A build definition says when it runs in a trigger block of its own

`onPush`, `atTimes`, `branches`, and `activeWithin` move into a nested `trigger`. The split is structural on purpose: the inheritance from `builds.default` now subtracts one key instead of a list of four, so a selector added to `TriggerConfig` later is non-inheritable by construction rather than because someone remembered to extend the list. A definition still writing those keys flat is refused by name, per file and scoped like the version check — the machine and project config abort the start, a branch's committed config fails only that branch. Ignoring them would leave the build with no trigger at all, which is a job that quietly stops running: the failure this refusal exists to prevent. Two more things a definition can now say: - A `!` prefix in `trigger.branches` excludes, and an exclusion wins whatever the order. `["*", "!master"]` gives one branch a build of its own without the default build running over it as well — until now the only way out of that double build was to drop the second definition's push trigger. - `statusContext` overrides the Gitea check this build reports as, empty keeping the repository-wide one. Two builds of a commit shared a context and overwrote each other's result, so a quick check beside a long build was not readable in Gitea. Pinned like `requirePullRequest`: a branch that could pick its context could take over the check a branch protection rule depends on. Fixed on the way: a branch whose builds all belong to named definitions rendered an empty row in the branches view, reading as "never built" directly beside its real builds. That row was unreachable before the exclusion patterns made such a branch possible.
2026-08-29 12:05:10 +02:00
parent 0fbb25b47f
commit f0f996a53c
22 changed files with 486 additions and 178 deletions
@@ -1,6 +1,6 @@
 package de.hoennig.gittally

-import de.hoennig.gittally.config.ConfigVersionException
+import de.hoennig.gittally.config.ConfigException
 import org.springframework.boot.CommandLineRunner
 import org.springframework.boot.ExitCodeGenerator
 import org.springframework.boot.SpringApplication
@@ -31,7 +31,7 @@ class CliRunner(
                .setExecutionExceptionHandler { exception, commandLine, _ ->
                    // a config GitTally must not read is a stated fact, not a crash: the message
                    // names the file, the versions, and the way out — a stack trace would bury it
-                    if (exception is ConfigVersionException) {
+                    if (exception is ConfigException) {
                        commandLine.err.println("Error: ${exception.message}")
                        CONFIG_ERROR_EXIT_CODE
                    } else {
@@ -396,12 +396,27 @@ class BuildExecutor(
                description = description(status, duration),
                targetUrl = null,
                workingDir = build.workingDir,
+                // from the primary config, not the worktree: statusContext is pinned, so a
+                // branch cannot report under a check name it was not given
+                context = statusContextOf(build),
            )
        } catch (e: Exception) {
            log.warn("could not publish Gitea status {} for {}: {}", status, build.runningBuild.commit, e.message)
        }
    }

+    /** The build's own Gitea status context, empty when it uses the repository-wide one. */
+    private fun statusContextOf(build: ActiveBuild): String =
+        try {
+            configLoader
+                .load(build.workingDir)
+                .buildSettings(build.runningBuild.branch, build.runningBuild.build)
+                .statusContext
+        } catch (e: Exception) {
+            log.warn("could not resolve the status context of {}: {}", build.runningBuild.branch, e.message)
+            ""
+        }
+
    private fun description(
        status: BuildStatus,
        duration: Duration?,
@@ -182,7 +182,13 @@ class InitCommand(
            # they apply to that branch alone, so a new job can be tried out on one branch.
            builds:
              default:
-                onPush: true            # build every new commit of the selected branches
+                # When this build runs and for which branches. The only part a build does
+                # NOT inherit from the default — everything below it does.
+                trigger:
+                  onPush: true          # build every new commit of the selected branches
+                  # branches: ["*", "!master"]   # names or globs; "!" excludes; default: all
+                  # atTimes: ["01:00"]           # daily UTC times HH:MM ("??:05" = every hour at :05)
+                  # activeWithin: 24h            # only branches with recent commits
                # run before each build
                cleanCommand: rm -rf build
                # shell command for each build
@@ -203,12 +209,16 @@ class InitCommand(
                  context: "."          # Docker build context used with dockerfile
                  network: ""           # Docker network mode for the build container; empty = Docker default (pinned)
                  env: {}               # additional environment variables set inside the build container
-              # Further jobs inherit those settings and add their own trigger and selector:
+                # Gitea check this build reports as; empty uses gitea.statusContext.
+                # Two builds of one commit under the same context overwrite each other.
+                statusContext: ""
+              # Further jobs inherit those settings and only bring their own trigger:
              # pitest:
-              #   atTimes: ["01:00"]           # daily UTC times HH:MM ("??:05" = every hour at :05)
-              #   branches: ["master"]         # names or glob patterns; default: all branches
-              #   activeWithin: 24h            # only branches with recent commits
+              #   trigger:
+              #     atTimes: ["01:00"]
+              #     branches: ["master"]
              #   buildCommand: ./gradlew pitestFull
+              #   statusContext: GitTally/pitest

