LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Process: no CODEOWNERS or required review — a single push to lotus deploys to production in ~11 minutes #100

New Issue
Closed
opened 2026-09-12 01:57:47 -04:00 by jared · 1 comment
jared commented 2026-09-12 01:57:47 -04:00
Owner
Copy Link
Copy Source

Location: repo settings (no branch protection on lotus, no CODEOWNERS), README.md "edit → commit → git push → ~11 min → live"

Problem

This is a deliberate velocity trade-off and may be exactly right for the team size, so this issue is a decision point rather than a defect. As it stands, any collaborator's direct push to lotus reaches every user with no second pair of eyes; combined with the upstream-merge bypass it means production can change with zero review and zero CI.

Suggested fix

At minimum, enable Gitea branch protection on lotus requiring the Build & Quality Checks status to pass before push (this alone closes the cancelled-run and merge-script gaps). Optionally require one approval for changes under src/app/features/call, src/app/utils/searchCache.ts, src/app/state/sessions.ts, and src/client/ — the areas where this audit found the security-relevant bugs — via a CODEOWNERS file.

Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).

**Location:** repo settings (no branch protection on `lotus`, no `CODEOWNERS`), `README.md` "edit → commit → git push → ~11 min → live" ### Problem This is a deliberate velocity trade-off and may be exactly right for the team size, so this issue is a decision point rather than a defect. As it stands, any collaborator's direct push to `lotus` reaches every user with no second pair of eyes; combined with the upstream-merge bypass it means production can change with zero review and zero CI. ### Suggested fix At minimum, enable Gitea branch protection on `lotus` requiring the `Build & Quality Checks` status to pass before push (this alone closes the cancelled-run and merge-script gaps). Optionally require one approval for changes under `src/app/features/call`, `src/app/utils/searchCache.ts`, `src/app/state/sessions.ts`, and `src/client/` — the areas where this audit found the security-relevant bugs — via a `CODEOWNERS` file. --- _Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:47 -04:00
jared added the priority: lowtech-debtarea: build-ci labels 2026-09-12 01:57:47 -04:00
jared self-assigned this 2026-09-12 01:57:47 -04:00
jared commented 2026-10-23 16:03:59 -04:00
Author
Owner
Copy Link
Copy Source

Owner decision (2026-10-23): require CI, no required approvals. Branch protection is now on:

branch direct push merging a PR needs
cinny lotus jared only CI / Build & Quality Checks, CI / Secret scan (gitleaks), CI / Playwright smoke (e2e) green
element-call lotus jared only CI / Build embedded bundle green
cinny-desktop main jared only (desktop PRs get no CI yet, so no status is required)
matrix main jared only (already set) Lint / * green (already set)

The automation still works:

  • the upstream sync on LXC 106 (lotus-build.sh) pushes with jared's credentials;
  • the desktop submodule bumps (RELEASE_TOKEN) are pushed as jared (the activity feed shows the Oct 21 bump).

Everyone else (the Developers team) now goes through a PR, and Gitea won't merge it until CI is green. The owner can still push directly, which is the accepted trade-off for a small team. Closing.

Owner decision (2026-10-23): **require CI, no required approvals.** Branch protection is now on: | branch | direct push | merging a PR needs | |---|---|---| | cinny `lotus` | `jared` only | `CI / Build & Quality Checks`, `CI / Secret scan (gitleaks)`, `CI / Playwright smoke (e2e)` green | | element-call `lotus` | `jared` only | `CI / Build embedded bundle` green | | cinny-desktop `main` | `jared` only | (desktop PRs get no CI yet, so no status is required) | | matrix `main` | `jared` only (already set) | `Lint / *` green (already set) | **The automation still works:** - the upstream sync on LXC 106 (`lotus-build.sh`) pushes with `jared`'s credentials; - the desktop submodule bumps (`RELEASE_TOKEN`) are pushed as `jared` (the activity feed shows the Oct 21 bump). Everyone else (the `Developers` team) now goes through a PR, and Gitea won't merge it until CI is green. The owner can still push directly, which is the accepted trade-off for a small team. Closing.
jared closed this issue 2026-10-23 16:04:00 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: build-ci priority: low tech-debt
Milestone
No items
No Milestone Audit 2026-09 · Medium & Low
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees jared
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#100