gitprofile

package

v0.0.106 Latest Latest Go to latest Published: Oct 27, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/colony-2/c2j

Links

Open Source Insights

Documentation ¶

Overview ¶

Package gitprofile implements tenant-backed Git routing and credentials.

Index ¶

Constants
func CacheNamespace(ctx context.Context) string
func CombinedOutput(ctx context.Context, cmd *exec.Cmd) ([]byte, error)
func Command(ctx context.Context, args ...string) *exec.Cmd
func CredentialNames(selection Selection, snapshot jobdb.ConfigurationSnapshot) ([]string, error)
func Env(ctx context.Context, base []string) []string
func Key(name string) (string, error)
func Output(ctx context.Context, cmd *exec.Cmd) ([]byte, error)
func ProtocolValue(s string) bool
func Run(ctx context.Context, cmd *exec.Cmd) error
func WithScope(ctx context.Context, s *Scope) context.Context
func WithSecretLimit(ctx context.Context, names []string) context.Context
type Entry
type Profile
- func Decode(data []byte, provisioning bool) (Profile, error)
- func Load(snapshot jobdb.ConfigurationSnapshot, name string) (Profile, error)
- func (p Profile) Match(protocol, host, requestPath, username string) (Entry, error)
- func (p Profile) Validate(provisioning bool) error
type Request
type Resolver
type Response
- func Call(ctx context.Context, socket string, req Request) (Response, error)
type Scope
- func FromContext(ctx context.Context) *Scope
- func NewScope(ctx context.Context, selection Selection, snapshot jobdb.ConfigurationSnapshot, ...) (*Scope, error)
- func (s *Scope) AllowSecrets(names []string)
- func (s *Scope) CheckOutput(v any) error
- func (s *Scope) Close()
- func (s *Scope) Context() context.Context
- func (s *Scope) Error(err error) error
- func (s *Scope) Fork(ctx context.Context, selection Selection) (*Scope, error)
- func (s *Scope) Redact(text string) string
- func (s *Scope) RetainRedaction() func()
type Selection
- func InheritedSelection(ctx context.Context) Selection
- func (s Selection) Resolve(snapshot jobdb.ConfigurationSnapshot) (string, error)
type StderrLog
- func WithStderrLog(ctx context.Context) (context.Context, *StderrLog)
- func (l *StderrLog) Bytes() []byte

Constants ¶

View Source

const (
	ProfilePrefix = "_c2j_git_profile_"
	SecretPrefix  = "_c2j_git_secret_"
	ReadOnlyKey   = "git-profile-ro"
	ReadWriteKey  = "git-profile-rw"
)

View Source

const SocketEnv = "C2J_EXECUTION_SOCKET"

View Source

const StderrArtifactName = "_c2j/git-stderr.txt"

Variables ¶

This section is empty.

Functions ¶

func CacheNamespace ¶

func CacheNamespace(ctx context.Context) string

CacheNamespace prevents source sharing across tenants and routing profiles.

func CombinedOutput ¶ added in v0.0.106

func CombinedOutput(ctx context.Context, cmd *exec.Cmd) ([]byte, error)

CombinedOutput preserves callers' combined output while logging only stderr.

func Command ¶

func Command(ctx context.Context, args ...string) *exec.Cmd

func CredentialNames ¶

func CredentialNames(selection Selection, snapshot jobdb.ConfigurationSnapshot) ([]string, error)

func Env ¶

func Env(ctx context.Context, base []string) []string

Env strips inherited Git authentication/configuration before applying this scope.

func Key ¶

func Key(name string) (string, error)

func Output ¶ added in v0.0.106

func Output(ctx context.Context, cmd *exec.Cmd) ([]byte, error)

Output keeps stdout separate from stderr, including for machine-readable Git output.

func ProtocolValue ¶

func ProtocolValue(s string) bool

func Run ¶ added in v0.0.106

func Run(ctx context.Context, cmd *exec.Cmd) error

Run preserves configured output writers while recording stderr in the task log.

func WithScope ¶

func WithScope(ctx context.Context, s *Scope) context.Context

func WithSecretLimit ¶

func WithSecretLimit(ctx context.Context, names []string) context.Context

WithSecretLimit restricts trusted include preparation as well as later node execution. Nested includes can narrow but cannot restore a removed name.

