188 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
copilotcoder	3db1b0676f	chore(ci): centralize runtime and image version constants	2026-07-22 17:38:34 -04:00
copilotcoder	cd19d06680	ci(e2e): align Playwright runtime image to 1.61.1	2026-07-22 16:36:43 -04:00
copilotcoder	f71025ee1c	fix(frontend-image): use repo-pinned yarn for immutable install	2026-07-22 14:26:11 -04:00
copilotcoder	e61b70c4a0	fix(frontend): restore TS6-compatible lint and type checks	2026-07-22 13:28:30 -04:00
copilotcoder	6c98ee7018	Trying to get all of the version updates in one go. ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-22 11:10:05 -04:00
copilotcoder	87f977280c	fix(frontend): align zod v4 typings and defaults	2026-07-22 10:59:55 -04:00
copilotcoder	ff53dec2c2	Trying to make the build and push base image for CICD work. ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-22 07:52:25 -04:00
Xlorep DarkHelm	2bb73a3f6b	chore: Update zod to 4.4.3 (#109) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #109	2026-07-21 22:20:46 -04:00
Xlorep DarkHelm	8ba9d5f5d0	chore: Update ubuntu Docker tag to v26 (#106) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #106	2026-07-21 22:20:21 -04:00
Xlorep DarkHelm	329663ccdf	chore: Update @types/node to 24.13.3 (#101) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #101	2026-07-21 22:20:04 -04:00
Xlorep DarkHelm	1ba01171a1	chore: Update Yarn to 4.17.1 (#100) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #100	2026-07-21 22:19:47 -04:00
Xlorep DarkHelm	9d97f4bec8	Merge pull request 'chore: Update typescript to 5.9.3' (#99) from renovate/typescript-5.x into main ... Reviewed-on: #99	2026-07-21 22:19:06 -04:00
Renovate Bot	81ff99fe59	chore: Update typescript to 5.9.3	2026-07-21 22:19:06 -04:00
Xlorep DarkHelm	a51bb70ba0	chore: Update @vue/tsconfig to 0.9.1 (#95) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #95	2026-07-21 22:18:42 -04:00
Xlorep DarkHelm	5fa44e2bec	chore: Update @playwright/test to 1.61.1 (#94) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #94	2026-07-21 22:17:44 -04:00
Xlorep DarkHelm	640d3bb767	chore: Update vue to 3.5.40 (#93) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #93	2026-07-21 22:16:56 -04:00
Xlorep DarkHelm	75fdff75cf	chore: Update Frontend dev tools (patch) (#91) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #91	2026-07-21 22:15:29 -04:00
Xlorep DarkHelm	4d1069767b	chore: Update fastapi to 0.139.2 (#90) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #90	2026-07-21 22:15:06 -04:00
Xlorep DarkHelm	9d4db9eaa4	chore: Update @vue/test-utils to 2.4.11 (#89) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #89	2026-07-21 22:14:25 -04:00
Xlorep DarkHelm	0e76925c90	chore: Update @vitest/coverage-v8 to 3.2.7 (#88) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #88	2026-07-21 22:12:41 -04:00
Xlorep DarkHelm	c4f59e4d05	chore: Update @vitejs/plugin-vue to 6.0.8 (#87) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #87	2026-07-21 22:12:22 -04:00
copilotcoder	e4925e2023	ci(renovate): force manual runs outside schedule	2026-07-21 15:52:58 -04:00
copilotcoder	f037e7138d	docs(dev): document Renovate manual dispatch behavior v0.0.3	2026-07-21 15:04:09 -04:00
copilotcoder	93b4000b20	ci(renovate): run manual dispatch outside schedule in single pass	2026-07-21 14:24:45 -04:00
copilotcoder	996a018dad	Working on debugging renovate, set log level back to debug. ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-21 13:46:45 -04:00
copilotcoder	b1055ba605	Updating psycopg to 3.3.4 ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org> v0.0.2	2026-07-20 20:50:10 -04:00
copilotcoder	5efe0446d5	Rename runtime images to explicit plex-playlist names	2026-07-20 20:44:58 -04:00
copilotcoder	d865be8b12	Restore backend coverage for runtime pin helpers v0.0.1	2026-07-20 18:06:58 -04:00
copilotcoder	fb82e3947d	Deduplicate dependency version pins from backend code/tests	2026-07-20 15:16:28 -04:00
Xlorep DarkHelm	4b2c46e1d8	chore: Update @types/node to 20.19.43 (#85) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #85	2026-07-20 14:18:08 -04:00
Xlorep DarkHelm	744937660e	chore: Update sqlalchemy to 2.0.51 (#83) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #83	2026-07-20 14:12:56 -04:00
Xlorep DarkHelm	c03457faed	chore: Update postgres Docker tag to v18 (#79) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYWpvci11cGRhdGUiXX0=--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #79	2026-07-19 22:43:21 -04:00
copilotcoder	0b64471603	Fixing grep substitutions for promotion. ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-19 07:18:41 -04:00
copilotcoder	37049c726e	Fixing the backend runtime policy tests. ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-19 00:07:02 -04:00
Xlorep DarkHelm	e9291b1ad5	chore: Update mcr.microsoft.com/playwright Docker tag to v1.61.1 (#78) ... This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| --- ### Release Notes ### Configuration 📅 **Schedule**: 🚦 **Automerge**: Disabled ♻ **Rebasing**: Not rebasing 👥 **Reviewers**: None --- *This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).* <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNzMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE3My4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJzZWN1cml0eSJdfQ==--> Co-authored-by: Renovate Bot <renovate@darkhelm.org> Reviewed-on: #78	2026-07-18 23:24:08 -04:00
