publish: the public projection begins here
This is a projection, not a development branch. The tree above was constructed from the internal source named below under a manifest that decides which paths may leave, then scanned as a whole tree rather than as a series of patches, and only then published. Public history starts here because the history before it was not admissible, and neither was the tree. What used to stand in this repository included a rescue copy of another machine, a directory of phone handoffs, deployment wired to one house, and a submodule pointing at a forge no stranger can reach. None of that was ever the product. It stays in the private forge, which is allowed to hold the whole working organism, and this is what was deliberately sent out instead. Three mechanisms produced this tree, in decreasing order of trust. A top-level path the manifest does not name never arrives at all, which is the one that catches directories nobody has thought of yet. Named internal files inside admitted roots are dropped. A short, reviewed table replaces deployment defaults that a public build must not carry -- an endpoint aimed at one LAN, a VPN profile belonging to one phone, packaging built from one checkout path. Everything after this commit is an ordinary publication with the same three trailers, so a force push stops being routine and starts meaning that something deliberate happened. The trailers bind the projection to its source without pretending the public SHA is the private one: same lineage, different tree, and the record says so. Source-Sha: 8f27b1e76a8fef560a336aba18e6990713ff1047 Policy-Sha: 6b261d2f3e6e1fb19874846ba4bb1dfe15565d25b8618c1c1afba0419c101d27 Tree-Digest: 18ec3563c5e5ef9a414993a9f6734b251ff9ed3cd56eebdd6cac01e45c6e3067
This commit is contained in:
Fimeg
commit
8f42fc953d
1476 changed files with 238455 additions and 0 deletions
199
.gitea/workflows/publish.yml
Normal file
199
.gitea/workflows/publish.yml
Normal file
|
|
@ -0,0 +1,199 @@
|
|||
name: publish
|
||||
|
||||
# The public branch is an output. Nothing here builds or tests the product --
|
||||
# `ci.yml` on `primary` did that against the source this projection was
|
||||
# constructed from. This workflow only carries an already-constructed,
|
||||
# already-gated candidate to the forge that is allowed to serve it, and proves
|
||||
# the forge serves exactly that.
|
||||
#
|
||||
# It lives on the public branch because that is where the push lands, and it is
|
||||
# deliberately the only workflow that does: `ci.yml` stays internal because it
|
||||
# names internal build hosts.
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [public]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
# The gate travels with the tree it judges. A candidate that reaches this
|
||||
# branch has already passed on the source side; running it again here means
|
||||
# the thing actually being published is the thing that was actually checked,
|
||||
# rather than something that resembled it an hour ago.
|
||||
public-surface:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Gate the published tree
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ ! -f .publication/surface_gate.py ]; then
|
||||
echo "::error::the public tree carries no gate; refusing to publish it"
|
||||
exit 1
|
||||
fi
|
||||
# The manifest is private -- its redaction table quotes what it
|
||||
# removes -- so the published tree is checked against the rules the
|
||||
# gate carries, with no exception list available to excuse anything.
|
||||
python3 - <<'PY' > /tmp/bare-manifest.json
|
||||
import json
|
||||
json.dump({
|
||||
"schema_version": 1,
|
||||
"repository": "Fimeg/souveraine",
|
||||
"public_roots": [], "public_root_files": [],
|
||||
"review_required": [], "forbidden": [], "forbidden_classes": [],
|
||||
"exceptions": [{"path": ".publication/*", "rule": r,
|
||||
"reason": "the gate names the patterns it refuses",
|
||||
"reviewed": "2026-09-04"}
|
||||
for r in ("internal-host", "internal-email", "rfc1918",
|
||||
"home-path", "bearer-token", "ai-attribution")],
|
||||
}, open("/dev/stdout", "w"))
|
||||
PY
|
||||
python3 .publication/surface_gate.py \
|
||||
--repo . --sha "$GITHUB_SHA" \
|
||||
--manifest /tmp/bare-manifest.json \
|
||||
--out /tmp/published-surface.md || true
|
||||
cat /tmp/published-surface.md
|
||||
# Tree shape is empty in the bare manifest, so only content, history
|
||||
# and file-class findings can deny here. Those are the ones that must
|
||||
# never reach a public forge.
|
||||
if grep -E '^\| deny \|' /tmp/published-surface.md | grep -vq 'unclassified-root'; then
|
||||
echo "::error::published tree carries content or history findings"
|
||||
exit 1
|
||||
fi
|
||||
echo "published tree carries no content or history findings"
|
||||
|
||||
publish-forge:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [public-surface]
|
||||
env:
|
||||
PUBLIC_FORGE_TOKEN: ${{ secrets.PUBLIC_FORGE_TOKEN }}
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Publish and verify exact SHA
|
||||
run: |
|
||||
set -euo pipefail
|
||||
: "${PUBLIC_FORGE_TOKEN:?PUBLIC_FORGE_TOKEN is required}"
|
||||
expected="${GITHUB_SHA}"
|
||||
forge_url='https://forge.caseytunturi.com/Fimeg/souveraine.git'
