Merge pull request 'Drop ci/woodpecker/pr/test status check from container-base and container-gobuilder' (#104) from container-protection-test-context into main

Reviewed-on: #104

config/git.unkin.net/mirrors/config.yaml

@@ -0,0 +1,3 @@
+description: "Pull mirrors of upstream repositories"
+visibility: public
+repo_admin_change_team_access: true

config/git.unkin.net/mirrors/repository/jellyfin-plugin-sso.yaml

@@ -0,0 +1,11 @@
+description: "Pull mirror of github.com/9p4/jellyfin-plugin-sso, the Jellyfin SSO/OIDC authentication plugin"
+private: false
+has_issues: false
+has_pull_requests: false
+mirror: true
+migration_clone_address: "https://github.com/9p4/jellyfin-plugin-sso"
+migration_service: "git"
+migration_mirror_interval: "8h0m0s"
+migration_issue_labels: false
+migration_milestones: false
+migration_releases: false

config/git.unkin.net/unkin/repository/argocd-apps.yaml

@@ -10,6 +10,5 @@ branch_protection:
     status_check_contexts:
       - "ci/woodpecker/pr/pre-commit"
       - "ci/woodpecker/pr/kubeconform"
-      - "ci/woodpecker/pr/vector-test"
     approval_whitelist_users:
       - "benvin"

config/git.unkin.net/unkin/repository/arti-pack.yaml

@@ -0,0 +1,14 @@
+description: "Neovim plugin manager that installs plugins from tagged archives in an HTTP artifact repository into nvim's native package path"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/certmanager.yaml

@@ -1,4 +1,4 @@
-description: "Vault PKI certificate issuance and SSH host key signing tool for Puppet-managed infrastructure"
+description: "Vault-backed X.509 certificate signing helper for Puppet"
 private: false
 default_branch: "master"
 default_delete_branch_after_merge: true

config/git.unkin.net/unkin/repository/container-base.yaml

@@ -0,0 +1,15 @@
+description: "Base container images for the estate, carrying internal CA trust and dnf/repo configuration, built as a matrix across the supported distros."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/container-gobuilder.yaml

@@ -0,0 +1,15 @@
+description: "Go toolchain builder container image, built on each supported container-base distro image, used by Woodpecker pipelines to compile Go projects."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/go-cache-plugin.yaml

@@ -0,0 +1,16 @@
+description: "Build repo that compiles the tailscale/go-cache-plugin GOCACHEPROG S3 Go build cache from a pinned upstream module version and publishes static binaries as Gitea releases."
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"
+    approval_whitelist_users:
+      - "benvin"

config/git.unkin.net/unkin/repository/golib.yaml

@@ -0,0 +1,14 @@
+description: "Shared Go library for estate services: postgres, http service kit, vault and gitea clients"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/jellyfin-plugin-sso.yaml

@@ -0,0 +1,15 @@
+fork_from: "mirrors/jellyfin-plugin-sso"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Whitelist-push: the owner pushes main directly when syncing upstream;
+    # everyone else must open a PR.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    # PRs to main must pass the plugin build pipeline before merge.
+    status_check_contexts:
+      - "ci/woodpecker/pr/ci"
+    approval_whitelist_teams:
+      - "Owners"

config/git.unkin.net/unkin/repository/puppet-catalog-tools.yaml

@@ -0,0 +1,14 @@
+description: "Go CLIs to diff Puppet catalogs between branches and map puppet-prod changes to affected hosts"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/sshsignhost.yaml

@@ -0,0 +1,14 @@
+description: "Vault-backed SSH host certificate signing helper for Puppet"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/repository/vimpack.yaml

@@ -0,0 +1,14 @@
+description: "Neovim plugin manager installing plugins from tagged archives on artifactapi/Artifactory instead of git clones"
+private: false
+default_branch: "main"
+default_delete_branch_after_merge: true
+default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/test"
+      - "ci/woodpecker/pr/lint"
+      - "ci/woodpecker/pr/pre-commit"

config/git.unkin.net/unkin/team/repospawner.yaml

@@ -0,0 +1,16 @@
+# Least-privilege access for the repospawner bot: Write on terraform-git only,
+# which is the minimum Gitea permission that allows pushing a branch and opening
+# a pull request. repospawner does its whole job here (repo-creation PRs), so it
+# is kept out of the org-wide "agents" team (include_all_repositories: true).
+#
+# Merge stays reserved for Ben: branch protection on terraform-git's main sets a
+# merge whitelist of the Owners team only. Keep this team out of every merge and
+# approval whitelist.
+description: "repospawner bot -- push branches + open PRs on terraform-git only"
+permission: write
+include_all_repositories: false
+can_create_repos: false
+repositories:
+  - terraform-git
+members:
+  - repospawner

