Commit log

d41a3b6 refactor(web): extract shared fields from structs

Click to expand commit body 
Consolidates common data fields across web UI pages into reusable
BaseData, RepoBaseData, and PaginationData structs to reduce code
duplication and improve maintainability.

Implements: bug-7dfe278
Co-authored-by: Crush <crush@charm.land>

Amolith and Crush created

8624ca2 fix: display full branch names in breadcrumbs

Click to expand commit body 
Previously, the breadcrumb navigation would truncate all refs using
shortHash, causing branch names like "generate-promo-codes" to display
as just "generate".

This change adds an IsCommitHash field to template data structures and
updates the templates to conditionally apply shortHash only for actual
commit hashes while showing full names for branches and tags.

Implements: bug-bf0175a
Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

5acf52c fix: detect MIME type for raw blob responses

Click to expand commit body 
Replace hardcoded text/plain content-type with proper MIME type
detection using mime.TypeByExtension and http.DetectContentType
as fallback. Ensures binary files are served with correct types
while maintaining UTF-8 charset for text files.

Fixes: bug-74a99e4

Amolith created

98239dd feat: add anchor links to file headings

Click to expand commit body 
Fixes: bug-dddb40e
Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

c1f46b3 fix(tree): don't link current item in breadcrumb navigation

Click to expand commit body 
Prevent the last breadcrumb item from being linked when viewing
a directory or file in the tree view. Follows the same pattern
already used in blob.html.

Fixes: bug-d8ce4b4

Amolith created

bef4c71 feat: link to my fork REMOVE ME BEFORE PR

Amolith created

708054f feat: prefer custom fonts

Click to expand commit body 
- Use Atkinson Hyperlegible as sans
- Use 0xProto first, JetBrains Mono second as mono
- Preserve existing Pico CSS fallbacks

Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

b2f3659 feat: introduce Pico ✨

Amolith created

68c2383 feat: introduce web UI

Click to expand commit body 
Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

eb9ccfe chore: ignore built binary

Amolith created

a966ccc docs: add AGENTS.md

Click to expand commit body 
Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

64249d3 chore: add justfile

Amolith created

063b4bf feat: add crush config

Click to expand commit body 
Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

86d4c48 feat: prioritize latest commit time for repo UpdatedAt

Click to expand commit body 
Change the order of operations in UpdatedAt() to first try getting
the timestamp from the latest commit before falling back to the
last-modified file. This ensures more accurate update timestamps.

Co-Authored-By: Crush <crush@charm.land>

Amolith and Crush created

8539f9a fix: authentication bypass

Ayman Bagabas created

91e4b2b chore(deps): bump the all group with 4 updates (#776)

Click to expand commit body 
Bumps the all group with 4 updates: [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma), [github.com/charmbracelet/x/ansi](https://github.com/charmbracelet/x), [golang.org/x/crypto](https://github.com/golang/crypto) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).


Updates `github.com/alecthomas/chroma/v2` from 2.22.0 to 2.23.0
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.22.0...v2.23.0)

Updates `github.com/charmbracelet/x/ansi` from 0.11.3 to 0.11.4
- [Commits](https://github.com/charmbracelet/x/compare/ansi/v0.11.3...ansi/v0.11.4)

Updates `golang.org/x/crypto` from 0.46.0 to 0.47.0
- [Commits](https://github.com/golang/crypto/compare/v0.46.0...v0.47.0)

Updates `modernc.org/sqlite` from 1.43.0 to 1.44.2
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.43.0...v1.44.2)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/charmbracelet/x/ansi
  dependency-version: 0.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: golang.org/x/crypto
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.44.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

2368256 chore(deps): bump the all group with 3 updates (#775)

Click to expand commit body 
Bumps the all group with 3 updates: [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma), [github.com/spf13/cobra](https://github.com/spf13/cobra) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite).


