Migration: release providers → go/forge¶

The release layer has been extracted:

Auth moved with the contract deliberately: it lived in pkg/vcs while the contract lived in pkg/vcs/release, and every real provider needs both. Shipping them apart would force an out-of-tree provider author back onto go-tool-base.

Repoint imports¶

-import "gitlab.com/phpboyscout/go-tool-base/pkg/vcs/release"
-import "gitlab.com/phpboyscout/go-tool-base/pkg/vcs"
+import "gitlab.com/phpboyscout/go/forge"

release.Provider → forge.Provider, vcs.ResolveToken → forge.ResolveToken, and so on. The symbols keep their names.

Mocks and the test double follow suit — alias the imports, since a bare mocks or test collides:

-import mockRelease "gitlab.com/phpboyscout/go-tool-base/mocks/pkg/vcs/release"
-import "gitlab.com/phpboyscout/go-tool-base/pkg/vcs/release/releasetest"
+import mockRelease "gitlab.com/phpboyscout/go/forge/mocks"
+import forgetest "gitlab.com/phpboyscout/go/forge/test"

Provider imports¶

Providers now register from their own modules:

-import _ "gitlab.com/phpboyscout/go-tool-base/pkg/vcs/gitlab"
+import _ "gitlab.com/phpboyscout/go/forge-gitlab"

A tool supporting one forge can now import only that provider and shed the other vendor clients entirely — which is the point of the split.

Register returns an error¶

It no longer overwrites a duplicate source type silently:

-forge.Register("s3", factory)
+if err := forge.Register("s3", factory); err != nil {
+    panic("myforge: " + err.Error())
+}

Silent overwriting let one blank import displace another with no diagnostic, and initialisation order decided the winner. Use forge.Unregister to replace a provider deliberately, or forge.Registered to register conditionally.

What stayed in GTB¶

• pkg/vcs.ConfigFromContainable — the go/config bridge to the narrow forge.Config seam.
• pkg/vcs/github — removed in a later wave. The auth and SSH-key-upload paths GTB actually used (the OAuth device-login flow, SSH key upload) moved into the forge provider capabilities consumed by pkg/setup/forge. The wider, unused client surface — pull requests, repository creation, file contents — was deleted rather than carried; giving one forge those capabilities while the others lack them is deferred to the go/forge provider-contract-widening spec, to be restored across every provider in lockstep in a future wave.
• pkg/vcs/repo — the props/config adapters for go/repo.

Three package-level tunables were removed¶

setup.MaxChecksumsSize, setup.MaxBinaryDownloadSize and setup.DefaultRequireChecksum were exported mutable variables. They are gone.

They raced under t.Parallel() — two tests had to run serially because of it — and scoped a setting to the whole process rather than to the updater that needed it.

Size bounds are now constants plus per-updater options:

-setup.MaxBinaryDownloadSize = 2 << 30
+setup.NewUpdater(ctx, props, "", false, setup.WithMaxBinaryDownloadSize(2<<30))

setup.DefaultMaxChecksumsSize and setup.DefaultMaxBinaryDownloadSize hold the defaults. WithMaxChecksumsSize and WithMaxBinaryDownloadSize raise them.

Checksum enforcement moves to the tool-author baseline on props, beside the other baselines like UpdatePolicy:

-func init() { setup.DefaultRequireChecksum = true }
+requireChecksum := true
+props.Tool.Signing.RequireChecksum = &requireChecksum

It is a pointer so "unset" stays distinguishable from "explicitly false". Runtime update.require_checksum config still overrides it, and the precedence is otherwise unchanged.

Documentation¶

• Release contract, credential chain, authoring guide: forge.go.phpboyscout.uk
• Per-provider config keys and capabilities: providers reference
• GTB wiring: VCS component page