config/git.unkin.net/user/repospawner.yaml

@@ -0,0 +1,22 @@
+# Service identity for repospawner, which opens pull requests against this
+# repository (terraform-git) to add new Gitea repositories on request. It is
+# deliberately separate from unkin-agent so its access can stay scoped to the
+# single repository it needs: the "repospawner" team (unkin/team/repospawner.yaml)
+# grants Write on terraform-git and nothing else.
+#
+# Auth is via ephemeral API tokens minted by the vault-plugin-secrets-gitea
+# engine -- no usable credential lives in this repo's state beyond the generated
+# placeholder. Merge stays blocked by branch protection (merge whitelist =
+# Owners only), so it can push branches and open PRs but never merge.
+email: repospawner@unkin.net
+full_name: "Repo Spawner"
+description: "repospawner service identity -- opens repo-creation PRs against terraform-git"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+# Restricted: account can only see repos/orgs it is explicitly added to -- the
+# repospawner team grant on terraform-git is all it needs.
+restricted: true
+allow_create_organization: false
+max_repo_creation: 0

modules/gitea_instance/imports.tf

@@ -4,167 +4,167 @@ import {
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/puppet-prod"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/puppet-prod"].gitea_repository.this[0]
   id = "2"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/puppet-r10k"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/puppet-r10k"].gitea_repository.this[0]
   id = "3"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-gonic"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-gonic"].gitea_repository.this[0]
   id = "23"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-base"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-base"].gitea_repository.this[0]
   id = "24"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-internal-ca-certificates"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-internal-ca-certificates"].gitea_repository.this[0]
   id = "27"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-template"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-template"].gitea_repository.this[0]
   id = "29"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-jellyfin-web"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-jellyfin-web"].gitea_repository.this[0]
   id = "31"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuild-proxlb"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuild-proxlb"].gitea_repository.this[0]
   id = "33"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-buildrunner"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-buildrunner"].gitea_repository.this[0]
   id = "36"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-template"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-template"].gitea_repository.this[0]
   id = "38"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-vault"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-vault"].gitea_repository.this[0]
   id = "39"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-jupyterinstance"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-jupyterinstance"].gitea_repository.this[0]
   id = "40"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/rpmbuilder"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/rpmbuilder"].gitea_repository.this[0]
   id = "41"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/docker-almalinux-runnerdnd"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/docker-almalinux-runnerdnd"].gitea_repository.this[0]
   id = "43"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/initbuilder"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/initbuilder"].gitea_repository.this[0]
   id = "47"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/puppetapi"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/puppetapi"].gitea_repository.this[0]
   id = "50"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-nomad"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-nomad"].gitea_repository.this[0]
   id = "53"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/packer-images"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/packer-images"].gitea_repository.this[0]
   id = "59"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-normalised"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-normalised"].gitea_repository.this[0]
   id = "60"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-individual"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/app-sudaporn-research-individual"].gitea_repository.this[0]
   id = "63"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-incus"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-incus"].gitea_repository.this[0]
   id = "66"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/artifactapi"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/artifactapi"].gitea_repository.this[0]
   id = "67"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/argocd-apps"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/argocd-apps"].gitea_repository.this[0]
   id = "100"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/certmanager"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/certmanager"].gitea_repository.this[0]
   id = "101"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/node-lookup"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/node-lookup"].gitea_repository.this[0]
   id = "102"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-devcompute"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-devcompute"].gitea_repository.this[0]
   id = "135"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/streamstack"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/streamstack"].gitea_repository.this[0]
   id = "136"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-provider-artifactapi"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-provider-artifactapi"].gitea_repository.this[0]
   id = "137"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/forgebot"].gitea_repository.this[0]
   id = "139"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/forgebot-skills"].gitea_repository.this[0]
   id = "140"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-agent-base"].gitea_repository.this[0]
   id = "141"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-agent-dev"].gitea_repository.this[0]
   id = "142"
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/container-agent-infra"].gitea_repository.this[0]
   id = "143"
 }
 
@@ -199,7 +199,7 @@ import {
 }
 
 import {
-  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this
+  to = module.repository["git.unkin.net/unkin/terraform-git"].gitea_repository.this[0]
   id = "144"
 }
 

modules/gitea_instance/main.tf

@@ -19,6 +19,7 @@ module "repository" {
 
   name                    = each.value.name
   organisation            = each.value.organisation
+  fork_from               = each.value.fork_from
   description             = each.value.description
   private                 = each.value.private
   default_branch          = each.value.default_branch
@@ -35,6 +36,16 @@ module "repository" {
   website                 = each.value.website
   autodetect_manual_merge = each.value.autodetect_manual_merge
 
+  mirror                    = each.value.mirror
+  migration_clone_address   = each.value.migration_clone_address
+  migration_service         = each.value.migration_service
+  migration_mirror_interval = each.value.migration_mirror_interval
+  migration_lfs             = each.value.migration_lfs
+  migration_lfs_endpoint    = each.value.migration_lfs_endpoint
+  migration_issue_labels    = each.value.migration_issue_labels
+  migration_milestones      = each.value.migration_milestones
+  migration_releases        = each.value.migration_releases
+
   depends_on = [module.organisation]
 }
 

modules/gitea_instance/modules/repository/main.tf

@@ -1,4 +1,10 @@
+locals {
+  fork_source = var.fork_from == null ? null : split("/", var.fork_from)
+}
+
 resource "gitea_repository" "this" {
+  count = var.fork_from == null ? 1 : 0
+
   username                = var.organisation
   name                    = var.name
   description             = var.description
@@ -18,8 +24,32 @@ resource "gitea_repository" "this" {
   autodetect_manual_merge = var.autodetect_manual_merge
   archive_on_destroy      = true
 
