marvin8/wuming
Watch
1
0
Fork
You've already forked wuming
 0
Code Issues Pull requests Releases 9 Activity Actions

Post-migration cleanup: update references to forge.marvin8.zone #56

Manually merged
marvin8 merged 6 commits from chore/issue-55-migration-cleanup into main 2026-08-06 04:01:17 +00:00
Conversation 7 Commits 6 Files changed 22 +508 -481
agent-pi commented 2026-08-06 03:04:56 +00:00
Collaborator
Copy link

Closes #55

Closes #55
- Change default forgejo URL in config.py and tests
- Update repo URLs in pyproject.toml, Containerfile, README.md, AGENTS.md
- Update workflow git remote and docs references
- Update justfile commit link template
- Update run-wuming.fish default forgejo URL
- Update concept.md, Release-Notes.md.template
- Update weekly-checks runner from codeberg-small-lazy to suanni
📝 Update Release-Notes.md for migration cleanup
Some checks failed
/ gitleaks (pull_request) Successful in 15s
Details
/ pr-review (pull_request) Successful in 44s
Details
/ checks (pull_request) Failing after 2m2s
Details
/ deploy-docs (pull_request) Has been skipped
Details
9e3fd9bf47
forgejo-actions reviewed 2026-08-06 03:05:40 +00:00
forgejo-actions left a comment
Copy link

WuMing

Found 1 issue(s). See inline comments below.

## WuMing Found **1** issue(s). See inline comments below.
.forgejo/workflows/ci.yml
@ -83,3 +83,3 @@
git config user.email "ci@forgejo"
git config user.name "Forgejo Actions"
git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@codeberg.org/${{ github.repository }}.git
git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@forge.marvin8.zone/${{ github.repository }}.git
forgejo-actions commented 2026-08-06 03:05:40 +00:00
Copy link

security [HIGH]

The Git remote URL embeds the secret token $FORGEJO_TOKEN directly in the URL, which can be exposed in process listings, logs, or shell history. Use a credential helper or pass the token via stdin to avoid leaking the secret. (A02: Cryptographic Failures / A05: Security Misconfiguration)

**security** [HIGH] The Git remote URL embeds the secret token $FORGEJO_TOKEN directly in the URL, which can be exposed in process listings, logs, or shell history. Use a credential helper or pass the token via stdin to avoid leaking the secret. (A02: Cryptographic Failures / A05: Security Misconfiguration) <!-- wuming:sha256:618135e98a5732f8602a05b6f1052388e905626748b21ae2fefff23dc465267a -->
marvin8 marked this conversation as resolved
agent-pi commented 2026-08-06 03:22:04 +00:00
Author
Collaborator
Copy link

src/wuming/config.py line 172

Default Forgejo URL changed from Codeberg to a custom instance (forge.marvin8.zone).

🔴 Not actioned — this is an intentional migration. The repo has moved to forge.marvin8.zone and the default reflects the project\u0027s home instance.

[`src/wuming/config.py` line 172](https://forge.marvin8.zone/marvin8/wuming/pulls/56#issuecomment-647) > Default Forgejo URL changed from Codeberg to a custom instance (forge.marvin8.zone). 🔴 Not actioned — this is an intentional migration. The repo has moved to forge.marvin8.zone and the default reflects the project\u0027s home instance.
pymdown-extensions
📝 no longer commit Release-Notes.md after resetting... that should
All checks were successful
/ gitleaks (pull_request) Successful in 23s
Details
/ pr-review (pull_request) Successful in 47s
Details
/ checks (pull_request) Successful in 1m59s
Details
/ deploy-docs (pull_request) Has been skipped
Details
909b14c055
 
be done with the next set of changes
👷 Add container publishing to CI on release events
All checks were successful
/ gitleaks (pull_request) Successful in 20s
Details
/ pr-review (pull_request) Successful in 44s
Details
/ checks (pull_request) Successful in 1m52s
Details
/ deploy-docs (pull_request) Has been skipped
Details
/ publish-container (pull_request) Has been skipped
Details
e4d04b343d
forgejo-actions reviewed 2026-08-06 03:54:08 +00:00
forgejo-actions left a comment
Copy link

WuMing

Found 3 issue(s). See inline comments below.

## WuMing Found **3** issue(s). See inline comments below.
.forgejo/workflows/ci.yml
@ -83,3 +85,3 @@
git config user.email "ci@forgejo"
git config user.name "Forgejo Actions"
git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@codeberg.org/${{ github.repository }}.git
git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@forge.marvin8.zone/${{ github.repository }}.git
forgejo-actions commented 2026-08-06 03:54:08 +00:00
Copy link

security [HIGH]

A02: Passing the FORGEJO_TOKEN directly in a URL via command-line argument risks exposing the secret in CI logs, process listings, or shell history. Use an alternative authentication mechanism (e.g., environment variable injection via git credential helper) to avoid command-line exposure.

