{% extends "base.html" %}

{% import "webhooks_panel.html" as w %}

{% import "assistants_panel.html" as ai %}

{% import "variables_panel.html" as va %}

{% import "secrets_panel.html" as se %}

{% import "repo_tabs.html" as m %}

{% block title %}{% if section != Section::General %}{{ section.title() }} · {% endif %}Settings · {{ repo.owner }}/{{ repo.name }}{% endblock %}

{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}

{% block tabs %}{% call m::tabs(repo, "settings") %}{% endblock %}

{% block content %}

<div class="head"><h1>Settings <small>{{ repo.owner }}/{{ repo.name }}</small></h1></div>

<div class="settings-layout">

<nav class="settings-nav" aria-label="Settings"{% if section == Section::General %} data-settings-anchors{% endif %}>

  {% for (group, pages) in nav %}<div class="settings-group">

    <h2>{{ group }}</h2>

    <ul>{% for p in pages %}<li><a href="{{ repo.url }}/settings/{{ p.slug() }}" data-slug="{{ p.slug() }}"{% if *p == section %} class="on" aria-current="page"{% endif %}>{{ p.title() }}</a></li>{% endfor %}</ul>

  </div>{% endfor %}

</nav>

<div class="sections settings-body">

{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}

{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}

{% match section %}

{% when Section::General %}

<form class="card wide" id="general" method="post" action="{{ repo.url }}/settings">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>General</h2>

  <label for="description">Description</label><input type="text" id="description" name="description" value="{{ row.description }}">

  <label for="topics">Topics</label><input type="text" id="topics" name="topics" value="{{ row.topics }}" placeholder="rust version-control retro">

  <p class="small mute">Separated by spaces or commas; letters, digits and dashes. People find repositories by them under Explore.</p>

  <label for="default_bookmark">Default bookmark</label><input type="text" id="default_bookmark" name="default_bookmark" value="{{ row.default_bookmark }}">

  <label>Visibility{% if role != crate::auth::Role::Admin %} <span class="mute">(admins only)</span>{% endif %}</label>

  <div class="choice">

    <label><input type="radio" name="visibility" value="public"{% if row.visibility == "public" %} checked{% endif %}> public</label>

    <label><input type="radio" name="visibility" value="internal"{% if row.visibility == "internal" %} checked{% endif %}> internal</label>

    <label><input type="radio" name="visibility" value="private"{% if row.visibility == "private" %} checked{% endif %}> private</label>

  </div>

  <button type="submit">SAVE</button>

</form>

{% when Section::Landing %}

<form class="card wide" id="landing" method="post" action="{{ repo.url }}/settings/requirements">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Landing requirements</h2>

  <label for="required_approvals">Sealed approvals required</label><input type="number" id="required_approvals" name="required_approvals" min="0" value="{{ requirements.required_approvals }}">

  <div class="choice">

    <label><input type="checkbox" name="require_owners" value="1"{% if requirements.require_owners %} checked{% endif %}> code owners from <code>.oxyowners</code> must approve</label>

    <label><input type="checkbox" name="allow_conflicts" value="1"{% if requirements.allow_conflicts %} checked{% endif %}> allow landing with conflicts</label>

  </div>

  <button type="submit">SAVE</button>

</form>

{% when Section::PushProtection %}

<section class="panel" id="push-protection">

  <h2>Push protection</h2>

  <p>A push that adds what looks like a credential (cloud keys, tokens, private keys) is refused before any of it is stored, naming the file, line and a fingerprint for each. Only what a push adds is scanned, up to a budget; the push log says when a large push was not scanned in full. What the repository already holds is scanned in the background (Found in history, below).</p>

  <form class="card" method="post" action="{{ repo.url }}/settings/push-protection">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <label class="check"><input type="checkbox" name="protect"{% if row.push_protection %} checked{% endif %}> Refuse pushes that add possible secrets</label>

    <button type="submit">SAVE</button>

  </form>

  <h3>Recent findings</h3>

  {% if push_findings.is_empty() %}<p class="mute small">No refused push is waiting on a decision.</p>{% else %}

  <p class="small mute">From refused pushes, newest first. Allow a finding only when it is not a real secret (an example key, a test fixture): a push adding that same value then passes.</p>

  <table class="small">

  <tr><th>When</th><th>Who</th><th>Where</th><th>What</th><th>Fingerprint</th><th>Allow, because…</th></tr>

