Skip to content

Commit 10070ba

Browse files
rldyourmndrldyourmnd
authored
Merge pull request #5 from NDDev-OpenNetwork/fix/public-repository-identity
fix(identity): bind public GDS repository
2 parents 51f1208 + bcd43d1 commit 10070ba

26 files changed

Lines changed: 111 additions & 112 deletions

‎.claude/CLAUDE.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
GENERATED FILE - DO NOT EDIT DIRECTLY
33
generator: gds
44
bundle: 0.4.0-dev
5-
source-tree-digest: sha256:34d52b7f9f301e146a8633cc7bf4e7e05ff45a630bbf3183d1e1e695e4ce5730
6-
input-digest: sha256:6b11cff602b0301d23c950660ac8fbb482bfb9e728db2380a2e0f0ccb318e0c3
5+
source-tree-digest: sha256:e6c3dab78cef49948ffeadd5c94271e6844424531f652ce366dc0a9c2f5f2b3e
6+
input-digest: sha256:c51495582a0accdbd10c58ff852e62f60ac12c83d736d5587db1a340b863d905
77
output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
88
edit-source:
99
- .gds/repository.yaml

‎.gds/bundle.lock.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@ bundle:
55
version: "0.4.0-dev"
66
release_sequence: 0
77
channel: "development"
8-
source_tree_digest: "sha256:34d52b7f9f301e146a8633cc7bf4e7e05ff45a630bbf3183d1e1e695e4ce5730"
9-
digest: "sha256:9bb7402d495fa2e0d5683dc90c8a50cc7a292174cf5723831cbb6ee3c4956a47"
8+
source_tree_digest: "sha256:e6c3dab78cef49948ffeadd5c94271e6844424531f652ce366dc0a9c2f5f2b3e"
9+
digest: "sha256:2d917e65f86cbaf4a9a9189c4ce79b17cf5d23266530236c1a101b275a82f567"
1010

1111
projection:
12-
input_digest: "sha256:6b11cff602b0301d23c950660ac8fbb482bfb9e728db2380a2e0f0ccb318e0c3"
13-
output_digest: "sha256:522904340dfcdd8383d7be1171a9d13241463cef7604233910576522ffc04e0b"
12+
input_digest: "sha256:c51495582a0accdbd10c58ff852e62f60ac12c83d736d5587db1a340b863d905"
13+
output_digest: "sha256:4c44ad712a3e8ada3f0d16eb012a9cec0040cd335fe9c436371315d6c6dd59c5"
1414
files:
1515
- path: ".claude/CLAUDE.md"
16-
digest: "sha256:9952447980be9cb5f2d17ccc9b32b3e7d96589ee245c7783ea70abbe35ac5cdb"
16+
digest: "sha256:92f75ec712f7fd21b74aa5a3909489e667e630d4a18165f334d6d5d609e2d709"
1717
- path: ".gds/compiled-policy.json"
18-
digest: "sha256:5f2cfdf82f4aa1c07a6895ac468cf9fc32773b0f5102dd4a58b5d77e3c0ca147"
18+
digest: "sha256:09752cc0cbe57dc3097f884927e2089a9730b9ebcf86ac27228812d54c5760f8"
1919
- path: ".github/workflows/gds-ci.yml"
20-
digest: "sha256:2322dcd26e109f7f68dd07ab6c77453e79f34aefd43c748938fc45baa260b323"
20+
digest: "sha256:aa5470c0cabff6141d24d62b97a3725182d36db5ca2f87ad8b3cc5b534944400"
2121
- path: "AGENTS.md"
22-
digest: "sha256:2e7d3e67a8da1e970cf6d508b97b92ff13d6c84652fb0aed2e9fd1f038fdcaa2"
22+
digest: "sha256:0d694f962bec1b7c4b82d2bb8c4768849bd4663c1d1e0543c72a1c9f61b80849"

‎.gds/compiled-policy.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
{
22
"schema_version": 1,
33
"compiled_policy": {
4-
"repository_id": "repo_01JEXAMPZ0000000000000000A",
4+
"repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
55
"bundle_version": "0.4.0-dev",
6-
"digest": "sha256:86b39e028f8fc5ea6da993db5ce82e2d5949f4457ba369d2908bb7ca311dce0c"
6+
"digest": "sha256:b566e3cc1e46f30d55eec1545b6e22697be999a2c0d80fe27068319d3630443d"
77
},
88
"sources": [
99
{

‎.gds/repository.yaml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,17 @@ schema_version: 1
66
# live beside it and was removed, because regenerating it after every source
77
# commit cost more than it ever caught.
88
repository:
9-
id: "repo_01JEXAMPZ0000000000000000A"
9+
id: "repo_01M0EZ7TB3KNXNSP78Z8M64WXG"
1010
display_name: "github-device-sync"
1111
roles:
1212
- "control-plane"
1313
lifecycle: "active"
1414