+  mirror                    = var.mirror
+  migration_clone_address   = var.migration_clone_address
+  migration_service         = var.migration_service
+  migration_mirror_interval = var.migration_mirror_interval
+  migration_lfs             = var.migration_lfs
+  migration_lfs_endpoint    = var.migration_lfs_endpoint
+  migration_issue_labels    = var.migration_issue_labels
+  migration_milestones      = var.migration_milestones
+  migration_releases        = var.migration_releases
+
   lifecycle {
     # migration_mirror_interval defaults to "8h0m0s" but Gitea returns an empty MirrorInterval for non-mirror repos, so the read-back never matches and plans a spurious update every run; it is a migration-only knob with no drift to track here.
     ignore_changes = [migration_mirror_interval]
   }
 }
+
+moved {
+  from = gitea_repository.this
+  to   = gitea_repository.this[0]
+}
+
+# gitea_fork has no archive_on_destroy, so removing a fork from the config deletes the repository instead of archiving it.
+resource "gitea_fork" "this" {
+  count = var.fork_from == null ? 0 : 1
+
+  owner        = local.fork_source[0]
+  repo         = local.fork_source[1]
+  organization = var.organisation
+}

modules/gitea_instance/modules/repository/outputs.tf

@@ -1,3 +1,3 @@
 output "id" {
-  value = gitea_repository.this.id
+  value = one(concat(gitea_repository.this[*].id, gitea_fork.this[*].id))
 }

modules/gitea_instance/modules/repository/variables.tf

@@ -6,6 +6,22 @@ variable "organisation" {
   type = string
 }
 
+variable "fork_from" {
+  description = "Source repository to fork, as \"<owner>/<repo>\". When set, a fork is created instead of a new repository."
+  type        = string
+  default     = null
+
+  validation {
+    condition     = var.fork_from == null || can(regex("^[^/]+/[^/]+$", var.fork_from))
+    error_message = "fork_from must be \"<owner>/<repo>\"."
+  }
+
+  validation {
+    condition     = var.fork_from == null || try(split("/", var.fork_from)[1], null) == var.name
+    error_message = "fork_from source repository must be named \"${var.name}\": a fork inherits the source name, so it cannot differ from the config file name."
+  }
+}
+
 variable "description" {
   type    = string
   default = null
@@ -80,3 +96,48 @@ variable "autodetect_manual_merge" {
   type    = bool
   default = null
 }
+
+variable "mirror" {
+  type    = bool
+  default = null
+}
+
+variable "migration_clone_address" {
+  type    = string
+  default = null
+}
+
+variable "migration_service" {
+  type    = string
+  default = null
+}
+
+variable "migration_mirror_interval" {
+  type    = string
+  default = null
+}
+
+variable "migration_lfs" {
+  type    = bool
+  default = null
+}
+
+variable "migration_lfs_endpoint" {
+  type    = string
+  default = null
+}
+
+variable "migration_issue_labels" {
+  type    = bool
+  default = null
+}
+
+variable "migration_milestones" {
+  type    = bool
+  default = null
+}
+
+variable "migration_releases" {
+  type    = bool
+  default = null
+}

modules/gitea_instance/variables.tf

@@ -17,6 +17,7 @@ variable "repository" {
   type = map(object({
     name                    = string
     organisation            = string
+    fork_from               = optional(string)
     description             = optional(string)
     private                 = optional(bool)
     default_branch          = optional(string)
@@ -32,8 +33,31 @@ variable "repository" {
     repo_template           = optional(bool)
     website                 = optional(string)
     autodetect_manual_merge = optional(bool)
+
+    mirror                    = optional(bool)
+    migration_clone_address   = optional(string)
+    migration_service         = optional(string)
+    migration_mirror_interval = optional(string)
+    migration_lfs             = optional(bool)
+    migration_lfs_endpoint    = optional(string)
+    migration_issue_labels    = optional(bool)
+    migration_milestones      = optional(bool)
+    migration_releases        = optional(bool)
   }))
   default = {}
+
+  validation {
+    condition = alltrue([
+      for key, repo in var.repository :
+      length([for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)]) == 0
+      if repo.fork_from != null
+    ])
+    error_message = "gitea_fork only takes the source repository and the owning organisation, so fork_from cannot be combined with other repository settings: ${join("; ", [
+      for key, repo in var.repository :
+      "${key} also sets ${join(", ", [for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)])}"
+      if repo.fork_from != null && length([for attribute, value in repo : attribute if value != null && !contains(["name", "organisation", "fork_from"], attribute)]) > 0
+    ])}."
+  }
 }
 
 variable "branch_protection" {