  {% for f in push_findings %}

  <tr><td><time title="{{ f.at_ms|when_i }}">{{ f.at_ms|ago_i }}</time></td><td>{% if f.pusher.is_empty() %}<span class="mute">anonymous</span>{% else %}{{ f.pusher }}{% endif %}{% if !f.via.is_empty() %} <span class="mute">via {{ f.via }}</span>{% endif %}</td><td class="px">{{ f.path }}:{{ f.line }}</td><td>{{ f.description }}<br><code class="mute">{{ f.excerpt }}</code></td><td><code>{{ f.fingerprint }}</code></td>

  <td><form class="tiny" method="post" action="{{ repo.url }}/settings/secret-bypass"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="fingerprint" value="{{ f.fingerprint }}"><input type="text" name="reason" aria-label="Reason" placeholder="not a secret: …" required><button type="submit">allow</button></form></td></tr>

  {% endfor %}

  </table>{% endif %}

  <form class="card" method="post" action="{{ repo.url }}/settings/secret-bypass">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <div class="row">

      <div><label for="bypass-fingerprint">Fingerprint</label><input type="text" id="bypass-fingerprint" name="fingerprint" placeholder="16 hex digits from the refusal" required></div>

      <div><label for="bypass-reason">Reason</label><input type="text" id="bypass-reason" name="reason" placeholder="not a secret: …" required></div>

    </div>

    <button type="submit">ALLOW</button>

  </form>

  <h3 id="history-scan">Found in history</h3>

  <p class="small mute">Every change reachable from this repository's bookmarks is scanned with the same rules in the background, a budget at a time: its whole history once, then what each push adds.

  {% if !history_scan_on %}The history scan is off on this hub (<code>history_scan_limit = 0</code> under <code>[limits]</code>).

  {% else if !row.push_protection %}History is not scanned while push protection is off.

  {% else if let Some(s) = history_scan %}{% if s.requested_ms.is_some() && s.target_heads.is_empty() %}A scan of the whole history is waiting to start.{% else if !s.target_heads.is_empty() %}Scanning: {{ s.position }} of {{ s.pending }} changes{% if s.requested_ms.is_some() %} (asked for){% endif %}.{% else if let Some(t) = s.finished_ms %}Scanned up to the bookmarks <time title="{{ t|when_i }}">{{ t|ago_i }}</time>.{% else %}Scanned up to the bookmarks.{% endif %} {{ s.changes }} changes ({{ s.bytes|bytes }}) scanned in all.{% if !s.error.is_empty() %} The last pass failed: {{ s.error }}{% endif %}

  {% else %}Not scanned yet: the scan reaches every repository soon after the hub starts.{% endif %}</p>

  {% if history_scan_on && row.push_protection %}<form class="tiny" method="post" action="{{ repo.url }}/settings/secret-scan"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit">SCAN HISTORY NOW</button></form>{% endif %}

  {% if history_findings.is_empty() %}<p class="mute small">Nothing open: no possible secret was found in history, or each was allowed or resolved.</p>{% else %}

  <p class="small mute">Values already in history: removing them from the files now leaves them in every earlier change, so a real one must be <strong>revoked or rotated</strong>, then marked resolved, with how. One that is not a secret (an example key, a test fixture) can be allowed instead, as for a push.</p>

  <table class="small">

  <tr><th>Where</th><th>What</th><th>Fingerprint</th><th>Found</th><th>Allow, because…</th><th>Resolved, because…</th></tr>

  {% for f in history_findings %}

  <tr><td class="px">{{ f.path }}:{{ f.line }}{% if !f.change_hash.is_empty() %}<br><span class="mute">in</span> <a class="chip" href="{{ repo.url }}/change/{{ f.change_hash }}">{{ f.change_hash|short }}</a>{% endif %}{% if !f.bookmark.is_empty() %} <span class="mute">on</span> {{ f.bookmark }}{% endif %}</td><td>{{ f.description }}<br><code class="mute">{{ f.excerpt }}</code></td><td><code>{{ f.fingerprint }}</code></td><td><time title="{{ f.at_ms|when_i }}">{{ f.at_ms|ago_i }}</time></td>

  <td><form class="tiny" method="post" action="{{ repo.url }}/settings/secret-bypass"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="fingerprint" value="{{ f.fingerprint }}"><input type="text" name="reason" aria-label="Reason to allow" placeholder="not a secret: …" required><button type="submit">allow</button></form></td>

  <td><form class="tiny" method="post" action="{{ repo.url }}/settings/secret-resolve"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="finding" value="{{ f.id }}"><input type="text" name="reason" aria-label="How it was resolved" placeholder="revoked: …" required><button type="submit">mark resolved</button></form></td></tr>