1515
provider:
1616
type: "github"
17-
installation: "installation:github-organization"
18-
repository_id: 1000000001
19-
owner: "example-org"
17+
installation: "installation:github-opennetwork"
18+
repository_id: 1335994527
19+
owner: "NDDev-OpenNetwork"
2020
name: "github-device-sync"
2121

2222
classification:
@@ -27,10 +27,9 @@ classification:
2727

2828
product:
2929
purpose: >-
30-
GDS is a control plane for a multi-owner GitHub estate: it holds the desired
31-
state of every repository, device and installation, compiles it into
32-
per-repository projections, and applies provider changes as approved,
33-
journaled, content-addressed transactions.
30+
GDS is the public engine for a multi-owner GitHub estate. It loads an
31+
external estate root, compiles deterministic projections and executes
32+
journaled, content-addressed provider transactions.
3433
capabilities:
3534
- "Compile canonical estate intent into deterministic per-repository projections"
3635
- "Resolve where a checkout sits in the estate and which policy governs it"

‎.github/workflows/gds-ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# GENERATED FILE - DO NOT EDIT DIRECTLY
22
# generator: gds
33
# bundle: 0.4.0-dev
4-
# source-tree-digest: sha256:34d52b7f9f301e146a8633cc7bf4e7e05ff45a630bbf3183d1e1e695e4ce5730
5-
# input-digest: sha256:6b11cff602b0301d23c950660ac8fbb482bfb9e728db2380a2e0f0ccb318e0c3
4+
# source-tree-digest: sha256:e6c3dab78cef49948ffeadd5c94271e6844424531f652ce366dc0a9c2f5f2b3e
5+
# input-digest: sha256:c51495582a0accdbd10c58ff852e62f60ac12c83d736d5587db1a340b863d905
66
# output-digest: sha256:f6f173457cc65a195b469109188c6de024ca0ea212327c2d725a165fa64fb67f
77
# edit-source:
88
# - .gds/repository.yaml

‎AGENTS.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
GENERATED FILE - DO NOT EDIT DIRECTLY
33
generator: gds
44
bundle: 0.4.0-dev
5-
source-tree-digest: sha256:34d52b7f9f301e146a8633cc7bf4e7e05ff45a630bbf3183d1e1e695e4ce5730
6-
input-digest: sha256:6b11cff602b0301d23c950660ac8fbb482bfb9e728db2380a2e0f0ccb318e0c3
7-
output-digest: sha256:d62e4493e9f0b9b6b63c223327f595943f5c7c7e970e6ceb874ed7de8eb128da
5+
source-tree-digest: sha256:e6c3dab78cef49948ffeadd5c94271e6844424531f652ce366dc0a9c2f5f2b3e
6+
input-digest: sha256:c51495582a0accdbd10c58ff852e62f60ac12c83d736d5587db1a340b863d905
7+
output-digest: sha256:5b65d5e1cb64f992e99e166a488206fac54b4b4e345cdfe795195290d5bd230d
88
edit-source:
99
- .gds/repository.yaml
1010
- policies/base/repository-default.yaml
@@ -16,7 +16,7 @@ edit-source:
1616
-->
1717
# Repository brief
1818

19-
GDS is a control plane for a multi-owner GitHub estate: it holds the desired state of every repository, device and installation, compiles it into per-repository projections, and applies provider changes as approved, journaled, content-addressed transactions.
19+
GDS is the public engine for a multi-owner GitHub estate. It loads an external estate root, compiles deterministic projections and executes journaled, content-addressed provider transactions.
2020

2121
## What it does
2222

@@ -64,6 +64,6 @@ GDS is a control plane for a multi-owner GitHub estate: it holds the desired sta
6464

6565
## Facts
6666

67-
- Repository `repo_01JEXAMPZ0000000000000000A`, roles `control-plane`, bundle `0.4.0-dev`.
67+
- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.4.0-dev`.
6868
- Canonical inputs: `.gds/repository.yaml`; compiled result: `.gds/compiled-policy.json`.
6969
- Visibility `public`, data `public`.

