datatug / backend / 38852631208
84%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 109
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 83.399%. Remained the same
38852631208

push

github

web-flow 
ci: authenticate backend private Core dependency reads (#48)

Backend CI needs separate installation credentials before DataTug Core becomes private. Preserve the existing Sneat Core/Paymentus contents-read scope and add only datatug/datatug-core through the released strongo/cicd v1.22.0 secondary-installation contract, pinned to its exact SHA.

The Firestore job mints both read-only tokens, requires Core installation membership and explicit authenticated Git access, routes credentials only to the three exact repositories, downloads Core before removing credential configuration, and disables persisted checkout credentials. The proof runs outside the checkout and uses environment-backed Git configuration so a publicly readable repository cannot hide an invalid token.

Validation: actionlint, embedded Bash syntax, and five tests executing the actual helper/proof scripts with synthetic credentials passed. Existing Firestore race/conformance command and 88% coverage gate remain unchanged. CI must prove the real App installation/access; no local keys, visibility change, deployment, or production access were used.

Source commits:

- 55dc61f87abc ci: scope backend private dependency access to both installations
- 0372df4e10bb fix(lint): quote empty Git credential-helper value (SC1007)
- ae67caa121ec ci: pin released secondary-installation workflow contract
- 06445c5779af ci: enforce exact Core installation scope and mask derived auth

Pull request: datatug/backend#48
Review: /private/tmp/context-backend48-root-review-r2.md

12605 of 15114 relevant lines covered (83.4%)

0.84 hits per line

Jobs
ID Job ID Ran Files Coverage
1 38852631208.1 109
83.4
GitHub Action Run
Source Files on build 38852631208