Merge pull request #1732 from entireio/swirling-doodling-waffle

d56613b→main·

toothbrush·4d ago·4 files·+183 added/-36 removed

Route checkpoints through entire:// push-through mirrors

Changes

4

• cmd/entire/cli

• checkpoint/remote

• Mutil.go+40/-17

• Mutil_test.go+59/-17

• strategy

• Mcheckpoint_remote_test.go+82

• docs/testing

• Mgit-remote-test-plan.md+2/-2

17 unmodified lines

18
19
20
21
22
21
22
23
24
25
26
86 unmodified lines

113
114
115
115
116
116
117
118
119
120
121
66 unmodified lines

188
189
190
189
190
191
192
193
194
192
193
194
195
196
197
198
199
19 unmodified lines

219
220
221
222
223
224
225
226
227
228
229
230
231
232
222
223
233
234
235
236
237
238
51 unmodified lines

290
291
292
281
282
283
284
293
294
295
296
297
298
299
300
8 unmodified lines

309
310
311
312
313
314
315
316
317
318
319
320
321
322
300
323
324
325
326
89 unmodified lines

416
417
418
396
419
420
421
422

17 unmodified lines

const originRemote = "origin"

const (
    ProtocolSSH   = gitremote.ProtocolSSH
    ProtocolHTTPS = gitremote.ProtocolHTTPS
    ProtocolSSH   = gitremote.ProtocolSSH
    ProtocolHTTPS  = gitremote.ProtocolHTTPS
    ProtocolEntire = gitremote.ProtocolEntire
)

// Info is an alias for gitremote.Info.

86 unmodified lines

checkpointURL, err := deriveCheckpointURLFromInfo(info, config)
    if err != nil {
        // Origin's protocol can't be mapped to a git transport (e.g. entire://,
        // file://). Honor the configured checkpoint_remote by targeting the
        // Origin's protocol can't be mapped to a checkpoint URL (e.g. file://,
        // or an entire:// mirror of a different forge than the configured
        // provider). Honor the configured checkpoint_remote by targeting the
        // provider's canonical host over HTTPS rather than falling back to origin.
        if providerURL, ok := resolveProviderCheckpointURL(config, opt.WorktreeRoot); ok {
            return providerURL, nil
        }
    }
    return "", true, fmt.Errorf("no push URL found: %w", err)
}
if strings.TrimSpace(os.Getenv(CheckpointTokenEnvVar)) != "" && isDerivableProtocol(pushInfo.Protocol) {
    // Coerce a derivable (ssh/https) remote to HTTPS so the token applies,
    withToken := strings.TrimSpace(os.Getenv(CheckpointTokenEnvVar)) != ""
    if withToken && isDirectGitTransport(pushInfo.Protocol) {
        // Coerce a direct (ssh/https) remote to HTTPS so the token applies,
        // keeping the host so enterprise installations stay on their own host.
        // A non-derivable protocol (e.g. entire://) carries a host that isn't a
        // usable HTTPS host, so it's left untouched and falls through to the
        // providerCheckpointURL fallback below.
        // An entire:// remote carries a cluster host that isn't a usable HTTPS
        // host, so it's handled separately after the owner check below.
        //
        // Keep the port only when the source was already HTTPS. SSH ports
        // (e.g., :2222) don't map to HTTPS ports on the same host.

19 unmodified lines

return fallbackURL, false, nil
}

if withToken && pushInfo.Protocol == ProtocolEntire {
    // The checkpoint token is an HTTPS credential for the provider host;
    // it can't ride through the entire:// helper (which does its own
    // auth). Route to the provider over HTTPS instead of the mirror.
    if providerURL, ok := resolveProviderCheckpointURL(config, ""); ok {
        return providerURL, true, nil
    }
}

pushURL, err := deriveCheckpointURLFromInfo(pushInfo, config)
if err != nil {
    // The push remote's protocol can't be mapped to a git transport
    // (e.g. entire://, file://). Honor the configured checkpoint_remote by
    // The push remote's protocol can't be mapped to a checkpoint URL
    // (e.g. file://, or an entire:// mirror of a different forge than the
    // configured provider). Honor the configured checkpoint_remote by
    // targeting the provider's canonical host over HTTPS rather than
    // misrouting checkpoints to the origin remote.
    if providerURL, ok := resolveProviderCheckpointURL(config, ""); ok {
        return providerURL, ""
    }
}

return info, nil
}

// isDerivableProtocol reports whether deriveCheckpointURLFromInfo can map the
// protocol to a checkpoint URL (i.e. it's a real git transport, not a remote
// helper scheme like entire:// or a local file://).
func isDerivableProtocol(protocol string) bool {
// isDirectGitTransport reports whether the protocol talks to the git host
// directly over ssh/https (where the host is a usable HTTPS host for token
// auth), as opposed to a remote helper scheme like entire:// or a local
// file://.
func isDirectGitTransport(protocol string) bool {
    return protocol == ProtocolSSH || protocol == ProtocolHTTPS
}

