feat: per-project publish gate for dashboard snapshot - #52
Merged
Conversation
Add publish: bool = False to ProjectConfig so the dashboard snapshot only includes runs from explicitly opted-in projects. Fails safe — new projects publish nothing until opted in. - Filter snapshot rows by published projects after VACUUM INTO - Upsert only published projects to the projects table - 5 new tests covering all filtering scenarios Fixes #51
The publish gate filtered runs/items_touched/projects but left the project_locks table untouched, so an unpublished project's name shipped in the snapshot as a live row whenever a lock existed (transient, during an in-flight run or a stale lock). Filter project_locks alongside the other tables — this is the substantive leak this commit closes. Also VACUUM the snapshot after the DELETEs. On the SQLite builds we ship (Debian bookworm and the dev interpreter) secure_delete is compiled in and defaults ON, so freed-page residue is already zeroed there; the VACUUM is defensive hardening that makes the no-residue guarantee hold regardless of the build's secure_delete setting, and it corrects the reported size_bytes. Fold the row-count read into the same connection instead of reopening the snapshot. Adds a byte-level regression test asserting no unpublished project name or free-text survives in the raw snapshot bytes.
Owner
|
Reviewed and verified by driving the real |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in
publishflag toProjectConfigso the dashboard snapshot only includes runs from projects that explicitly enable publishing. Default isFalse— new projects and new deployments contribute nothing to the public dashboard until opted in.Fixes #51
Changes
config/schema.py:publish: bool = Falsefield onProjectConfigcli.py:_cmd_publish_dbfilters snapshot by published projects (deletes non-published rows fromruns,items_touched, andprojectsin the snapshot copy afterVACUUM INTO)tests/test_publish_db.py: 5 new tests covering no-publish, mixed, all-publish, items_touched filtering, and manifest row_count accuracyConfig note
The three current public projects need
publish = trueinlabro-rssrn/labro.tomlto keep appearing on the dashboard.