            # Build artifact storage and retention.
            artifacts:
@@ -8,16 +8,82 @@ import java.time.Instant
 * top-level `builds` section next to the reserved execution key `maxConcurrent`
 * (split apart by [ConfigLoader]).
 *
- * A definition carries the complete description of one build. The `default` entry is
- * additionally the base every other definition inherits its settings from — but never
- * its trigger, see [SELECTOR_KEYS][ConfigLoader]. Unset values fall through to the
- * [BranchConfig] defaults.
- *
- * The `default` build records its results under the plain branch name; every other
- * build records under `<branch>@<name>` with its own history, retention pool, and
- * permanent latest-green link.
+ * A definition describes one build completely, in two halves: [trigger] says when it
+ * runs and for which branches, everything else says what it does. The `default` entry
+ * is additionally the base every other definition inherits from — its settings, never
+ * its [trigger]. That is why the halves are separated structurally instead of by a list
+ * of key names: a selector added to [TriggerConfig] later is non-inheritable by
+ * construction, not because someone remembered to extend a list.
 */
 data class BuildDefinition(
+    /** When and for which branches this build runs; never inherited from `builds.default`. */
+    val trigger: TriggerConfig = TriggerConfig(),
+    /** Overrides the build command; null inherits it. */
+    val buildCommand: String? = null,
+    /** Overrides the clean command; null inherits it. */
+    val cleanCommand: String? = null,
+    /** Overrides the artifact directories; null inherits them. */
+    val artifactDirs: List<String>? = null,
+    /** Overrides the stdout log file name; null inherits it. */
+    val stdoutLog: String? = null,
+    /** Overrides the stderr log file name; null inherits it. */
+    val stderrLog: String? = null,
+    /**
+     * The watcher builds a selected branch only while its head commit matches a
+     * pull-request head; null inherits. Pinned — a branch's own committed config can
+     * never set it, or it would bypass its own gate.
+     */
+    val requirePullRequest: Boolean? = null,
+    /**
+     * Gitea commit status context of this build; null uses `gitea.statusContext`.
+     * Two builds of the same commit under the same context overwrite each other's
+     * result, so a second build over a branch needs its own context to be readable.
+     */
+    val statusContext: String? = null,
+    /** Overrides of the docker settings; null inherits them. */
+    val docker: DockerOverrides? = null,
+) {
+    /** The settings this build runs with: [branchConfig] with this definition applied; unset values fall through. */
+    fun applyTo(branchConfig: BranchConfig): BranchConfig =
+        branchConfig.copy(
+            buildCommand = buildCommand ?: branchConfig.buildCommand,
+            cleanCommand = cleanCommand ?: branchConfig.cleanCommand,
+            artifactDirs = artifactDirs ?: branchConfig.artifactDirs,
+            stdoutLog = stdoutLog ?: branchConfig.stdoutLog,
+            stderrLog = stderrLog ?: branchConfig.stderrLog,
+            requirePullRequest = requirePullRequest ?: branchConfig.requirePullRequest,
+            statusContext = statusContext ?: branchConfig.statusContext,
+            docker =
+                branchConfig.docker.copy(
+                    enabled = docker?.enabled ?: branchConfig.docker.enabled,
+                    image = docker?.image ?: branchConfig.docker.image,
+                    dockerfile = docker?.dockerfile ?: branchConfig.docker.dockerfile,
+                    context = docker?.context ?: branchConfig.docker.context,
+                    network = docker?.network ?: branchConfig.docker.network,
+                    env = docker?.env ?: branchConfig.docker.env,
+                ),
+        )
+
+    companion object {
+        /** Name of the implicit build that preserves the pre-ADR-0007 behavior: `onPush` over all branches. */
+        const val DEFAULT = "default"
+
+        /** The result-pool name of [build] on [branch]: the plain branch for the default build. */
+        fun poolName(
+            branch: String,
+            build: String,
+        ): String = if (build == DEFAULT) branch else "$branch@$build"
+    }
+}
+
+/**
+ * When a build runs and for which branches — the `trigger` block of a build definition,
+ * and the one part of it that is never inherited from `builds.default`.
+ *
+ * A definition with neither [onPush] nor [atTimes] never triggers automatically; that is
+ * how `builds.default` is written when it is meant as a settings base only.
+ */
+data class TriggerConfig(
    /** Build every new commit of the selected branches. */
    val onPush: Boolean = false,
    /**
@@ -28,7 +94,8 @@ data class BuildDefinition(
    val atTimes: List<String> = emptyList(),
    /**
     * Branch names or glob patterns (`*` matches any characters, also across `/`);
-     * empty selects all origin branches.
+     * empty selects all origin branches. A pattern prefixed with `!` excludes instead,
+     * and an exclusion always wins — `["*", "!master"]` is every branch but master.
     */
    val branches: List<String> = emptyList(),
    /**
@@ -36,27 +103,15 @@ data class BuildDefinition(
     * empty applies no age filter. Combines with [branches] as an intersection.
     */
    val activeWithin: String = "",
-    /** Overrides the branch's build command; null inherits it. */
-    val buildCommand: String? = null,
-    /** Overrides the branch's clean command; null inherits it. */
-    val cleanCommand: String? = null,
-    /** Overrides the branch's artifact directories; null inherits them. */
-    val artifactDirs: List<String>? = null,
-    /** Overrides the branch's stdout log file name; null inherits it. */
-    val stdoutLog: String? = null,
-    /** Overrides the branch's stderr log file name; null inherits it. */
-    val stderrLog: String? = null,
-    /**
-     * The watcher builds a selected branch only while its head commit matches a
-     * pull-request head; null inherits. Pinned — a branch's own committed config can
-     * never set it, or it would bypass its own gate.
-     */
-    val requirePullRequest: Boolean? = null,
-    /** Overrides of the branch's docker settings; null inherits them. */
-    val docker: DockerOverrides? = null,
 ) {
-    /** True when [branch] matches the [branches] patterns (or none are configured). */
-    fun selectsByName(branch: String): Boolean = branches.isEmpty() || branches.any { globToRegex(it).matches(branch) }
+    /** True when [branch] matches the [branches] patterns (or none are configured) and none excludes it. */
+    fun selectsByName(branch: String): Boolean {
+        val (excluding, including) = branches.partition { it.startsWith(EXCLUDE_PREFIX) }
+        if (excluding.any { globToRegex(it.removePrefix(EXCLUDE_PREFIX)).matches(branch) }) {
+            return false
+        }
+        return including.isEmpty() || including.any { globToRegex(it).matches(branch) }
+    }

