chore: sync the fork with upstream main

.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
           version: 10
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
 
@@ -82,7 +82,7 @@ jobs:
           version: 10
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
       - name: Build the SPA and the SDK

.gitignore

@@ -11,6 +11,7 @@ target/
 
 # local review dumps (findings, smoketests, notes — not for the repo)
 .review/
+reports/
 
 # built web assets (embedded into the binary at build time; `just web-build`)
 web/dist/

Cargo.toml

@@ -60,11 +60,6 @@ must_use_candidate = "allow"
 similar_names = "allow"
 too_many_lines = "allow"
 
-# Every site is an integer widened to f64 for a ratio, a gauge, or a human-readable
-# size. There is no lossless spelling to migrate to, so the lint only ever asks for
-# an #[allow] at the cast.
-cast_precision_loss = "allow"
-
 [workspace.dependencies]
 walgit-proto = { path = "crates/walgit-proto" }
 walgit-store = { path = "crates/walgit-store" }

README.md

@@ -141,7 +141,7 @@ each repository one maintainer (placement globs) and you are done.
 
 | mode | who gets in | how git authenticates |
 |---|---|---|
-| `none` | everyone is `anon` with write — loopback experiments | nothing |
+| `none` | everyone is `anon` with write and admin — loopback experiments | nothing |
 | `token` | static `tokens` in the config (`token_env` reads the secret from the environment) | `Authorization: Bearer <token>`, or the token as an HTTP Basic password |
 | `oidc` | any OpenID Connect issuer (`issuer`, `oauth_client_id/secret`, `allowed_domains`/`allowed_emails`): Google, Entra, Okta, Auth0, Keycloak, Dex, GitLab… | a **walgit access token**: sign in once in the browser, create one at `/_auth/tokens`, paste it into the installer. Stateless (HMAC with `session_secret`, `access_token_ttl`); rotating the secret revokes all. ID tokens from the issuer (`audiences`) and static `tokens` work too. |
 
