[KristiforMilchev]

Runs now start from a git push, whether the repository is on your own git server or on GitHub. No forge integrations: both paths use the same trigger API and CLI code, all ours.

This branch is built on #6 (secrets), so it contains that commit too. Merge #6 first; this PR's diff then shrinks to its own changes.

Repository registry (controller repo create|list|delete|token create)

• Each repository has a clone URL and routing rules that decide the pool. The first matching rule wins, and an event that matches no rule starts no run. Example: -route push:main=trusted -route tag:v*=release -route pull_request=untrusted. The default sends everything to untrusted.
• Trigger tokens are scoped to one repository and stored only as hashes.
• An optional read credential for private repositories is encrypted, and is given to workers with each job, never stored in the job.

Trigger API (TriggerService: Trigger, GetRun, GetJobLog)

• A token reaches only its own repository's runs and logs.
• The controller reads .opifica/pipeline.yaml at the commit, from its own mirror. The caller can neither supply the pipeline nor choose the pool.

Your own git server: opifica hook post-receive is the hook for bare repositories. It never fails a push, since the push has already been accepted, and it prints the runs it started:

remote: opifica: main: run 0b6f… started in pool trusted (3 jobs)

GitHub: opifica trigger -wait, in a workflow step (examples/github-actions.yml).

• It reads the workflow's event. For pull requests it builds the head commit, not GitHub's temporary merge commit.
• It prints the run's output, exits with the run's result so the check passes or fails in GitHub, and adds a summary table to the workflow run.

Tests

• Real bare repository, real git hook: a git push of a branch and a tag starts two runs, in trusted and release. A push no rule matches is reported to the pusher, and the push still succeeds.
• The real opifica binary with GitHub Actions' environment: a succeeding run exits 0 with the output and summary. A failing run exits 1 and shows the failing job's exit code.
• Authorization: an unknown token, another repository's token (for triggering, reading runs and reading logs), and a revoked token are all rejected.
• Credentials: a read credential reaches the worker, and is stored neither in the job nor unencrypted.
• Unit tests for routing, including that a pull request is routed by its target branch, never its source branch, so naming your branch main gets nothing. Also the GitHub event parsing.
• The integration suite passes 5 times in a row under the race detector.

Next: opifica-git, so that creating a repository makes the bare repo and installs this hook for you. It still needs a decision: push over HTTPS, SSH, or both.

🤖 Generated with Claude Code