    /**
     * True when [branch] passes both selector parts; [headCommittedAt] is the branch
@@ -80,35 +135,9 @@ data class BuildDefinition(

    fun maxAge(): Duration = DurationParser.parse(activeWithin)

-    /** The branch settings with this build's overrides applied; unset values fall through. */
-    fun applyTo(branchConfig: BranchConfig): BranchConfig =
-        branchConfig.copy(
-            buildCommand = buildCommand ?: branchConfig.buildCommand,
-            cleanCommand = cleanCommand ?: branchConfig.cleanCommand,
-            artifactDirs = artifactDirs ?: branchConfig.artifactDirs,
-            stdoutLog = stdoutLog ?: branchConfig.stdoutLog,
-            stderrLog = stderrLog ?: branchConfig.stderrLog,
-            requirePullRequest = requirePullRequest ?: branchConfig.requirePullRequest,
-            docker =
-                branchConfig.docker.copy(
-                    enabled = docker?.enabled ?: branchConfig.docker.enabled,
-                    image = docker?.image ?: branchConfig.docker.image,
-                    dockerfile = docker?.dockerfile ?: branchConfig.docker.dockerfile,
-                    context = docker?.context ?: branchConfig.docker.context,
-                    network = docker?.network ?: branchConfig.docker.network,
-                    env = docker?.env ?: branchConfig.docker.env,
-                ),
-        )
-
    companion object {
-        /** Name of the implicit build that preserves the pre-ADR-0007 behavior: `onPush` over all branches. */
-        const val DEFAULT = "default"
-
-        /** The result-pool name of [build] on [branch]: the plain branch for the default build. */
-        fun poolName(
-            branch: String,
-            build: String,
-        ): String = if (build == DEFAULT) branch else "$branch@$build"
+        /** Marks a [branches] pattern as excluding. */
+        const val EXCLUDE_PREFIX = "!"

        private fun globToRegex(pattern: String): Regex =
            Regex(
@@ -79,6 +79,7 @@ class ConfigLoader(
        // scoped to this branch: an incompatible branch config fails its own builds and
        // must never stop the server or hold up the branches that are fine
        checkVersion(branchLayer, "the committed .gittally.yml of this branch", BRANCH_HINT)
+        checkTriggerBlocks(branchLayer, "the committed .gittally.yml of this branch", BRANCH_HINT)
        return toConfig(deepMerge(loadRaw(workingDir), stripPinned(branchLayer)))
    }

@@ -200,8 +201,34 @@ class ConfigLoader(
    }

    private fun isTriggered(definition: Any?): Boolean {
-        val entry = definition as? Map<*, *> ?: return false
-        return entry["onPush"] == true || (entry["atTimes"] as? List<*>)?.isNotEmpty() == true
+        val trigger = (definition as? Map<*, *>)?.get("trigger") as? Map<*, *> ?: return false
+        return trigger["onPush"] == true || (trigger["atTimes"] as? List<*>)?.isNotEmpty() == true
+    }
+
+    /**
+     * Refuses a definition that still writes its trigger and selector keys flat instead of
+     * inside `trigger`. Silently ignoring them would leave a build with no trigger at all —
+     * a branch that stops building without saying so, which is worse than not starting.
+     * Scoped like [checkVersion]: per file, so the message names the one to fix.
+     */
+    private fun checkTriggerBlocks(
+        raw: Map<String, Any?>,
+        source: String,
+        hint: String,
+    ) {
+        val builds = raw["builds"] as? Map<*, *> ?: return
+        val offenders =
+            builds.entries.mapNotNull { (name, value) ->
+                val flat = (value as? Map<*, *>)?.keys?.filter { it in FLAT_TRIGGER_KEYS } ?: return@mapNotNull null
+                flat.takeIf { it.isNotEmpty() }?.let { "builds.$name: ${it.joinToString(", ")}" }
+            }
+        if (offenders.isEmpty()) {
+            return
+        }
+        throw ConfigFormatException(
+            "$source declares a build trigger outside its trigger block (${offenders.joinToString("; ")}). " +
+                "Move these keys into a `trigger:` block inside the definition. $hint",
+        )
    }