@@ -156,7 +156,8 @@ and turns on `transfer.bundleURI`. `?repo=owner/name` clones right after.
 just test          # fast hermetic tier (< 1 min): unit + quick integration, in-memory store, real git
 just e2e           # real git against the server (~20 s)
 just warnings      # zero rustc warnings across all targets
-just ci            # all of the above
+just clippy        # the [workspace.lints] set across all targets, warnings are errors
+just ci            # warnings, clippy, test, e2e: everything that must be green before a merge
 cargo test -p walgit-server --test sim     # fault-injection simulation (crashes, partitions, stale reads)
 just test-s3       # store contract against local rustfs
 ```

crates/walgit-bundle/src/lib.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::unused_self, clippy::doc_lazy_continuation)]
 //! bundle-uri: scheduled full/incremental bundle strategies, bundle list.
 //! See AGENTS.md Phase 5 and docs/CONTRACT.md `walgit-bundle`.
 //!
@@ -6,9 +7,9 @@
 //! The [`Bundler`] is the public entry point. It depends on a [`BundleSource`]
 //! trait that provides repo-scoped access (local git repo + [`Prefixed`] store
 //! + `head_seq`). When `walgit_wal::Registry` lands it will implement
-//!   `BundleSource` (impl lives in this crate) and the `new` signature will
-//!   accept `Arc<Registry>` directly. Until then, [`Bundler::new_with_source`]
-//!   accepts any `BundleSource` impl (used by tests).
+//! `BundleSource` (impl lives in this crate) and the `new` signature will
+//! accept `Arc<Registry>` directly. Until then, [`Bundler::new_with_source`]
+//! accepts any `BundleSource` impl (used by tests).
 //!
 //! The core operations in [`ops`] take a [`walgit_git::LocalRepo`] + [`Prefixed`]
 //! store so they are unit-testable with upstream `git` + [`MemoryStore`] without
@@ -190,6 +191,7 @@ impl Bundler {
     }
 
     fn find_strategy<'a>(
+        &self,
         cfg: &'a Config,
         name: &str,
     ) -> Result<&'a walgit_config::BundleStrategy, BundleError> {
@@ -234,7 +236,7 @@ impl Bundler {
         cut: &ops::Cut,
     ) -> Result<BundleEntry, BundleError> {
         let cfg = self.cfg_for(handle);
-        let strat = Self::find_strategy(cfg, strategy_name)?;
+        let strat = self.find_strategy(cfg, strategy_name)?;
         let store = &handle.store;
         let refs = slots::default_refs(&cfg.bundles, strat);
 
@@ -299,7 +301,7 @@ impl Bundler {
                     .map(|t| t.oid.clone())
                     .collect();
                 let commits = ops::count_commits(&handle.local, &tip_oids, &prerequisites).await?;
-                metrics::histogram!("walgit_bundle_commits", "strategy" => strategy_name.to_string()).record(commits as f64);
+                metrics::histogram!("walgit_bundle_commits", "strategy" => strategy_name.to_string()).record(metric_u64(commits));
                 tracing::info!(
                     strategy = strategy_name,
                     slot = cut.slot,
@@ -636,7 +638,7 @@ impl Bundler {
     ) -> Result<Option<BundleEntry>, BundleError> {
         let mut handle = self.source.open_repo(id).await?;
         let cfg = self.cfg_for(&handle).clone();
-        let strat = Self::find_strategy(&cfg, strategy)?.clone();
+        let strat = self.find_strategy(&cfg, strategy)?.clone();
         let strat = &strat;
         let store = handle.store.clone();
         let Some(lease) = ops::try_acquire_lease(&store, &strat.name, self.lease_ttl).await? else {
@@ -824,6 +826,13 @@ impl Bundler {
     }
 }
 
+/// Metrics use `f64`; values beyond its exact integer range are still useful as
+/// approximate counters.
+#[allow(clippy::cast_precision_loss)]
+fn metric_u64(value: u64) -> f64 {
+    value as f64
+}
+
 // ---------------------------------------------------------------------------
 // BundleSource impl for walgit_wal::Registry (behind 'wal' feature)
 // ---------------------------------------------------------------------------

crates/walgit-bundle/src/ops.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::needless_continue, clippy::too_many_arguments)]
 //! Core bundling operations: ref resolution, bundle creation, store upload,
 //! bundle-list CAS management, pruning, and per-strategy leasing.
 //!
@@ -70,7 +71,7 @@ pub(crate) fn filter_refs(snap: &RefSnapshotData, patterns: &[String]) -> (Vec<S
     let effective: Vec<&str> = if patterns.is_empty() {
         vec!["refs/heads/*", "refs/tags/*", "HEAD"]
     } else {
-        patterns.iter().map(String::as_str).collect()
