weichen
83561682eb
DB-backed repo_path_allowlist reader (deny-all until admin seeds), per-prefix admin test_commands (goose 00075), execution evidence table (goose 00074), isolated git-worktree patch executor with command allowlist/time/output caps and failure-stops evidence; controlled_patch creation/preview unlocked only with an allowlisted repo binding (projectworkflow gate + catalog flag); creator-only server endpoints for bindings/executions; merge/push/deploy stay behind a typed separate-authorization boundary. Module boundary: app->swboot composition import registered.
30 lines
1.2 KiB
SQL
30 lines
1.2 KiB
SQL
-- +goose Up
|
|
-- SWBOOT-10: controlled patch execution records. The executor never merges,
|
|
-- pushes or deploys; rows are audit evidence for patch/test candidates only.
|
|
|
|
CREATE TABLE IF NOT EXISTS swboot_controlled_executions (
|
|
id BIGSERIAL PRIMARY KEY,
|
|
project_id BIGINT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
|
|
requested_by BIGINT REFERENCES users(id) ON DELETE SET NULL,
|
|
repo_path TEXT NOT NULL,
|
|
base_ref TEXT NOT NULL DEFAULT '',
|
|
worktree_path TEXT NOT NULL DEFAULT '',
|
|
branch TEXT NOT NULL DEFAULT '',
|
|
status TEXT NOT NULL DEFAULT 'pending',
|
|
patches_applied INT NOT NULL DEFAULT 0,
|
|
files_json JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
commands_json JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
error TEXT NOT NULL DEFAULT '',
|
|
started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
finished_at TIMESTAMPTZ,
|
|
CONSTRAINT chk_swboot_exec_status
|
|
CHECK (status IN ('pending', 'succeeded', 'failed'))
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_swboot_exec_project
|
|
ON swboot_controlled_executions (project_id, started_at DESC);
|
|
|
|
-- +goose Down
|
|
-- record retention: do not drop evidence tables
|
|
SELECT 1;
|