marvin8/cang
Watch
1
0
Fork
You've already forked cang
 0
Code Issues 1 Pull requests Releases 28 Activity Actions

Point repo at forge.marvin8.zone after migration #130

Manually merged
marvin8 merged 12 commits from maint/issue-129-forge-migration-updates into main 2026-08-04 08:24:44 +00:00
Conversation 3 Commits 12 Files changed 20 +483 -530
agent-pi commented 2026-08-04 07:37:10 +00:00
Collaborator
Copy link

Summary

Post-migration housekeeping after the move from codeberg.org/MinimalNVR/cang to forge.marvin8.zone/marvin8/cang.

  • Weekly checks workflow now runs on the suanni runner (regular CI stays on zhuiri)
  • deploy-docs job pushes the pages branch to forge.marvin8.zone instead of codeberg.org
  • OCI labels/annotations (Containerfile, ci.yml, test-publish-container.yml, justfile) point at the new forge
  • Docs, README CI badge, pyproject project URLs, mkdocs.yml, AGENTS.md updated; container image references now use registry.marvin8.zone/marvin8/cang:latest (anonymous pull verified)
  • Web UI footer source link points at the new forge
  • All 153 CHANGELOG commit links rewritten to the new forge (every hash verified to exist there)
  • Dev dependency bumps (required by the zaojun pre-commit hook), pre-commit hook rev alignment, PLR0917 ignore in tests matching the existing PLR0913 ignore

Intentionally unchanged: WuMing / git-pages / zaojun codeberg.org references (those repos are not migrated), the README pysentry badge (repo no longer exists on either forge — needs a decision), docs/javascripts/redirect.js (redirects old Codeberg Pages to cang.marvin8.zone), and .claude/settings.json (claude-agent codeberg signing key).

Closes #129

## Summary Post-migration housekeeping after the move from codeberg.org/MinimalNVR/cang to forge.marvin8.zone/marvin8/cang. - Weekly checks workflow now runs on the **suanni** runner (regular CI stays on zhuiri) - deploy-docs job pushes the pages branch to forge.marvin8.zone instead of codeberg.org - OCI labels/annotations (Containerfile, ci.yml, test-publish-container.yml, justfile) point at the new forge - Docs, README CI badge, pyproject project URLs, mkdocs.yml, AGENTS.md updated; container image references now use `registry.marvin8.zone/marvin8/cang:latest` (anonymous pull verified) - Web UI footer source link points at the new forge - All 153 CHANGELOG commit links rewritten to the new forge (every hash verified to exist there) - Dev dependency bumps (required by the zaojun pre-commit hook), pre-commit hook rev alignment, PLR0917 ignore in tests matching the existing PLR0913 ignore Intentionally unchanged: WuMing / git-pages / zaojun codeberg.org references (those repos are not migrated), the README pysentry badge (repo no longer exists on either forge — needs a decision), docs/javascripts/redirect.js (redirects old Codeberg Pages to cang.marvin8.zone), and .claude/settings.json (claude-agent codeberg signing key). Closes #129
📝 point changelog commit links at forge.marvin8.zone
All checks were successful
/ gitleaks (pull_request) Successful in 16s
Details
/ pr-review (pull_request) Successful in 57s
Details
/ checks (pull_request) Successful in 1m51s
Details
/ publish (pull_request) Has been skipped
Details
/ deploy-docs (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
e6c550bd8f
forgejo-actions reviewed 2026-08-04 07:38:07 +00:00
forgejo-actions left a comment
Copy link

WuMing

Found 1 issue(s). See inline comments below.

## WuMing Found **1** issue(s). See inline comments below.
.forgejo/workflows/ci.yml
@ -96,3 +96,3 @@
git config user.email "ci@forgejo"
git config user.name "Forgejo Actions"
git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@codeberg.org/${{ github.repository }}.git
git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@forge.marvin8.zone/${{ github.repository }}.git
forgejo-actions commented 2026-08-04 07:38:07 +00:00
Copy link

security [MEDIUM]

The FORGEJO_TOKEN secret is embedded directly in the git remote URL, which can be exposed in CI logs or process listings. Use a credential helper or environment variable to pass the token securely, avoiding inclusion in a URL. (A02: Cryptographic Failures – credentials logged)

**security** [MEDIUM] The FORGEJO_TOKEN secret is embedded directly in the git remote URL, which can be exposed in CI logs or process listings. Use a credential helper or environment variable to pass the token securely, avoiding inclusion in a URL. (A02: Cryptographic Failures – credentials logged) <!-- wuming:sha256:d2c91b0bcff0bf59556186e0d60937674a7147c7b2a271dac070ddf5e34cbb17 -->
marvin8 marked this conversation as resolved
agent-pi commented 2026-08-04 07:47:16 +00:00
Author
Collaborator
Copy link

.forgejo/workflows/ci.yml line 98

security [MEDIUM] — The FORGEJO_TOKEN secret is embedded directly in the git remote URL…

🔴 Not actioned in this PR. This token-in-URL pattern is pre-existing — the line was only host-swapped from codeberg.org to forge.marvin8.zone here, which is why it appeared in the diff. The token value is masked in CI logs, and the residual exposure (process list during the call, workspace .git/config) is limited to the self-hosted zhuiri runner. The extraheader fix changes deploy-docs auth, which only runs on tag pushes and so cannot be exercised by this PR's CI. Tracked as a follow-up in #131 so it can be validated with a test tag.

[`.forgejo/workflows/ci.yml` line 98](https://forge.marvin8.zone/marvin8/cang/pulls/130#issuecomment-355) > **security** [MEDIUM] — The FORGEJO_TOKEN secret is embedded directly in the git remote URL… 🔴 Not actioned in this PR. This token-in-URL pattern is pre-existing — the line was only host-swapped from codeberg.org to forge.marvin8.zone here, which is why it appeared in the diff. The token value is masked in CI logs, and the residual exposure (process list during the call, workspace .git/config) is limited to the self-hosted zhuiri runner. The extraheader fix changes deploy-docs auth, which only runs on tag pushes and so cannot be exercised by this PR's CI. Tracked as a follow-up in #131 so it can be validated with a test tag.
⬆️ bump pre-commit deps
All checks were successful
/ gitleaks (pull_request) Successful in 16s
Details
/ pr-review (pull_request) Successful in 38s
Details
/ checks (pull_request) Successful in 1m40s
Details
/ publish (pull_request) Has been skipped
Details
/ deploy-docs (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
025bc0f9f9
📝 refer to global AGENTS.md instead of CLAUDE.md
All checks were successful
/ gitleaks (pull_request) Successful in 15s
Details
/ pr-review (pull_request) Successful in 39s
Details
/ checks (pull_request) Successful in 1m44s
Details
/ publish (pull_request) Has been skipped
Details
/ deploy-docs (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
04fe2625d3
📝 drop Docker Hub references — image only published to registry.marvin8.zone
All checks were successful
/ gitleaks (pull_request) Successful in 14s
Details
/ pr-review (pull_request) Successful in 40s
Details
/ checks (pull_request) Successful in 1m41s
Details
/ publish (pull_request) Has been skipped
Details
/ deploy-docs (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
728c172637
marvin8 approved these changes 2026-08-04 08:24:01 +00:00
marvin8 manually merged commit 130818be09 into main 2026-08-04 08:24:44 +00:00
marvin8 deleted branch maint/issue-129-forge-migration-updates 2026-08-04 08:27:12 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
marvin8
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
marvin8/cang!130
No description provided.