    /**
@@ -213,7 +240,7 @@ class ConfigLoader(
    @Suppress("UNCHECKED_CAST")
    private fun mergeBuildDefaults(raw: Map<String, Any?>): Map<String, Any?> {
        val builds = raw["builds"] as? Map<String, Any?> ?: return raw
-        val base = (builds[BuildDefinition.DEFAULT] as? Map<String, Any?>)?.minus(SELECTOR_KEYS) ?: return raw
+        val base = (builds[BuildDefinition.DEFAULT] as? Map<String, Any?>)?.minus(TRIGGER_KEYS) ?: return raw
        if (base.isEmpty()) {
            return raw
        }
@@ -245,6 +272,8 @@ class ConfigLoader(
        // per file, so the message names the file to fix — the merged map has no provenance
        checkVersion(project, ".gittally.yml", ROLLBACK_HINT)
        checkVersion(repoInstall, ".git/gittally/.gittally.yml", ROLLBACK_HINT)
+        checkTriggerBlocks(project, ".gittally.yml", ROLLBACK_HINT)
+        checkTriggerBlocks(repoInstall, ".git/gittally/.gittally.yml", ROLLBACK_HINT)
        return deepMerge(project, repoInstall)
    }

@@ -348,15 +377,25 @@ class ConfigLoader(
        /**
         * Settings keys a branch must never override, in a build definition as well as in
         * a legacy branch entry: the trust gate that decides whether the watcher builds
-         * this branch at all.
+         * this branch at all, and the Gitea check this build reports as — a branch that
+         * could choose its own context could take over the check a branch protection
+         * rule depends on.
         */
-        private val PINNED_SETTING_KEYS = setOf("requirePullRequest")
+        private val PINNED_SETTING_KEYS = setOf("requirePullRequest", "statusContext")

        /** `docker` keys a branch must never override: the sandbox policy. */
        private val PINNED_DOCKER_KEYS = setOf("enabled", "network")

-        /** Keys of a build definition that say *when* it runs; never inherited from `builds.default`. */
-        private val SELECTOR_KEYS = setOf("onPush", "atTimes", "branches", "activeWithin")
+        /**
+         * The one key of a build definition that says *when* and *for which branches* it
+         * runs; never inherited from `builds.default`. A single key on purpose: a selector
+         * added inside it is non-inheritable by construction, where a list of key names
+         * would have to be remembered.
+         */
+        private val TRIGGER_KEYS = setOf("trigger")
+
+        /** The keys that moved into [TRIGGER_KEYS]; still writing them flat is refused, not ignored. */
+        private val FLAT_TRIGGER_KEYS = setOf("onPush", "atTimes", "branches", "activeWithin")

        private const val LEGACY_BRANCHES_WARNING = "legacy-branches-ignored"

@@ -44,10 +44,23 @@ sealed interface VersionVerdict {
 }

 /** A configuration file this GitTally must not read; carries the file's name in its message. */
-class ConfigVersionException(
+open class ConfigException(
    message: String,
 ) : RuntimeException(message)

+/** The file declares a GitTally that cannot read it, see [ConfigVersions]. */
+class ConfigVersionException(
+    message: String,
+) : ConfigException(message)
+
+/**
+ * The file is written in a shape this GitTally no longer reads. Refusing it is the point:
+ * a key that moved and is silently ignored means a build that quietly stops happening.
+ */
+class ConfigFormatException(
+    message: String,
+) : ConfigException(message)
+
 object ConfigVersions {
    /**
     * The version in which the configuration format last changed incompatibly — a file
@@ -22,7 +22,7 @@ data class GitTallyConfig(
 ) {
    /** The configured [buildDefinitions] plus the implicit `default` build unless overridden. */
    fun effectiveBuildDefinitions(): Map<String, BuildDefinition> =
-        mapOf(BuildDefinition.DEFAULT to BuildDefinition(onPush = true)) + buildDefinitions
+        mapOf(BuildDefinition.DEFAULT to BuildDefinition(trigger = TriggerConfig(onPush = true))) + buildDefinitions

