OXYGENHUB

Pin oxygenflow 21114cf3 (oxygen ec1dc9bd: vet_push); push protection in the changelog c30444e35f2e

Closes #268 (first slice: push protection; the history scan stays for
later).
Author
Andy McCall @andymccall <[email protected]>
via
agent agent:claude@andymccall <[email protected]> · keyless, under your grant for changes,refs,seal · key 41d58b64bdd4
When
· 2026-10-19 21:10 UTC
Signature
◈ sealed by agent:claude@andymccall
Hash
c30444e35f2e8a7a173e9b7a00a8f5c920f4b86525720df4eac038dfb9e20738
Depends on
0f1727376823 380996db84e5 a7e6e8e6094c b5668108487f b9eb70fb9509
Depended on by
1c4ad601ef9d
In bookmarks
api-unknown-fields diffusion-pin-bookmark draft-ready main proposal-list-fast
In tags
v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
Edits
2 atoms, 0 tree operations, 2 files

Browse the tree at this change

hide whitespace changes
modified CHANGELOG.md +1 −0
… 
3 unchanged lines
4 4 

    

  
    

      5
      5
       
      
## Unreleased

    

  
    

      6
      6
       
      

    

  
    

      
      7
      +
      
- **Push protection (#268):** the hub refuses a push that adds what looks like a credential (cloud keys, GitHub, GitLab and OxygenHub tokens, Slack and Stripe keys, private keys; rules v1), naming each by file, line and a fingerprint, never the secret itself, and saying how to take it out (`oxy amend`) and to revoke it if real. Nothing of a refused push is stored. A maintainer can allow one fingerprint with a reason (Settings › Push protection, audited); the setting is on for every repository and can be turned off there. Only what a push adds is scanned, within `[limits] scan_limit` (16 MiB), `scan_file_limit` (1 MiB) and `scan_time_ms` (2 s); a push past them is accepted and its push log says how much went unscanned. Existing history is not scanned yet.

    

  
    

      7
      8
       
      
- **Land when checks pass, or land now over them (#261):** anyone who may land a proposal can set it to land by itself, on the proposal, through `POST`/`DELETE …/proposals/{n}/auto-land` or with `oh proposal land N --when-ready` (`--off` to clear it). Once every required check has passed and nothing else blocks it, it lands as the person who set it, if they may still land. A required check that fails or is cancelled turns it off with a note on the timeline; a push to the source makes it wait again. When required checks are the only thing in the way (pending, or failed with the runners down), a maintainer may land now with a reason: on the proposal, with `{"over_checks": "reason"}` on the API's land, or `oh proposal land N --over-checks REASON`. Only the checks are passed over; approvals, code owners, requested changes, drafts, dependencies and the trust policy still apply. Both are audited, and the proposal, its timeline and the pushes page say how it landed.

    

  
    

      8
      9
       
      
- **The repository bar has an Artifacts menu and a More menu (#254):** the bar is now Code, Changes, Proposals, Issues, Flow, Releases, Wiki, Artifacts, More and Settings, and no longer wraps. Artifacts holds Releases, Build artifacts (every run's outputs in one list, new), Images (the runner images the repository's jobs used, new), Terraform state and Reports; More holds Bookmarks, Tags, Diffusion, Trust, Pushes and Conflicts. Projects leaves the bar (it is on the site band and every profile). The menus work without JavaScript.

    

  
    

      9
      10
       
      
- **The hub keeps Terraform and OpenTofu state (#252, #255):** an HTTP backend per repository at `/api/v1/repos/OWNER/NAME/terraform/state/STATE`, with locking. A job uses it with an identity token for `{base}/terraform` or its job token, for its own repository only; people use a token of theirs and their role. State is sealed at rest and its last 20 versions are kept; backups carry it. The Terraform state page (under Artifacts) lists each state's versions; writers download the current state or any version as a `.tfstate` file, and maintainers restore one. A restore writes the version again with a serial above the current one, since OpenTofu and Terraform only take a state forward, and keeps the state it replaces as a version, so nothing is lost. Refused while the state is locked, never by a job, and audited.

    

  
    

      
      
      …
      
246 unchanged lines

    

  
  

  





  
    replaced
    deps/oxygenflow
    +0 −0
  
  
No line changes.