chadtmiller.com/knotless

Switch repository

Loading…

What changes

An account's private repositories, on its profile, show when they were last pushed to and their sparkline of pushes, as its public ones do, to whoever may see them listed: its owner, and each member proven so. Before, they always read "Created …" with a flat line.

dev.knotless.getActorActivity now sits behind the viewer middleware, as getActorRepos does, and adds to repos the private repositories the asker may read (private_of, the same rule the list follows), their pushes counted from this server's index of their spaces, which already keeps their claims and refs. Such an answer is marked private, no-store. days, the year of weeks, still counts only what the appview index has.

Why

The list reads its pushes by name from getActorActivity, which read only the appview index, where nothing in a space lands. Counting private pushes into days too would make the strip differ by who looks; left out for now.

How it was checked

private_repositories_on_the_pages in tests/gateway.rs now asks the owner's activity as the member, who is answered hidden with its one push, private and kept by no cache, and as no one and an outsider, neither of whom hears of it. Left to CI.

Shortcomings

A private repository's activity shows only once this server's index of its space has synced it, as its listing already does.

The activity change is sound. getActorActivity now sits behind the viewer middleware and adds only the private repositories private_of allows. The new test covers the member, no one, and an outsider. I didn't run anything; the pull states its checks were left to CI.

The pull also carries a second, unrelated commit, be629d5b ("An agent watching an owner finds their private repositories shared with it"). The body doesn't mention it. It adds the repo share invite, knotless-agent --owner discovery of private repositories, a changeset, docs, and a deploy.yml change. Please split it into its own pull, or retitle and rewrite this one to cover both. As it stands, a reader of this pull's description would not know the deploy, the agent and the CLI change with it.

Merging it as is has a concrete risk. deploy.yml drops chadtmiller.com/group-host from KNOTLESS_REVIEW_REPOS and relies on the invite instead. repo share only leaves an invite from now on. The existing share of group-host with review.knotless.dev has no invite at the appview. After the deploy the reviewer would silently stop watching it until someone re-shares. Keep the explicit name until it is re-shared, or say in the pull that it must be.

The unrelated commit is gone. pull_diff now shows only the activity change, with the matching docs and lexicon text, so the title and body describe the pull. That was my earlier request, and the group-host and deploy.yml risk goes with it. The changes between my last review and this head are mostly a merge of the base. Its changes aren't the pull's, and I didn't review them.

The change itself is sound. getActorActivity moves behind the viewer middleware, and private_pushes adds only the repositories private_of allows for that viewer. It filters the spaces index's pushes by those names and leaves days alone. The test covers the member, who gets private, no-store and the one push. It also covers no one and an outsider, who hear nothing of it. I didn't run anything; the pull says its checks were left to CI.