168 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
copilotcoder	062f19b4aa	ci: retrigger workflow run	2026-07-08 07:41:50 -04:00
copilotcoder	93529b91ec	Use internal Playwright mirror for E2E tester builds	2026-07-07 23:39:23 -04:00
copilotcoder	6f8913ba70	Harden CICD image refs against empty SHA/base hash	2026-07-07 21:41:20 -04:00
copilotcoder	ca99393700	Fix hyphenated needs references in CI gate expressions	2026-07-07 21:17:54 -04:00
copilotcoder	e246e6d5bc	Adding the workflow spreadsheet ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-07 19:24:30 -04:00
copilotcoder	bd174d8186	Harden E2E tester build against transient MCR DNS failures	2026-07-07 19:22:29 -04:00
copilotcoder	d4aa16e18a	Separate backend/frontend base-main lanes and add postmortem coverage	2026-07-07 18:15:33 -04:00
copilotcoder	f0b259e1c3	Add tester image lanes and production gates to CICD workflow	2026-07-07 18:01:48 -04:00
copilotcoder	9301466f9e	Add source-lane postmortem job for setup-stage failures	2026-07-07 14:36:46 -04:00
copilotcoder	1e9e3f0c41	Add runtime-images postmortem job for setup-stage failures	2026-07-07 12:45:48 -04:00
copilotcoder	b7b66c9e26	Harden runtime health probes in integration and e2e jobs	2026-07-07 10:59:29 -04:00
copilotcoder	f1651affd0	Retry runtime image pushes on transient registry resets	2026-07-07 09:38:48 -04:00
copilotcoder	0ac6108fc7	Use full runner pool for source test lanes	2026-07-07 08:27:13 -04:00
copilotcoder	d59217912d	Discover actual runner containers dynamically	2026-07-07 08:19:15 -04:00
copilotcoder	8619e00a17	Add runner diagnostics and rebalance source lanes	2026-07-07 08:14:10 -04:00
copilotcoder	71b9dda8a4	ci: retrigger workflow run	2026-07-07 07:12:34 -04:00
copilotcoder	08d36e958b	Run integration and E2E against deployable app images	2026-07-06 23:12:38 -04:00
copilotcoder	738ab39736	Resolve CICD image tag for runtime-based jobs	2026-07-06 22:02:18 -04:00
copilotcoder	6963c3ae2f	ci: retrigger workflow run attempt 2	2026-07-06 19:47:50 -04:00
copilotcoder	6f3d96d6ef	Handle missing frontend .yarn directory in runtime build	2026-07-06 18:59:05 -04:00
copilotcoder	4855be1c12	ci: retrigger workflow run attempt 2	2026-07-06 18:06:51 -04:00
copilotcoder	2df9dbe7a0	ci: retrigger workflow run attempt 2	2026-07-06 17:24:44 -04:00
copilotcoder	4af111fcdb	Align CI and Poe test lanes with runtime compose flows	2026-07-06 16:51:39 -04:00
copilotcoder	0791f9257e	Keep integration tests out of backend unit lane	2026-07-06 16:45:05 -04:00
copilotcoder	9a43d9090b	Reclaim runner disk before CICD image build	2026-07-06 13:01:27 -04:00
copilotcoder	fe02644e1d	Trigger CICD on every push	2026-07-06 11:48:38 -04:00
copilotcoder	7c06fa3474	Refactor CI and runtime images to two-stage builds	2026-07-06 10:29:31 -04:00
Xlorep DarkHelm	1f6cafa1bc	TASK: Replace integration lane with post-build backend runtime black-box tests (#72) ... ## Summary Replace the existing source-context integration lane with backend runtime black-box integration checks that run against started deployable containers. This change wires deployable backend image references (both commit tag and immutable digest) from the build workflow into the tests workflow, then validates runtime behavior over network endpoints. ## Why Integration confidence should come from testing running service artifacts, not only source-mounted or in-process execution. ## What Changed - Build workflow now: - Publishes deployable backend image tag reference and digest reference - Exposes both as job outputs - Passes both references into CICD Tests dispatch inputs - CICD Tests workflow now: - Accepts deployable backend tag and digest inputs - Propagates these through setup outputs - Replaces previous integration lane behavior with runtime black-box execution: - Starts isolated Docker network - Starts Postgres container - Starts backend container from digest-pinned deployable image - Enforces tag-to-digest consistency before running checks - Runs endpoint checks against live container: - GET / - GET /compatibility - GET /health - Captures backend/db logs and container state on failure - Cleans up containers and network via trap - Documentation updated: - Runtime contract enforcement section now includes runtime black-box integration checks - CI success summary now reflects runtime integration lane behavior ## Scope Included: - Backend runtime black-box integration replacement for the existing integration lane - Digest + tag identity enforcement - Failure diagnostics for triage Out of scope: - Frontend runtime smoke checks - E2E lane redesign ## Acceptance Criteria Mapping - Integration tests execute against runtime container endpoints: ✅ - Integration lane consumes built image references (not source-mounted execution): ✅ - Failures surface service logs and test logs for triage: ✅ ## Verification - Workflow files pass local validation checks - Pre-commit hooks pass on committed changes - Branch pushed and ready for PR review ## Related - Issue: #61 - Dependency context: #66 Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #72	2026-07-05 22:48:57 -04:00
Xlorep DarkHelm	549469f105	CI: Establish source-first quality gate and simplify pipeline flow (#71) ... This PR establishes a deterministic source-level quality gate before any build promotion and removes redundant post-build quality checks. The new flow makes local developer workflow and CI behavior align: - Developers run pre-commit locally (with auto-fix where appropriate) - CI runs a check-only smoke gate to validate pre-commit cleanliness - Build/test promotion only proceeds after source checks pass ## What Changed ### 1. Added a source-first quality gate - Added a dedicated source gate workflow: - `.gitea/workflows/cicd-source-checks.yaml` - Gate now: - Checks out target SHA - Bootstraps backend/frontend toolchains - Installs dependencies (`backend` via `uv`, `frontend` via `yarn`) - Runs `pre-commit --all-files` as the quality smoke test - Downstream build dispatch only occurs if this gate passes. ### 2. Updated pipeline routing - `cicd-start.yaml` now dispatches the source gate first. - `cicd-start.yaml` push trigger now includes all branches so feature branches run the same gate. - Added explicit routing logs in dispatch steps (route decision, SHA, trace id) for easier debugging. ### 3. Removed redundant checks workflow - Removed: - `.gitea/workflows/cicd-checks.yaml` - Updated: - `.gitea/workflows/docker-build-main.yaml` now dispatches `cicd-tests.yaml` directly after successful main build. ### 4. CI check-only behavior vs local auto-fix behavior Updated `.pre-commit-config.yaml` so hooks that can auto-fix behave as: - **Local developer pre-commit**: auto-fix enabled - **CI source gate**: check-only (no auto-fix) Applied to: - `ruff` / `ruff-format` - `eslint` - `prettier` - `tsdoc-lint` - `markdownlint` - `pretty-format-toml` This keeps CI as a true smoke validation of local pre-commit compliance. ### 5. Renovate workflow hardening - Improved auth/token handling and diagnostics in: - `.gitea/workflows/renovate.yml` - Added support for internal/self-signed TLS endpoints used by this environment. ## Why - Faster, earlier feedback on source quality failures - Avoid expensive build/test progression when source hygiene fails - Align CI with developer habits for predictable outcomes - Remove duplicated quality checks and reduce pipeline complexity ## New Effective CI Flow 1. `cicd-start.yaml` 2. `cicd-source-checks.yaml` (pre-commit smoke gate) 3. `docker-build-base.yaml` / `docker-build-main.yaml` 4. `cicd-tests.yaml` ## Acceptance Criteria Mapping (Issue #60) - Source-level lane runs independently and consistently: **Implemented** - Source-lane failure blocks promotion: **Implemented** - Outputs/logging are clear and actionable: **Implemented** ## Notes - Source gate is intentionally check-only in CI. - Developers should continue running local pre-commit before pushing. - Any remaining failures in source gate indicate local pre-commit was not fully clean. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #71	2026-07-02 07:21:18 -04:00
Xlorep DarkHelm	b16ef3a276	Minor adjustments to renovate. (#70) ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org> Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #70	2026-06-22 12:56:59 -04:00
Xlorep DarkHelm	c7540e97ad	feat(ci): enforce runtime-validation image separation (#69) ... ## Summary Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images. This PR: - Adds automated deployable-runtime boundary checks in CI. - Verifies deployable backend/frontend artifacts are free of CI/development tooling. - Documents runtime-vs-validation ownership and enforcement behavior. ## What Changed ### CI workflow enforcement - Updated `.gitea/workflows/docker-build-main.yaml` to: - Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories). - Run `scripts/check-dockerfile-boundaries.sh`. - Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`). - Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image. - Updated `.gitea/workflows/cicd-checks.yaml` to add: - `dockerfile-boundary-check` job. - Boundary validation execution inside the CICD validation image. ### New enforcement scripts - Added `scripts/check-dockerfile-boundaries.sh`: - Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.). - Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens. - Enforces runtime base expectations: - Backend: `python:3.14-slim` - Frontend production target: `nginx:alpine` - Added `scripts/verify-deployable-image-purity.sh`: - Baseline binary checks for disallowed tooling. - Backend-specific deep checks: - Python module import probes for disallowed CI/dev modules. - `pip show` package metadata checks for disallowed CI/dev packages. - Frontend-specific deep checks: - OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks. - Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths). ## Documentation updates - Updated `docs/DEVELOPMENT.md`: - Clarifies runtime-vs-validation enforcement and where checks run. - Notes purity checks include binaries and metadata artifacts. - Updated `docs/CICD_MULTI_STAGE_BUILD.md`: - Adds explicit “Runtime Boundary Enforcement” section. - Documents metadata-level purity probes. - Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`: - Replaces future-only language with current enforcement hooks. - Documents binary + metadata-level purity enforcement. ## Acceptance Criteria Mapping 1. **Deployable backend/frontend image paths do not require CI-only tool installation** - Enforced by: - `scripts/check-dockerfile-boundaries.sh` - `scripts/verify-deployable-image-purity.sh` - `docker-build-main.yaml` pre-publish gates 2. **Checks and tests execute in dedicated validation environment(s)** - Reinforced by: - `cicd-checks.yaml` boundary-check job running in CICD validation image - Existing check/test workflow usage of CICD image 3. **Workflow docs identify runtime vs validation concerns** - Addressed via updates to: - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` ## Scope / Non-Goals - Included: - Structural separation enforcement - Workflow-level guardrails - Documentation clarity and traceability - Not included: - Full staging deployment wiring - Security policy redesign ## Notes for Reviewers - Main enforcement path is in `docker-build-main.yaml` before CICD image publish. - New scripts are intentionally fail-fast and policy-oriented. - Existing deployable Dockerfiles currently satisfy the new gates. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #69	2026-06-22 12:45:20 -04:00
Xlorep DarkHelm	9b742a5a6d	feature/pp-58-runtime-image-contract (#68) ... ## Summary This PR tightens repository quality enforcement around markdown and documentation. It adds `markdownlint` to the `cicd-checks` workflow, expands pre-commit coverage so markdown files are checked repo-wide, and cleans up the PP-58 documentation set to keep it aligned with the new policy. ## What changed - Added a `Markdownlint Check` entry to `.gitea/workflows/cicd-checks.yaml` - Added `markdownlint` to pre-commit and widened prettier coverage to include markdown files across the repo - Updated `README.md` to satisfy markdownlint line-length rules - Normalized the PP-58 documentation set: - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - `docs/adr/ADR003-deployable_runtime_image_contract.md` - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/CICD_TROUBLESHOOTING_GUIDE.md` - `docs/SECURE_DOCKER_CICD.md` ## Validation - `pre-commit run markdownlint --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - `pre-commit run prettier --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - Workflow YAML validation returned no errors ## Notes This change does not alter application runtime behavior. It only strengthens CI and documentation quality enforcement. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #68	2026-06-19 17:00:57 -04:00
Xlorep DarkHelm	48a37b943f	PP-11_Add_SQLAlchemy_async_engine_session (#67) ... ## Summary This PR upgrades backend typing tooling and finalizes quality cleanup for the SQLAlchemy async engine/session work on `PP-11_Add_SQLAlchemy_async_engine_session`. ## What Changed - Upgraded pinned `pyright` version from `1.1.406` to `1.1.410`. - Regenerated backend lock state to align with the new pyright pin. - Removed deprecated `pythonPath` from pyright config to eliminate the config notice. - Refined backend DB runtime state handling and cleanup paths. - Updated database tests to avoid brittle singleton assumptions and keep typeguard-compatible async engine test doubles. ## Why - Remove tooling noise and keep checks deterministic. - Keep backend static/type/doc/test quality gates warning-free. - Improve reliability and clarity of DB engine/session lifecycle tests. ## Validation - `uv run ruff format --check .` - `uv run ruff check .` - `uv run pyright .` - `uv run pydoclint --config=pyproject.toml src/` - `uv run xdoctest --module backend` - `uv run pytest` Results: - Pyright: `0 errors, 0 warnings` - Pytest: `21 passed` ## Impact - No API contract changes intended. - No frontend changes. - Backend behavior remains the same; this is tooling/test/runtime-state cleanup. ## Risk - Low risk. - Main touched areas are backend tooling config, lockfile, DB runtime state internals, and tests. ## Checklist - [x] Backend lint clean - [x] Backend type checks clean - [x] Backend doc checks clean - [x] Backend tests passing - [x] Branch pushed and ready for review Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #67	2026-06-19 07:39:56 -04:00
Cliff Hill	d02039a22e	Backend runtime upgraded to Python 3.14 with exact dependency pinning (#57) ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org> ## Summary Upgrades backend runtime baseline and dependency management for issue #10. ### Changes 1. **Python Baseline**: Updated from 3.13 to 3.14 - Updated `backend/pyproject.toml` requires-python constraint - Updated `backend/pyrightconfig.json` pythonVersion - Updated all Dockerfile and CI references 2. **Dependency Pinning**: Switched to exact version pins in `backend/pyproject.toml` - All dev and runtime dependencies now use `==` instead of `>=` - `fastapi==0.120.2`, `uvicorn==0.38.0` - ruff, pyright, pytest suite pinned to current resolved versions - Regenerated `backend/uv.lock` under Python 3.14 3. **Startup Compatibility Guard** (TDD via RED→GREEN) - New `compatibility_status()` function evaluates runtime and pinned deps - Startup raises `RuntimeError` if policy fails - Implemented via FastAPI lifespan (non-deprecated) handler 4. **Compatibility Status Endpoint** - New `GET /compatibility` returns policy status, runtime version, and package checks - Shares single source of truth with startup validation 5. **Integration Tests** - Added failing-then-passing tests for startup guard and endpoint behavior - 100% coverage maintained 6. **Direnv Configuration** - Added `UV_PYTHON="3.14"` pin to repo `.envrc` - Ensures direnv creates/recreates venv with correct Python version ### Validation - ✅ ruff format/check - ✅ pyright strict (0 errors) - ✅ pytest: 8 passed, 100% coverage (>=95 gate) - ✅ pydoclint: pass - ✅ xdoctest: pass ### Notes - SQLAlchemy/SQLModel introduction deferred to next pass per scope - Compatibility logic currently validates fastapi/uvicorn pins (runtime deps) - Ready for container build validation and Renovate bot testing Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #57 Co-authored-by: Cliff Hill <xlorep@darkhelm.org> Co-committed-by: Cliff Hill <xlorep@darkhelm.org>	2026-06-18 11:19:24 -04:00
Cliff Hill	5d74dd8d8f	Adding some stuff for the new structure to work with my system. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2026-04-08 09:45:49 -04:00
Cliff Hill	18dc1c887a	Retrying run.	2025-11-06 08:22:48 -05:00
Cliff Hill	d3a839489e	Retrying run.	2025-11-06 08:22:45 -05:00
Cliff Hill	e401d852f4	Fixing renovate (again). ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-06 07:09:55 -05:00
Cliff Hill	de5fde5460	Trying this again.	2025-11-05 18:10:10 -05:00
Cliff Hill	4454e9aef5	Adding renovate stuff. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-04 12:40:53 -05:00
Cliff Hill	a142bc46c2	CICD workflow is now valid. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-03 12:14:44 -05:00
Cliff Hill	b9c6b604b1	Make the e2e test use docker in the same way all the others do. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-03 08:40:19 -05:00
Cliff Hill	bf1f3f30df	Making the e2e tests more resiliant for network issues. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 18:33:19 -04:00
Cliff Hill	e16141cdbd	Better dependency processing for the frontend in the CICD. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 16:13:30 -04:00
Cliff Hill	125e889501	Even more dependency fixing happening here. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 15:24:59 -04:00
Cliff Hill	9203e4ff73	More frontend dependency fixes for the CICD build. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 13:27:56 -04:00
Cliff Hill	c34c6e45d6	Adding CICD troubleshooting documentation. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 13:04:39 -04:00
Cliff Hill	b0115e33d3	Attempting to fix how the frontend dependencies are handled in the CICD build. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 13:03:18 -04:00
Cliff Hill	91e6dd7ae1	Fixing the build. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 12:45:11 -04:00
Cliff Hill	aee570e8c3	Trying to improve how images are built, using docker caching the best I can ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 11:20:56 -04:00