Types ¶

type Entry ¶

type Entry struct {
	URL         string   `json:"url" yaml:"url"`
	RewriteFrom []string `json:"rewrite_from,omitempty" yaml:"rewrite_from,omitempty"`
	Username    string   `json:"username,omitempty" yaml:"username,omitempty"`
	SecretRef   string   `json:"secret_ref,omitempty" yaml:"secret_ref,omitempty"`
	SecretFile  string   `json:"secret_file,omitempty" yaml:"secret_file,omitempty"`
}

type Profile ¶

type Profile struct {
	Version int     `json:"version" yaml:"version"`
	Entries []Entry `json:"entries" yaml:"entries"`
}

func Decode ¶

func Decode(data []byte, provisioning bool) (Profile, error)

func Load ¶

func Load(snapshot jobdb.ConfigurationSnapshot, name string) (Profile, error)

func (Profile) Match ¶

func (p Profile) Match(protocol, host, requestPath, username string) (Entry, error)

func (Profile) Validate ¶

func (p Profile) Validate(provisioning bool) error

type Request ¶

type Request struct {
	Operation string `json:"operation"`
	Name      string `json:"name,omitempty"`
	Protocol  string `json:"protocol,omitempty"`
	Host      string `json:"host,omitempty"`
	Path      string `json:"path,omitempty"`
	Username  string `json:"username,omitempty"`
}

type Resolver ¶

type Resolver func(context.Context, []string) (jobdb.SecretResolveResult, error)

type Response ¶

type Response struct {
	Value    json.RawMessage    `json:"value,omitempty"`
	Secret   *jobdb.SecretValue `json:"secret,omitempty"`
	Username string             `json:"username,omitempty"`
	Error    string             `json:"error,omitempty"`
}

func Call ¶

func Call(ctx context.Context, socket string, req Request) (Response, error)

type Scope ¶

type Scope struct {
	// contains filtered or unexported fields
}

func FromContext ¶

func FromContext(ctx context.Context) *Scope

func NewScope ¶

func NewScope(ctx context.Context, selection Selection, snapshot jobdb.ConfigurationSnapshot, resolve Resolver, executable string, namespace ...string) (*Scope, error)

func (*Scope) AllowSecrets ¶

func (s *Scope) AllowSecrets(names []string)

AllowSecrets adds references already validated against the operation schema.

func (*Scope) CheckOutput ¶

func (s *Scope) CheckOutput(v any) error

func (*Scope) Close ¶

func (s *Scope) Close()

func (*Scope) Context ¶ added in v0.0.99

func (s *Scope) Context() context.Context

Context carries this invocation's dependencies and cancellation directly.

func (*Scope) Error ¶

func (s *Scope) Error(err error) error

func (*Scope) Fork ¶

func (s *Scope) Fork(ctx context.Context, selection Selection) (*Scope, error)

Fork is for trusted recipe preparation, not the subprocess control API.

func (*Scope) Redact ¶

func (s *Scope) Redact(text string) string

func (*Scope) RetainRedaction ¶

func (s *Scope) RetainRedaction() func()

RetainRedaction keeps masks until a running task finishes unwinding, even when cancellation has already closed its resolver socket.

type Selection ¶

type Selection struct {
	Explicit bool `json:"explicit,omitempty"`
	Value    any  `json:"value,omitempty"`
	Publish  bool `json:"publish,omitempty"`
}

Selection distinguishes inherited defaults from an explicit name or null.

func InheritedSelection ¶

func InheritedSelection(ctx context.Context) Selection

func (Selection) Resolve ¶

func (s Selection) Resolve(snapshot jobdb.ConfigurationSnapshot) (string, error)

type StderrLog ¶ added in v0.0.106

type StderrLog struct {
	// contains filtered or unexported fields
}

StderrLog belongs to one task, including its workspace and source preparation. Whole command records are retained so truncation cannot expose partial secrets.

func WithStderrLog ¶ added in v0.0.106

func WithStderrLog(ctx context.Context) (context.Context, *StderrLog)

func (*StderrLog) Bytes ¶ added in v0.0.106

func (l *StderrLog) Bytes() []byte

Bytes redacts at publication time, after all credentials have been registered.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL