c26a432769	Merge pull request 'Fork the Jellyfin SSO plugin mirror into unkin' (#99) from benvin/fork-jellyfin-plugin-sso into main ... Reviewed-on: #99	2026-09-19 17:17:31 +10:00
unkin-agent	289ebc84d6	Fork the Jellyfin SSO plugin mirror into unkin ... Add config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml forking mirrors/jellyfin-plugin-sso.	2026-09-19 17:11:06 +10:00
benvin	25ef56fc30	Merge pull request 'Use plain git migration service for the SSO plugin mirror' (#98) from benvin/mirror-sso-plain-git into main ... Reviewed-on: #98	2026-09-19 17:03:48 +10:00
unkin-agent	112f7c8042	Use plain git migration service for the SSO plugin mirror	2026-09-19 16:47:41 +10:00
benvin	b126fffe17	Merge pull request 'Mirror the upstream Jellyfin SSO plugin' (#97) from benvin/mirror-jellyfin-plugin-sso into main ... Reviewed-on: #97	2026-09-19 16:36:09 +10:00
unkin-agent	8207d8cc8a	Mirror the upstream Jellyfin SSO plugin ... Add a pull mirror of github.com/9p4/jellyfin-plugin-sso into the mirrors organisation, syncing every 8h with issues, pull requests and release migration disabled.	2026-09-19 16:18:55 +10:00
benvin	55151a8796	Merge pull request 'Add declarative fork support to repository config' (#96) from benvin/gitea-fork-from into main ... Reviewed-on: #96	2026-09-19 16:13:06 +10:00
unkin-agent	8bc04e2c7d	Reject fork_from alongside unsupported repository keys ... gitea_fork can only express the source repo and owning organisation, so any other setting in a fork's yaml is silently dropped. - validate fork_from entries carry no other repository attributes, naming the offending config key and attributes - note that gitea_fork has no archive_on_destroy	2026-09-19 16:03:44 +10:00
benvin	2cb056cbac	Merge pull request 'Add Gitea pull-mirror support and a mirrors organisation' (#95) from benvin/gitea-mirror-repos into main ... Reviewed-on: #95	2026-09-19 15:58:01 +10:00
unkin-agent	9ab540719e	Add fork_from to repository config ... Express a fork as an optional fork_from key on the repository yaml, so a forked repo is declared the same way as any other repo. - add fork_from "<owner>/<repo>" to the repository module and object type - create gitea_fork instead of gitea_repository when fork_from is set - validate the source repo name matches the config file name, since a fork inherits the source name - move gitea_repository.this to index 0 for the count refactor - index existing repository import targets to match	2026-09-19 15:55:12 +10:00
unkin-agent	66823a939a	Add pull-mirror support and a mirrors organisation ... Expose the non-secret gitea_repository mirror/migration attributes through the repository module and add the mirrors org for public upstream mirrors.	2026-09-19 15:47:32 +10:00
benvin	26e7723251	Merge pull request 'Add sshsignhost repository and scope certmanager to X.509' (#94) from benvin/puppet-vault-signers-repo into main ... Reviewed-on: #94	2026-09-19 10:25:37 +10:00
unkin-agent	1a43ed6a47	repository: add sshsignhost and scope certmanager to X.509 ... Puppet calls /usr/local/bin/certmanager and /usr/local/bin/sshsignhost at hardcoded paths, so each tool needs a repo named for its binary.	2026-09-19 10:21:14 +10:00
unkin-agent	de2b8acf8a	Add puppet-vault-signers repository ... Host the Go rewrites of the certmanager and sshsignhost Vault signing helpers. - Add config/git.unkin.net/unkin/repository/puppet-vault-signers.yaml - Protect main with Owners-only merge and the standard woodpecker checks	2026-09-14 23:30:11 +10:00
benvin	93b47c0941	Merge pull request 'Add puppet-catalog-tools repository' (#93) from benvin/puppet-catalog-tools-repo into main ... Reviewed-on: #93	2026-09-12 15:35:20 +10:00
unkin-agent	73cc875373	Add puppet-catalog-tools repository	2026-09-12 15:32:55 +10:00
benvin	4424abad17	Merge pull request 'Make arti-pack repo description vendor-neutral' (#92) from benvin/arti-pack-neutral-description into main ... Reviewed-on: #92	2026-09-09 23:12:29 +10:00
unkin-agent	96ca0630d5	Make arti-pack repo description vendor-neutral	2026-09-09 22:39:34 +10:00
benvin	deaa0f003d	Merge pull request 'Add arti-pack repository' (#91) from benvin/arti-pack-repo into main ... Reviewed-on: #91	2026-09-08 22:59:29 +10:00
unkin-agent	d0c1f7f6bd	Add arti-pack repository	2026-09-07 23:49:12 +10:00
benvin	9230ece23a	Merge pull request 'Add vimpack repository' (#90) from benvin/vimpack-repo into main ... Reviewed-on: #90	2026-09-05 13:06:55 +10:00
unkin-agent	62b8ab4e9c	Add vimpack repository	2026-09-05 11:13:50 +10:00
benvin	7b699c36b7	Merge pull request 'Add golib repository' (#89) from benvin/golib-repo into main ... Reviewed-on: #89	2026-08-31 06:58:05 +10:00
unkin-agent	c731f89dd4	Add golib repository ... Shared Go library for estate services, starting with a postgres pool and migrations module.	2026-08-31 04:15:59 +10:00
benvin	2e9a5fb8d4	Merge pull request 'Add repospawner machine user scoped to terraform-git' (#88) from benvin/repospawner-user into main ... Reviewed-on: #88	2026-08-30 09:34:47 +10:00