8 unmodified lines

return fmt.Sprintf("git@%s:%s.git", info.Host, config.Repo), nil
    case ProtocolHTTPS:
    return fmt.Sprintf("https://%s/%s.git", info.HostPort(), config.Repo), nil
    case ProtocolEntire:
    // entire:// push-through mirrors are cluster-scoped: keep the cluster
    // host and forge segment, swap in the checkpoint repo. Only derivable
    // when the forge maps back to the configured provider's host, so a
    // github checkpoint_remote never routes through another forge's mirror.
    host, ok := providerHost(config.Provider)
    if !ok || !strings.EqualFold(info.CanonicalHost(), host) {
        return "", fmt.Errorf("entire:// remote forge %q does not match checkpoint provider %q", info.Forge, config.Provider)
    }
    return fmt.Sprintf("entire://%s/%s/%s", info.HostPort(), info.Forge, config.Repo), nil
    default:
    return "", fmt.Errorf("unsupported protocol %q in origin remote", info.Protocol)
    return "", fmt.Errorf("unsupported protocol %q in remote URL", info.Protocol)
}

89 unmodified lines

if err != nil {
            continue
        }
        if strings.EqualFold(info.Host, host) && isDerivableProtocol(info.Protocol) {
            if strings.EqualFold(info.Host, host) && isDirectGitTransport(info.Protocol) {
                return info, true
            }
        }
``

Mcmd/entire/cli/checkpoint/remote/util.go+40/-17

130 unmodified lines

131 132 133 134 134 135 136 137 138 139 140 141 142 143 144 145 172 unmodified lines

318 319 320 315 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 73 unmodified lines

420 421 422 401 402 403 404 405 406 407 408 423 424 425 426 427 428 429 430 431 432 433 434 435 2 unmodified lines

438 439 440 417 441 442 419 443 444 445 446 423 447 448 425 449 450 451 452 429 430 453 454 455 456 457 434 458 459 460 461 144 unmodified lines

606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629

130 unmodified lines

wantURL: "git@github.com:acme/checkpoints.git", }, { name: "entire:// origin without token routes to provider checkpoint url (ssh default)", name: "entire:// origin without token derives mirror checkpoint url on same cluster", originURL: "entire://app.entire.io/gh/acme/app", settingsJSON: {"enabled":true,"strategy_options":{"checkpoint_remote":{"provider":"github","repo":"acme/checkpoints"}}}, wantURL: "entire://app.entire.io/gh/acme/checkpoints", wantEnabled: true, }, { name: "entire:// origin with forge not matching provider routes to provider checkpoint url (ssh default)", originURL: "entire://app.entire.io/et/acme/app", settingsJSON: {"enabled":true,"strategy_options":{"checkpoint_remote":{"provider":"github","repo":"acme/checkpoints"}}}, wantURL: "git@github.com:acme/checkpoints.git", wantEnabled: true, }, { name: "entire:// origin with different owner disables checkpoint push url", originURL: "entire://app.entire.io/gh/fork/app", pushRemote: "origin", settingsJSON: {"enabled":true,"strategy_options":{"checkpoint_remote":{"provider":"github","repo":"acme/checkpoints"}}}, wantURL: "entire://app.entire.io/gh/fork/app", wantEnabled: false, }, { name: "file:// origin routes to provider checkpoint url (ssh default)", originURL: "file:///acme/app", 73 unmodified lines

} }

// TestPushURL_EntireOriginReusesProviderRemoteScheme reproduces the real-world // setup: origin migrated to an entire:// URL (forge-prefixed /gh/owner/repo) // with a github checkpoint_remote. The checkpoint URL must route to github // rather than fall back to the entire:// origin, reusing the auth/scheme the // repo had for that endpoint — a token forces HTTPS, then an existing remote // on the provider host, then defaulting to SSH. func TestPushURL_EntireOriginReusesProviderRemoteScheme(t *testing.T) { const entireOrigin = "entire://aws-eu-central-1.entire.io/gh/entireio/cli" // TestPushURL_EntireOriginDerivesMirrorURL reproduces the real-world setup: // origin migrated to an entire:// URL (forge-prefixed /gh/owner/repo) with a // github checkpoint_remote. Checkpoints must follow origin through the // push-through mirror on the same cluster — even when leftover direct github // remotes (e.g. URL-named promisor entries from filtered fetches) exist. The // exception is a checkpoint token, which is an HTTPS credential for the // provider host and therefore forces direct provider HTTPS. func TestPushURL_EntireOriginDerivesMirrorURL(t *testing.T) { const entireOrigin = "entire://aws-ap-southeast-2.entire.io/gh/entireio/cli" const mirrorCheckpointURL = "entire://aws-ap-southeast-2.entire.io/gh/entireio/cli-checkpoints" tests := []struct { name string githubURL string 2 unmodified lines

