Contributors should be able to publish CI results without permissions

[andychu]

Right now it requires an SSH key.

I think we need a simple CGI upload program that accepts 3 files: JSON, TSV, and ZIP. (honestly PHP is the best at this for multi-file uploads).

And then it will call the Python program to rewrite the index.

This will also solve #1015

We have to be careful about the atomic rewrite of the index.

[andychu]

We should also rename it to build.oilshell.org when we do this. Then we can be securely "multi-tenant" without multiple subdomains

Actually it is bad if anyone can publish HTML to our subdomain ... so we still need some kind of auth. I think a manual password file is OK.

Or maybe we can authenticate with github accounts somehow?

[andychu]

Need four passwords with access to publish into 4 directories:

1. sourcehut/
2. github/
3. circle-ci/
4. cirrus-ci/

And then rewrite the dashboard in that directory.

I guess that means contributors can get the password? As long as they can only add, it's mostly OK

[andychu]

Should we have a "docs" task?

• See doc/getting-started: basic sort, add usage table #1151

It would be nice if it could just run alone ... without the cpp and everything

[andychu]

We can simply add contributors to the repo, but I'd like them to be able to do so with less permissions ... I guess there should be a separate auth secret for travis-ci.oilshell.org ?

• They don't need to be able to SSH and write files. The /status-api/github thing
• But they should be able to publish JSON, TSV, and .wwz, and then rewrite the jobs index.
  • So I think this could go in some sort of PHP script that does auth and invokes shell ...
  • or really this would be a great use case for Oil ... maybe we should be ambitious and use a build of Oil
  • It should be a simple CGI. But I also want logging? CGI logging is not good. I want a process ID and task ID etc.

[andychu]

This is a little messed up now, we have to add people explicitly as contributors

It would be nice to do this for PRs from anyone

[andychu]

https://oilshell.zulipchat.com/#narrow/stream/121539-oil-dev/topic/Contributors.20should.20be.20able.20to.20push.20to.20CI