refi64.dev / core
Monorepo for Tangled
Star
Fork 0
Watch

Commits on dwn/spindle-hardening

spindle/models: hold back a trailing window so secrets split across log writes stay masked
Signed-off-by: dawn <dawn@tangled.org>
dwn/spindle-hardening
dawn committed
spindle/microvm: bind qmp sockets ourselves at 0600 and pass qemu the fd
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle/microvm: cap each workflow vm's cpu and io in its cgroup
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle/microvm: key the activation config cache per repo so tenants can't poison each other's toplevels
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle/netguard: refuse to dial internal addresses on user-controlled fetches
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle/engines/microvm: treat exited vms as already destroyed instead of erroring out
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
*: fmt
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
knotserver: inline knot2 to monorepo
oyster.cafe committed
appview/pages/templates: use generic htmx trigger `from:` query
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
knotmirror/xrpc: skip blob size check on submodules
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
idresolver,spindle: add regressions tests for all paths that use perms
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle: reject repo record if repo was already registered under another owner
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
knotserver/git: validate fork source
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
spindle: check owner did is a member in processRepo
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle: check for perm on process pull
dawn committed
bobbin/worker: add cors headers
Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
Anirudh Oppiliappan committed
appview: disable autocomplete in markdownEditor and issue title to avoid browser repeating submitted content
Wilhelm Berggren committed
spindle/engines/microvm: set vsock to use host cid explicitly
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle/microvm: vacate populated cgroup namespace roots at init
Signed-off-by: Winter <winter@madoka.systems>
Winter committed
spindle: ingest pull records only from jetstream
Signed-off-by: noriaki watanabe <nabeyang@gmail.com>
noriaki watanabe committed
camo: verify hmac before checking the cache
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
appview/pages/templates: require comment body in issue comment
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/notify/email: cap at 10 notifs
Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
Anirudh Oppiliappan committed
appview/pages/templates: visibility based line-quote-button
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
nix/{microvm,pkgs}: add wf user to trusted users in microvm images
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
shuttle,spindle/engines/microvm: have shuttle detect step ooms properly, parse serial for oom / kernel panic
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
fix(appview/oauth): derive dev client URI from configured appview host
Niels Mokkenstorm committed
appview/pages: unify button styles across all edit/create forms
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages: load pipeline statuses using htmx in pulls pages
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
spindle/engine: properly interrupt running workflows on cancel, dont overwrite cancelled status
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
spindle/engine: reject workflows that map to colliding keys
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
appview/pages/templates: remove unnecessary top-level `hx-include`
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
Revert "appview/pages/templates: fix patch resubmit button"
Seongmin Lee committed
appview: add theme drop-down persisted in database
Signed-off-by: TheBananaPancake <did:plc:3ywraszv5eqhnlvzumwju5fa>
Banana Pancake committed
appview/pages: update copy for CI section
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages: incorporate new features group into landing
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages: incorporate rope svgs into landing
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/db: add indices to load issues-by-repo quicker
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages/templates: fix patch resubmit button
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/notify/db: remove actorDid from recipients after subscription overrides
Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
Anirudh Oppiliappan committed
appview/db: suppress backlog on email prefrence toggle
Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
Anirudh Oppiliappan committed
appview/db: add read filter for pending email notifs
Signed-off-by: Anirudh Oppiliappan <anirudh@tangled.org>
Anirudh Oppiliappan committed
appview: deduplicate stars
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview: remove `Rkey` from `models.Follow`
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/pages/templates: unpack follow fragment params
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/pages: fix loginbase template bug
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
localinfra: fix tailwind setup
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages: remove `pullNewComment` fragment
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/pages/templates: fix htmx inception
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/{pages,pulls}: support PR title/body edit
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/pages: markdown-editor web component
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview: use markdownEditor fragment for all markdown body inputs
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
*: bump htmx to latest (2.0.10)
Signed-off-by: Seongmin Lee <git@boltless.me>
Seongmin Lee committed
appview/pages: apply scaleFmt to follower counts in follow cards
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
nix/modules/shuttle: add missing git to shuttle.nix
waveringana committed
appview/pages: move merge check info into round card
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/oauth: ensure profile record when onboarding is skipped too
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages: add spindle selector in repo/fork pages
Signed-off-by: oppiliappan <me@oppi.li>
oppiliappan committed
appview/pages/repo/pipelines: dont copy ssh log cmd quoted, replace inner text with 'Copied!' when copied
Signed-off-by: dawn <dawn@tangled.org>
dawn committed
appview/state: start email digest dispatcher
Signed-off-by: Anirudh Oppiliappan <x@icyphox.sh>
Anirudh Oppiliappan committed