marvin8/fedinesia
Watch
1
0
Fork
You've already forked fedinesia
 0
Code Issues Pull requests Releases 54 Activity Actions

Finalise forge.marvin8.zone migration (stage 2) #62

Manually merged
marvin8 merged 2 commits from chore/repo-migration-stage2 into main 2026-08-17 10:33:45 +00:00
Conversation 3 Commits 2 Files changed 5 +464 -408
agent-pi commented 2026-08-17 09:37:44 +00:00
Collaborator
Copy link

Finalises the stage-2 cleanup of the forge.marvin8.zone migration for fedinesia.

Changes

  • Source references: repoint the zaojun pre-commit hook from codeberg.org/marvin8/zaojun to forge.marvin8.zone/marvin8/zaojun. The grebedoc git-pages/action upload step and the Codeberg Pages JS redirect are intentionally left as-is.
  • Dependency bump (zaojun --format json): bumped cyclopts, longwei, whenever, bump-my-version, prek, ruff, ty, and uv to their appropriate ~= minimums. complexipy was left alone — its only newer release is within the 7-day quarantine with no aged fallback. Regenerated uv.lock and pylock.toml.
  • Pre-commit alignment: ruff, ty, and uv hook revs updated to match the bumped pyproject.toml versions.

Already complete (verified, no change needed)

  • Docs links point to fedinesia.marvin8.zone.
  • CI runners use zhuiri / suanni (no codeberg-small-lazy).
  • Container publishing targets registry.marvin8.zone only.
  • No claude / codeberg-agent git remotes remain.

Verification

  • pysentry: 0 vulnerabilities.
  • ruff check ., ruff format --check ., ty check ., complexipy .: clean.
  • nox -s tryke: 73 tests pass across Python 3.12–3.14t.
  • nox -s interrogate deptry dependency_versions: all pass.
Finalises the stage-2 cleanup of the forge.marvin8.zone migration for fedinesia. ## Changes - **Source references**: repoint the zaojun pre-commit hook from `codeberg.org/marvin8/zaojun` to `forge.marvin8.zone/marvin8/zaojun`. The grebedoc `git-pages/action` upload step and the Codeberg Pages JS redirect are intentionally left as-is. - **Dependency bump** (`zaojun --format json`): bumped `cyclopts`, `longwei`, `whenever`, `bump-my-version`, `prek`, `ruff`, `ty`, and `uv` to their appropriate `~=` minimums. `complexipy` was left alone — its only newer release is within the 7-day quarantine with no aged fallback. Regenerated `uv.lock` and `pylock.toml`. - **Pre-commit alignment**: `ruff`, `ty`, and `uv` hook revs updated to match the bumped `pyproject.toml` versions. ## Already complete (verified, no change needed) - Docs links point to `fedinesia.marvin8.zone`. - CI runners use `zhuiri` / `suanni` (no `codeberg-small-lazy`). - Container publishing targets `registry.marvin8.zone` only. - No `claude` / `codeberg-agent` git remotes remain. ## Verification - `pysentry`: 0 vulnerabilities. - `ruff check .`, `ruff format --check .`, `ty check .`, `complexipy .`: clean. - `nox -s tryke`: 73 tests pass across Python 3.12–3.14t. - `nox -s interrogate deptry dependency_versions`: all pass.
⬆️ bump deps and migrate zaojun hook to forge.marvin8.zone
All checks were successful
/ gitleaks (pull_request) Successful in 15s
Details
/ pr-review (pull_request) Successful in 39s
Details
/ checks (pull_request) Successful in 2m7s
Details
/ publish (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
/ deploy-docs (pull_request) Has been skipped
Details
eaafed61bf
⬆️ bump deps, sync pre-commit revs, fix zaojun nox call
All checks were successful
/ gitleaks (pull_request) Successful in 15s
Details
/ pr-review (pull_request) Successful in 1m15s
Details
/ checks (pull_request) Successful in 1m54s
Details
/ publish (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
/ deploy-docs (pull_request) Has been skipped
Details
f58a40b225
forgejo-actions reviewed 2026-08-17 10:08:56 +00:00
forgejo-actions left a comment
Copy link

WuMing

Found 1 issue(s). See inline comments below.

## WuMing Found **1** issue(s). See inline comments below.
.pre-commit-config.yaml
@ -48,3 +48,3 @@
- id: gitleaks
- repo: https://codeberg.org/marvin8/zaojun
- repo: https://forge.marvin8.zone/marvin8/zaojun
forgejo-actions commented 2026-08-17 10:08:56 +00:00
Copy link

security [MEDIUM]

A08: Changing the pre-commit hook repository URL from codeberg.org to a custom domain (forge.marvin8.zone) introduces supply-chain integrity risk. Pre-commit hooks execute arbitrary code; ensure the new source is trusted and preferably pin to a known commit hash or signed tag.

**security** [MEDIUM] A08: Changing the pre-commit hook repository URL from codeberg.org to a custom domain (forge.marvin8.zone) introduces supply-chain integrity risk. Pre-commit hooks execute arbitrary code; ensure the new source is trusted and preferably pin to a known commit hash or signed tag. <!-- wuming:sha256:893b82ea828b2e7e9f8cfe0ff60295eb7b32d0492abe3680c33e69182e9f46e4 -->
marvin8 marked this conversation as resolved
marvin8 approved these changes 2026-08-17 10:29:23 +00:00
agent-pi commented 2026-08-17 10:30:52 +00:00
Author
Collaborator
Copy link

.pre-commit-config.yaml line 50

A08: Changing the pre-commit hook repository URL from codeberg.org to a custom domain (forge.marvin8.zone) introduces supply-chain integrity risk. Pre-commit hooks execute arbitrary code; ensure the new source is trusted and preferably pin to a known commit hash or signed tag.

🔴 Declined — the URL change is the intended migration from Codeberg to forge.marvin8.zone, Marvin8's own self-hosted Forgejo instance, so the source is trusted. The hook is already pinned to a version tag (rev: 1.7.2). No action needed.

[`.pre-commit-config.yaml` line 50](https://forge.marvin8.zone/marvin8/fedinesia/pulls/62#issuecomment-1530) > A08: Changing the pre-commit hook repository URL from codeberg.org to a custom domain (forge.marvin8.zone) introduces supply-chain integrity risk. Pre-commit hooks execute arbitrary code; ensure the new source is trusted and preferably pin to a known commit hash or signed tag. 🔴 Declined — the URL change is the intended migration from Codeberg to forge.marvin8.zone, Marvin8's own self-hosted Forgejo instance, so the source is trusted. The hook is already pinned to a version tag (`rev: 1.7.2`). No action needed.
marvin8 manually merged commit f4ad73d935 into main 2026-08-17 10:33:45 +00:00
marvin8 deleted branch chore/repo-migration-stage2 2026-08-17 10:34:25 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
marvin8
Labels
Clear labels   
bug
Something is not working

  
contribution welcome
Contributions are very welcome, get started here

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
good first issue
Interested in contributing? Get started here.

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
upstream
Related to an upstream repository, already reported there

No labels
bug
contribution welcome
duplicate
enhancement
good first issue
help wanted
invalid
question
upstream
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
marvin8/fedinesia!62
No description provided.