Documentation
¶
Overview ¶
Package gitstore persists per-app repo-path GitOps config (plan §7.6): the repo URL/ref/paths, the FSM state (deployed/staged commit, update_state), and the secret material (PAT/deploy-key, webhook HMAC secret) AES-256-GCM at rest. The webhook token is stored only as a SHA-256 hash; the token itself is never persisted or logged.
Index ¶
- func ValidMooringFile(name string) bool
- type Config
- type GitHubConn
- type SaveInput
- type Store
- func (s *Store) CountPreviews(base string) (int, error)
- func (s *Store) Creds(project string) (git.Creds, error)
- func (s *Store) Delete(ctx context.Context, project string) error
- func (s *Store) DeleteGitHubConn(ctx context.Context) error
- func (s *Store) Get(project string) (Config, bool, error)
- func (s *Store) GitHubConn(ctx context.Context) (conn GitHubConn, ok bool, err error)
- func (s *Store) List() ([]Config, error)
- func (s *Store) RefreshPreviewCreds(ctx context.Context, base, repoURL, privatePEM, knownHosts string) error
- func (s *Store) RegisterPreview(ctx context.Context, base, slug, ref string) error
- func (s *Store) RotateWebhook(ctx context.Context, project string) (token string, err error)
- func (s *Store) Save(ctx context.Context, in SaveInput) error
- func (s *Store) SaveGitHubConn(ctx context.Context, login, token string) error
- func (s *Store) SetAutoDeploy(ctx context.Context, project string, enabled bool)
- func (s *Store) SetDeployed(ctx context.Context, project, sha string)
- func (s *Store) SetDeployedBehind(ctx context.Context, project, sha string, behind int)
- func (s *Store) SetFetchError(ctx context.Context, project, classified string)
- func (s *Store) SetFetchResult(ctx context.Context, project, stagedSha string, behind int, state string)
- func (s *Store) SetPreviewEnabled(ctx context.Context, project string, enabled bool) error
- func (s *Store) SetState(ctx context.Context, project, state string)
- func (s *Store) StalePreviews(before int64) ([]string, error)
- func (s *Store) WebhookLookup(token string) (project string, hmacSecret []byte, ok bool)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ValidMooringFile ¶
ValidMooringFile reports whether name is an acceptable per-app mooring file.
Types ¶
type Config ¶
type Config struct {
Project string
RepoURL string
Ref string
ComposePath string
DockerfilePath string
MooringFile string // repo-relative mooring file driving this app (default mooring.yaml)
AutoDeploy bool
BuildPolicy string
CredKind string // "" | token | ssh
DeployedCommit string
StagedCommit string
UpdateState string
CommitsBehind int
LastFetchAt int64
LastFetchError string
HasWebhook bool
PreviewEnabled bool // base app opts into per-PR preview environments
PreviewOf string // non-empty ⇒ this app is an ephemeral preview OF this base slug
}
Config is one repo app's GitOps configuration + state.
type GitHubConn ¶
GitHubConn is the operator's GitHub OAuth connection (account-level; one row). The token is held encrypted at rest and used only to list repos + install per-repo read-only deploy keys — never for day-to-day fetching.
type SaveInput ¶
type SaveInput struct {
Project string
RepoURL string
Ref string
ComposePath string
DockerfilePath string
MooringFile string // "" keeps the stored value (or defaults to mooring.yaml on insert)
AutoDeploy bool
BuildPolicy string
// NewCred tri-state: nil keeps, "" clears, value replaces.
NewCred *string
CredKind string // token | ssh (when NewCred set)
KnownHosts string // ssh only
}
SaveInput is an operator's repo-app config edit.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store persists GitOps config.
func (*Store) CountPreviews ¶ added in v0.7.0
CountPreviews returns how many live previews exist for a base app (the per-base cap input).
func (*Store) Delete ¶
Delete removes an app's entire GitOps row — repo config, deploy FSM, the encrypted fetch credential, and the webhook material all live on this one row, so the row delete fully purges them. Used by the app-delete teardown.
func (*Store) DeleteGitHubConn ¶
DeleteGitHubConn removes the connection (operator clicks Disconnect). Existing per-repo deploy keys keep working — they don't depend on this token.
func (*Store) GitHubConn ¶
GitHubConn loads the connection (ok=false when none is configured). The decrypted token never leaves this layer except to the GitHub client.
func (*Store) List ¶
List returns all repo apps. It selects every column in ONE query and scans each row directly — it must NOT call Get() inside the row loop. The DB pool is capped at a single connection (store.SetMaxOpenConns(1)), so a nested query issued while these rows are still open self-deadlocks: the open rows pin the only connection and the nested query waits forever for a connection that never frees, stranding the pool and hanging every subsequent request (session validation included).
func (*Store) RefreshPreviewCreds ¶ added in v0.11.2
func (s *Store) RefreshPreviewCreds(ctx context.Context, base, repoURL, privatePEM, knownHosts string) error
RefreshPreviewCreds re-copies a base app's (rotated) SSH credential + URL into every live preview that inherits it. A preview has no deploy key of its own — RegisterPreview copies the BASE's key — so rotating the base key (reconnect / reinstall) would strand every active preview on the now- revoked key. This re-syncs them. A no-op when the base has no previews.
func (*Store) RegisterPreview ¶ added in v0.7.0
RegisterPreview creates (or refreshes the ref of) an ephemeral per-PR app that INHERITS the base app's repo, credentials, build policy, and mooring file, checking out the PR head `ref`. preview_of is set to `base`, which scopes teardown. It fail-closes: the base must exist AND have previews enabled, and it refuses to touch a slug already owned by a NON-preview app or a preview of a DIFFERENT base — so a preview can never clobber a real app.
func (*Store) RotateWebhook ¶
RotateWebhook generates a new webhook token (returned once) + HMAC secret, storing only the token hash + the encrypted secret.
func (*Store) SaveGitHubConn ¶
SaveGitHubConn upserts the single GitHub connection (token encrypted at rest).
func (*Store) SetAutoDeploy ¶ added in v0.7.0
SetAutoDeploy toggles a repo app's auto-deploy flag (used to PAUSE auto-deploy after a rollback, so the next webhook can't silently re-promote the commit the operator rolled away).
func (*Store) SetDeployed ¶
SetDeployed records a successful deploy (pins deployed_commit, FSM up_to_date).
func (*Store) SetDeployedBehind ¶ added in v0.7.0
SetDeployedBehind records a deploy of `sha` that is `behind` commits behind the staged tip — used by ROLLBACK, where the app is intentionally moved to an OLDER commit while the branch tip is still ahead. Setting the true state (not a false 'up_to_date') keeps the UI honest.
func (*Store) SetFetchError ¶
SetFetchError records a classified fetch error (never raw git stderr).
func (*Store) SetFetchResult ¶
func (s *Store) SetFetchResult(ctx context.Context, project, stagedSha string, behind int, state string)
SetFetchResult records a successful fetch outcome + FSM transition.
func (*Store) SetPreviewEnabled ¶ added in v0.7.0
SetPreviewEnabled toggles a base app's opt-in for per-PR preview environments.
func (*Store) StalePreviews ¶ added in v0.7.0
StalePreviews returns the slugs of preview apps whose last activity (updated_at) is older than `before` (unix seconds) — the TTL reaper's input, so an abandoned preview (a "closed" event that never arrived) is still cleaned up.
Source Files