Private artifacts stay private; builds.<name>.publicArtifacts releases chosen paths with CORS (v1.35.0) #114

2026-10-04T19:03:22+02:00

mi commented

2026-10-04 19:03:22 +02:00

A private repository on vm4006 (hs.hsadmin.ng) served every artifact without the control token: the repository is internal in a private organisation, and Werkator asked Gitea with its token and read only the private flag.

Visibility is asked as a visitor (without token); 401/403/404 and a visible private/internal answer mean private. An unclear answer hides the repository (fail closed, retried after a minute). Artifact routes answer 404 instead of 500 for unknown or hidden names.
builds.<name>.publicArtifacts releases chosen artifacts of a private repository: globs over workspace paths like artifactDirs, or true. The paths come from the built commit's own .werkator.yml; only a branch the primary configuration names literally in that definition's trigger.branches publishes.
Released artifacts answer server.corsAllowedOrigins (PR#96) via a Spring CorsFilter, preflight included; nothing else carries a CORS header.

PR-doc: docs/prs/2026-10-04-PR#114-private-artifacts-and-public-paths.md

🤖 Generated with Claude Code

A private repository on vm4006 (hs.hsadmin.ng) served every artifact without the control token: the repository is `internal` in a private organisation, and Werkator asked Gitea with its token and read only the `private` flag. - Visibility is asked as a visitor (without token); 401/403/404 and a visible `private`/`internal` answer mean private. An unclear answer hides the repository (fail closed, retried after a minute). Artifact routes answer 404 instead of 500 for unknown or hidden names. - `builds.<name>.publicArtifacts` releases chosen artifacts of a private repository: globs over workspace paths like `artifactDirs`, or `true`. The paths come from the built commit's own `.werkator.yml`; only a branch the primary configuration names literally in that definition's `trigger.branches` publishes. - Released artifacts answer `server.corsAllowedOrigins` (PR#96) via a Spring `CorsFilter`, preflight included; nothing else carries a CORS header. PR-doc: `docs/prs/2026-10-04-PR#114-private-artifacts-and-public-paths.md` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mi added 5 commits 2026-10-04 19:03:22 +02:00

Ask the forge as a visitor whether a repository is private, fail closed, 404 on artifact routes

werkator build succeeded after 02:09

Details

928b150c8f

hs.hsadmin.ng on vm4006 served every artifact without the control token:
the repository is internal in a private organisation, so the token's
view said private: false. Werkator now asks without the token, treats
401/403/404 and a visible private/internal answer as private, an
unclear answer as private (asked again after a minute), and answers
404 instead of 500 for an unknown or hidden repository on the artifact
routes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Release chosen artifacts of a private repository with builds.<name>.publicArtifacts

werkator build succeeded after 01:57

Details

72f97fb2fa

The released paths are read from the built commit's own .werkator.yml,
so they change with the code; a build releases only when the primary
configuration names its branch literally in the definition's
trigger.branches, so no branch can publish its own artifacts. Every
other path of a private repository keeps answering the 404 of an
unknown repository; pages and the artifact index stay hidden.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Answer CORS for released artifacts, preflight included; publicArtifacts names workspace paths

werkator build succeeded after 02:04

Details

295c07529b

A Spring CorsFilter with a per-request source (ArtifactCors) shares an
artifact with an origin in server.corsAllowedOrigins when everyone may
have it anyway: any artifact of a public repository, a released one of
a private repository. The preflight is answered by the same rule; an
artifact that is not released carries no CORS header, token or not.

publicArtifacts globs are written like artifactDirs (build/reports/...);
ArchivedPaths maps a stored file back to its workspace path by the rule
FileArtifactStore archives with.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Rename to PR#114, the number Gitea gives this pull request 646ee60240

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into claude/werkator-artifact-access-1b476e

werkator build succeeded after 02:13

Details

4ec29f4e34

# Conflicts:
#	build.gradle.kts
#	src/main/resources/templates/releases.html

mi added 2 commits 2026-10-04 19:03:22 +02:00

Rename to PR#114, the number Gitea gives this pull request 646ee60240

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into claude/werkator-artifact-access-1b476e

werkator build succeeded after 02:13

Details

4ec29f4e34

# Conflicts:
#	build.gradle.kts
#	src/main/resources/templates/releases.html

mi added 1 commit 2026-10-04 19:24:56 +02:00

Merge remote-tracking branch 'origin/main' into claude/werkator-artifact-access-1b476e

werkator build succeeded after 02:08

Details

38e881ba80

# Conflicts:
#	build.gradle.kts
#	src/main/resources/templates/releases.html

mi merged commit 1fe92b3586 into main

2026-10-04 20:07:55 +02:00

mi deleted branch claude/werkator-artifact-access-1b476e

2026-10-04 20:07:55 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkator#114