+        patterns.iter().map(std::string::String::as_str).collect()
     };
 
     let mut ref_names = Vec::new();
@@ -230,12 +231,12 @@ pub async fn create_bundle(
         "--stdout",
     ]
     .iter()
-    .map(ToString::to_string)
+    .map(std::string::ToString::to_string)
     .collect();
     if let Some(f) = filter {
         po_args.push(format!("--filter={f}"));
     }
-    let po_args: Vec<&str> = po_args.iter().map(String::as_str).collect();
+    let po_args: Vec<&str> = po_args.iter().map(std::string::String::as_str).collect();
     let mut child = git(&po_args)
         .stdin(std::process::Stdio::piped())
         .stdout(std::process::Stdio::piped())
@@ -247,7 +248,7 @@ pub async fn create_bundle(
         let mut stdin = child
             .stdin
             .take()
-            .ok_or_else(|| BundleError::Io("git pack-objects stdin".into()))?;
+            .ok_or_else(|| BundleError::Io("git pack-objects stdin was not piped".into()))?;
         stdin
             .write_all(revs.as_bytes())
             .await
@@ -268,12 +269,16 @@ pub async fn create_bundle(
     let mut stdout = child
         .stdout
         .take()
-        .ok_or_else(|| BundleError::Io("git pack-objects stdout".into()))?;
+        .ok_or_else(|| BundleError::Io("git pack-objects stdout was not piped".into()))?;
     let mut first = [0u8; 12];
     tokio::io::AsyncReadExt::read_exact(&mut stdout, &mut first)
         .await
         .map_err(|e| BundleError::Io(format!("pack header: {e}")))?;
-    let objects = u32::from_be_bytes([first[8], first[9], first[10], first[11]]);
+    let count_bytes: [u8; 4] = first
+        .get(8..12)
+        .and_then(|bytes| bytes.try_into().ok())
+        .ok_or_else(|| BundleError::Other("pack header lacks an object count".into()))?;
+    let objects = u32::from_be_bytes(count_bytes);
     {
         use tokio::io::AsyncWriteExt;
         file.write_all(&first)
@@ -332,7 +337,10 @@ pub fn bundle_checksum_file(path: &std::path::Path) -> std::io::Result<String> {
         if n == 0 {
             break;
         }
-        hasher.update(buf.get(..n).unwrap_or_default());
+        let chunk = buf
+            .get(..n)
+            .ok_or_else(|| std::io::Error::other("read exceeded checksum buffer"))?;
+        hasher.update(chunk);
     }
     Ok(hex::encode(hasher.finalize()))
 }
@@ -460,6 +468,7 @@ where
                         Ok(meta) => return Ok(Some((meta.version, new_list))),
                         Err(StoreError::PreconditionFailed { .. }) => {
                             debug!(attempt, "cas retry: list created by another writer");
+                            continue;
                         }
                         Err(e) => return Err(e.into()),
                     }
@@ -482,6 +491,7 @@ where
                             Ok(new_meta) => return Ok(Some((new_meta.version, new_list))),
                             Err(StoreError::PreconditionFailed { .. }) => {
                                 debug!(attempt, "cas retry: list changed by another writer");
+                                continue;
                             }
                             Err(e) => return Err(e.into()),
                         }
@@ -800,7 +810,7 @@ pub async fn build_and_upload(
             build_span.record("bytes", s);
             build_span.record("outcome", "ok");
             metrics::histogram!("walgit_bundle_build_seconds", "strategy" => strategy_name.to_string(), "kind" => match kind { BundleKind::Full => "full", BundleKind::Incremental => "incremental" }).record(t_build.elapsed().as_secs_f64());
-            metrics::histogram!("walgit_bundle_build_bytes", "strategy" => strategy_name.to_string()).record(s as f64);
+            metrics::histogram!("walgit_bundle_build_bytes", "strategy" => strategy_name.to_string()).record(metric_u64(s));
             s
         }
         Err(BundleError::Git(GitError::Subprocess { stderr, .. }))
@@ -884,6 +894,13 @@ pub async fn build_and_upload(
     Ok(entry)
 }
 
+/// Metrics use `f64`; values beyond its exact integer range are still useful as
+/// approximate byte counts.
+#[allow(clippy::cast_precision_loss)]
+fn metric_u64(value: u64) -> f64 {
+    value as f64
+}
+
 /// Find the most recent bundle entry for `strategy` in `list`.
 pub fn last_for_strategy<'a>(list: &'a BundleList, strategy: &str) -> Option<&'a BundleEntry> {
     list.bundles
@@ -1012,10 +1029,6 @@ pub fn full_bundle_header(
     (h, tips)
 }
 
-#[allow(
-    clippy::too_many_arguments,