  {% endfor %}

  </table>{% endif %}

  {% if !resolved_findings.is_empty() %}

  <details><summary class="small">Resolved ({{ resolved_findings.len() }})</summary>

  <table class="small">

  <tr><th>Where</th><th>What</th><th>Fingerprint</th><th>How</th><th>By</th><th>When</th></tr>

  {% for f in resolved_findings %}

  <tr><td class="px">{{ f.path }}:{{ f.line }}{% if !f.change_hash.is_empty() %} <a class="chip" href="{{ repo.url }}/change/{{ f.change_hash }}">{{ f.change_hash|short }}</a>{% endif %}</td><td>{{ f.description }}</td><td><code>{{ f.fingerprint }}</code></td><td>{{ f.resolved_reason }}</td><td>{{ f.resolved_by }}</td><td>{% if let Some(t) = f.resolved_ms %}<time title="{{ t|when_i }}">{{ t|ago_i }}</time>{% endif %}</td></tr>

  {% endfor %}

  </table></details>{% endif %}

  {% if !secret_bypasses.is_empty() %}

  <h3>Allowed</h3>

  <table class="small">

  <tr><th>Fingerprint</th><th>Rule</th><th>Reason</th><th>By</th><th>When</th><th></th></tr>

  {% for b in secret_bypasses %}

  <tr><td><code>{{ b.fingerprint }}</code></td><td>{{ b.rule }}</td><td>{{ b.reason }}</td><td>{{ b.by_name }}</td><td><time title="{{ b.created_ms|when_i }}">{{ b.created_ms|ago_i }}</time></td>

  <td><form class="tiny" method="post" action="{{ repo.url }}/settings/secret-bypass/remove"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="fingerprint" value="{{ b.fingerprint }}"><button type="submit" title="Refuse pushes adding this value again">remove</button></form></td></tr>

  {% endfor %}

  </table>{% endif %}

</section>

{% when Section::GitMirror %}

<form class="card wide" id="git-mirror" method="post" action="{{ repo.url }}/settings/mirror">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Git mirror</h2>

  <div class="choice"><label><input type="checkbox" name="enabled" value="1"{% if row.git_mirror %} checked{% endif %}> keep a read-only Git mirror of <strong>{{ row.default_bookmark }}</strong></label></div>

  <p class="small mute">For tools that only speak Git (CI runners, IDEs): <code>git clone {{ shell.base_url }}{{ repo.url }}.git</code>. Private repositories take a personal access token as the password. Pushing to the mirror is refused.{% if row.git_mirror && !row.git_mirror_state.is_empty() %} Last exported state <code>{{ row.git_mirror_state|short }}</code>.{% endif %}</p>

  <button type="submit">SAVE</button>

</form>

{% when Section::Checks %}

<form class="card wide" id="checks" method="post" action="{{ repo.url }}/settings/checks">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Required checks</h2>

  <label for="required_checks">Check names that must pass on a proposal's projected state (comma-separated)</label><input type="text" id="required_checks" name="required_checks" value="{{ required_checks }}" placeholder="build, test">

  <p class="small mute">Any token with <code>checks:write</code> reports checks with <code>POST {{ shell.base_url }}/api/v1/repos/{{ repo.owner }}/{{ repo.name }}/checks</code>.</p>

  <button type="submit">SAVE</button>

</form>

{% when Section::Pipelines %}

<form class="card wide" id="flow" method="post" action="{{ repo.url }}/settings/flow">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>OxygenFlow</h2>

  <p>Pushes to this repository {% if flow_enabled %}<strong>start runs</strong>{% else %}<strong>do not start runs</strong>{% endif %} of its <code>.flow/pipeline.kdl</code>.</p>

  {% if site_admin || own_runner || row.flow == "own" %}

  <div class="choice">

    {% if site_admin %}<label><input type="radio" name="flow" value="on"{% if row.flow == "on" %} checked{% endif %}> on, any runner (the site's too)</label>{% endif %}

    {% if site_admin || own_runner %}<label><input type="radio" name="flow" value="own"{% if row.flow == "own" %} checked{% endif %}> on, own runners only</label>{% endif %}

    <label><input type="radio" name="flow" value="off"{% if row.flow == "off" %} checked{% endif %}> off</label>