Updates `github.com/alecthomas/chroma/v2` from 2.21.1 to 2.22.0
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.21.1...v2.22.0)

Updates `github.com/spf13/cobra` from 1.10.1 to 1.10.2
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.10.1...v1.10.2)

Updates `modernc.org/sqlite` from 1.42.2 to 1.43.0
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.42.2...v1.43.0)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

28c4854 feat: add support for certificate reloading upon SIGHUP (#710)

Click to expand commit body 
* feat: add support for certificate reloading upon SIGHUP

* fix: support certificate reloading for unix and add test

* fix(cmd): move cert reloader logic to the serve package

---------

Co-authored-by: Ayman Bagabas <ayman.bagabas@gmail.com>

Harsh Mantri and Ayman Bagabas created

0758e66 chore(ci): update linting workflow

Ayman Bagabas created

1249f9b chore(lint): remove unused nolint directive

Ayman Bagabas created

2d0e48f chore(lint): fix lint issues

Ayman Bagabas created

0f573f4 chore: update golangci-lint config

Ayman Bagabas created

000ab51 Merge commit from fork

Click to expand commit body 
* fix: require admin privileges for force delete of LFS locks

Move user context retrieval before the force flag check to ensure
proper authorization. Force deletions now require admin privileges,
preventing non-admin users from deleting locks owned by others.

Fixes GHSA-6jm8-x3g6-r33j (CVE-2026-22253)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: improve comment clarity for force delete path

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Tomer Fichman and Claude Opus 4.5 created

62e2d5c fix(ssh): ui: respect anon-access setting for the ui

Click to expand commit body 
Fixes: https://github.com/charmbracelet/soft-serve/issues/759

Ayman Bagabas created

ba7d415 ci: sync golangci-lint config (#767)

Click to expand commit body 
Co-authored-by: aymanbagabas <3187948+aymanbagabas@users.noreply.github.com>

github-actions[bot] and aymanbagabas created

c8779b1 chore(deps): bump the all group across 1 directory with 9 updates (#772)

Click to expand commit body 
Bumps the all group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.20.0` | `2.21.1` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) | `5.16.2` | `5.16.4` |
| [github.com/google/go-querystring](https://github.com/google/go-querystring) | `1.1.0` | `1.2.0` |
| [github.com/muesli/mango-cobra](https://github.com/muesli/mango-cobra) | `1.2.0` | `1.3.0` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.23.0` | `1.23.2` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.45.0` | `0.46.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.38.2` | `1.42.2` |



Updates `github.com/alecthomas/chroma/v2` from 2.20.0 to 2.21.1
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.20.0...v2.21.1)

Updates `github.com/go-git/go-git/v5` from 5.16.2 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.16.2...v5.16.4)

Updates `github.com/google/go-querystring` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/google/go-querystring/releases)
- [Commits](https://github.com/google/go-querystring/compare/v1.1.0...v1.2.0)

Updates `github.com/muesli/mango-cobra` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/muesli/mango-cobra/releases)
- [Commits](https://github.com/muesli/mango-cobra/compare/v1.2.0...v1.3.0)

Updates `github.com/prometheus/client_golang` from 1.23.0 to 1.23.2
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.0...v1.23.2)

Updates `github.com/spf13/cobra` from 1.9.1 to 1.10.1
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.1)

Updates `golang.org/x/crypto` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/crypto/compare/v0.45.0...v0.46.0)

Updates `golang.org/x/sync` from 0.18.0 to 0.19.0
- [Commits](https://github.com/golang/sync/compare/v0.18.0...v0.19.0)

Updates `modernc.org/sqlite` from 1.38.2 to 1.42.2
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.2...v1.42.2)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/go-git/go-git/v5
  dependency-version: 5.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/google/go-querystring
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/muesli/mango-cobra
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github.com/spf13/cobra
  dependency-version: 1.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/crypto
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: golang.org/x/sync
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: modernc.org/sqlite
  dependency-version: 1.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

2447a96 fix(tests): ignore stderr output in SSRF webhook test

Ayman Bagabas created

9e67180 chore(deps): bump actions/checkout from 5 to 6 in the all group (#765)

Click to expand commit body 
Bumps the all group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 5 to 6
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