    /**
     * The settings one build of [build] on [branch] runs with: the branch entry (falling
@@ -153,6 +153,8 @@ data class BranchConfig(
     * head (`refs/pull/<n>/head` on origin); manual `build` commands are not affected.
     */
    val requirePullRequest: Boolean = false,
+    /** Gitea commit status context of this build; empty uses `gitea.statusContext`. */
+    val statusContext: String = "",
    val autoBuild: AutoBuildConfig = AutoBuildConfig(),
    val docker: DockerConfig = DockerConfig(),
 )
@@ -56,13 +56,19 @@ class GiteaClient(

    fun isEnabled(workingDir: Path = Paths.get(".")): Boolean = isEnabled(configLoader.load(workingDir))

-    /** Publishes a commit status for [sha]; returns false when disabled or the request failed. */
+    /**
+     * Publishes a commit status for [sha]; returns false when disabled or the request failed.
+     * [context] is the build's own status context (`builds.<name>.statusContext`); blank or
+     * null uses the repository-wide `gitea.statusContext`. Two builds of one commit sharing
+     * a context overwrite each other's result, which is what a per-build context avoids.
+     */
    fun publishStatus(
        sha: String,
        status: BuildStatus,
        description: String,
        targetUrl: String? = null,
        workingDir: Path = Paths.get("."),
+        context: String? = null,
    ): Boolean {
        val config = configLoader.load(workingDir)
        if (!isEnabled(config)) {
@@ -71,7 +77,7 @@ class GiteaClient(
        }
        val body = mutableMapOf<String, String>()
        body["state"] = status.toGiteaState()
-        body["context"] = config.gitea.statusContext
+        body["context"] = context?.takeIf { it.isNotBlank() } ?: config.gitea.statusContext
        body["description"] = description
        if (!targetUrl.isNullOrBlank()) {
            body["target_url"] = targetUrl
@@ -22,16 +22,25 @@ class BranchListing(
 ) {
    fun branches(workingDir: Path = Paths.get(".")): List<BranchDto> {
        val heads = gitService.originBranchHeads(workingDir)
+        val namedResults = repository.latestPerName().filter { it.name != it.branch && it.branch in heads }
+        val branchesWithNamedPool = namedResults.map { it.branch }.toSet()
        val branchRows =
-            heads.map { (branch, headCommit) ->
-                // latestFor groups by build name, so a named slot's results never shadow the branch row
-                BranchDto.from(branch, headCommit, repository.latestFor(branch))
-            }
+            heads
+                .mapNotNull { (branch, headCommit) ->
+                    // latestFor groups by build name, so a named slot's results never shadow the branch row
+                    val latest = repository.latestFor(branch)
+                    // A branch whose builds all belong to named definitions has no default pool,
+                    // and an empty row for it would read as "never built" next to its real ones.
+                    // Without any build at all the row stays: that a branch is known and idle is
+                    // exactly what it says then.
+                    if (latest == null && branch in branchesWithNamedPool) {
+                        null
+                    } else {
+                        BranchDto.from(branch, headCommit, latest)
+                    }
+                }
        val namedRows =
-            repository
-                .latestPerName()
-                .filter { it.name != it.branch && it.branch in heads }
-                .map { latest -> BranchDto.from(latest.branch, latest.commit, latest, name = latest.name) }
+            namedResults.map { latest -> BranchDto.from(latest.branch, latest.commit, latest, name = latest.name) }
        return (branchRows + namedRows)
            .sortedWith(compareBy({ sortGroup(it.branch) }, { it.branch }, { it.name }))
            .map { row ->
@@ -208,7 +208,7 @@ class Watcher(
            gitService.newOriginBranches(DurationParser.parse(config.watcher.newBranchMaxAge), workingDir)
        val changed = (changedLocal + newOrigin).distinct()
        for (branch in changed) {
-            val onPush = definitionsFor(branch, heads[branch], workingDir, config).filterValues { it.onPush }
+            val onPush = definitionsFor(branch, heads[branch], workingDir, config).filterValues { it.trigger.onPush }
            for ((buildName, definition) in onPush) {
                if (selects(definition, branch, headCommitTimes)) {
                    startBuildIfDue(branch, allowSameCommit = false, config, pullRequestHeads, workingDir, buildName)
@@ -270,7 +270,7 @@ class Watcher(
        definition: BuildDefinition,
        branch: String,
        headCommitTimes: Lazy<Map<String, Instant>>,
-    ): Boolean = definition.selects(branch, { headCommitTimes.value[branch] }, clock.instant())
+    ): Boolean = definition.trigger.selects(branch, { headCommitTimes.value[branch] }, clock.instant())

