max / makenotwork

sando: configure pull-based upstream (makenot.work read-only) Point [repo].upstream at the canonical git remote so sandod fetches the deploy branch on /rebuild instead of relying on a manually-pushed bare repo. Authorized via the sando-deploy read-only service account (fetch-only collaborator on max/makenotwork). Verified end-to-end: POST /rebuild of a sha absent from the bare repo now fetches it and builds with no manual steps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-06-12 17:55 UTC

Commit: 722d1385d67142f121c8e50b1eeda6b7f0452e4a

Parent: 511f567

1 file changed, +5 insertions, -0 deletions

M sando/sando.toml +5

			@@ -15,6 +15,11 @@
15	15		[repo]
16	16		bare_path = "/srv/sando/mnw.git"
17	17		branch = "main"
	18	+	# Canonical remote sandod fetches the deploy branch from before worktree-ing a
	19	+	# sha (pull-based /rebuild). Authorized via the `sando-deploy` read-only
	20	+	# service account on the makenot.work git server (fetch-only collaborator).
	21	+	# Leave unset for push-based hosts (commits arrive via the bare-repo hook).
	22	+	upstream = "git@ssh.makenot.work:max/makenotwork.git"
18	23
19	24		[backup]
20	25		# Source of the prod-backup clone used by migration_dry_run on the Sando host.