Documentation
¶
Overview ¶
Package github implements forge.Forge against the GitHub REST API through go-github. Branch and tag protection go through repository rulesets, never the tag protection API sunset in 2024.
Index ¶
- Constants
- type Client
- func (c *Client) BranchExists(ctx context.Context, name string) (bool, error)
- func (c *Client) DefaultBranch(ctx context.Context) (string, error)
- func (c *Client) ProtectTag(ctx context.Context, pattern string) error
- func (c *Client) Protection(ctx context.Context, branch string) (forge.Protection, error)
- func (c *Client) SetDefaultBranch(ctx context.Context, name string) error
- func (c *Client) SetProtection(ctx context.Context, branch string, want forge.Protection) error
- func (c *Client) SetVariable(ctx context.Context, write forge.VariableWrite) error
- func (c *Client) TagProtection(ctx context.Context) ([]string, error)
- func (c *Client) Variable(ctx context.Context, name string, secret bool) (forge.VariableState, error)
Constants ¶
const RulesetName = "forgectl"
RulesetName is the name of the ruleset forgectl owns.
forgectl creates rulesets under this name and modifies only those. A ruleset carrying any other name is left untouched and, if it already grants the required protection, the check still passes: forgectl verifies the effect, not its own authorship (research.md open item 2).
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client implements forge.Forge against the GitHub REST API.
It deliberately does NOT implement forge.TokenIssuer: GitHub has no project access token equivalent, so a generated variable is skipped with a warning rather than failed (FR-029). The absence of those methods makes that skip a fact about the type rather than a runtime check.
func New ¶
New builds a client for one repository, carrying forgectl's own transport: the 30-second timeout and the bounded, backed-off retry (CLI-005, R5).
func NewAt ¶
NewAt builds a client against an explicit API base URL, which is how the httptest suite points it at its own server.
func (*Client) BranchExists ¶
BranchExists reports whether the named branch is on the platform. A 404 is the answer "no", not a failure (FR-024).
func (*Client) DefaultBranch ¶
DefaultBranch reports the repository's default branch (FR-023).
func (*Client) ProtectTag ¶
ProtectTag protects one tag pattern through the tag ruleset forgectl owns (FR-025).
The pattern is added to the includes already there rather than replacing them, so protecting a second pattern does not unprotect the first.
func (*Client) Protection ¶
Protection reads the protection in force on a branch, through rulesets.
Every ACTIVE ruleset covering the branch is considered, not only the one forgectl owns: a maintainer who wrote their own ruleset granting the required protection is compliant, and reporting drift at them would be wrong.
func (*Client) SetDefaultBranch ¶
SetDefaultBranch makes name the repository's default branch (FR-037, FR-038).
func (*Client) SetProtection ¶
SetProtection puts the wanted protection in force on a branch, through the ruleset forgectl owns (FR-037).
It creates that ruleset when it does not exist and updates it when it does. A ruleset carrying any other name is never touched: forgectl is responsible for its own, and overwriting a maintainer's would be the kind of surprise a check/apply tool exists to avoid.
func (*Client) SetVariable ¶
SetVariable creates or updates a CI variable (FR-042).
A secret's value cannot be read back, so apply writes it on every run rather than comparing first. That converges to the same result and is the only thing a write-only store allows.
func (*Client) TagProtection ¶
TagProtection lists the tag patterns any active ruleset protects (FR-025).
func (*Client) Variable ¶
func (c *Client) Variable(ctx context.Context, name string, secret bool) (forge.VariableState, error)
Variable reads what GitHub reports about a CI variable (FR-026).
The attribute mapping is fixed: a secret variable is an Actions secret, a non-secret one is an Actions variable. Masking and protection have no GitHub equivalent and are left at their zero values, which the compliance layer then never compares (FR-026).
Source Files