Portability · 02 of 06 · The shape
Two contracts, many drivers
The forge and the registry are two independent choices, and today they are welded together: the image path is ghcr.io/<GitHub owner>/<app> and the pull credential is a GitHub token. Hangar owns the two contracts; each vendor is a driver behind one of them.
Two contracts, many drivers
Three callers, Airframe compositions (repositories, seed files and webhooks), Glidepath tasks (pull requests, statuses and image pushes) and the Tower backend (pull requests, links, images and pruning), call Hangar contracts, never a vendor API. The SCM contract covers repositories, files, hooks, the merge gate, pull requests, statuses and tokens; the registry contract covers OCI push, pull, digest, referrers, list and delete. Each contract has a set of drivers. Forge drivers: GitHub, built today, then GitLab for gitlab.com and self-managed in phase 3, and Bitbucket Cloud and Bitbucket Data Center in phase 4. Registry drivers: GHCR, built today, then the GitLab Container Registry and Harbor, the neutral default, in phase 1, and ECR, ACR and Artifactory on demand.
CONTRACT ONLY WHO CALLS HANGAR CONTRACTS Airframe compositions repos · seed files · hooks Glidepath tasks PRs · statuses · image push Tower backend PRs · links · images · prune SCM contract repos · files · hooks · merge gate · PRs · statuses · tokens Registry contract OCI push · pull · digest · referrers · list · delete FORGE Forge drivers GitHub built today · driver 1 GitLab · .com and self-managed phase 3 Bitbucket Cloud phase 4 Bitbucket Data Center phase 4 REGISTRY Registry drivers GHCR built today GitLab Container Registry phase 1 Harbor phase 1 · neutral default ECR · ACR · Artifactory by demand Two choices, made separately. A Bitbucket shop still needs a registry. LEGEND Caller Hangar-owned contract Driver set Planned driver
Declarative: Repository, RepositoryFile, Webhook, MergeGate, as scm.hangar.io resources. Imperative: pr open, find, comment, status, contents, compare, token. One Go library behind the provider, the scm CLI and the broker.
Push, pull, digest and cosign already speak plain OCI. Only listing with dates and deleting are vendor APIs, so only those need drivers.
A driver declares what it can enforce, such as a required check from one named app. Tower shows the level each app actually has.