Build against oxygenflow's pinned oxygen (deps/oxygenflow/deps/oxygen) instead of a second pin, so there is one oxy-core; OxygenFlow claims follow subrepos of subrepos, parents first, up to three deep 25091e5c3bba

# oxygenflow as a pinned subrepo (oxy submodule), and oxygen as oxygenflow's

# own pinned subrepo inside it: one oxygen, the one oxygenflow was tested

# with. They are workspaces of their own.

oxy-core = { path = "deps/oxygenflow/deps/oxygen/crates/oxy-core" }

oxy-server = { path = "deps/oxygenflow/deps/oxygen/crates/oxy-server" }

# Move the pinned oxygenflow (deps/oxygenflow) to its main on Earth, with the

# oxygen it pins; the next commit records the new pin. Push oxygen, then

# oxygenflow (with `make pins` there), first.

	cd deps/oxygenflow && OXY_CA=$(HOME)/.config/oxy/earth-ca.pem oxy --plain pull origin && OXY_CA=$(HOME)/.config/oxy/earth-ca.pem oxy --plain submodule update --init

## oxygenflow and oxygen as pinned subrepos

The hub builds against `deps/oxygenflow`, a subrepo (`oxy submodule`) pinned to an exact state, and against the oxygen that oxygenflow pins in turn, `deps/oxygenflow/deps/oxygen`. So there is one oxygen, the one oxygenflow was built and tested with, every build says which it used, and OxygenFlow can build the hub without network.

- **Newer code:** push oxygen, run `make pins` in oxygenflow and push it, then run `make pins` here. The next commit records the new pin.

- **Formatting:** format only this workspace, with `cargo fmt -p oxygenhub -p hub-api`. `--all` also reaches the path dependencies in `deps/`, which have their own formatting.

- **Fresh clone:** `oxy submodule update --init` here and in `deps/oxygenflow` fetches them.

/// The Oxygen subrepo pins in `name`'s state `heads`: (path, repository id, pinned heads).

async fn pins_in(

    app: &Shared,

    name: crate::repos::RepoName,

    heads: Vec<oxy_core::hash::ChangeHash>,

) -> Vec<(String, [u8; 16], Vec<oxy_core::hash::ChangeHash>)> {

    app.repos

        .unwrap_or_default()

}

/// How deep subrepos of subrepos are followed.

const MAX_SUBREPO_DEPTH: usize = 3;

/// The Oxygen subrepos the run's state pins, and those their states pin in

/// turn (parents first, paths joined), that live on this hub and that the

/// run's pusher may read: what the job's workspace needs beside its own

/// tree. A pin the hub cannot serve is left out, with what it pins; the job

/// then fails on the missing files with an ordinary error.

async fn subrepo_inputs(app: &Shared, row: &db::repos::RepoRow, run: &fdb::Run) -> (Vec<flow_core::api::SubrepoInput>, Vec<i64>) {

    let Some(name) = crate::repos::RepoName::new(&row.owner, &row.name) else { return (vec![], vec![]) };

    let heads: Vec<oxy_core::hash::ChangeHash> = run.head_list().into_iter().filter_map(oxy_core::hash::ChangeHash::from_hex).collect();

    let rows = db::repos::list(&app.db).await.unwrap_or_default();

    // (path prefix, repository, heads, depth), parents before children.

    let mut queue = std::collections::VecDeque::from([(String::new(), name, heads, 0usize)]);

    while let Some((prefix, name, heads, depth)) = queue.pop_front() {

        if depth == MAX_SUBREPO_DEPTH {

            continue;

        }

        for (path, id, pinned) in pins_in(app, name, heads).await {

            let path = if prefix.is_empty() { path } else { format!("{prefix}/{path}") };

            for other in &rows {

                let Some(other_name) = crate::repos::RepoName::new(&other.owner, &other.name) else { continue };

                let matches = app.repos.read(&other_name, move |r, _| Ok(r.id().ok() == Some(id))).await.unwrap_or(false);

                if !matches {

                    continue;

                }

                let role = crate::auth::roles::role_for(&app.db, pusher.as_ref(), other).await.ok().flatten();

                if crate::auth::roles::allows(role, crate::auth::Access::Read) {

                    inputs.push(flow_core::api::SubrepoInput {

                        path: path.clone(),

                        repo: format!("{}/{}", other.owner, other.name),

                        clone_url: format!("{}/{}/{}", app.config.base_url(), other.owner, other.name),

                        heads: pinned.iter().map(|h| h.to_hex()).collect(),

                    });

                    if !ids.contains(&other.id) {

                        ids.push(other.id);

                    }

                    queue.push_back((path.clone(), other_name, pinned.clone(), depth + 1));

                }

                break;

    for n in ["base", "lib", "vault", "other", "app"] {

    let (_b, base_heads) = push("base", "base.rs");

    // lib pins base in turn: a subrepo of a subrepo.

    let lib_work = tempfile::tempdir().unwrap();

    let lib = client(&format!("{}/andy/lib", h.base), lib_work.path());

    lib.submodule_add(&format!("{}/andy/base", h.base), "deps/base", Some("main")).unwrap();

    write(lib_work.path(), "lib.rs", "x\n");

    lib.snapshot("t").unwrap();

    lib.commit("lib on base", &[]).unwrap();

    assert!(lib.push("origin", false).unwrap().iter().all(|r| r.ok));

    let lib_heads = lib.bookmark_heads().unwrap();

    assert_eq!(subs.len(), 2, "lib and what lib pins; vault is private and the pusher has no account: {subs:?}");

    assert_eq!(subs[1]["path"], "deps/lib/deps/base", "nested under its parent, after it");

    assert_eq!(subs[1]["heads"], serde_json::json!(base_heads.iter().map(|h| h.to_hex()).collect::<Vec<_>>()));

    assert!(read("app") && read("lib") && read("base"));