8262d91 chore: go mod tidy

Ayman Bagabas created

a7f2fbe chore: bump dependencies and use charm.land modules

Ayman Bagabas created

f946151 chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#764)

Click to expand commit body 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.41.0 to 0.45.0.
- [Commits](https://github.com/golang/crypto/compare/v0.41.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.45.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

8a99b84 test: fix

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

bb73b9a Merge commit from fork

Click to expand commit body 
closes GHSA-vwq2-jx9q-9h9f

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

56e9784 docs: Add `IdentitiesOnly` option to ssh command examples (#628)

Rob Berwick created

d963932 Merge commit from fork

Click to expand commit body 
* sec: escape ansi sequences on user input

fixes HSA-fv2r-r8mp-pg48

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

* Apply suggestion from @Tomer-PL

Co-authored-by: Tomer Fichman <tomer@irregular.com>

* chore: fmt

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

---------

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Co-authored-by: Tomer Fichman <tomer@irregular.com>

Carlos Alexandro Becker and Tomer Fichman created

ea8799b feat: add CORS headers (#654)

fetsorn created

15e9e25 chore(deps): bump actions/setup-go from 5 to 6 in the all group (#748)

Click to expand commit body 
Bumps the all group with 1 update: [actions/setup-go](https://github.com/actions/setup-go).


Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

6856877 feat: add readiness and liveness probes for self healing (#734)

Click to expand commit body 
* feat: add k8s readiness and liveness probes

* fix: switch to single err var and add logging

* chore: remove fmt import

Jay Madden created

5c8639b chore(deps): update all deps (#746)

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

8e52267 chore(deps): bump github.com/sergi/go-diff (#729)

Click to expand commit body 
Bumps [github.com/sergi/go-diff](https://github.com/sergi/go-diff) from 1.3.2-0.20230802210424-5b0b94c5c0d3 to 1.4.0.
- [Commits](https://github.com/sergi/go-diff/commits/v1.4.0)

---
updated-dependencies:
- dependency-name: github.com/sergi/go-diff
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

bec9fb3 chore(deps): bump github.com/prometheus/client_golang (#739)

Click to expand commit body 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.22.0 to 1.23.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.22.0...v1.23.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

e5edfd5 sec: update git-module (#742)

Click to expand commit body 
The regex solution proposed in #737 is not sufficient.
I've added `--end-of-options` to the relevant commands in https://github.com/aymanbagabas/git-module/pull/1
so this reverts changes made in #737 and update git-module to include that fix.

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

a73db1a test: use a repo that doesn't change as much (#743)

Click to expand commit body 
wizard tutorial last commit was 2y ago

catwalk get commits almost daily

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

5d9034c ci: sync dependabot config (#741)

Charm created

76a71ef chore(deps): bump actions/checkout from 4 to 5 (#735)

Click to expand commit body 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

5a2bde5 fix: check that commit is a SHA1 (#737)

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

68e6304 chore(deps): bump github.com/alecthomas/chroma/v2 from 2.19.0 to 2.20.0 (#730)

Click to expand commit body 
Bumps [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) from 2.19.0 to 2.20.0.
- [Release notes](https://github.com/alecthomas/chroma/releases)
- [Changelog](https://github.com/alecthomas/chroma/blob/master/.goreleaser.yml)
- [Commits](https://github.com/alecthomas/chroma/compare/v2.19.0...v2.20.0)

---
updated-dependencies:
- dependency-name: github.com/alecthomas/chroma/v2
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

efa8c06 chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.2 to 5.3.0 (#731)

Click to expand commit body 
Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.2.2 to 5.3.0.
- [Release notes](https://github.com/golang-jwt/jwt/releases)
- [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md)
- [Commits](https://github.com/golang-jwt/jwt/compare/v5.2.2...v5.3.0)

---
updated-dependencies:
- dependency-name: github.com/golang-jwt/jwt/v5
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot[bot] and dependabot[bot] created

fa175c7 fix: repo commit help (#736)

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created

de888b9 test: fix golden files

Click to expand commit body 
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>

Carlos Alexandro Becker created