Refactor v2

.cargo/config.toml

@@ -0,0 +1,2 @@
+[net]
+git-fetch-with-cli = true

.claude/settings.local.json

@@ -0,0 +1,20 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cargo check:*)",
+      "Bash(cargo update:*)",
+      "Bash(ls:*)",
+      "Bash(git checkout:*)",
+      "Bash(cargo clean:*)",
+      "Bash(cargo metadata:*)",
+      "Bash(git fetch:*)",
+      "Bash(git rebase:*)",
+      "Bash(git pull:*)",
+      "Bash(git add:*)",
+      "Bash(GIT_EDITOR=true git rebase:*)",
+      "Bash(git merge:*)",
+      "Bash(git reset:*)",
+      "Bash(git commit:*)"
+    ]
+  }
+}

.github/workflows/build.yaml

@@ -12,10 +12,15 @@ jobs:
       - uses: actions/checkout@v4
       - name: Build binary using Docker
         shell: bash
+        env:
+          REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
         run: |
           set -euxo pipefail
           mkdir -p /tmp/build-output
-          docker build -t synapse-builder:latest -f pkg/docker/build.Dockerfile .
+          export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
+          DOCKER_BUILDKIT=1 docker build \
+            --secret id=github_token,env=GITHUB_TOKEN \
+            -t synapse-builder:latest -f pkg/docker/build.Dockerfile .
           docker create --name synapse-build synapse-builder:latest
           docker cp synapse-build:/output/synapse /tmp/build-output/synapse
           docker rm synapse-build
@@ -32,10 +37,15 @@ jobs:
       - uses: actions/checkout@v4
       - name: Build binary using Docker
         shell: bash
+        env:
+          REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
         run: |
           set -euxo pipefail
           mkdir -p /tmp/build-output
-          docker build -t synapse-builder:latest -f pkg/docker/build.Dockerfile .
+          export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
+          DOCKER_BUILDKIT=1 docker build \
+            --secret id=github_token,env=GITHUB_TOKEN \
+            -t synapse-builder:latest -f pkg/docker/build.Dockerfile .
           docker create --name synapse-build synapse-builder:latest
           docker cp synapse-build:/output/synapse /tmp/build-output/synapse
           docker rm synapse-build

.github/workflows/pkg-build.yml

@@ -12,10 +12,16 @@ jobs:
 
       - name: Build DEB using Docker
         shell: bash
+        env:
+          REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
         run: |
           set -euxo pipefail
           mkdir -p /tmp/deb-build-output
-          docker build -t synapse-builder-deb:latest -f pkg/deb/Dockerfile .
+          export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
+          DOCKER_BUILDKIT=1 docker build \
+            --build-arg REQUIRE_GITHUB_TOKEN=1 \
+            --secret id=github_token,env=GITHUB_TOKEN \
+            -t synapse-builder-deb:latest -f pkg/deb/Dockerfile .
           docker run -v "${GITHUB_WORKSPACE}:/tmp/repo" -v /tmp/deb-build-output:/tmp/output --rm synapse-builder-deb:latest
 
       - name: Installing package
@@ -40,11 +46,14 @@ jobs:
 
       - name: Build RPM using release Dockerfile
         shell: bash
+        env:
+          REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
         run: |
           set -euxo pipefail
           mkdir -p /tmp/rpm-build-output
+          export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
           docker build -t synapse-builder-rpm:latest -f pkg/rpm/docker/Dockerfile pkg/rpm/docker/
-          docker run -v "${GITHUB_WORKSPACE}:/tmp/repo" -v /tmp/rpm-build-output:/tmp/output --rm synapse-builder-rpm:latest
+          docker run -e GITHUB_TOKEN -v "${GITHUB_WORKSPACE}:/tmp/repo" -v /tmp/rpm-build-output:/tmp/output --rm synapse-builder-rpm:latest
 
       - name: Build systemd-enabled Oracle image for testing
         shell: bash

.github/workflows/release.yaml

@@ -62,11 +62,16 @@ jobs:
     runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     needs:
       - docker-prepare
+    env:
+      GITHUB_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
     strategy:
       fail-fast: false
       matrix:
         platform: ${{ fromJson(needs.docker-prepare.outputs.matrix) }}
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Prepare
         run: |
           platform=${{ matrix.platform }}
@@ -161,6 +166,7 @@ jobs:
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     env:
       CARGO_TERM_COLOR: always
+      REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -186,7 +192,11 @@ jobs:
       run: |
         set -euxo pipefail
         mkdir -p /tmp/build-output
-        docker build -t synapse-builder:latest -f pkg/docker/build.Dockerfile .
+        export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
+        DOCKER_BUILDKIT=1 docker build \
+          --build-arg REQUIRE_GITHUB_TOKEN=1 \
+          --secret id=github_token,env=GITHUB_TOKEN \
+          -t synapse-builder:latest -f pkg/docker/build.Dockerfile .
         docker create --name synapse-build synapse-builder:latest
         docker cp synapse-build:/output/synapse /tmp/build-output/synapse
         docker rm synapse-build
@@ -228,10 +238,16 @@ jobs:
 
