Tahinli/forge
public0 watching
★ 0
| 1 | # Backlog (ordered by value; the orchestrator picks from the top) |
| 2 | |
| 3 | Status: `[ ]` todo, `[~]` in progress, `[x]` done. |
| 4 | |
| 5 | ## Now |
| 6 | - [x] Branch protection rules (force-push and deletion per pattern) |
| 7 | - [x] M3: issues, comments, labels, milestones, assignees, `#N`/`@user` linking, closing keywords from commits |
| 8 | |
| 9 | ## Next: repo management (small, high value) |
| 10 | - [x] Repo settings: description, website, visibility toggle (public/private), default branch change, archive/unarchive |
| 11 | - [x] Repo rename (with `repo_redirects` so old URLs and clone URLs keep working) and transfer to another user |
| 12 | - [x] Collaborators UI: add/remove users with a role (Read, Triage, Write, Maintain, Admin) |
| 13 | - [x] Explore page: list public repos, search by name |
| 14 | - [x] Stars (star/unstar, count, "starred" tab on profile) |
| 15 | |
| 16 | ## Security and accounts |
| 17 | - [x] Login throttling / rate limiting (per IP and per account) for login, git HTTP auth and token auth |
| 18 | - [x] TOTP 2FA with recovery codes (the schema is ready for it) |
| 19 | - [x] User deletion with ghost-user reassignment of issues and comments |
| 20 | - [x] Password change, email change, admin password reset |
| 21 | - [x] Audit log (security-relevant events: logins, key and token changes, deletions, protection changes) |
| 22 | |
| 23 | ## M4: pull requests |
| 24 | - [x] Forks (`git clone --bare --local`, hardlinked objects, no alternates) and same-repo branch PRs |
| 25 | - [x] `refs/pull/N/head`, mergeability via `merge-tree --write-tree`, three-dot diff, merge strategies (merge, squash, ff) with CAS ref update |
| 26 | - [x] PR list, compare page (forks read via `GIT_ALTERNATE_OBJECT_DIRECTORIES`, no writes on GET), PR view with commits and files tabs, editing |
| 27 | - [x] PR end-to-end test over real git; merge errors shown in the merge box |
| 28 | - [x] M4b: reviews (approve / request changes / comment), line comments on the files tab, outdated marking |
| 29 | - [x] "Recent pushes: Compare & pull request" banner on the repo home |
| 30 | - [x] Delete the head branch after merge (button) |
| 31 | - [x] Required approvals and other merge rules as part of branch protection |
| 32 | - [x] Review line-position remapping (outdated is per file today), dismissed reviews keep their original verb |
| 33 | |
| 34 | ## M5: integrations and reliability |
| 35 | - [x] Webhooks (HMAC-SHA256, delivery log, retries, SSRF guard) |
| 36 | - [x] Webhook follow-ups: audit entries, sent headers in the delivery log |
| 37 | - [x] Notifications (in-app inbox for mentions, assignments, comments on watched issues) |
| 38 | - [x] Push and pull mirrors (contract: `docs/mirrors-interfaces.md`) |
| 39 | - [x] Mirror follow-ups: add a pull mirror in settings to an empty repo; e2e pull over real HTTP; pin git's DNS to the checked address (rebinding race) |
| 40 | - [x] Backups: verified sets (DB snapshot + bundles), scheduler with retention and healthchecks, `fsck` schedule, `/admin/backups`, restore command, `docs/backup.md` |
| 41 | - [x] Replication to the standby (`push --mirror` after each push, hourly reconcile by refs checksum, DB snapshots; `/admin/replication`; runbook in `docs/backup.md`) |
| 42 | - [x] Commit status API (for the future CI runner) |
| 43 | |
| 44 | ## M3 follow-ups |
| 45 | - [x] Edit history viewer: an "edited" marker linking to past versions (store read fn for `edit_history`) |
| 46 | - [x] Default label set on repo creation (bug, enhancement, documentation, …) |
| 47 | - [x] Issue reactions |
| 48 | - [x] Issue locking (reactions must then hide buttons), issue templates, pinned issues |
| 49 | |
| 50 | - [x] The "Archived" banner shows only on the repo home and settings pages; `repo_head` should take the Repo (or RepoCtx) so every repo page gets it automatically |
