Skip to content

Commit a82352a

Browse files
committed
Update documentation.
1 parent 6bb3f2d commit a82352a

3 files changed

Lines changed: 144 additions & 133 deletions

File tree

README.adoc

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
== GitBark Core
2+
A collection of useful rules and subcommands for use in link:https://github.com/YubicoLabs/gitbark[GitBark].
3+
4+
=== Usage
5+
To use this package in GitBark include the package reference in the `requirements.txt` file, that should be located in the `bark_rules` branch (for more information see link:https://github.com/YubicoLabs/gitbark/blob/main/doc/Overview.adoc#bark-modules[here]). Below is an example:
6+
7+
----
8+
# requirements.txt
9+
git+https://github.com/YubicoLabs/gitbark-core.git
10+
----
11+
12+
The module can also be added interactively using the `bark add-modules` command.
13+
14+
15+
=== Commit Rules
16+
17+
==== `require_signature`
18+
19+
This rule mandates that a commit must be signed by a specific key, supporting both SSH and OpenPGP keys, including Security Keys.
20+
21+
The authorized keys are defined as one or a list of glob patterns matching the specific public key files, which should be checked into the repository and reside in `/.bark/.pubkeys/`.
22+
23+
Here is an example configuration of this rule in the `commit_rules.yaml` file:
24+
25+
[source, yaml]
26+
----
27+
rules:
28+
- require_signature:
29+
authorized_keys: [Alice.pub, Bob.pub]
30+
----
31+
In this configuration, only commits signed with Alice's or Bob's key are considered authorized.
32+
33+
==== `file_not_modified`
34+
35+
This rule prevents modification to specific fles.
36+
37+
The set of files that should remain unmodified is defined as one or more glob patterns.
38+
39+
An example configuration of this rule in the `commit_rules.yaml` file is shown below:
40+
41+
[source, yaml]
42+
----
43+
rules:
44+
- file_not_modified:
45+
pattern: sensitive.json
46+
----
47+
48+
To achieve file-level authorization one can combine this rule with `require_signature` using the `any` clause (for more information on the `any` clause see link:https://github.com/YubicoLabs/gitbark/blob/main/doc/Overview.adoc#specification[here]).
49+
50+
Here is an example of that configuration:
51+
52+
[source, yaml]
53+
----
54+
rules:
55+
- any:
56+
- file_not_modified:
57+
pattern: sensitive.json
58+
- require_signature:
59+
authorized_keys: Alice.pub
60+
----
61+
In this configuration the two rules are evaluated using OR logic, meaning that at least one of them need to be satisfied. The resulting behavior stipulates that `sensitive.json` cannot be modified unless the commit is signed by Alice.
62+
63+
==== `max_parents`
64+
This rule requires a commit to have a maximum number of parents.
65+
66+
An example configuration of this rule in the `commit_rules.yaml` file is shown below:
67+
68+
[source, yaml]
69+
----
70+
rules:
71+
- max_parents:
72+
threshold: 1
73+
----
74+
In this configuration, the rule mandates that a commit can have a maximum of one parent.
75+
76+
77+
==== `require_valid_parents`
78+
By default, not all commits are required to be valid in GitBark. The framework only ensures that a commit is validated against the rules defined in the nearest **valid** ancestor commit.
79+
80+
Using this rule you can reuire ALL parents of a commit to be valid, as seen below:
81+
82+
[source, yaml]
83+
----
84+
rules:
85+
- require_valid_parents:
86+
----
87+
88+
Optionally, you can allow non-valid parents as long as their commit hashes are included in the commit message (this makes allowing them more explicit, which prevent accidental inclusion). To accomplish this, use the `allow_explicit` parameter, as illustrated below:
89+
90+
[source, yaml]
91+
----
92+
rules:
93+
- require_valid_parents:
94+
allow_explicit: True
95+
----
96+
97+
=== Ref Rules
98+
99+
==== `require_approval`
100+
This rule requires commits on specific references to be **Approved** by a predetermined number of people.
101+
102+
An **Approved** commit is a merge commit comprising a previous commit from the target ref, followed by one or more **Approval** commits. All its approval commits must have the same tree hash as the approved commit, and must include the approved commits initial parent in their set of parents. All approval commits must also have the same set of parents, and must be valid according to their commit rules.
103+
104+
Essentially, an approval commit is a "normal" merge commit, with additional approvals being copies of the first approval, but with different authors (and possible messages). The *approved* commit is then an octo-merge commit containing the merge target, and all approval commits.
105+
106+
To configure this rule, you must define the set of authorized approvers (as a list of email addresses) and the approval threshold.
107+
108+
An example configuration of this rule in the `bark_rules.yaml` file is shown below:
109+
110+
[source, yaml]
111+
----
112+
project:
113+
- bootstrap: 80a177b2b7fc39b4dd664fcda0cd185457fbaaeb
114+
refs:
115+
- pattern: refs/heads/main
116+
rules:
117+
- require_approval:
118+
threshold: 2
119+
authorized_authors:
120+
- alice@test.com
121+
- bob@test.com
122+
----
123+
This configuration requires the HEAD commit on `refs/heads/main` to be **Approved** by Alice and Bob.
124+
125+
==== `require_fast_forward`
126+
This rule requires changes on specific references to be fast-forward only (i.e. no force pushing, linear history).
127+
128+
An example configuration of this rule is shown below:
129+
130+
[source, yaml]
131+
----
132+
project:
133+
- bootstrap: 80a177b2b7fc39b4dd664fcda0cd185457fbaaeb
134+
refs:
135+
- pattern: refs/heads/main
136+
rules:
137+
- require_fast_forward:
138+
----
139+
This configuration prevents non-fast-forward changes on `refs/heads/main`.
140+
141+
142+
143+

README.md

Lines changed: 0 additions & 132 deletions
This file was deleted.

pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ version = "0.1.0"
44
description = "Core Bark rules and commands"
55
authors = ["Elias Bonnici <elias.bonnici@yubico.com>"]
66
license = "APACHE-2.0"
7-
readme = "README.md"
7+
readme = "README.adoc"
88
packages=[{include = "bark_core"}]
99

1010
[tool.poetry.dependencies]

0 commit comments

Comments
 (0)