From 7162aef3344a4f4f2d7edd2f214d805bd744c20c Mon Sep 17 00:00:00 2001
From: Saya Andy <saya.andy@posteo.com>
Date: Thu, 30 Jul 2026 12:27:31 +0700
Subject: ui-ci: let a ci-filter decide whether the tab is shown

cgit cannot know whether the ref being viewed actually has a pipeline, so
the "ci" tab is offered for every ref and only reveals a missing one once
followed. Probing the ci system from cgit is not an option: the tab is
part of the page header, so it would mean a blocking request for every
page of every repository, cgit links no http client, and job pages are
usually not readable anonymously.

Add a ci filter instead, which receives the ref, whether it is a branch or
a tag, and the expanded url, and answers with its exit status. This keeps
credentials, timeouts and caching in a script, where they belong;
filters/ci-jenkins.sh demonstrates all three against Jenkins' REST API.

The verdict is memoized, so the filter runs once per request rather than
once for the tab and again for the redirect, and it governs the page as
well as the tab, so a hidden tab cannot be reached by typing the url.

Signed-off-by: Saya Andy <saya.andy@posteo.com>
---
 tests/t0112-ci.sh | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

(limited to 'tests/t0112-ci.sh')

diff --git a/tests/t0112-ci.sh b/tests/t0112-ci.sh
index d8673e4..33609d6 100644
--- a/tests/t0112-ci.sh
+++ b/tests/t0112-ci.sh
@@ -10,6 +10,7 @@ cat >cgitrc.ci <<EOF
 virtual-root=/
 cache-root=$PWD/cache
 cache-size=0
+enable-filter-overrides=1
 
 repo.url=tagonly
 repo.path=$PWD/repos/foo/.git
@@ -27,8 +28,20 @@ repo.path=$PWD/repos/foo/.git
 repo.url=override
 repo.path=$PWD/repos/foo/.git
 repo.ci-url=https://ci.example.org/override/\$repo/\$\$/\$ref
+
+repo.url=filtered
+repo.path=$PWD/repos/foo/.git
+repo.ci-filter=exec:$PWD/ci-filter.sh
 EOF
 
+# Records its arguments and only accepts tags.
+cat >ci-filter.sh <<EOF
+#!/bin/sh
+printf '%s|%s|%s\n' "\$1" "\$2" "\$3" >>"$PWD/ci-filter.log"
+test "\$2" = tag
+EOF
+chmod +x ci-filter.sh
+
 git --git-dir="$PWD/repos/foo/.git" tag v0.17.3.2 master
 
 cgit_ci()
@@ -80,4 +93,35 @@ test_expect_success 'no ci tab without a ci url' '
 	! grep ">ci</a>" tmp
 '
 
+test_expect_success 'ci filter accepts a tag' '
+	rm -f ci-filter.log &&
+	cgit_ci "filtered/ci&h=v0.17.3.2" >tmp &&
+	grep "^Location: https://ci.example.org/job/filtered/view/tags/job/v0.17.3.2$" tmp &&
+	echo "v0.17.3.2|tag|https://ci.example.org/job/filtered/view/tags/job/v0.17.3.2" >expected &&
+	test_cmp expected ci-filter.log
+'
+
+test_expect_success 'ci filter rejects a branch' '
+	rm -f ci-filter.log &&
+	cgit_ci "filtered/ci&h=master" >tmp &&
+	grep "^Status: 404 Not found$" tmp &&
+	echo "master|branch|https://ci.example.org/job/filtered/job/master" >expected &&
+	test_cmp expected ci-filter.log
+'
+
+test_expect_success "ci filter hides the tab and is consulted once" '
+	rm -f ci-filter.log &&
+	cgit_ci "filtered/refs&h=master" >tmp &&
+	! grep ">ci</a>" tmp &&
+	test_line_count = 1 ci-filter.log &&
+	cgit_ci "filtered/refs&h=v0.17.3.2" >tmp &&
+	grep "href=./filtered/ci/?h=v0.17.3.2.>ci</a>" tmp
+'
+
+test_expect_success 'ci filter is not consulted without a ci url' '
+	rm -f ci-filter.log &&
+	cgit_url "foo/refs" >tmp &&
+	test_path_is_missing ci-filter.log
+'
+
 test_done
-- 
cgit v1.3.1+13