Amolith
292db50660
govulncheck reported that we're calling vulnerable codepaths from an older version of git-go, so I upgraded git-go and its direct dependencies. |
||
|---|---|---|
| .files | ||
| .reuse | ||
| LICENSES | ||
| cmd | ||
| db | ||
| git | ||
| project | ||
| rss | ||
| users | ||
| ws | ||
| .air.toml | ||
| .gitignore | ||
| .golangci.toml | ||
| README.md | ||
| go.mod | ||
| go.sum | ||
| go.sum.license | ||
| justfile | ||
README.md
Willow
Forge-agnostic software release tracker
This UI is a minimal proof-of-concept, it's going to change drastically in the near future.
What is it?
If you'd rather watch a video, I gave a lightning talk on Willow at the 2023 Ubuntu Summit.
Willow tracks software releases across arbitrary forge platforms by trying to support one of the very few things they all have in common: the VCS. At the moment, git is the only supported VCS, but I would be interested in adding Pijul, Fossil, Mercurial, etc. You can also track releases using RSS feeds.
Willow exists because decentralisation can be annoying. One piece of software can be found on GitHub, another piece on GitLab, one on Bitbucket, a fourth on SourceHut, and a fifth on the developer's self-hosted Forgejo instance. Forgejo and GitHub have RSS feeds that only notify you of releases. GitLab doesn't support RSS feeds for anything, just an API you can poke. Some software updates might be on the developers' personal blog. Sometimes there are CVEs for specific software and they get published somewhere completely different before they're fixed in a release.
I want to bring all that scattered information under one roof so a developer or sysadmin can pop open willow's web UI and immediately see what needs updating where. I've recorded some of my other ideas and plans in my wiki.
Installation and use
Note: prebuilt binaries will be available after I release v0.0.1
- Clone the repo
- Build the binary with
CGO_ENABLED=0 go build -ldflags="-s -w" -o willow ./cmd - Upload it to a remote server
- Execute the binary
- Edit the
config.toml - Create a user with
./willow -a <username> - Execute the binary again
- Reverse proxy
http://localhost:1313 - Open the web UI
- Click
Track new project - Fill out the form
- Indicate which version you're currently on
- That's it!
Note that I still consider the project to be in alpha state. There will be bugs; please help fix them!
Contributing
Contributions are very much welcome! Please take a look at the ticket tracker and see if there's anything you're interested in working on. If there's specific functionality you'd like to see implemented and it's not mentioned in the ticket tracker, please send a description to the mailing list so we can discuss its inclusion. If I don't feel like it fits with Willow's goals, you're encouraged to fork the project and make whatever changes you like!
Questions, comments, and patches can always be sent to the mailing list, but I'm also in the IRC channel/XMPP room pretty much 24/7. I might not see messages right away, so please stick around.
- Email: ~amolith/willow@lists.sr.ht
- IRC: irc.libera.chat/#willow
- XMPP: willow@muc.secluded.site
If you haven't used mailing lists before, please take a look at SourceHut's documentation, especially the etiquette section.
Configuring git...
…for git send-email
git config sendemail.to "~amolith/willow@lists.sr.ht"
git config format.subjectPrefix "PATCH willow"
git send-email [HASH]
…for signing the DCO
git config format.signOff yes
Required tools
- Go
- gofumpt
- Stricter formatting rules than the default
go fmt
- Stricter formatting rules than the default
- golangci-lint
- Aggregates various preinstalled Go linters, runs them in parallel, and makes heavy use of the Go build cache
- Staticcheck
- Uses static analysis to find bugs and performance issues, offer simplifications, and enforce style rules