Merge remote-tracking branch 'upstream/main' into feat/gerrit-adapter

# Conflicts:
#	README.md
#	internal/cli/auth.go
#	internal/config/config.go

Author: abhinavgautam01

.github/workflows/ci.yml

@@ -16,12 +16,12 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
 
@@ -42,12 +42,12 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
 

.github/workflows/release.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
           cache: false

README.md

@@ -43,6 +43,18 @@ forge auth login                          # interactive: asks domain + token
 forge auth login --domain github.com --token ghp_abc123
 forge auth login --domain gitea.example.com --token abc123 --type gitea
 forge auth login --domain gerrit.example.com --token user:http_password --type gerrit
+forge auth login --domain github.com --token-cmd 'rbw get github-token'
+```
+
+`--token-cmd` stores a shell command instead of a literal token; the command
+is run each time the token is needed (see [token commands](#token-commands) below).
+
+When prompted for a token interactively, press **Ctrl+E** as the first key
+to enter a command instead:
+
+```
+Token for github.com (Ctrl+E first for command):
+Command for token (e.g. rbw get github.com): rbw get github-token
 ```
 
 Check what's configured with `forge auth status`.
@@ -71,6 +83,38 @@ type = gerrit
 token = user:http_password
 ```
 
+### Token commands
+
+Instead of a literal `token`, use `token-cmd` to specify a shell command (not supported on Windows).
+The command is executed via `sh -c` each time forge needs the token and its
+stdout is used as the value. This lets you fetch secrets from a password manager
+instead of storing them in plain text:
+
+```ini
+[github.com]
+token-cmd = rbw get github-token
+
+[gitlab.com]
+token-cmd = pass show forge/gitlab
+
+[myhostedgitlab.example.com]
+token-cmd = rbw get --raw myhostedgitlab | jq -r '.fields | map(select(.name == "token"))[0].value'
+```
+
+The variable `FORGE_DOMAIN` is set to the domain name when the command runs,
+so a single command can serve multiple domains:
+
+```ini
+[github.com]
+token-cmd = pass show forge/$FORGE_DOMAIN
+
+[myhostedgitlab.example.com]
+token-cmd = pass show forge/$FORGE_DOMAIN
+```
+
+`forge auth login` sets this up interactively (Ctrl+E at the token prompt).
+`forge auth status` shows the command source instead of the resolved value.
+
 `.forge` in the repo root is for per-project settings, committed to the repo, no tokens:
 
 ```ini

bitbucket/helpers_test.go

@@ -2,9 +2,9 @@ package bitbucket
 
 import "testing"
 
-func assertEqual(t *testing.T, field, want, got string) {
+func assertEqual[T ~string](t *testing.T, field, want string, got T) {
 	t.Helper()
-	if want != got {
+	if want != string(got) {
 		t.Errorf("%s: want %q, got %q", field, want, got)
 	}
 }

bitbucket/issues.go

@@ -107,13 +107,7 @@ func convertBitbucketIssue(bb bbIssue) forge.Issue {
 		HTMLURL: bb.Links.HTML.Href,
 	}
 
-	// Normalize Bitbucket states to open/closed
-	switch bb.State {
-	case "new", stateOpen:
-		result.State = stateOpen
-	default:
-		result.State = stateClosed
-	}
+	result.State = forge.NormalizeIssueState(bb.State)
 
 	if bb.Reporter != nil {
 		result.Author = forge.User{

bitbucket/prs.go

@@ -123,14 +123,9 @@ func convertBitbucketPR(bb bbPullRequest) forge.PullRequest {
 		}
 	}
 
-	switch bb.State {
-	case "OPEN":
-		result.State = "open"
-	case "MERGED":
-		result.State = "merged"
+	result.State = forge.NormalizePRStatus(bb.State)
+	if result.State == forge.PRStatusMerged {
 		result.Merged = true
-	default:
-		result.State = "closed"
 	}
 
 	if bb.Author != nil {

gerrit/changes.go

@@ -79,16 +79,16 @@ func (s *gerritPRService) convertAccount(a *gerritAccountInfo) forge.User {
 }
 
 func (s *gerritPRService) convertChange(c gerritChangeInfo) forge.PullRequest {
-	state := strings.ToLower(c.Status)
+	state := forge.NormalizePRStatus(strings.ToLower(c.Status))
 	merged := false