    {% if site_admin %}<label><input type="radio" name="flow" value="default"{% if row.flow.is_empty() %} checked{% endif %}> site default ({% if flow_default %}on{% else %}off{% endif %}, from <code>[flow] repos</code> in <code>hub.toml</code>)</label>{% endif %}

  </div>

  <p class="small mute"><strong>Own runners only</strong>: jobs go only to runners registered for this repository or its owner (Runners), never to the site's. Only site administrators let the site's runners take them. It takes effect at the next push.</p>

  <button type="submit">SAVE</button>

  {% else %}

  <p class="small mute">To run pipelines on your own machines, register a runner for this repository under {% if role == crate::auth::Role::Admin %}<a href="{{ repo.url }}/settings/runners">Runners</a>{% else %}Runners{% endif %}, then choose <strong>on, own runners only</strong> here. A site administrator can also let the site's runners take its jobs.</p>

  {% endif %}

</form>

{% when Section::Runs %}

<form class="card wide" id="flow-priority" method="post" action="{{ repo.url }}/settings/flow-priority">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>OxygenFlow priority</h2>

  <p>Runners take higher levels first; within a level, repositories take turns. To rush one run (an incident's fix), expedite it on its page.</p>

  <select name="priority" aria-label="Priority">

    <option value="default"{% if row.flow_priority.is_empty() %} selected{% endif %}>the default (the organisation's or the site's)</option>

    {% if site_admin %}<option value="high"{% if row.flow_priority == "high" %} selected{% endif %}>high</option>{% endif %}

    <option value="normal"{% if row.flow_priority == "normal" %} selected{% endif %}>normal</option>

    <option value="low"{% if row.flow_priority == "low" %} selected{% endif %}>low</option>

  </select>

  <button type="submit">SAVE</button>

</form>

<form class="card wide" id="flow-supersede" method="post" action="{{ repo.url }}/settings/flow-supersede">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Newest run wins</h2>

  <p>A new push run cancels the older push runs of its bookmark still going, and a proposal's new run its older ones: they test states that have moved on, and each cancelled job says which run superseded it. Runs started by hand, by a schedule, by a tag or as a re-run are never cancelled this way.</p>

  <label class="check"><input type="checkbox" name="running"{% if !row.flow_keep_running %} checked{% endif %}> Cancel superseded runs already running too (untick to let them finish and cancel only those still queued)</label>

  <button type="submit">SAVE</button>

</form>

<form class="card wide" id="flow-reuse" method="post" action="{{ repo.url }}/settings/flow-reuse">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Reuse passes</h2>

  <p>A push run doesn't run a job again when the same job, with the same spec and sandbox, already passed on the very same state, as main does after a proposal lands: the job shows as passed, reused from that run, with its receipt. A job that waits for an approval, deploys to an environment, holds secrets or asks for identity tokens always runs, as does one whose artifacts another job of the run takes.</p>

  <label class="check"><input type="checkbox" name="reuse"{% if row.flow_reuse %} checked{% endif %}> Reuse a job's pass on the same state (untick to run every job of every push, for flaky or time-dependent tests)</label>

  <button type="submit">SAVE</button>

</form>

<form class="card wide" id="flow-skip" method="post" action="{{ repo.url }}/settings/flow-skip">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Pushing without a run</h2>

  <p>A push whose newest change says <code>[skip flow]</code>, <code>[skip ci]</code> or <code>[ci skip]</code> in its message starts no jobs: the run list shows it as skipped, with the change and who pushed it, and the next run still covers what it brought. A pushed tag always runs.</p>

  <select name="skip" aria-label="Where a push may skip its run">

    <option value="any"{% if row.flow_skip != "others" && row.flow_skip != "never" %} selected{% endif %}>on any bookmark</option>

    <option value="others"{% if row.flow_skip == "others" %} selected{% endif %}>on any bookmark but {{ row.default_bookmark }}</option>

    <option value="never"{% if row.flow_skip == "never" %} selected{% endif %}>never: every push runs</option>

  </select>

  <button type="submit">SAVE</button>

</form>

{% when Section::Gates %}

<form class="card wide" id="agent-gates" method="post" action="{{ repo.url }}/settings/agent-gates">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Approval gates and agents</h2>

  <p>A gate is there so a person decides. By default an agent's token (an agent-marked token, or a keyless agent's grant) cannot approve or reject one here; a decision signed with a person's key (a sealed approval) always can.</p>

  <label class="check"><input type="checkbox" name="agents"{% if row.agents_decide_gates %} checked{% endif %}> Let agents' tokens approve and reject this repository's approval gates (each decision still says which agent)</label>