|
||||
|
||||
# Ordinary publication is fast-forward only. .publication/EPOCH may
|
||||
# authorise exactly one replacement, and only of the SHA it names, so
|
||||
# the authorisation is spent the moment it is used.
|
||||
lease=""
|
||||
remote_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
|
||||
if [ -n "$remote_sha" ]; then
|
||||
if git cat-file -e "${remote_sha}^{commit}" 2>/dev/null &&
|
||||
git merge-base --is-ancestor "$remote_sha" "$expected"; then
|
||||
:
|
||||
else
|
||||
authorised="$(awk '$1 == "replaces" { print $2 }' .publication/EPOCH 2>/dev/null || true)"
|
||||
if [ -n "$authorised" ] && [ "$authorised" = "$remote_sha" ]; then
|
||||
echo "[publish] epoch authorised to replace $remote_sha"
|
||||
lease="$remote_sha"
|
||||
else
|
||||
echo "[publish] refusing non-fast-forward public history" >&2
|
||||
echo "[publish] remote is $remote_sha; EPOCH authorises ${authorised:-nothing}" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
auth="$(printf 'publisher-souveraine:%s' "$PUBLIC_FORGE_TOKEN" | base64 -w0)"
|
||||
if [ -n "$lease" ]; then
|
||||
git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
|
||||
push --force-with-lease="refs/heads/public:$lease" "$forge_url" HEAD:public
|
||||
else
|
||||
git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
|
||||
push "$forge_url" HEAD:public
|
||||
fi
|
||||
|
||||
forge_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
|
||||
test "$forge_sha" = "$expected"
|
||||
git fetch --force --no-tags "$forge_url" \
|
||||
refs/heads/public:refs/remotes/public-forge/public
|
||||
test "$(git rev-parse refs/remotes/public-forge/public)" = "$forge_sha"
|
||||
echo "[publish] Forgejo anonymously serves exact published SHA: $forge_sha"
|
||||
|
||||
# Downstreams reproduce the anonymously fetched Forgejo ref. A missing
|
||||
# credential or a divergent history is a visible degraded mirror, never a
|
||||
# failure of the canonical publication.
|
||||
mirror-downstreams:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [publish-forge]
|
||||
env:
|
||||
CODEBERG_TOKEN: ${{ secrets.CODEBERG_TOKEN }}
|
||||
MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Mirror downstreams from Forgejo
|
||||
run: |
|
||||
set -euo pipefail
|
||||
expected="${GITHUB_SHA}"
|
||||
forge_url='https://forge.caseytunturi.com/Fimeg/souveraine.git'
|
||||
forge_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
|
||||
test "$forge_sha" = "$expected"
|
||||
git fetch --force --no-tags "$forge_url" \
|
||||
refs/heads/public:refs/remotes/public-forge/public
|
||||
test "$(git rev-parse refs/remotes/public-forge/public)" = "$forge_sha"
|
||||
|
||||
mirror_downstream() {
|
||||
label="$1"; url="$2"; host="$3"; user="$4"; token="$5"
|
||||
|
||||
if [ -z "$token" ]; then
|
||||
echo "::warning::[mirror] $label credential absent; Forgejo is published, $label is degraded"
|
||||
return 0
|
||||
fi
|
||||
if ! remote_sha="$(git ls-remote "$url" refs/heads/public | awk '{print $1}')"; then
|
||||
echo "::warning::[mirror] cannot read $label public ref; Forgejo remains authoritative"
|
||||
return 0
|
||||
fi
|
||||
|
||||
lease=""
|
||||
if [ -n "$remote_sha" ]; then
|
||||
if ! git fetch --force --no-tags "$url" \
|
||||
"refs/heads/public:refs/remotes/mirror-check/$label"; then
|
||||
echo "::warning::[mirror] cannot fetch $label public ref; leaving it unchanged"
|
||||
return 0
|
||||
fi
|
||||
if ! git merge-base --is-ancestor "$remote_sha" "$forge_sha"; then
|
||||
authorised="$(awk '$1 == "replaces" { print $2 }' .publication/EPOCH 2>/dev/null || true)"
|
||||
if [ -n "$authorised" ] && [ "$authorised" = "$remote_sha" ]; then
|
||||
echo "[mirror] $label follows the authorised epoch from $remote_sha"
|
||||
lease="$remote_sha"
|
||||
else
|
||||
echo "::warning::[mirror] refusing non-fast-forward $label history; explicit alignment required"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
auth="$(printf '%s:%s' "$user" "$token" | base64 -w0)"
|
||||
if [ -n "$lease" ]; then
|
||||
if ! git -c "http.https://$host/.extraheader=Authorization: Basic $auth" \
|
||||
push --force-with-lease="refs/heads/public:$lease" \
|
||||
"$url" refs/remotes/public-forge/public:public; then
|
||||
echo "::warning::[mirror] $label epoch push failed; Forgejo remains authoritative"
|
||||
return 0
|
||||
fi
|
||||
elif ! git -c "http.https://$host/.extraheader=Authorization: Basic $auth" \
|
||||
push "$url" refs/remotes/public-forge/public:public; then
|
||||
echo "::warning::[mirror] $label push failed; Forgejo remains authoritative"
|
||||
return 0
|
||||
fi
|
||||
|
||||
mirrored_sha="$(git ls-remote "$url" refs/heads/public | awk '{print $1}')"
|
||||
if [ "$mirrored_sha" != "$forge_sha" ]; then
|
||||
echo "::warning::[mirror] $label SHA mismatch after push; Forgejo remains authoritative"
|
||||
return 0
|
||||
fi
|
||||
echo "[mirror] $label agrees with Forgejo: $forge_sha"
|
||||
}
|
||||
|
||||
mirror_downstream codeberg 'https://codeberg.org/Fimeg/souveraine.git' codeberg.org Fimeg "$CODEBERG_TOKEN"
|
||||
mirror_downstream github 'https://github.com/Fimeg/souveraine.git' github.com Fimeg "$MIRROR_GITHUB_TOKEN"
|
||||
Loading…
Reference in a new issue