| 51 | |
| 52 | ## Tech debt |
| 53 | - [x] A shared test fixture `test_support::app(dir) -> (AppState, Router)`: Config and AppState literals are copied into about 8 test modules, and every new field breaks them all |
| 54 | - [x] Store read pool: one writer connection plus 4 `query_only` readers (`Store::read_conn`); pure-SELECT functions use the readers (rules in the `Store` doc comment, proof in `crates/forge-core/tests/read_pool.rs`) |
| 55 | - [x] Login and git auth throttling (`throttle.rs`, `client_ip.rs`, `trusted_proxies`) |
| 56 | |
| 57 | ## Later |
| 58 | - [x] Releases with attachments (object_store), LFS (batch API, SSH `git-lfs-authenticate`, pointer display, `admin lfs-gc`) |
| 59 | - [x] Code search |
| 60 | - [x] Signed commit verification (SSH/GPG) badges |
| 61 | - [x] Compression for HTML pages (tower-http layer with a text-only, path-excluding policy; `docs/architecture.md` §5.6) |
| 62 | |
| 63 | ## M6: CI (contract: `docs/ci-interfaces.md`) |
| 64 | - [x] `forge-ci` crate: `.forge/ci.toml` parsing and validation, triggers, runner protocol types, secret masking |
| 65 | - [x] Schema and store: runners, registration tokens, runs, jobs, artifacts, sealed secrets |
| 66 | - [x] Scheduling on push, tag, PR and manual runs; fork PR approval; commit statuses; lost-runner reaper; retention |
| 67 | - [x] Runner API: register, long-poll claim, logs, heartbeat and cancel, artifacts, finish; job-token git read |
| 68 | - [x] Run, job and live-log pages; cancel, re-run, approve; artifact downloads |
| 69 | - [x] Repo secrets settings page and `/admin/runners` |
| 70 | - [x] `forge-runner` binary: rootless podman executor, workspace checkout, log streaming, artifacts, timeouts |
| 71 | - [x] CI end-to-end test and `docs/ci.md` |
| 72 | |
| 73 | ## Runner without podman (contract: `docs/ci-builtin-executor.md`) |
| 74 | - [x] Images: in-process registry pull, digest-verified blob cache, safe layer unpacking (whiteouts, no escapes), GC |
| 75 | - [x] Sandbox: `forge-runner __sandbox` helper on youki `libcontainer` (rootless userns, pure-Rust seccomp via seccompiler, no caps, overlay rootfs, cgroup limits) |
| 76 | - [x] `BuiltinExecutor` as the default, `forge-runner check`, runner config and `docs/ci.md` updates |
| 77 | |
| 78 | ## CI sandbox v2 (contract: `docs/ci-sandbox-v2.md`) |
| 79 | - [x] Subordinate id mapping via newuidmap/newgidmap, auto fallback to single uid, `__sandbox-rm` |
| 80 | - [x] Image layers unpacked with real ownership inside the mapped userns (`__sandbox-unpack`) |
| 81 | - [x] Sandbox, executor, config (`[sandbox] userns`), `check` and docs use the mapping |
| 82 | |
| 83 | ## Wave C (contract: `docs/wave-c-interfaces.md`) |
| 84 | - [x] O1 organizations core (accounts of kind org, members, teams, authz) |
| 85 | - [x] O2 organizations UI (org pages, owner select, transfer to org) |
| 86 | - [x] M1 mail core (lettre, outbox worker, admin mail settings) |
| 87 | - [x] M2 mail flows (password reset, email verification, invites; notification emails move to M3) |
| 88 | - [x] M3 notification emails (per-user opt-out on `/settings/notifications`, threaded by Message-ID) |
| 89 | - [x] W1 wiki (git-backed, web editing, clone/push, backups/replication) |
| 90 | - [x] D1 discussions |
| 91 | - [x] S1 snippets |
| 92 | - [x] T1 theme and language preferences (dark mode toggle) |
| 93 | - [x] I18 i18n infrastructure (En/Tr) and the shell, auth and settings pages |
| 94 | - [x] I18b remaining pages translated (11 per-group key modules in i18n/, Turkish review pass done) |
| 95 | - [x] I18c shared time/size/visibility helpers localised |
| 96 | - [x] A1 security advisories (OSV, opt-in) |
| 97 | - [x] P1 repo transfer acceptance |
| 98 | - [x] LFS media route moved to `/-/media/` (branch named `media` no longer shadowed) |