1.3 KiB
ADR 0001: Keep source inventory subordinate to Git-owned build inputs
- Status: Accepted
- Date: 2026-07-25
Context
The control plane can inspect and discover repositories, while the deterministic builder resolves its site definition and other declared inputs from exact Git commits. A mutable source-management UI must not become an alternate build configuration channel.
Decision
Repository discovery and connectivity state remain operational inventory only. They may not alter a release input, theme selection, project declaration, or source pin. Build inputs continue to come from closed-schema, Git-owned configuration resolved into immutable snapshots.
Gitea discovery is fail-closed: its HTTPS origin must be configured and allow-listed, its API token comes from the process environment, requests use a bounded timeout, and callers are rate-limited. Discovered entries are merged atomically into inventory and begin with projection disabled.
Source-management UX may add review and configuration workflows later, but any accepted change must be committed to the Git-owned configuration before it can affect a release.
Consequences
- Discovery cannot silently expand release inputs.
- Operators must configure Gitea credentials and origin policy explicitly.
- A future writable source UX requires a new ADR describing its Git commit and review workflow.