evidence

package
v1.55.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 11, 2026 License: MIT Imports: 10 Imported by: 0

Documentation

Overview

Package evidence publishes pipeline test-evidence artifacts to a dedicated orphan branch in the same repository.

Evidence used to be committed into the pushed branch, so every merged PR carried its screenshots and logs into the default branch's history forever. An orphan branch keeps the artifacts in the same repository - same access control, binaries welcome, no external host - while sharing no history with the code branches, so nothing lands in the PR branch or the default branch.

PR bodies link artifacts by the evidence COMMIT sha rather than the branch name, so a link keeps resolving to the exact bytes that run published even after later runs overwrite the same paths at the branch tip.

Index

Constants

View Source
const DefaultBranch = "no-mistakes/evidence"

DefaultBranch is the evidence branch used when the config sets no name.

View Source
const (
	// GateEvidenceRefPrefix is the private namespace in a gate mirror for
	// commits reviewed by a completed review round.
	GateEvidenceRefPrefix = "refs/gate-evidence/"
)
View Source
const MarkerContent = `` /* 251-byte string literal not displayed */

MarkerContent is written verbatim at MarkerPath. Keep it byte-stable: a changed blob would make every publish rewrite the marker.

View Source
const MarkerPath = ".no-mistakes-evidence"

MarkerPath is the file every no-mistakes evidence branch carries at its root. Publishing refuses to append to an existing branch that does not have it, which is what keeps a misconfigured (or hostile) branch name - "main", a release branch, someone's feature branch - from receiving evidence commits. The check is on content, not on the name, so it holds regardless of where the name came from.

Variables

This section is empty.

Functions

func ConfigureGateGCProtection

func ConfigureGateGCProtection(ctx context.Context, gateDir string) error

ConfigureGateGCProtection makes reflogs in the reviewed-tree namespace permanent. The refs themselves keep their target commits reachable; the namespace-specific reflog policy also protects a reviewed commit if an operator temporarily removes a ref before an intentional retention decision.

func EnsureGateGCProtection

func EnsureGateGCProtection(ctx context.Context, gateDir string) error

EnsureGateGCProtection installs the reviewed-tree retention policy only when it is absent or has drifted. This keeps already-current gates cheap and avoids rewriting their config on every daemon restart.

func NormalizeBranch

func NormalizeBranch(name string) (string, error)

NormalizeBranch validates a configured evidence branch name and returns the name to use. An empty value resolves to DefaultBranch; anything Git would reject as a branch ref is an error, so a typo fails the config closed instead of failing later inside a run.

The rules mirror git-check-ref-format(1) applied to a branch name, minus the checks that only make sense for a full ref path.

Types

type GateEvidencePinRequest

type GateEvidencePinRequest struct {
	GateDir         string
	RunID           string
	Round           int
	ReviewedHeadSHA *string
}

GateEvidencePinRequest identifies one review tree to retain in the gate mirror. GateDir must be the repository's managed bare gate, never the user's working repository.

type GateEvidencePinResult

type GateEvidencePinResult struct {
	Ref    string
	SHA    string
	Pinned bool
}

GateEvidencePinResult reports whether a reviewed head was retained and the exact ref used for it. Pinned is false when the round had no reviewed head.

func PinReviewedTree

PinReviewedTree retains the reviewed commit under one deterministic ref in the gate mirror. A nil or empty ReviewedHeadSHA is a valid no-op: the round has no evidence to pin. An existing ref for the same round is idempotent when it already names the same commit; changing an existing ref is rejected so a run cannot silently change which tree its evidence claims to review.

type Request

type Request struct {
	// RepoDir is any non-bare worktree (or bare gate dir) of the repository.
	// Objects are written into its store and pushed from there; nothing is
	// checked out, so a detached HEAD or a shallow clone is fine - the orphan
	// branch shares no history with the shallow code branches.
	RepoDir string
	// PushURL is the remote the evidence branch is pushed to. It is the same
	// target the pipeline pushes the code branch to, so fork contributions
	// keep their evidence in the fork the PR head lives in.
	PushURL string
	// Branch is the evidence branch name (already normalized).
	Branch string
	// Dir is an optional directory prefix inside the evidence branch.
	Dir string
	// Segments are further in-branch directory segments below Dir, typically
	// the slugged code-branch name.
	Segments []string
	// SourceDir is the local directory holding the run's evidence files.
	SourceDir string
	// Message is the evidence commit message.
	Message string
	// ForbiddenBranches names branches that must never receive evidence (the
	// run's own branch and the repository default branch). The marker check
	// already refuses them; this turns the refusal into a message that names
	// the misconfiguration.
	ForbiddenBranches []string
}

Request describes one publication of a run's evidence directory.

type Result

type Result struct {
	// Branch is the evidence branch that now holds the files.
	Branch string
	// CommitSHA is the evidence commit to build stable links against.
	CommitSHA string
	// Dir is the in-branch directory the run's files live under, "" at root.
	Dir string
	// Files are the published paths relative to Dir, slash separated.
	Files []string
}

Result describes what a publication landed on the evidence branch.

func Publish

func Publish(ctx context.Context, req Request) (*Result, error)

Publish copies every regular file under req.SourceDir onto the evidence branch and pushes it.

The commit is built with plumbing against a scratch index, so the caller's worktree, index, and HEAD are never touched. The new commit's parent is the tip that was just fetched from the remote, which makes the push a plain fast-forward: evidence is only ever appended, and this never force-pushes.

It fails closed rather than guessing: an unreadable remote, a branch that exists without the marker file, a lost push race, or a refused push (no permission, protected ref) all return an error and publish nothing. The caller then leaves the PR body pointing at local paths instead of links that would not resolve.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL