This post continues the discussion about how to implement repo push activities. My current implementation does the following:
This works fine so far, assuming you like the idea that the Push activity is authored on the server while you're the actor of the activity and not the repo. But there's a complication: What happens when you push to a repo hosted on a different server, not the one where your account is? In that case, the server can't publish the Push activity for you!
So I'd like to ask the following:
The answer also needs to make sure that those Push activities are authentic and honest and match the actual repo commits, otherwise anyone can claim pushing some fake arbitrary commit to any arbitrary repo.
Idea, maybe instead of a Push activity we could have a Receive activity in which the repo is the actor?