OXYGENHUB

Changes up to # 681db69eba17 touching crates/hub/tests/flow.rs · 40

See as swimlanes (independent work side by side)

Provenance is built on oxy-core's DSSE, with one build type everywhere head
Andy McCall via Claude Code agent ·
✔ 681db69eba17
Flow: SLSA provenance for artifacts, in DSSE, that cosign verifies
Andy McCall via Claude Code agent ·
✔ 076c7a7c86b1
A job's identity: the hub is an OIDC issuer
Andy McCall ·
✔ d1727c573f30
Secrets for pipelines, mounted as files
Andy McCall ·
✔ 4ac01a732552
Variables for pipelines at the site, organisation and repository
Andy McCall ·
✔ 2a83f5303458
The hub garbage-collects every repository nightly
Andy McCall ·
✔ 8a3334b7a364
Cancel runs from oh, the run page, and newer pushes v0.3.1
Andy McCall ·
✔ 745d225de344
Scheduled runs: on { schedule } jobs start on the default bookmark when due v0.3.1
Andy McCall ·
✔ 348f8c4baccf
Runs by event: on decides the jobs; tag pushes run tag jobs
Andy McCall ·
✔ c889911bec12
Admin runner settings: job time limits; each job runs under its own
Andy McCall ·
✔ 5dead1f4f26d
Runs started by a push honour each job's scope
Andy McCall ·
✔ d7ce41acf22c
Release trust page: badges of what is signed and attested, a graph drawn at its own size
Andy McCall ·
✔ bf5101d394c0
End the jobs a runner no longer holds at its next claim
Andy McCall ·
✔ eef677c48cd1
Runners are offered only jobs whose image they hold (closes #73)
Andy McCall ·
✔ b0612e7dce30
The hub ends jobs no runner reports, past the time limit (refs #71)
Andy McCall ·
✔ 070a7b64b368
oh signs in through oxy's credential store; pin oxygen with oxy auth and remote bookmarks (refs andymccall/oxygen#47, #48)
Andy McCall ·
✔ 2bbe88a85860
Flow: jobs that ask for runner labels go to runners with them (refs #41, part 3)
Andy McCall ·
✔ c4c87f481d05
Settings → Runners for repository admins and organisation owners (refs #41, part 2b)
Andy McCall ·
✔ 7974adb0be66
Runners: the queue on Admin → Runners, and the runner API (refs #41, part 4)
Andy McCall ·
✔ b66e70b7b6c7
Runners serve the site, an owner or one repository (refs #41, part 2)
Andy McCall ·
✔ 74be97962ed8
Flow: a job's log says which pinned subrepos it was not given, and why (closes #56) v0.2.0v0.3.0v0.3.1v0.4.0
Andy McCall ·
✔ afd0be382257
Pin oxygenflow with the escape hint and oxygen's state index
Andy McCall ·
✔ a4f01d51c2a7
Runners: registration, Admin -> Runners, history, drain/disable/remove
Andy McCall ·
✔ b6b7e4cf6b24
Trust and audit for each release
Andy McCall ·
✔ df940d75cd3d
Run pipeline from bookmarks and changes, and say why it is unavailable
Andy McCall ·
✔ 4f6925337848
Release assets link to the receipt that built them
Andy McCall ·
✔ 10708ab8f54d
Keep and serve Flow job artifacts
Andy McCall ·
✔ a3c8288b0141
Verify and keep signed Flow receipts
Andy McCall ·
✔ cc19697f8871
A queued run says where it stands
Andy McCall ·
✔ bf3d07541368
Flow runs, jobs and logs in the API; checks by heads
Andy McCall ·
✔ 90326c9601f9
Claims tell the runner the run's state, bookmark and number
Andy McCall ·
✔ 9a065bc0ce33
Run pipeline and Re-run: runs that move no bookmark
Andy McCall ·
✔ 1edac4b68c6d
Number Flow runs per repository
Andy McCall ·
✔ a0d4bbfbedd1
Turn OxygenFlow on or off per repository in settings
Andy McCall ·
✔ 9008bf6c2b8c
Write transactions begin IMMEDIATE, so a concurrent writer is waited for (busy timeout) instead of failing at once with database is locked; a test of 16 concurrent log appends fails without it
Andy McCall ·
✔ 941abdd6bb4c
Build against oxygenflow's pinned oxygen (deps/oxygenflow/deps/oxygen) instead of a second pin, so there is one oxy-core; OxygenFlow claims follow subrepos of subrepos, parents first, up to three deep
Andy McCall ·
✔ 25091e5c3bba
Flow test: a private subrepo pinned with the environment's token is still left out for a pusher who cannot read it
Andy McCall ·
✔ 370035a46397
OxygenFlow claims list the state's pinned Oxygen subrepos that the pusher can read, and the job token may read those repositories too
Andy McCall ·
✔ fd3db644df22
Flow state stamps: a state-addressed, verifiable pipeline result for READMEs, and a raw route so Markdown images work
Andy McCall ·
✔ 736f6813543d
OxygenFlow runs: pushes start pipeline runs, a runner API with job tokens, jobs as checks, and a Flow tab with the job graph and live logs
Andy McCall ·
✔ 42fa95540468