Documentation
¶
Overview ¶
Package git is the pull half of GitOps: it fetches an application's repository and pins it to a commit.
It uses go-git rather than shelling out. The controller image should carry no binaries it does not need — the same reasoning that made swarmcli-cd implement charts.Backend on the moby client rather than ship the docker CLI — and an in-process client is testable against a fixture repository with no exec dependency and no network.
Index ¶
Constants ¶
const ( EnvUsername = "SWARMCLI_CD_GIT_USERNAME" EnvToken = "SWARMCLI_CD_GIT_TOKEN" EnvTokenFile = "SWARMCLI_CD_GIT_TOKEN_FILE" )
Environment variables AuthFromEnv reads. The file form exists because a Docker secret arrives as a file: in Swarm it is encrypted at rest in the raft log and delivered in memory, which the string form gives up.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Auth ¶
Auth is how the controller authenticates to a git remote. It is HTTP basic authentication, which is how every forge accepts a token.
func AuthFromEnv ¶
AuthFromEnv reads the git credential from the environment. Its arguments are injected so the controller has one place that touches the process environment and the tests touch none.
No credential is not an error: public repositories are a legitimate source.
The credential is global to the controller. Per-repository credentials need a field on the application spec and a way to name a secret, which is worth doing when someone has two forges, not before.
type Checkout ¶
type Checkout struct {
// Dir is the working tree root. Paths from the application's spec are
// resolved against it.
Dir string
// Revision is the resolved commit, always a full hash and never the branch
// or tag it was reached through. The status records what was actually
// deployed, so a moving ref would make it a guess.
Revision string
}
Checkout is a repository pinned to a commit.
type Sourcer ¶
type Sourcer struct {
// contains filtered or unexported fields
}
Sourcer fetches repositories into a cache directory, one clone per application.
Keying the cache by application rather than by URL means two applications tracking different revisions of the same repository do not fight over one working tree. It costs a clone per application; sharing one and using linked worktrees would be the optimisation, and go-git does not support them.
func New ¶
New returns a Sourcer caching under root.
Credentials are passed in rather than read from the environment here: the sourcer should be drivable from a test without touching the process environment, and the controller should have exactly one place that reads configuration. See AuthFromEnv.
func (*Sourcer) Fetch ¶
Fetch brings the application's repository up to date and checks out the revision its source names, returning the working tree and the commit it resolved to.
The caller decides whether anything changed by comparing the returned revision with the one it last saw; an unchanged repository still costs a fetch, but no render and no plan.
Source Files