‎core/app/github_governance_operations_test.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@ func TestGitHubGovernancePlanIsReadyAndMissingWriteRuntimeFailsBeforeMutation(t
4444
options := GitHubGovernanceOperationOptions{
4545
GitHubGovernanceOptions: GitHubGovernanceOptions{
4646
GitHubReadOptions: GitHubReadOptions{
47-
RuntimeConfig: runtimePath, InstallationID: "installation:github-organization",
47+
RuntimeConfig: runtimePath, InstallationID: "installation:github-opennetwork",
4848
},
49-
Owner: "example-org", Repository: "github-device-sync",
49+
Owner: "NDDev-OpenNetwork", Repository: "github-device-sync",
5050
},
5151
ProjectionOperationOptions: ProjectionOperationOptions{
5252
StatePath: statePath, DeviceID: "device_01JEXAMPZ00000000000000000",
@@ -80,9 +80,9 @@ func TestGitHubGovernanceObserverUsesPlanBoundEstateRoot(t *testing.T) {
8080
}
8181
observer := githubGovernanceObserver{
8282
services: services, root: root, estateRoot: filepath.Join(t.TempDir(), "missing-estate"),
83-
repositoryID: "repo_01JEXAMPZ0000000000000000A", providerID: 1000000001,
84-
owner: "example-org", name: "github-device-sync",
85-
installation: "installation:github-organization",
83+
repositoryID: "repo_01M0EZ7TB3KNXNSP78Z8M64WXG", providerID: 1335994527,
84+
owner: "NDDev-OpenNetwork", name: "github-device-sync",
85+
installation: "installation:github-opennetwork",
8686
}
8787
_, err = observer.Observe(context.Background(), observer.repositoryID)
8888
if err == nil || !strings.Contains(err.Error(), "policy does not compile") {
@@ -99,20 +99,20 @@ func appGovernanceOperationServer(t *testing.T) *httptest.Server {
9999
strings.TrimPrefix(request.URL.Path, "/app/installations/"), "/access_tokens",
100100
)
101101
_, _ = fmt.Fprintf(writer, `{"token":"ghs_%s","expires_at":"2099-01-01T00:00:00Z","permissions":{"actions":"read","administration":"read","checks":"read","contents":"read","metadata":"read","pull_requests":"read"},"repository_selection":"all"}`, providerID)
102-
case request.URL.Path == "/repos/example-org/github-device-sync":
102+
case request.URL.Path == "/repos/NDDev-OpenNetwork/github-device-sync":
103103
_, _ = writer.Write([]byte(`{
104-
"id": 1000000001,
104+
"id": 1335994527,
105105
"node_id": "R_gds",
106106
"name": "github-device-sync",
107-
"full_name": "example-org/github-device-sync",
107+
"full_name": "NDDev-OpenNetwork/github-device-sync",
108108
"private": false,
109109
"visibility": "public",
110110
"fork": false,
111111
"archived": false,
112112
"disabled": false,
113113
"default_branch": "main",
114-
"html_url": "https://github.com/example-org/github-device-sync",
115-
"owner": {"login": "example-org"},
114+
"html_url": "https://github.com/NDDev-OpenNetwork/github-device-sync",
115+
"owner": {"login": "NDDev-OpenNetwork"},
116116
"allow_merge_commit": true,
117117
"allow_squash_merge": false,
118118
"allow_rebase_merge": true,
@@ -128,7 +128,7 @@ func appGovernanceOperationServer(t *testing.T) *httptest.Server {
128128
case strings.HasSuffix(request.URL.Path, "/actions/permissions/workflow"):
129129
_, _ = writer.Write([]byte(`{"default_workflow_permissions":"read","can_approve_pull_request_reviews":false}`))
130130
case strings.HasSuffix(request.URL.Path, "/actions/permissions/selected-actions"):
131-
_, _ = writer.Write([]byte(`{"github_owned_allowed":true,"verified_allowed":false,"patterns_allowed":["example-org/ci-workflows/.github/workflows/*@*"]}`))
131+
_, _ = writer.Write([]byte(`{"github_owned_allowed":true,"verified_allowed":false,"patterns_allowed":["NDDev-OpenNetwork/ci-workflows/.github/workflows/*@*"]}`))
132132
case strings.HasSuffix(request.URL.Path, "/actions/permissions"):
133133
_, _ = writer.Write([]byte(`{"enabled":true,"allowed_actions":"selected","sha_pinning_required":true}`))
134134
case strings.HasSuffix(request.URL.Path, "/rulesets"):

