Ingest and staged publish paths, reliable spool, hardening

.github/workflows/gateway-publish.yml

@@ -0,0 +1,72 @@
+# Integration test: publish through a real cvmfs_gateway.
+#
+# Builds a mountless cvmfs_gateway + cvmfs_receiver from cvmfs@devel, backed by
+# S3 (Garage), and drives a full publish through cvmfs-prepub in gateway mode.
+# This is the only test that exercises the live lease → payload → commit/graft
+# path against the actual gateway; the Go unit tests only cover the client side.
+#
+# It is heavy (builds cvmfs from source), so it runs on demand and on pull
+# requests that touch the gateway client or the fixtures — not on every push.
+
+name: gateway-publish
+
+on:
+    workflow_dispatch:
+        inputs:
+            cvmfs_ref:
+                description: "cvmfs git ref to build the gateway from"
+                required: false
+                default: "devel"
+    pull_request:
+        paths:
+            - "internal/lease/**"
+            - "internal/api/**"
+            - "cmd/prepub/**"
+            - "test/integration/gateway/**"
+            - ".github/workflows/gateway-publish.yml"
+    push:
+        branches:
+            - "gateway-dedicated-graft-endpoint-test"
+
+# A gateway build from source is expensive; don't pile up concurrent runs.
+concurrency:
+    group: gateway-publish-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    gateway-publish:
+        runs-on: ubuntu-latest
+        timeout-minutes: 90
+        env:
+            CVMFS_REF: ${{ github.event.inputs.cvmfs_ref || 'devel' }}
+        steps:
+            - name: Check out cvmfs-bits
+              uses: actions/checkout@v4
+              with:
+                  path: cvmfs-bits
+
+            - name: Check out cvmfs (${{ env.CVMFS_REF }})
+              uses: actions/checkout@v4
+              with:
+                  repository: cvmfs/cvmfs
+                  ref: ${{ env.CVMFS_REF }}
+                  path: cvmfs
+
+            - name: Set up Go
+              uses: actions/setup-go@v5
+              with:
+                  go-version-file: cvmfs-bits/go.mod
+                  cache-dependency-path: cvmfs-bits/go.sum
+
+            - name: Run gateway publish integration test
+              working-directory: cvmfs-bits
+              env:
+                  CVMFS_SRC: ${{ github.workspace }}/cvmfs
+              run: ./test/integration/gateway/run.sh
+
+            - name: Dump gateway logs on failure
+              if: failure()
+              working-directory: cvmfs-bits
+              env:
+                  CVMFS_SRC: ${{ github.workspace }}/cvmfs
+              run: docker compose -f test/integration/gateway/docker-compose.yml logs --no-color || true

.gitignore

@@ -3,7 +3,6 @@
 # (e.g. cmd/prepub/ was being silently gitignored by the bare "prepub" pattern)
 /bin/
 /prepub
-/prepubctl
 
 # Go build cache and test output
 *.test
@@ -60,3 +59,21 @@ journal.jsonl
 *.pem
 *.key
 *.crt
+
+# Archives. The keys above (*.key, *.crt, *.pem) were already ignored when a
+# cvmfs.tar.gz containing the repository signing key, the gateway key and the
+# S3 credentials was committed anyway: an ignore pattern only sees the file it
+# is given, not what is packed inside it. So ignore the containers too.
+*.tar
+*.tar.gz
+*.tgz
+*.tar.bz2
+*.tar.xz
+*.zip
+
+# Copies of a CVMFS server configuration tree, which carry keys wholesale.
+/cvmfs/
+/etc/
+*.gw
+*.s3.conf
+.gofmt-leftovers/

Makefile

@@ -1,10 +1,14 @@
 .PHONY: build test lint clean run-sim
 
+# Version stamped into the binary (cvmfs-prepub --version); empty outside git,
+# where the binary falls back to the go tool's VCS stamp or "dev".
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null)
+LDFLAGS := -X main.version=$(VERSION)
+
 build:
-	@echo "Building cvmfs-prepub and prepubctl..."
+	@echo "Building cvmfs-prepub..."
 	@mkdir -p bin
-	go build -v -o bin/cvmfs-prepub  ./cmd/prepub
-	go build -v -o bin/prepubctl     ./cmd/prepubctl
+	go build -v -ldflags "$(LDFLAGS)" -o bin/cvmfs-prepub  ./cmd/prepub
 
 test:
 	@echo "Running tests..."