Added worktree-layered build config: resolves .gittally.yml from the worktree for per-branch build settings, with precedence worktree > .git > project; pinned secrets, server-side keys, and sandbox policy to .git.

2026-07-09 09:20:34 +02:00
parent 095e6fa44f
commit fb6d4501b9
7 changed files with 209 additions and 17 deletions
@@ -138,7 +138,7 @@ class FileArtifactStore(
            log.warn("build {} has no workspace; storing only its logs", build.artifactKey)
            return
        }
-        for (artifactDir in branchConfig(build.branch).artifactDirs) {
+        for (artifactDir in branchConfig(build.branch, workspace).artifactDirs) {
            if (artifactDir.isBlank()) {
                continue
            }
@@ -159,8 +159,12 @@ class FileArtifactStore(
            "reports/$artifactDir"
        }

-    private fun branchConfig(branch: String): BranchConfig {
-        val branches = configLoader.load(workingDir).branches
+    /** The build config for [branch], with the build [workspace]'s `.gittally.yml` layered on top (see [ConfigLoader.loadForWorktree]). */
+    private fun branchConfig(
+        branch: String,
+        workspace: Path,
+    ): BranchConfig {
+        val branches = configLoader.loadForWorktree(workingDir, workspace).branches
        return branches[branch] ?: branches["default"] ?: BranchConfig()
    }

@@ -178,7 +178,7 @@ class BuildExecutor(
        build: ActiveBuild,
        workspace: Path,
    ): Int {
-        val branchConfig = branchConfig(build.runningBuild.branch, build.workingDir)
+        val branchConfig = branchConfig(build.runningBuild.branch, build.workingDir, workspace)
        val stagingDir = build.runningBuild.stagingDir
        Files.newOutputStream(stagingDir.resolve(branchConfig.stdoutLog)).use { stdoutLog ->
            Files.newOutputStream(stagingDir.resolve(branchConfig.stderrLog)).use { stderrLog ->
@@ -366,11 +366,13 @@ class BuildExecutor(
        }
    }

+    /** The build config for [branch], with the build [worktree]'s `.gittally.yml` layered on top (see [ConfigLoader.loadForWorktree]). */
    private fun branchConfig(
        branch: String,
        workingDir: Path,
+        worktree: Path,
    ): BranchConfig {
-        val branches = configLoader.load(workingDir).branches
+        val branches = configLoader.loadForWorktree(workingDir, worktree).branches
        return branches[branch] ?: branches["default"] ?: BranchConfig()
    }

@@ -19,8 +19,33 @@ class ConfigLoader {
            .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
            .configure(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS, false)

-    fun load(workingDir: Path = Paths.get(".")): GitTallyConfig {
-        val raw = loadRaw(workingDir)
+    fun load(workingDir: Path = Paths.get(".")): GitTallyConfig = toConfig(loadRaw(workingDir))
+
+    /**
+     * Config for building a branch in [worktreeDir]: the worktree's `.gittally.yml`
+     * (the committed config of the branch being built) overrides the primary/`.git`
+     * config, giving the precedence worktree > `.git` > project. So a branch controls
+     * its own build settings (`buildCommand`, `cleanCommand`, `artifactDirs`,
+     * `docker.image`/`env`, …).
+     *
+     * The [pinned][stripPinned] keys are the exception: secrets (`git`), `gitea`/`server`
+     * settings, and the docker sandbox policy (`docker.enabled`/`docker.network`) always
+     * come from `.git`/primary — a branch must never be able to disable its own container,
+     * change its network mode, or reach the credentials. They are stripped from the
+     * worktree layer before it is merged, so a worktree cannot set them at all.
+     *
+     * With no worktree `.gittally.yml` this is identical to [load].
+     */
+    fun loadForWorktree(
+        workingDir: Path,
+        worktreeDir: Path,
+    ): GitTallyConfig {
+        val primary = loadRaw(workingDir)
+        val worktree = stripPinned(loadFile(worktreeDir.resolve(".gittally.yml").toFile()))
+        return toConfig(deepMerge(primary, worktree))
+    }
+
+    private fun toConfig(raw: Map<String, Any?>): GitTallyConfig {
        val config =
            if (raw.isEmpty()) {
                GitTallyConfig()
@@ -30,6 +55,32 @@ class ConfigLoader {
        return defaultPublicBaseUrl(config)
    }

+    /**
+     * Removes the keys a build worktree must never override: the secret/server-side
+     * top-level sections and the per-branch docker sandbox policy. See [loadForWorktree].
+     */
+    @Suppress("UNCHECKED_CAST")
+    private fun stripPinned(worktree: Map<String, Any?>): Map<String, Any?> {
+        if (worktree.isEmpty()) {
+            return worktree
+        }
+        val result = worktree.toMutableMap()
+        PINNED_TOP_LEVEL_KEYS.forEach { result.remove(it) }
+        val branches = result["branches"] as? Map<String, Any?>
+        if (branches != null) {
+            result["branches"] =
+                branches.mapValues { (_, value) ->
+                    val branch = value as? Map<String, Any?> ?: return@mapValues value
+                    val docker = branch["docker"] as? Map<String, Any?> ?: return@mapValues branch
+                    val strippedDocker = docker.toMutableMap().apply { PINNED_DOCKER_KEYS.forEach { remove(it) } }
+                    branch.toMutableMap().apply {
+                        if (strippedDocker.isEmpty()) remove("docker") else put("docker", strippedDocker)
+                    }
+                }
+        }
+        return result
+    }
+
    /** Legacy default: an empty `server.publicBaseUrl` becomes `https://<nginx.serverName>/`. */
    private fun defaultPublicBaseUrl(config: GitTallyConfig): GitTallyConfig {
        if (config.server.publicBaseUrl.isNotBlank() ||
@@ -88,4 +139,12 @@ class ConfigLoader {
        }
        return result
    }
+
+    companion object {
+        /** Top-level sections a build worktree must never override: secrets and server-side settings. */
+        private val PINNED_TOP_LEVEL_KEYS = setOf("git", "gitea", "server")
+
+        /** Per-branch `docker` keys the worktree must never override: the sandbox policy. */
+        private val PINNED_DOCKER_KEYS = setOf("enabled", "network")
+    }
 }