 	switch c.Status {
 	case "NEW":
-		state = stateOpen
+		state = forge.PRStatusOpen
 	case "MERGED":
-		state = stateMerged
+		state = forge.PRStatusMerged
 		merged = true
 	case "ABANDONED":
-		state = stateClosed
+		state = forge.PRStatusClosed
 	}
 
 	head := forge.PRBranch{SHA: c.CurrentRevision}

gitea/ci.go

@@ -23,7 +23,7 @@ func convertGiteaWorkflowRun(r *gitea.ActionWorkflowRun) forge.CIRun {
 	result := forge.CIRun{
 		ID:        r.ID,
 		Title:     r.DisplayTitle,
-		Status:    r.Status,
+		Status:    forge.NormalizeCIStatus(r.Status),
 		Branch:    r.HeadBranch,
 		SHA:       r.HeadSha,
 		Event:     r.Event,
@@ -32,7 +32,7 @@ func convertGiteaWorkflowRun(r *gitea.ActionWorkflowRun) forge.CIRun {
 	}
 
 	if r.Conclusion != "" {
-		result.Conclusion = r.Conclusion
+		result.Conclusion = forge.NormalizeCIConclusion(r.Conclusion)
 	}
 
 	if r.Actor != nil {
@@ -54,8 +54,8 @@ func convertGiteaWorkflowJob(j *gitea.ActionWorkflowJob) forge.CIJob {
 	job := forge.CIJob{
 		ID:         j.ID,
 		Name:       j.Name,
-		Status:     j.Status,
-		Conclusion: j.Conclusion,
+		Status:     forge.NormalizeCIStatus(j.Status),
+		Conclusion: forge.NormalizeCIConclusion(j.Conclusion),
 		HTMLURL:    j.HTMLURL,
 	}
 	if !j.StartedAt.IsZero() {

gitea/collaborators.go

@@ -41,7 +41,7 @@ func (s *giteaCollaboratorService) List(ctx context.Context, owner, repo string,
 			}
 			all = append(all, forge.Collaborator{
 				Login:      u.UserName,
-				Permission: perm,
+				Permission: forge.NormalizeAccessLevel(perm),
 			})
 		}
 		if lastPage(resp, len(users), perPage) || (opts.Limit > 0 && len(all) >= opts.Limit) {
@@ -78,7 +78,7 @@ func (s *giteaCollaboratorService) getPermission(owner, repo, username string) (
 func (s *giteaCollaboratorService) Add(ctx context.Context, owner, repo, username string, opts forge.AddCollaboratorOpts) error {
 	var perm *gitea.AccessMode
 	if opts.Permission != "" {
-		mode := gitea.AccessMode(opts.Permission)
+		mode := gitea.AccessMode(giteaPermission(opts.Permission))
 		perm = &mode
 	}
 
@@ -94,6 +94,19 @@ func (s *giteaCollaboratorService) Add(ctx context.Context, owner, repo, usernam
 	return nil
 }
 
+func giteaPermission(permission forge.AccessLevel) string {
+	switch forge.NormalizeAccessLevel(string(permission)) {
+	case forge.AccessLevelRead:
+		return "read"
+	case forge.AccessLevelWrite:
+		return "write"
+	case forge.AccessLevelAdmin:
+		return "admin"
+	default:
+		return string(permission)
+	}
+}
+
 func (s *giteaCollaboratorService) Remove(ctx context.Context, owner, repo, username string) error {
 	resp, err := s.client.DeleteCollaborator(owner, repo, username)
 	if err != nil {

gitea/commit_statuses.go

@@ -57,7 +57,7 @@ func (s *giteaCommitStatusService) List(ctx context.Context, owner, repo, sha st
 		}
 		for _, st := range statuses {
 			cs := forge.CommitStatus{
-				State:       string(st.State),
+				State:       forge.NormalizeCommitStatusState(string(st.State)),
 				Context:     st.Context,
 				Description: st.Description,
 				TargetURL:   st.TargetURL,
@@ -78,7 +78,7 @@ func (s *giteaCommitStatusService) List(ctx context.Context, owner, repo, sha st
 
 func (s *giteaCommitStatusService) Set(ctx context.Context, owner, repo, sha string, opts forge.SetCommitStatusOpts) (*forge.CommitStatus, error) {
 	result, resp, err := s.client.CreateStatus(owner, repo, sha, gitea.CreateStatusOption{
-		State:       gitea.StatusState(opts.State),
+		State:       gitea.StatusState(string(opts.State)),
 		TargetURL:   opts.TargetURL,
 		Description: opts.Description,
 		Context:     opts.Context,
@@ -91,7 +91,7 @@ func (s *giteaCommitStatusService) Set(ctx context.Context, owner, repo, sha str
 	}
 
 	cs := &forge.CommitStatus{
-		State:       string(result.State),
+		State:       forge.NormalizeCommitStatusState(string(result.State)),
 		Context:     result.Context,
 		Description: result.Description,
 		TargetURL:   result.TargetURL,