gitops-commit

gitops-commit

Go module that lands rendered files in GitOps repositories as the person: Flux provenance, SOPS encryption for the repository's recipients, branch, commit, pull request and merge.

Packages

• provenance — where a target's files live. Flux.Resolve(namespace, name) follows a Flux Kustomization to its GitRepository and returns the GitHub repository, branch and directory (spec.path); Explicit(repository, branch, directory) for a location the caller names. Input is data the caller has read (typed structs or decoded objects via Flux.Add); the package talks to no cluster.
• sopsenc — encryption of a repository's secret files. Which files are secret files follows the repository's .sops.yaml: a file a creation rule's path_regex matches is SOPS-encrypted for that rule's age recipients whatever its name (secrets/api-key.yaml by its directory), public keys only; a file named *secret*/*credential* — the naming convention callers follow — that no rule covers is refused, never written in plaintext. Values declared as Generated are drawn from crypto/rand at commit time — once per name, so two files sharing a name carry the same value — and exist only in the encrypted output. A secret file that already exists in the repository is left untouched, never re-generated. The module holds no private key and has no decryption code path; a test fails the build if one appears.
• commit — landing the files as the person. Open takes a Remote built from the caller's GitHub token (NewGitHub) or from an HTTP client that already carries the caller's identity (NewGitHubWithClient: a GitHub App installation transport, a rotated token file), a Request (head branch, title, body) and one Change per location, and makes for every repository one branch, one commit with all of that repository's files and one pull request whose title and body are the caller's text — an open pull request of the same branch is reused. Merge merges as the person and is refused until the caller says approved and every status and check run on the head is green, and when the head is no longer the commit the caller saw; a repository's own protection — the approving review that satisfies enforce_admins and rulesets — applies at the merge call, and no administrative path exists. The Remote also carries the pull-request seams a caller's own flow needs: FindPullRequest (the open pull request of a branch), OpenDraftPullRequest, EnableAutoMerge (arms GitHub's auto-merge with the repository's merge method — the caller's choice, never the module's default), Approve (an approving review as the person, pinned to the head the caller saw), Close (with or without deleting the head branch; a closed pull request is left alone) and Revert (a pull request undoing a merged one: its files inverted in one commit on the base's tip, added files removed, changed files restored, named paths overridden; history is never rewritten). Fake is the in-process remote for tests, the module's and its callers', and implements every seam.

Who imports it

The platform manager, mctl, the cluster manager and the agent manager: one implementation of "render, encrypt, commit, open the pull request, merge on approval" for every GitOps repository the platform writes to.

Identity

The module holds no token, no App and no private key. Every call acts with the token the caller passes in — for the managers, the person's user token of the manager's GitHub App — so commits, pull requests and merges are the person's. A token GitHub refuses (401 or 403) surfaces as commit.ErrAuth with the status; the caller answers with its sign-in flow, and nothing is retried with another identity.