    /**
     * Enqueues a build of the branch's origin head unless one is already pending or
@@ -331,12 +331,14 @@ class Watcher(
        val timeOfDay = LocalTime.ofInstant(now, ZoneOffset.UTC)
        for (branch in originBranches) {
            val scheduled =
-                definitionsFor(branch, heads[branch], workingDir, config).filterValues { it.atTimes.isNotEmpty() }
+                definitionsFor(branch, heads[branch], workingDir, config).filterValues {
+                    it.trigger.atTimes.isNotEmpty()
+                }
            for ((buildName, definition) in scheduled) {
                if (!selects(definition, branch, headCommitTimes)) {
                    continue
                }
-                val slot = AutoBuildSlots.latestDueSlot(definition.atTimes, timeOfDay) ?: continue
+                val slot = AutoBuildSlots.latestDueSlot(definition.trigger.atTimes, timeOfDay) ?: continue
                val pool = BuildDefinition.poolName(branch, buildName)
                if (autoBuildState.value.isTriggered(pool, today, slot)) {
                    continue
@@ -7,6 +7,29 @@
    <div th:replace="~{fragments :: nav(${view})}"></div>
    <div class="panel release-notes">

+        <h2>v0.9.20 <span class="muted">— 2026-08-29</span></h2>
+        <ul>
+            <li>A build definition is now split in two: a <code>trigger</code> block says when the
+                build runs and for which branches (<code>onPush</code>, <code>atTimes</code>,
+                <code>branches</code>, <code>activeWithin</code>), everything beside it says what
+                the build does. Only the second half is inherited from <code>builds.default</code>,
+                and making that structural means a selector added later cannot become inheritable
+                by accident. A definition still writing those keys flat is refused by name — a
+                trigger nobody reads any more is a build that silently stops running.</li>
+            <li>A branch pattern prefixed with <code>!</code> excludes instead of selecting, and an
+                exclusion wins whatever the order: <code>branches: ["*", "!master"]</code> is every
+                branch but master. That lets one branch have a build of its own without being built
+                by the default one as well — previously the only way to avoid the double build was
+                to give up the second definition's push trigger.</li>
+            <li>A build may report under its own Gitea check with <code>statusContext</code>; empty
+                keeps the repository-wide <code>gitea.statusContext</code>. Two builds of one commit
+                used to overwrite each other's result there, so a second build over the same branch
+                — a quick check next to a long one — was not readable in Gitea.</li>
+            <li><strong>Fixed:</strong> a branch whose builds all belong to named definitions showed
+                an empty row in the branches view, reading as "never built" right next to its actual
+                builds.</li>
+        </ul>
+
        <h2>v0.9.19 <span class="muted">— 2026-08-29</span></h2>
        <ul>
            <li>A build definition now describes its build completely: <code>requirePullRequest</code>