benvin	cb61d385e2	Merge pull request 'Add repospawner repository' (#87) from benvin/repospawner-repo into main ... Reviewed-on: #87	2026-08-30 09:28:12 +10:00
unkin-agent	dd26c861fc	repospawner: mark the account restricted ... Defense in depth for the repo-creation bot: a restricted Gitea account can only see repositories and organisations it is explicitly added to, so a leaked repospawner token cannot enumerate or read the rest of the estate. The repospawner team grant on terraform-git already covers everything the bot does, so nothing it needs is lost.	2026-08-30 00:55:01 +10:00
unkin-agent	4b30ba0cfd	Add repospawner machine user scoped to terraform-git ... repospawner opens repo-creation PRs against terraform-git and needs no other access, so give it its own identity and a per-repo team instead of adding it to the org-wide agents team. - add config/git.unkin.net/user/repospawner.yaml (limited visibility, not admin, no org/repo creation), mirroring the unkin-agent bot posture - add config/git.unkin.net/unkin/team/repospawner.yaml granting write on the terraform-git repository only (include_all_repositories false)	2026-08-30 00:48:10 +10:00
unkin-agent	0e9f2a1279	Add repospawner repository	2026-08-30 00:40:44 +10:00
benvin	a38a792f69	Merge pull request 'Add mediamark repository' (#86) from benvin/mediamark-repo into main ... Reviewed-on: #86	2026-08-29 21:13:42 +10:00
unkin-agent	cd006fdff6	mediamark: make repo public and require woodpecker PR checks	2026-08-29 21:08:48 +10:00
unkin-agent	ae41bf6cdc	repository: add mediamark repo	2026-08-29 20:57:05 +10:00
benvin	98169c7cf8	Merge pull request 'Archive terraform-nomad repository' (#85) from benvin/archive-nomad into main ... Reviewed-on: #85	2026-08-23 22:36:29 +10:00
unkin-agent	960e88cd7e	Archive terraform-nomad repository ... The terraform-nomad project is being decommissioned; mark it archived in Gitea so it becomes read-only, consistent with other retired repos in this config (e.g. rpmbuild-template).	2026-08-23 22:34:03 +10:00
benvin	9ac6edd0a1	Merge pull request 'Run plan without acquiring the Consul state lock' (#84) from benvin/lockfree-plan into main ... Reviewed-on: #84	2026-08-23 22:31:30 +10:00
unkin-agent	f83bdff5e6	Run plan without acquiring the Consul state lock ... PR plan pipelines were failing with "Error acquiring the state lock" when they collided with a concurrent apply (or another plan) holding the lock on the same Consul-backed state. - plan: pass -lock=false to terragrunt plan; apply/apply-if-changes keep locking	2026-08-23 22:21:11 +10:00
benvin	e4a65e18ab	Merge pull request 'Make clickhouse-tools and logviewer public and require CI status checks' (#83) from benvin/repo-defaults into main ... Reviewed-on: #83	2026-08-23 16:56:12 +10:00
unkin-agent	54fb6154af	Require all three woodpecker PR contexts (build/test/pre-commit)	2026-08-23 16:43:18 +10:00
unkin-agent	3cbfac7017	Make clickhouse-tools and logviewer public and require CI status checks ... Both repos do not need to be private, and their main branches should only accept PRs whose Woodpecker pipeline passed. - private: false for clickhouse-tools and logviewer - require ci/woodpecker/pr/build status check on main for both	2026-08-23 16:33:47 +10:00
benvin	58c67e69be	Merge pull request 'Add clickhouse-tools repository' (#81) from benvin/clickhouse-tools-repo into main ... Reviewed-on: #81	2026-08-23 12:40:12 +10:00
benvin	43a43b5f85	Merge pull request 'Add logviewer repository' (#82) from benvin/logviewer-repo into main ... Reviewed-on: #82	2026-08-23 12:39:40 +10:00
unkin-agent	d4018f6b7e	Add logviewer repository	2026-08-23 12:37:18 +10:00
unkin-agent	22f11a0bda	Add clickhouse-tools repository	2026-08-23 12:36:32 +10:00
benvin	78191e8eaf	Merge pull request 'Add mediamover repository' (#80) from benvin/mediamover-repo into main ... Reviewed-on: #80	2026-08-22 22:53:07 +10:00
unkin-agent	9f85070281	repository: add mediamover repo	2026-08-22 22:37:46 +10:00
benvin	fe7dec14e8	Merge pull request 'waitfordb: add branch protection on main' (#79) from benvin/waitfordb-branch-protection into main ... Reviewed-on: #79	2026-08-22 17:03:15 +10:00
unkin-agent	dd02e3dc75	Require all three PR status checks for waitfordb ... The waitfordb CI is being split into three Woodpecker PR workflows (pre-commit, test, build), each exposing its own status context. Require all three on the main branch protection so a PR cannot merge until pre-commit, test, and build all pass. Mirrors node-lookup.	2026-08-22 15:16:48 +10:00
unkin-agent	c44f90e1ff	waitfordb: add branch protection on main ... Owners-only merge, benvin approval, and the required Woodpecker PR check. Requires the repo to be activated in Woodpecker so ci/woodpecker/pr/build reports before a PR can merge.	2026-08-22 15:05:31 +10:00
benvin	6e6dcc1f25	Merge pull request 'Add waitfordb repo' (#78) from benvin/waitfordb-repo into main ... Reviewed-on: #78	2026-08-22 13:29:00 +10:00