forge¶

Forge release operations for Go — a provider contract, a registry, and a credential chain for GitHub, GitLab, Gitea, Codeberg, Bitbucket and plain download sources, with no vendor SDK in the core.

go get gitlab.com/phpboyscout/go/forge

factory, err := forge.Lookup(sourceType)
provider, err := factory(ctx, source, cfg)

rel, err := provider.GetLatestRelease(ctx, owner, repo)

Why¶

Depend on the contract, not a client. Consuming code takes a forge.Provider, never a *github.Client. Switching forges is a one-line constructor change, not a second code path. See backend agnosticism.
You pay only for what you use. The core imports no forge SDK — a guard test enforces it — and each provider is its own module, enabled by a blank import.
Any forge, including one we have never heard of. The registry is keyed by a plain string, so a provider ships as your module with nothing contributed here. See author a provider.
A credential seam, not a credential chain. A provider asks a CredentialSource for a token; where that token comes from — a config key you name, an environment variable, your own vault client — is your composition. Precedence lives in your config stack, stated once, rather than a second time inside here. See authenticate.
Credentials pinned to the host they were issued for. Asset URLs come from release metadata, which a release author controls. See credential pinning.
A conformance harness, not just an interface. The compiler checks your method set; RunProviderConformance checks the protocol the compiler cannot see.

Where next¶

Getting started — resolve a provider and read a release.
Verify a release — accept a good artefact, refuse a tampered one.
Author a provider — teach it a new forge, in your own module.
Authenticate — the credential seam and how to pin it.
Direct provider — releases from a plain web server.
Providers — which forges are supported, their config keys and capabilities.
Configuration — every key, param and environment variable, with its default.
What forge does not do — the limits, stated rather than discovered.

Reference¶

Providers — supported forges and their capabilities
Configuration — keys, params, environment variables, defaults
Errors — every sentinel and what to do with it
Conformance harness — the field list for RunProviderConformance

The Go API reference is on pkg.go.dev.