  <button type="submit">SAVE</button>

</form>

{% when Section::Diffusion %}

<form class="card wide" id="diffusion" method="post" action="{{ repo.url }}/settings/diffusion">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Diffusion</h2>

  <p>When a repository this one pins as a subrepo moves on, Diffusion opens a proposal here that moves the pin, tested by this repository's own pipeline, with the upstream's changes listed. By default it never lands anything by itself.</p>

  <div class="choice">

    <label><input type="radio" name="diffusion" value="green"{% if row.diffusion == "green" %} checked{% endif %}> when the upstream's checks pass</label>

    <label><input type="radio" name="diffusion" value="any"{% if row.diffusion == "any" %} checked{% endif %}> on every upstream move</label>

    <label><input type="radio" name="diffusion" value="off"{% if row.diffusion == "off" %} checked{% endif %}> off</label>

    <label><input type="radio" name="diffusion" value="default"{% if row.diffusion.is_empty() %} checked{% endif %}> site default ({{ diffusion_site }}, from <code>[diffusion] follow</code> in <code>hub.toml</code>)</label>

  </div>

  <h3>Landing</h3>

  <div class="choice">

    <label><input type="radio" name="land" value="propose"{% if row.diffusion_land != "auto" %} checked{% endif %}> propose only: a person lands each bump</label>

    <label><input type="radio" name="land" value="auto"{% if row.diffusion_land == "auto" %} checked{% endif %}> land by itself when both halves are green: the upstream state it pins passed its own checks and this repository's run on the bump passed</label>

  </div>

  <p class="small mute">An untested (amber) upstream always waits for a person. A landing by Diffusion still needs this repository's required checks and approvals, and a trust policy that lets the hub's key move the bookmark; otherwise the bump waits, and its timeline says why.</p>

  <p class="small mute">A subrepo's <code>.oxymodules</code> entry overrides this with <code>follow = green</code>, <code>any</code> or <code>off</code>; <code>land = auto</code> or <code>propose</code> overrides the landing, <code>target</code> names the bookmark to move (else the one this repository's proposals land on) and <code>watch</code> lists paths whose upstream changes are flagged.</p>

  <button type="submit">SAVE</button>

</form>

{% when Section::Backup %}

<form class="card wide" id="backup" method="post" action="{{ repo.url }}/settings/backup">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Backup</h2>

  {% if let Some(b) = backup_owner %}

  <p>{{ row.owner }} backs up {% if b.every == "off" %}only by hand or when a repository asks{% else %}{% if b.every == "hourly" %}every hour{% else %}every day{% endif %}{% endif %} to {% if b.destination == "gcs" %}<code>gs://{{ b.target }}</code>{% else %}a directory on this hub's host{% endif %}. Every repository goes with it unless it says otherwise here.</p>

  {% else %}

  <p>{{ row.owner }} has no backup set up yet: a user sets one up in <a href="/settings/backups">Settings › Backups</a>, an organisation's owners in its settings. What you choose here applies once it has.</p>

  {% endif %}

  <div class="choice">

    {% for (v, label) in backup_choices() %}<label><input type="radio" name="backup" value="{{ v }}"{% if row.backup == *v %} checked{% endif %}> {{ label }}</label>{% endfor %}

  </div>

  <p class="small mute">A repository with its own schedule makes its owner's backup run at least that often; each run sends only what changed and keeps every repository, so any run restores everything. Left out, it is in no new run; earlier runs keep it until they are pruned.</p>

  <button type="submit">SAVE</button>

</form>

{% when Section::Coverage %}

<form class="card wide" id="coverage" method="post" action="{{ repo.url }}/settings/coverage">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <h2>Coverage</h2>

  <p class="small mute">A job's <code>coverage</code> artifact (LCOV) gives each run a <code>coverage</code> check, measured against <strong>{{ row.default_bookmark }}</strong>. Without rules it only reports; with them it fails when they are broken, and a required check named <code>coverage</code> then holds a proposal back.</p>

  <div class="row">

    <div><label for="cov_min">Fail below this percentage</label><input type="number" id="cov_min" name="min" min="0" max="100" step="0.1" value="{% if let Some(m) = coverage.min %}{{ m }}{% endif %}" placeholder="e.g. 80"></div>

    <div><label for="cov_drop">Fail when it falls by more than (points)</label><input type="number" id="cov_drop" name="max_drop" min="0" max="100" step="0.1" value="{% if let Some(m) = coverage.max_drop %}{{ m }}{% endif %}" placeholder="e.g. 0.5"></div>

