Follow-ups review fixes: LFS key pin, mirror numeric hosts, visibility re-auth, docs !514

merged merged by cmc on 2026-09-29 02:39 UTC · krz/gitbay:followups-fixes into main

Discussion

cmc
  • LFS tokens carry a hash of the minting key's fingerprint next to its id; a key that takes over a deleted key's id (SQLite reuses it) no longer inherits the old key's tokens. Tokens issued before this refuse. Closes #303.
  • repo mirror add refuses a numerically written host at add time, as sync already does (gitpin.CheckHost).
  • repo settings visibility needs a recent web sign-in, like the other grants (#297).
  • webhook add trims a CRLF from the stdin secret; the stdin registry test covers --secret -.
  • CHANGELOG: duplicate #297 bullet removed, upgrade notes grouped after the list, the mirror note corrected, the iOS break named (krz/gitbay-ios#21). Wiki: SSRF rows for #301 corrected; Admin runner-validation step names where to run repo runner add.