Automatic branch-push pipelines

Golf's new portable automatic shell pipeline slice combines signed native push intake, explicit personal delegation, independent push policy and isolated Docker workers. It needs neither AI nor Cloudflare. This is a bounded development implementation, not full GitHub Actions or GitLab Runner compatibility. Exact-image disposable-stack qualification has passed for this increment; the retained local installation is now schema021 with an explicitly configured private demo; other repositories still require deliberate grants and policy eligibility.

Enable deliberately in a disposable development stack

1. Configure the native repository hook and immutable repository/owner binding with a distinct signing secret.
2. Register the Docker worker and operator-approved exact image digests. PostgreSQL owns coordination; source snapshots use configured PostgreSQL or private RustFS/S3 storage.
3. Set GOLF_PUSH_CI_ENABLED=true in the private operator environment and recreate Golf. The default is false; enabled startup requires event connections and runner/image configuration. Restart the Compose worker too: it shares Golf's private network namespace. make local-up recreates them in order.
4. Create an independent personal-token automation grant for exact branches and workflow paths. Every applicable instance, organization and repository ceiling must allow push execution. Manual permission remains independent.
5. Wait at least seven seconds after grant creation, then push supported configuration as the grant sponsor. Tags, deletions, foreign senders, unsupported syntax and missing native evidence do not run.

The environment flag controls new admission. To fence already admitted work, revoke its grant or deny push policy. Configuration alone is not a verified execution result; current repository authority and all admission checks still apply.

Exact source and durable decisions

HMAC authenticates the body, not its delivery header. An immutable canonical ledger therefore deduplicates connection plus signed-payload SHA-256 even when replay changes the delivery UUID. It records whether admission was enabled when received. Pre-upgrade and disabled-time receipts remain ineligible after a later enable; saving a policy does not replay historical work or terminal decisions.

Schema021 records one materialization per event/grant/workflow path with the original grant revision, revocation epoch and credential version. Decisions finish as admitted, blocked or skipped. PostgreSQL bounds pending preparation to 512 items, claims batches of at most 20 with FOR UPDATE SKIP LOCKED and prepares one per process. Preparation has a 60-second bound and a 90-second lease. Only uncertain read-only preparation may resume after expiry, at most three attempts. Proven denials and nonmatching triggers remain terminal. Provider reads do not hold database row locks.

Before reading commands/source, Golf checks delegated identity, immutable repository/owner/type, current native access, grant expiry/version, sponsor state and all push ceilings. It resolves the event's exact after commit, verifies workflow blob bytes, compiles the supported branch-push subset and normalizes the ordinary-source archive. Jobs receive no native credential, browser cookie or Git metadata. The image and source-storage destination retain approved immutable bindings.

Fresh native checks precede the final transaction. It locks sponsor, grant/credential and policy scopes, verifies unchanged epochs and the current lease, then inserts the push-origin run and admitted decision atomically. Admission blocks when a repository already has 64 queued/running runs. Native activity/grant/workflow uniqueness also prevents differently represented payloads for one native push from executing twice. An uploaded source later denied admission may remain an unreferenced object; automatic object garbage collection is not implemented.

Worker assignment, source access, heartbeat, logs and finish recheck current grant/native/policy authority. Logout and backend restart do not revoke committed delegation. Revocation, expiry, sponsor disable, permission/resource changes and policy epoch changes fence work. Executed attempts are never automatically retried: an expired ambiguous attempt becomes lost.

Sponsor-only freshness and clock requirements

Golf independently reads native repository activity using the delegated credential. Admission requires an original commit_repo activity matching the exact repository, full branch ref, sponsor actor and after-commit SHA. Receipt time and Git author dates are insufficient evidence.

This initial slice accepts sponsor-authored pushes only: another user's private activity may be invisible to a personal token. Only the newest 100 activities are searched; older, missing or inaccessible evidence denies execution. Native HTTP Date must be within five seconds of Golf, and activity must be later than grant creation plus five seconds. Whole-second precision deliberately excludes early pushes. Golf, PostgreSQL and the forge need synchronized stable trusted clocks. Broader shared automation-account and native-clock activation-boundary qualification remain open.

There is no supported native public delivery-list API in the qualified forge version. Golf does not scrape internal pages or read the forge database to establish freshness. Captured-body replay checks are not a native redelivery API qualification.

Inspect and qualify

Run tables distinguish manual and push origins. Authorized repository viewers can inspect event ref, receipt ID and grant ID without secrets. A grant may report requires_push_admission when the switch is enabled; this does not mean the grant alone authorizes execution. System status separates disabled admission, degraded coordination/worker and active infrastructure. Detailed materialization history currently requires operator SQL; a product inventory is planned.

The disposable proof uses actual native Git/HMAC callbacks, exact source in RustFS and isolated Docker shell jobs:

python3 scripts/push-ci-smoke.py --image golf-push-automation:development --runner-image golf-runner:latest

Final qualification passed on image sha256:7fb7ed76de50f29d4e9481c0bab1b15f0f4a9bcc8cef9e80d129116bfe754d58, server binary SHA-256 a3f234c3aa0e92436d01fc7b51c9fcd613f8f2e7e59f1ba8c4e3dd4ac5e11eef, from product e862ba9. The pinned ledger records terminal proof and cleanup. Checks include exact commit/blob/source, logout, queued/completed restart, same-body/new-delivery replay, running revocation, subsequent push denial and cleanup. PostgreSQL tests separately cover concurrent claims, stale leases, preparation bounds and recovery quarantine. These are distinct from full engine or production-scale qualification.

Schema020/021 upgrades require stopped writers; mixed binaries have incompatible manual uniqueness contracts. The expanded schema021/local RustFS recovery drill now passes, including automatic-history preservation and quarantining restored grants/runs/preparation. Schema020 alone remains outside the recovery allowlist. External object profiles, workers/executor state, TLS edge volumes, Kubernetes and production failover remain unqualified.

Coding-agent harnesses, outbound notifications/email, protected-merge evidence, remote actions/matrices, caches/artifacts, fair autoscaling, Kubernetes execution and Cloudflare adapters remain separate gates. See the authoritative push automation contract.

Retained local demo

The private golf-admin/golf-local-ci-0c61aa repository has a successful actual native push-origin run, 1664b5bf-a052-4578-8d2f-db07152a99ac, executed by the isolated Docker worker with exact RustFS env_s3 source and no PostgreSQL archive copy. The retained schema021 image is sha256:f658a021b4cc908beb171430bb18a3b31e1b9196e044d9a909b7dc8b260f67c9, with the qualified backend binary. Existing administrator credentials/session and previous operator configuration survived restart. Native intake, automatic coordination and manual pipelines are ready for this deliberately scoped development configuration.

Sign in at http://localhost:8080/ with admin@golfgit.local and the existing password; inspect the demo in repository workflow settings. Its exact-branch/path grant expires after 24 hours. Other repositories remain default-denied unless deliberately configured; this demo is not broad authorization or production automation onboarding.

To create another deliberately new private development demo, first start the full healthy profile, then run python3 scripts/local-push-ci-demo.py --configure. It refuses older schemas or an unavailable worker before creation, preserves existing policies/operator bindings and leaves the test repository for review. The portable callback allowlist explicitly permits the private golf host; it does not allow every private destination.