     - name: Build DEB using Docker
       shell: bash
+      env:
+        REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
       run: |
         set -euxo pipefail
         mkdir -p /tmp/deb-build-output
-        docker build -t synapse-builder-deb:latest -f pkg/deb/Dockerfile .
+        export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
+        DOCKER_BUILDKIT=1 docker build \
+          --build-arg REQUIRE_GITHUB_TOKEN=1 \
+          --secret id=github_token,env=GITHUB_TOKEN \
+          -t synapse-builder-deb:latest -f pkg/deb/Dockerfile .
         docker run -v "${GITHUB_WORKSPACE}:/tmp/repo" -v /tmp/deb-build-output:/tmp/output --rm synapse-builder-deb:latest
 
     - name: Archive output package
@@ -268,11 +284,14 @@ jobs:
 
     - name: Build RPM using Docker
       shell: bash
+      env:
+        REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
       run: |
         set -euxo pipefail
         mkdir -p /tmp/rpm-build-output
+        export GITHUB_TOKEN="${REPO_ACCESS_TOKEN}"
         docker build -t synapse-builder-rpm:latest -f pkg/rpm/docker/Dockerfile pkg/rpm/docker/
-        docker run -v "${GITHUB_WORKSPACE}:/tmp/repo" -v /tmp/rpm-build-output:/tmp/output --rm synapse-builder-rpm:latest
+        docker run -e GITHUB_TOKEN -v "${GITHUB_WORKSPACE}:/tmp/repo" -v /tmp/rpm-build-output:/tmp/output --rm synapse-builder-rpm:latest
 
     - name: Archive output package
       uses: actions/upload-artifact@v4

.github/workflows/wellness-check.yaml

@@ -0,0 +1,52 @@
+name: Wellness Check
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  fmt-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install packages
+        run: |
+          sudo apt-get update && sudo apt-get install -y --no-install-recommends \
+              libc6-dev \
+              g++ \
+              gcc \
+              make \
+              git \
+              build-essential \
+              clang \
+              libelf-dev \
+              libelf1 \
+              libssl-dev \
+              zlib1g-dev \
+              libzstd-dev \
+              pkg-config \
+              libcap-dev \
+              binutils-multiarch-dev \
+              cmake
+
+      - name: Configure git for private deps
+        env:
+          REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}
+        run: |
+          if [ -n "${REPO_ACCESS_TOKEN:-}" ]; then
+            export GITHUB_TOKEN=$(echo -n "$REPO_ACCESS_TOKEN" | tr -d '\n\r')
+            git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
+            echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> $GITHUB_ENV
+          fi
+
+      - name: Check formatting
+        run: cargo fmt -- --check
+
+      - name: Run tests
+        run: cargo test -- --include-ignored

.gitignore

@@ -46,4 +46,6 @@ upstreams_*.yaml
 *.rpm
 null
 *.log
-
+config_*.yaml
+config_*.yml
+synapse

AGENTS.md

@@ -0,0 +1,10 @@
+- Use 'bd' for task tracking
+- Shared configs: `rust-toolchain.toml`, `rustfmt.toml`, `deny.toml`, `flake.nix`, `.envrc.example`.
+- Rust edition 2024; formatting via `rustfmt` (see `rustfmt.toml`, `max_width = 88`).
+- Prefer `#![forbid(unsafe_code)]` and safe Unix APIs via `rustix` instead of `libc`.
+…s, instead prefer using regular async traits (built into rust) and use an Enum instead of a trait object. Alternativel…
+- Avoid OOP style code. Prefer using composition and Rust's data types (structs, enums).
+- Use rust's `tracing` and `metrics` crates for logging, and be sure to utilize tracing spans to associate log messages…
+- when using implicit returns in rust (such as returning Ok(()) on the last line of a function with the `return` keywor…
+- Use standard Rust tests: unit tests in modules, integration tests under `tests/`.
+- Leverage rust's testcontainers library and things like minio or aws localstack if minio doesn't work.