mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive-c0re forge-credential chain nothing reads any more

Browse source 
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
This commit is contained in:
atlas 2026-10-29 22:55:31 +01:00
commit 221c3f35a1
1 changed files with 69 additions and 310 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hive-c0re/src/forge/mod.rs
View file

@ -1,5 +1,5 @@
//! The hive's forge access: reads of the forge go through [`reader_token`] on
//! every hive, and [`ensure_all`] publishes that token for nix's `git`. The
//! every hive. The
//! swarm-wide orgs, teams and repos, and each agent's read grant on
//! `internal/docs`, are swarm-controller's. Full design:
//! `docs/integrations/forge.md`.
@ -10,7 +10,7 @@ mod reconcile;
mod repos;
pub(crate) use internal_meta::internal_meta_source;
pub use reader::{publish_nix_credential, reader_token};
pub use reader::reader_token;
pub use reconcile::{fetch_forge_main, reconcile_config_apply, reconcile_config_status};
pub use repos::{clone_config_into_proposed, fetch_config_main_into_applied};
@ -145,16 +145,6 @@ where
.map_err(|_| anyhow::anyhow!("{op}: no answer from the forge within {API_TIMEOUT:?}"))
}
/// Publish this hive's forge read token for nix's `git` at startup, so a build
/// that starts before any `internal/meta` read still has a credential. Every
/// hive runs it: the token is the hive's own, in the store, whether or not a
/// forge container is local.
pub async fn ensure_all() {
if publish_nix_credential().await {
tracing::debug!("forge: nix's forge credential is current");
}
}
#[cfg(test)]
mod tests {
use super::{API_TIMEOUT, bounded, git_url_with_base};