  </div>

  <button type="submit">SAVE</button>

</form>

{% when Section::Runners %}

<section class="panel" id="runners">

  <h2>Runners</h2>

  <p class="small">The OxygenFlow runners that may take this repository's jobs: the site's, {{ row.owner }}'s, and this repository's own.</p>

  {% if let Some(t) = runner_token %}<p class="note">Register a runner for this repository with:</p><pre class="snippet">flow runner register {{ shell.base_url }} --token {{ t }} --name NAME</pre>{% endif %}

  {% if runners.is_empty() %}<p class="mute small">None yet: runs wait until a runner that serves this repository is added.</p>{% else %}

  <div class="table"><table>

  <tr><th>Runner</th><th>Status</th><th>Serves</th><th>Machine</th><th></th></tr>

  {% for (r, serves, own) in runners %}<tr><td><strong>{{ r.name }}</strong></td><td><span class="runner-status st-{{ r.status() }}">{{ r.status() }}</span></td><td class="small">{{ serves }}</td><td class="small">{% if r.arch.is_empty() %}<span class="mute">unknown</span>{% else %}{{ r.arch }} · {{ r.os }}{% endif %}</td>

  <td>{% if *own %}<form class="tiny" method="post" action="{{ repo.url }}/settings/runners/{{ r.id }}/remove" data-confirm="Remove {{ r.name }}? Its credential stops working."><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button class="danger-btn">remove</button></form>{% endif %}</td></tr>{% endfor %}

  </table></div>{% endif %}

  <form method="post" action="{{ repo.url }}/settings/runners/token"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit">Add a runner for this repository</button></form>

</section>

{% when Section::Webhooks %}

{% call w::panel(repo.url ~ "/settings", hooks, shell.csrf, "Each delivery is signed with the secret (X-Oxyhub-Signature) and retried with backoff for a day.") %}

{% when Section::Variables %}

{% call va::panel(repo.url ~ "/settings", variables, shell.csrf, "This repository's jobs get these, beside the ones the site and its owner set.") %}

{% when Section::Secrets %}

{% call se::panel(repo.url ~ "/settings", secrets, shell.csrf, "This repository's jobs may use these, beside the ones the site and its owner set.") %}

{% when Section::Assistants %}

{% call ai::panel(repo.url ~ "/settings", assistants, shell.csrf, "This repository may ask these, beside the ones the site and its owner provide.") %}

{% when Section::Storage %}

{% if let Some(st) = storage %}<section class="panel" id="storage">

  <h2>Storage</h2>

  <p>This repository's data lives in <code>{{ st.url }}</code>, your bucket. This server keeps a cache and the credentials, sealed.</p>

  <dl class="facts">

    <dt>Since</dt><dd><time title="{{ st.created_ms|when_i }}">{{ st.created_ms|ago_i }}</time></dd>

    <dt>Last check</dt><dd>{% if let Some(t) = st.checked_ms %}<time title="{{ t|when_i }}">{{ t|ago_i }}</time>: {{ st.check_result }}{% else %}<span class="mute">never</span>{% endif %}</dd>

  </dl>

  <form class="inline" method="post" action="{{ repo.url }}/settings/storage">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <input type="hidden" name="action" value="check">

    <button type="submit" title="Write, read, list and delete under a probe prefix of the bucket, and compare-and-swap a record">CHECK THE BUCKET</button>

  </form>

  <details>

    <summary>Replace the credentials</summary>

    <form class="card" method="post" action="{{ repo.url }}/settings/storage">

      <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

      <input type="hidden" name="action" value="credentials">

      <p class="small mute">The new credentials must pass the check before they replace the old ones. Fill the fields for your provider.</p>

      {% if st.url.starts_with("s3://") %}<div class="row">

        <div><label for="sak">Access key ID</label><input type="text" id="sak" name="access_key_id" autocomplete="off" required></div>

        <div><label for="ssk">Secret access key</label><input type="password" id="ssk" name="secret_access_key" autocomplete="new-password" required></div>

      </div>{% else if st.url.starts_with("gs://") %}<label for="ssa">Service account key</label><textarea id="ssa" name="service_account_key" rows="3" required spellcheck="false"></textarea>{% else %}<div class="row">

        <div><label for="stn">Tenant ID</label><input type="text" id="stn" name="tenant_id" autocomplete="off" required></div>

        <div><label for="sci">Client ID</label><input type="text" id="sci" name="client_id" autocomplete="off" required></div>