Decide whether BReg needs a minimal in-process review option

Open
#1,220 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
rust
Domain
authentication, authorization, backend

Research direction

Start with crates/registry-breg/src/runtime_config.rs:537-556 and review PR #1189 to understand how review authorities are activated. Trace the current Casework and OIDC requirements, then document whether a minimal in-process option belongs in BReg or the external-service requirement is intentional. Done means the product decision and its scope are recorded.

Written by the indexing model from the issue text.

Description

area:breg needs-jeremi-decision question triage:needs-design

After PR #1189, the smallest possible BReg deployment that needs a two-eyes review now requires standing up Casework plus an OIDC issuer and token flow. activate_review_authorities (crates/registry-breg/src/runtime_config.rs:537-556) only returns None (no review authority active) when no change request in the compiled registry declares a review requirement; as soon as one does, BReg needs a full external review authority, currently only Casework, wired in.

This is a product/scope decision, not a bug: before this PR, BReg had (or could plausibly grow) an in-process, no-external-dependency approve/reject path for the simplest two-eyes case. Now every registry project that wants any review at all takes on the operational cost of a second service plus an identity provider, even for a single-reviewer, single-registry deployment that has no other reason to run Casework.

Question for a product decision:

  • Should BReg keep or reintroduce a minimal in-process review option for the smallest deployments, or is requiring Casework (plus an OIDC issuer) for any review now the intended floor?

Filed from the review of #1189; not merge-blocking.

Dominant language
Rust
Stars
2
Forks
0
Avg merge
3h 45m
Merged PRs (30d)
134

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from registrystack/registry-stack

All issues in registrystack/registry-stack

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.