‎core/app/github_projection_operations_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -98,22 +98,22 @@ func appProjectionOperationServer(t *testing.T) *httptest.Server {
9898
strings.TrimPrefix(request.URL.Path, "/app/installations/"), "/access_tokens",
9999
)
100100
_, _ = fmt.Fprintf(writer, `{"token":"ghs_%s","expires_at":"2099-01-01T00:00:00Z","permissions":{"actions":"read","administration":"read","checks":"read","contents":"read","metadata":"read","pull_requests":"read"},"repository_selection":"all"}`, providerID)
101-
case request.URL.Path == "/repos/example-org/github-device-sync":
101+
case request.URL.Path == "/repos/NDDev-OpenNetwork/github-device-sync":
102102
_, _ = writer.Write([]byte(`{
103-
"id": 1000000001,
103+
"id": 1335994527,
104104
"node_id": "R_gds",
105105
"name": "github-device-sync",
106-
"full_name": "example-org/github-device-sync",
106+
"full_name": "NDDev-OpenNetwork/github-device-sync",
107107
"private": false,
108108
"visibility": "public",
109109
"fork": false,
110110
"archived": false,
111111
"disabled": false,
112112
"default_branch": "main",
113-
"html_url": "https://github.com/example-org/github-device-sync",
114-
"owner": {"login": "example-org"}
113+
"html_url": "https://github.com/NDDev-OpenNetwork/github-device-sync",
114+
"owner": {"login": "NDDev-OpenNetwork"}
115115
}`))
116-
case request.URL.Path == "/repos/example-org/github-device-sync/git/ref/heads/main":
116+
case request.URL.Path == "/repos/NDDev-OpenNetwork/github-device-sync/git/ref/heads/main":
117117
_, _ = fmt.Fprintf(writer, `{"ref":"refs/heads/main","object":{"sha":%q}}`, baseSHA)
118118
case strings.Contains(request.URL.Path, "/git/ref/heads/gds/projection-"):
119119
http.NotFound(writer, request)

‎core/app/github_readonly_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ func TestGitHubInventoryAndReconciliationUseLiveReadOnlyRuntime(t *testing.T) {
7272
})
7373
summaryData, ok := summary.Data.(EstateSummaryReport)
7474
if summary.ExitClass != domain.ExitSuccess || !ok || summaryData.Repositories != 5 ||
75-
summaryData.ManagementModes["observe-only"] != 4 ||
76-
summaryData.ManagementModes["managed"] != 1 ||
75+
summaryData.ManagementModes["observe-only"] != 3 ||
76+
summaryData.ManagementModes["managed"] != 2 ||
7777
summaryData.IdentityStates["unassigned"] != 5 ||
7878
summaryData.DriftByClass["identity"] != 5 {
7979
t.Fatalf("summary=%#v", summary)

‎core/app/repository_provider_lifecycle_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ func TestRepositoryRenamePlanBindsProviderRemoteAndRejectsInsecureMutationRuntim
4040
}
4141
remote := exec.Command(
4242
"git", "remote", "set-url", "origin",
43-
"https://github.com/example-org/github-device-sync.git",
43+
"https://github.com/NDDev-OpenNetwork/github-device-sync.git",
4444
)
4545
remote.Dir = root
4646
if output, err := remote.CombinedOutput(); err != nil {
@@ -51,9 +51,9 @@ func TestRepositoryRenamePlanBindsProviderRemoteAndRejectsInsecureMutationRuntim
5151
if err != nil {
5252
t.Fatal(err)
5353
}
54-
oldProvider := " owner: \"example-org\"\n name: \"github-device-sync\"\n\nclassification:"
55-
newProvider := " owner: \"example-org\"\n name: \"github-device-sync-renamed\"\n" +
56-
" aliases:\n - owner: \"example-org\"\n name: \"github-device-sync\"\n\nclassification:"
54+
oldProvider := " owner: \"NDDev-OpenNetwork\"\n name: \"github-device-sync\"\n\nclassification:"
55+
newProvider := " owner: \"NDDev-OpenNetwork\"\n name: \"github-device-sync-renamed\"\n" +
56+
" aliases:\n - owner: \"NDDev-OpenNetwork\"\n name: \"github-device-sync\"\n\nclassification:"
5757
candidate := strings.Replace(string(current), oldProvider, newProvider, 1)
5858
if candidate == string(current) {
5959
t.Fatal("fixture provider locator was not replaced")
@@ -123,8 +123,8 @@ func TestRepositoryRenamePlanBindsProviderRemoteAndRejectsInsecureMutationRuntim
123123
}
124124
_, remoteName, expectedURL, targetURL, err := gitops.RemoteUpdateStep(data.Plan.Steps[1])
125125
if err != nil || remoteName != "origin" ||
126-
expectedURL != "https://github.com/example-org/github-device-sync.git" ||
127-
targetURL != "https://github.com/example-org/github-device-sync-renamed.git" {
126+
expectedURL != "https://github.com/NDDev-OpenNetwork/github-device-sync.git" ||
127+
targetURL != "https://github.com/NDDev-OpenNetwork/github-device-sync-renamed.git" {
128128
t.Fatalf("remote step expected=%q target=%q remote=%q err=%v", expectedURL, targetURL, remoteName, err)
129129
}
130130
applied := services.ApplyRepositoryTransition(

0 commit comments

Comments
 (0)