mhoennigandClaude
dea6770998
Works off the security audit in docs/prs/2026-07-08-PR#000: TODO 1, 8, 9 and 10, the four items that need no design decision. New `SecretFiles` creates files holding secrets with mode 0600 and their directories with 0700 *at creation*, as a file attribute, instead of writing at the umask default and chmod-ing afterwards — that left a window in which the Gitea token was world-readable, which matters on a multi-tenant host. It is used by `init` for .git/gittally/.gittally.yml and by `ControlTokenService` for the control token; the shell setup script now writes its YAML in a `umask 077` subshell for the same reason. `ControlTokenService.matches` hashes both sides with SHA-256 before `MessageDigest.isEqual`, so the comparison always runs over two 32-byte buffers and cannot return early on a length mismatch. `GitService.checkout` and `fetchBranch` pass `--` before the refname, so a branch named like an option cannot be read as one. `resetHardToOrigin` keeps its plain form: `git reset --hard -- <commit>` is rejected outright and its argument is already `origin/`-prefixed. Co-Authored-By: Claude <noreply@anthropic.com>
GitTally
Lightweight, declarative and highly opinionated software build system (CI/CD).
Documentation
- docs/configuration.md — configuration reference
- docs/bootstrapping.md — initializing a repository with
init - docs/deployment.md — running GitTally as a systemd service behind a reverse proxy
- docs/migration-from-legacy.md — migrating from the legacy bash script
Legacy Script
legacy/gitTally (bash) is deprecated and kept only as a behavioral reference for the rewrite.
Do not use it for new installations; see docs/migration-from-legacy.md.
Developer Setup
Source .envrc to add tools/ to your PATH, or install direnv to have this done automatically on cd:
source .envrc
Common tasks:
./gradlew build # compile and run all checks
./gradlew test # run tests
./gradlew ktlintFormat # auto-format Kotlin sources
./gradlew ktlintCheck # check formatting (also runs as part of build)
adr-status # show all architecture decisions at a glance
direnv
direnv sources .envrc automatically whenever you enter the repository and unloads it when you leave.
# Ubuntu
sudo apt install direnv
# add to ~/.bashrc or ~/.zshrc
eval "$(direnv hook bash)" # or: eval "$(direnv hook zsh)"
Trust the project's .envrc once per clone:
direnv allow
Tools (tools/)
| Command | Description |
|---|---|
adr-status |
List all Architecture Decision Records with their status and decision summary |
Architecture Decision Records
Major technical decisions are documented as ADRs in docs/adrs/.
adr-status # show all decisions at a glance
New ADRs follow the template at docs/adrs/0000-00-00.adr-template.md.