Documentation
¶
Overview ¶
@index Authentication helpers for webhook-driven git access.
@index Repository locking and clone-or-pull operations for webhook sync.
Index ¶
- Variables
- func CloneOrPull(ctx context.Context, repoURL, repoRoot, namespace string, ...) error
- func CloneOrPullBranch(ctx context.Context, repoURL, repoRoot, namespace, branch string, ...) error
- func CloneOrPullBranchLocked(ctx context.Context, locker *RepoLocker, ...) error
- func GenerateAppJWT(appID int64, privateKeyPEM []byte) (string, error)
- func RepoDir(repoRoot, namespace string) string
- type Checkout
- type GitAuth
- type RepoLocker
Constants ¶
This section is empty.
Variables ¶
var ErrRepoLockTimeout = errors.New("repo lock timeout")
@intent signal that a per-repository lock could not be acquired within the configured wait window.
Functions ¶
func CloneOrPull ¶
func CloneOrPull(ctx context.Context, repoURL, repoRoot, namespace string, auth transport.AuthMethod) error
CloneOrPull syncs the repository namespace to the default remote branch. @intent give webhook handlers a branch-agnostic entry point for standard repo refresh. @param auth is the git transport auth method to use when the remote requires credentials. @sideEffect may clone or hard-reset the target repository checkout on disk.
func CloneOrPullBranch ¶
func CloneOrPullBranch(ctx context.Context, repoURL, repoRoot, namespace, branch string, auth transport.AuthMethod) error
CloneOrPullBranch ensures the namespace checkout exists and matches the requested branch head. @intent reuse the same repo sync path for first clone and subsequent updates. @sideEffect creates or hard-resets the namespace checkout on disk. @param branch is optional; when empty the repository's current HEAD branch is used during sync. @ensures the checkout at RepoDir(repoRoot, namespace) matches the requested remote branch head on success.
func CloneOrPullBranchLocked ¶
func CloneOrPullBranchLocked(ctx context.Context, locker *RepoLocker, repoURL, repoRoot, repoFullName, namespace, branch string, auth transport.AuthMethod) error
CloneOrPullBranchLocked wraps branch sync with repository locking. @intent prevent overlapping webhook deliveries from cloning or resetting the same checkout simultaneously. @ensures branch sync runs under repository locking even when caller passes a nil locker.
func GenerateAppJWT ¶
GenerateAppJWT signs a short-lived GitHub App JWT from the configured private key. @intent mint the app identity token needed to exchange for installation-scoped repository access. @requires privateKeyPEM must decode to an RSA PKCS#1 private key. @ensures returns an RS256 JWT whose iss claim matches appID and whose exp claim is set to now+10 minutes. @domainRule issued-at is backdated by 60 seconds to tolerate small clock skew.
Types ¶
type Checkout ¶
type Checkout struct {
Root string
Locker *RepoLocker
Auth transport.AuthMethod
}
Checkout binds repository root, locking, and optional transport auth to the app port. @intent expose one locked checkout capability while retaining go-git types inside the adapter.
func NewCheckout ¶
func NewCheckout(root string, locker *RepoLocker, auth transport.AuthMethod) *Checkout
NewCheckout constructs the outbound repository synchronization capability. @intent bind repository root, lock coordination, and transport authentication once at composition.
type GitAuth ¶
type GitAuth struct {
SSHKeyPath string
SSHKeyData []byte
SSHPassword string
AppID int64
AppKey []byte
InstallToken string
}
@intent bundle the supported git authentication inputs (SSH key, GitHub App credentials, install token) for webhook clone and fetch.
func (*GitAuth) Resolve ¶
func (a *GitAuth) Resolve() (transport.AuthMethod, error)
Resolve picks the first configured git authentication strategy. @intent allow webhook sync to switch between SSH and GitHub App token auth without branching at call sites. @domainRule prefer SSHKeyPath first, then inline SSHKeyData, then InstallToken, and return nil auth if none are configured. @sideEffect reads the SSH private key file when SSHKeyPath is used. @ensures returns the first usable transport.AuthMethod for the configured credentials.
type RepoLocker ¶
type RepoLocker struct {
// contains filtered or unexported fields
}
@intent keep repository-scoped git operations serialized across concurrent webhook deliveries.
func NewRepoLocker ¶
func NewRepoLocker(timeout time.Duration) *RepoLocker
NewRepoLocker creates a per-repository lock coordinator with a bounded wait time. @intent serialize concurrent webhook sync for the same repo so git operations do not corrupt the working tree. @param timeout bounds how long callers wait before ErrRepoLockTimeout is returned. @ensures non-positive timeout falls back to 30 seconds.
func (*RepoLocker) WithLock ¶
func (l *RepoLocker) WithLock(ctx context.Context, lockRoot, repoFullName string, fn func(context.Context) error) error
WithLock runs a sync operation while holding both in-process and filesystem repo locks. @intent coordinate webhook workers across goroutines and processes before touching a repository checkout. @sideEffect creates and removes filesystem lock files under the repo root. @param lockRoot is the filesystem root under which lock files are created. @param repoFullName is the repository key used for in-memory and filesystem lock scoping. @ensures fn runs at most once concurrently per repository across cooperating workers/processes.
Source Files