honest

edit aqua

edit aqua

aqua
run with sh -c in a fresh checkout; stdout and stderr are merged
optional; runs in the checkout first (pull an image, install deps); a non-zero exit errors the build without running the command
optional; runs in the checkout after the command passes (a deploy, a tag), with the project's variables. To deploy merged changes only: if [ "$HONEST_STATE" = merged ]; then ./deploy.sh; fi
optional; runs in the checkout after a build that did not pass (failed, timed out, or a setup that errored), with HONEST_STATUS saying which. Neither of the two changes the build's status
advanced setupevents, secret, timeout, report, notify, team, keep, runs on, exclusive, supersede, docker
rev webhook filters: state.merged, change.saved, state, *
the --secret given to rev repo webhooks add; empty accepts unsigned posts
30s, 10min, 2h
a URL that gets a POST when a build ends
optional one-line template over ${project} ${build} ${number} ${version} ${title} ${author} ${trigger} ${status} ${passed} ${exit_code} ${url} ${took} ${then_step} ${then_status} ${then_exit_code}, or ${payload} for the default JSON object; empty sends the default
the Content-Type of that POST; values are JSON-escaped when it contains "json"
--team for rev get, when the repo is outside the login's active team
a label; only the hub or an worker offering it runs this project (empty: anywhere)

docker

run setup and the command inside this image with the checkout at /src (empty: on the host); only machines offering the docker label take it
container paths kept between builds, comma-separated: /usr/local/cargo/registry, /src/target
extra docker run arguments: --memory 4g, --user 1000:1000, -e FOO=bar
cancel
delete projectDelete?removes aqua from honest.conf and all of its builds

Environment · encrypted at rest in the vault (not set up)

Variables need the vault: set auth on the settings page and set the vault up, then add them here.

SSH keys · private halves encrypted at rest in the vault (not set up)

Keys need the vault: set it up, then make or import them here.

SSH hosts · where a build may ssh and scp, by name

and pin its host key now
In a build: scp -F "$HONEST_SSH_CONFIG" ./app prod:/srv/app/. A host that is not pinned is checked against the building machine's own known_hosts.