wantEnabled bool }{ { name: "ssh github remote yields ssh checkpoint url", name: "existing ssh github remote does not divert checkpoints off the mirror", githubURL: "git@github.com:entireio/cli.git", wantURL: "git@github.com:entireio/cli-checkpoints.git", wantURL: mirrorCheckpointURL, wantEnabled: true, }, { name: "https github remote yields https checkpoint url", name: "existing https github remote does not divert checkpoints off the mirror", githubURL: "https://github.com/entireio/cli.git", wantURL: "https://github.com/entireio/cli-checkpoints.git", wantURL: mirrorCheckpointURL, wantEnabled: true, }, { name: "no signal defaults to ssh", wantURL: "git@github.com:entireio/cli-checkpoints.git", name: "entire origin alone derives mirror checkpoint url", wantURL: mirrorCheckpointURL, wantEnabled: true, }, { name: "token forces https over existing ssh remote", name: "token forces https on the provider host", githubURL: "git@github.com:entireio/cli.git", token: "ci-token", wantURL: "https://github.com/entireio/cli-checkpoints.git", 144 unmodified lines

checkpointRepo: "org/checkpoints", want: "ssh://git@git.example.com:2222/org/checkpoints.git", }, { name: "entire push remote keeps cluster and forge", pushRemoteURL: "entire://aws-ap-southeast-2.entire.io/gh/org/main-repo", checkpointRepo: "org/checkpoints", want: "entire://aws-ap-southeast-2.entire.io/gh/org/checkpoints", }, { name: "entire push remote with non-standard port", pushRemoteURL: "entire://cluster.example.com:8443/gh/org/main-repo", checkpointRepo: "org/checkpoints", want: "entire://cluster.example.com:8443/gh/org/checkpoints", }, { name: "entire push remote with forge not matching provider", pushRemoteURL: "entire://aws-ap-southeast-2.entire.io/et/org/main-repo", checkpointRepo: "org/checkpoints", wantDeriveErr: true, }, { name: "invalid push remote", pushRemoteURL: "not-a-url", ``

Mcmd/entire/cli/checkpoint/remote/util_test.go+59/-17

335 unmodified lines

336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423

335 unmodified lines

assert.False(t, ps.pushDisabled)
}

// Not parallel: uses t.Chdir()
//
// When origin is an entire:// push-through mirror whose forge (gh) matches the
// configured checkpoint provider (github), checkpoints route through the same
// cluster mirror instead of falling back to a direct github.com URL.
func TestResolvePushSettings_WithCheckpointRemote_EntireMirror(t *testing.T) {
    ctx := context.Background()

localDir := t.TempDir()
    testutil.InitRepo(t, localDir)
    testutil.WriteFile(t, localDir, "f.txt", "init")
    testutil.GitAdd(t, localDir, "f.txt")
    testutil.GitCommit(t, localDir, "init")

// Origin is an entire:// mirror on cluster app.entire.io for forge gh.
    cmd := exec.CommandContext(ctx, "git", "remote", "add", "origin", "entire://app.entire.io/gh/org/main-repo")
    cmd.Dir = localDir
    cmd.Env = testutil.GitIsolatedEnv()
    require.NoError(t, cmd.Run())

entireDir := filepath.Join(localDir, ".entire")
    require.NoError(t, os.MkdirAll(entireDir, 0o755))
    require.NoError(t, os.WriteFile(
        filepath.Join(entireDir, "settings.json"),
        []byte(`{"enabled": true, "strategy_options": {"checkpoint_remote": {"provider": "github", "repo": "org/checkpoints"}}}`),
        0o644,
    ))

// Seed the local v1 metadata branch so resolvePushSettings finds it and
    // skips fetchMetadataBranchIfMissing — which would otherwise invoke the
    // entire:// remote helper against a live cluster.
    runCheckpointRemoteGit(ctx, t, localDir, "branch", paths.MetadataBranchName)

t.Chdir(localDir)

ps := resolvePushSettings(ctx, "origin")
    assert.True(t, ps.hasCheckpointURL())
    // Keeps the cluster host and forge segment, swaps in the checkpoint repo.
    assert.Equal(t, "entire://app.entire.io/gh/org/checkpoints", ps.pushTarget())
    assert.False(t, ps.pushDisabled)
}

// Not parallel: uses t.Chdir()
//
// When origin is an entire:// mirror of a different forge (et) than the
// configured checkpoint provider (github), it must not route through the
// mirror; it falls back to the provider's canonical host.
func TestResolvePushSettings_EntireMirrorForgeMismatchFallsBackToProvider(t *testing.T) {
    ctx := context.Background()

cmd := exec.CommandContext(ctx, "git", "remote", "add", "origin", "entire://app.entire.io/et/org/main-repo")
    cmd.Dir = localDir
    cmd.Env = testutil.GitIsolatedEnv()
    require.NoError(t, cmd.Run())

// Seed the local v1 branch so the provider-host fallback URL isn't fetched
    // from github.com for real.
    runCheckpointRemoteGit(ctx, t, localDir, "branch", paths.MetadataBranchName)

t.Chdir(localDir)

ps := resolvePushSettings(ctx, "origin")
    assert.True(t, ps.hasCheckpointURL())
    // Provider host over SSH (default transport), not the non-matching mirror.
    assert.Equal(t, "git@github.com:org/checkpoints.git", ps.pushTarget())
    assert.False(t, ps.pushDisabled)
}

// Not parallel: uses t.Chdir()
func TestResolvePushSettings_CheckpointURLDoesNotAffectRemoteField(t *testing.T) {
    ctx := context.Background()