Documentation
¶
Overview ¶
Package actions is a private serialization backend: it writes a forge-neutral model.Pipeline out in the GitHub Actions workflow wire format.
It is mechanism, not identity. It lives under ci/render/internal so it can be imported only by the render layer and never appears in any user-facing surface (CLI, config, docs, output). A forge emitter that happens to use this wire format calls Emit with a Dialect carrying that forge's provider identity; the backend itself names no forge and asserts no equivalence between forges. When a forge's needs diverge from this format, that forge's package owns the divergence — this backend does not grow forge-specific branches.
Lowering decisions (the gaps a stage-based forge hides that Actions makes explicit):
- stages → none exist; a job with no explicit Needs is wired to depend on every job in the immediately-preceding stage, preserving ordering as an explicit needs DAG.
- artifacts → flow is explicit: a producer uploads, every downstream consumer that needs it downloads.
- OIDC → permissions: id-token: write plus a step that requests a token with audience "stagefreight" and exports it as STAGEFREIGHT_OIDC.
- docker → NOT injected. The build engine is deferred to the runner (mounted socket on hosted; dind/buildkitd via DOCKER_HOST/BUILDKIT_HOST on self-hosted), auto-detected by the runtime. The workflow injects no transport or dind service.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Dialect ¶
type Dialect struct {
// Provider is the forge identity string. It is written verbatim into the
// header banner and SF_CI_PROVIDER so the rendered document and the runtime
// context both report the calling forge, not the backend.
Provider string
// NativeRegistries are the config registry providers this forge can authenticate
// with its auto-token (e.g. github → "ghcr","github"). A job that pushes to one of
// them gets PackageAuth wired; others are left to explicit secrets.
NativeRegistries []string
// PackageAuth, when non-nil, is the forge's recipe for authenticating to its
// native package/container registry. The backend emits it verbatim — it names no
// forge and chooses nothing; the forge package decides whether its registry has a
// turnkey token and which providers count as native.
PackageAuth *PackageAuth
// ForgeAPIAuth, when non-nil, is the forge's REST-API token wiring — lowered ONLY
// onto jobs carrying the ForgeAPI capability (forge mutation: releases, MRs), so the
// credential never reaches the build phase. The forge package owns the env var its
// API client reads and the operator-override expression.
ForgeAPIAuth *ForgeAPIAuth
}
Dialect carries the per-call values a forge emitter supplies. Only the values that legitimately vary between callers belong here; the backend reads them but chooses nothing about identity itself.
type ForgeAPIAuth ¶ added in v0.7.0
ForgeAPIAuth is a forge's REST-API token recipe for jobs that mutate the forge. EnvVar is the variable the forge's API client reads (GitHub → GITHUB_TOKEN, Gitea → GITEA_TOKEN, Forgejo → FORGEJO_TOKEN); Value is the resolution expression, an operator secret override falling back to the forge auto-token (e.g. `${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}`) — the same fallback shape as PackageAuth, because a read-only fork auto-token can't create releases.
type PackageAuth ¶ added in v0.7.0
PackageAuth is a forge's package-registry auth recipe: the permission that widens the job token, plus the credential VALUE expressions the forge runtime provides (e.g. GitHub's `${{ github.actor }}` / `${{ secrets.GITHUB_TOKEN }}`). User and Token are emitted as `<prefix>_USER` / `<prefix>_TOKEN` from the job's capability.
Source Files