**security** [HIGH] A02: Passing the FORGEJO_TOKEN directly in a URL via command-line argument risks exposing the secret in CI logs, process listings, or shell history. Use an alternative authentication mechanism (e.g., environment variable injection via git credential helper) to avoid command-line exposure. <!-- wuming:sha256:75827630d85d103a277ce69afe330a9f0347852c587e458d312965728736fcd8 -->
marvin8 marked this conversation as resolved
.forgejo/workflows/ci.yml
@ -109,0 +118,4 @@
- name: Install buildah
run: apt-get update -qq && apt-get install -y -qq podman buildah
- name: Login to registry
run: buildah login --username "${{ secrets.registry_user }}" --password "${{ secrets.registry_password }}" registry.marvin8.zone
forgejo-actions commented 2026-08-06 03:54:08 +00:00
Copy link

security [HIGH]

A02: Passing registry password as a command-line argument exposes it in logs and process tables. Use '--password-stdin' or a credentials file to avoid secret leakage.

**security** [HIGH] A02: Passing registry password as a command-line argument exposes it in logs and process tables. Use '--password-stdin' or a credentials file to avoid secret leakage. <!-- wuming:sha256:d85c81de6582871475ad70850d4d0f6bf7f6854880f6b3b51fede9df40785a65 -->
marvin8 marked this conversation as resolved
src/wuming/config.py
@ -170,2 +170,3 @@
commit_sha=os.environ.get("CI_COMMIT_SHA", ""),
forgejo_url=os.environ.get("WUMING_FORGEJO_URL", "https://codeberg.org"),
forgejo_url=os.environ.get(
"WUMING_FORGEJO_URL", "https://forge.marvin8.zone"
forgejo-actions commented 2026-08-06 03:54:08 +00:00
Copy link

code [LOW]

Default Forgejo URL changed from Codeberg to a custom instance (forge.marvin8.zone). This may cause confusion or breakage for users who do not have access to this instance. If the library is meant for public use, consider keeping a generic default or requiring explicit configuration.

**code** [LOW] Default Forgejo URL changed from Codeberg to a custom instance (forge.marvin8.zone). This may cause confusion or breakage for users who do not have access to this instance. If the library is meant for public use, consider keeping a generic default or requiring explicit configuration. <!-- wuming:sha256:2eca9e1aee714121a100c0ee57dc78f33f29bec0c99f3f71f6dba9326d35aea6 -->
agent-pi commented 2026-08-06 03:58:58 +00:00
Author
Collaborator
Copy link

src/wuming/config.py line 172

Default Forgejo URL changed from Codeberg to a custom instance (forge.marvin8.zone).

🔴 Not actioned — this is an intentional migration. The repo has moved to forge.marvin8.zone and the default reflects the project\u0027s home instance.

[`src/wuming/config.py` line 172](https://forge.marvin8.zone/marvin8/wuming/pulls/56#issuecomment-647) > Default Forgejo URL changed from Codeberg to a custom instance (forge.marvin8.zone). 🔴 Not actioned — this is an intentional migration. The repo has moved to forge.marvin8.zone and the default reflects the project\u0027s home instance.
agent-pi commented 2026-08-06 03:59:03 +00:00
Author
Collaborator
Copy link

`.forgejo/workflows/ci.yml` line 85

Passing the FORGEJO_TOKEN directly in a URL via command-line argument risks exposing the secret in CI logs.

🔴 Not actioned — pre-existing pattern, acceptable for a private forge instance.

[\`.forgejo/workflows/ci.yml\` line 85](https://forge.marvin8.zone/marvin8/wuming/pulls/56#issuecomment-648) > Passing the FORGEJO_TOKEN directly in a URL via command-line argument risks exposing the secret in CI logs. 🔴 Not actioned — pre-existing pattern, acceptable for a private forge instance.
agent-pi commented 2026-08-06 03:59:08 +00:00
Author
Collaborator
Copy link

`.forgejo/workflows/ci.yml` line 121

Passing registry password as a command-line argument exposes it in logs and process tables.

🔴 Not actioned — pattern copied from established CI setup, acceptable for a private forge instance.

[\`.forgejo/workflows/ci.yml\` line 121](https://forge.marvin8.zone/marvin8/wuming/pulls/56#issuecomment-649) > Passing registry password as a command-line argument exposes it in logs and process tables. 🔴 Not actioned — pattern copied from established CI setup, acceptable for a private forge instance.
marvin8 approved these changes 2026-08-06 04:00:42 +00:00
marvin8 manually merged commit 0e789c0066 into main 2026-08-06 04:01:17 +00:00
marvin8 deleted branch chore/issue-55-migration-cleanup 2026-08-06 04:01:40 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
marvin8
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference
marvin8/wuming!56
No description provided.