-    reason = "one parameter per input the compose needs; a wrapper struct would only be built and destructured at the call sites"
-)]
 /// Publish `bundles/<strategy>/<stamp>-<pack>.bundle` = header ∘ `wal/<pack>.pack`
 /// by compose (falls back to streaming header + `pack_path` when the store
 /// cannot compose; then `pack_path` must be a local file) and return the entry

crates/walgit-bundle/src/render.rs

@@ -1,10 +1,10 @@
+#![allow(clippy::too_many_arguments)]
 //! Render the bundle list in git's bundle-list config format and protocol v2
 //! key=value lines.
 //!
 //! See: <https://git-scm.com/docs/bundle-uri> and
 //!      <https://git-scm.com/docs/gitprotocol-v2> (bundle-uri command).
 
-use std::fmt::Write as _;
 use std::time::Duration;
 
 use walgit_config::{BundleServe, BundlesConfig};
@@ -54,10 +54,11 @@ static SIGNING_WARNED: std::sync::LazyLock<std::sync::Mutex<std::collections::Ha
 
 fn warn_signing_once(owner: &str, repo: &str, e: &dyn std::fmt::Display) {
     let key = format!("{owner}/{repo}");
-    let mut seen = SIGNING_WARNED
+    if SIGNING_WARNED
         .lock()
-        .unwrap_or_else(std::sync::PoisonError::into_inner);
-    if seen.insert(key.clone()) {
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .insert(key.clone())
+    {
         tracing::warn!(repo = %key, error = %e, "signed bundle URL failed; serving proxy URIs instead (check the store signing permissions)");
     }
 }
@@ -81,10 +82,6 @@ fn proxy_uri(entry: &BundleEntry, owner: &str, repo: &str, base_url: &str) -> St
     )
 }
 
-#[allow(
-    clippy::too_many_arguments,
-    reason = "one parameter per input the render needs; a wrapper struct would only be built and destructured at the call sites"
-)]
 /// Render the bundle list as git config text (bundle-list format).
 ///
 /// ```ini
@@ -140,11 +137,26 @@ pub async fn render_list_text(
         )
         .await?;
         out.push('\n');
-        let _ = writeln!(out, "[bundle \"{}\"]", entry.id);
-        let _ = writeln!(out, "    uri = {uri}");
-        let _ = writeln!(out, "    creationToken = {}", entry.creation_token);
+        {
+            let _ =
+                std::fmt::Write::write_fmt(&mut out, format_args!("[bundle \"{}\"]\n", entry.id));
+        };
+        {
+            let _ = std::fmt::Write::write_fmt(&mut out, format_args!("    uri = {uri}\n"));
+        };
+        {
+            let _ = std::fmt::Write::write_fmt(
+                &mut out,
+                format_args!("    creationToken = {}\n", entry.creation_token),
+            );
+        };
         if !entry.filter.is_empty() {
-            let _ = writeln!(out, "    filter = {}", entry.filter);
+            {
+                let _ = std::fmt::Write::write_fmt(
+                    &mut out,
+                    format_args!("    filter = {}\n", entry.filter),
+                );
+            };
         }
     }
 

crates/walgit-bundle/src/schedule.rs

@@ -28,7 +28,7 @@ fn to_chrono(t: SystemTime) -> DateTime<Utc> {
 
 /// Convert a chrono UTC datetime back to [`SystemTime`].
 fn to_system(dt: DateTime<Utc>) -> SystemTime {
-    UNIX_EPOCH + Duration::from_secs(u64::try_from(dt.timestamp().max(0)).unwrap_or(0))
+    UNIX_EPOCH + Duration::from_secs(dt.timestamp().max(0).unsigned_abs())
 }
 
 /// Next fire time of `schedule` strictly after `after`, or `None` if the

crates/walgit-bundle/src/slots.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::doc_lazy_continuation)]
 //! Calendar-slot scheduling with backfill.
 //!
 //! A strategy's cron expression defines **slots** (its fire times). Each
@@ -181,7 +182,7 @@ pub fn base_for_slot_chain<'a>(
 /// * `chain = true`: this strategy's own newest bundle before the slot, **if it is newer than
 ///   that base** (dailies chain from the weekly onwards; hourlies restart from every new daily
 ///   instead of chaining across it); else the base.
-///   `slot = 0` (a manual cut, "now"): the same with the newest bundles overall.
+/// `slot = 0` (a manual cut, "now"): the same with the newest bundles overall.
 pub fn base_for_incremental<'a>(
     cfg: &BundlesConfig,
     list: &'a BundleList,
@@ -598,7 +599,7 @@ mod tests {
     }
     fn t(s: &str) -> SystemTime {
         let dt = chrono::DateTime::parse_from_rfc3339(s).unwrap();
-        from_epoch(u64::try_from(dt.timestamp()).unwrap_or(0))
+        from_epoch(dt.timestamp().max(0).unsigned_abs())
     }
     fn entry(strategy: &str, slot: u64, base_id: &str) -> BundleEntry {
         BundleEntry {