Xlorep DarkHelm	e539f9b0d8	ci: consolidate cicd workflow lanes, clean up helpers, and align CI docs (#86) ... ## Summary This PR simplifies the CICD workflow by merging related lanes, reducing duplicated script logic, and keeping the same overall pipeline behavior and gates. It also updates CI documentation to match the new job topology. ## What Changed ### Workflow consolidation - Merged base and complete CICD image publication into one producer job: - Build and Push CICD Images - Merged dependency audits into one informational lane: - Dependency Audits (Informational) - Merged runtime image build lanes into one release producer: - Build Release Images - Merged tester image build lanes into one tester producer: - Build Tester Images ### Dependency/gate rewiring - Updated downstream needs to consume merged producers. - Kept output contracts for deployable and tester image references. - Updated production and postmortem gates to the new job IDs. ### Cleanup/simplification - Removed duplicate helper-function definition(s) in CICD scripts. - Replaced a manual docker login retry loop with existing retry helper usage. - Removed redundant shell option declarations where behavior was unchanged. - Removed one unused E2E environment variable. ### Documentation alignment - Updated CI architecture documentation to reflect merged workflow lanes. - Updated troubleshooting guidance to reference current job sequencing. ## Why - Reduce job startup overhead on self-hosted runners. - Keep behavior consistent while lowering workflow complexity. - Improve maintainability by removing duplicated/unused script fragments. - Keep docs in sync with operational workflow reality. ## Validation - Workflow file checks passed with pre-commit. - Documentation checks passed with pre-commit (including markdownlint/prettier). - No diagnostics/errors reported for updated workflow/docs files. ## Risk and Impact - Low-to-medium operational risk due to job-ID/needs rewiring. - Mitigated by preserving output keys consumed by integration and e2e lanes. - Audit lane remains informational-only (non-blocking), same intent as before. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #86	2026-07-17 17:14:00 -04:00
Xlorep DarkHelm	19f6428775	ix runtime policy pin mismatch and make dependency audits non-blocking (#81) ... ## Summary This PR fixes backend test breakage caused by stale runtime compatibility pins and updates CI behavior so dependency audits remain informative without blocking delivery. ## What Changed - Updated backend runtime compatibility package pins to match current dependency versions. - Updated backend tests to align with the new compatibility expectations and restore coverage compliance. - Expanded backend unit coverage around runtime policy and health-check behavior. - Changed frontend and backend dependency audit lanes in CI to be non-blocking: - They still run in the same workflow position. - Failures are logged clearly. - Pipeline completion is no longer gated on audit pass/fail. ## Why - Recent dependency updates caused runtime policy startup validation to fail in tests. - Audit jobs are useful for visibility, but they should not prevent system completion when they detect issues. ## Validation - Pre-commit hooks passed on commit. - Backend unit tests with coverage pass, including fail-under threshold. - Branch pushed successfully: `fix/backend-runtime-policy-tests`. ## Notes - Audit failures now signal actionable dependency risk without stopping the release flow. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #81	2026-07-16 07:40:11 -04:00
copilotcoder	5fc16d4b5b	chore: run renovate on weekdays	2026-07-14 12:26:38 -04:00
copilotcoder	fdf8637f88	chore: reduce renovate log verbosity	2026-07-14 12:12:36 -04:00
copilotcoder	7603381c30	fix: harden renovate npm heap and dashboard approvals	2026-07-14 11:48:49 -04:00
copilotcoder	a2d7013dd4	chore: tune runner defaults and pin renovate to 8gb	2026-07-14 10:12:57 -04:00
copilotcoder	484bfbf74f	perf: harden renovate gitea api timeouts	2026-07-14 08:46:08 -04:00
copilotcoder	b5991ac1ae	perf: stabilize batched renovate runs	2026-07-14 07:55:01 -04:00
copilotcoder	e81f94c45c	perf: enforce renovate manager batching under 2gb cap	2026-07-14 07:35:03 -04:00
copilotcoder	7d053780f5	Patching the renovate flow. ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>	2026-07-13 22:58:28 -04:00
Xlorep DarkHelm	f627ef018a	feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration (#74) ... ## Summary This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution. ## What changed - Added Bandit to pre-commit backend checks. - Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit. - Added dedicated audit tasks: - backend audit via pip-audit - frontend audit via yarn npm audit - Updated CI/CD workflow to include and gate on frontend/backend audit jobs. - Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI. - Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable. - Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently. ## Validation - Pre-commit hooks run and pass after formatting/autofixes. - Branch commit created successfully after hook-driven file updates. - Branch pushed to remote and tracking is configured. ## Notes - pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout. - Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable. ## Follow-ups (optional) - Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale. - Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #74	2026-07-13 22:19:57 -04:00
Xlorep DarkHelm	f3698b095b	Stabilize self-hosted CI workflows and resolve issue #62 (#73) ... ## Summary Hardens CI workflows for self-hosted Gitea runners by stabilizing E2E execution and Renovate behavior across internal/external network paths. Closes #62 ## What Changed ### E2E workflow reliability - Fixed E2E workspace handoff to ensure expected repository contents are present during test execution. - Added stricter preflight checks for required frontend files before running E2E. - Reduced mount/path fragility while preserving runtime image pull and compose flow. ### Renovate workflow hardening - Added internal-first endpoint reachability selection with fallback handling. - Added token preflight checks for repository access. - Added explicit host-rule auth handling for API/git paths. - Added container-level connectivity preflight diagnostics. - Added git URL override aligned with selected endpoint context. - Removed incorrect forced Dogar host-IP pinning that broke HTTPS clone routing. ## Why CI behavior was sensitive to runner networking and Renovate clone/auth interactions. These changes make the workflow deterministic in our runner topology and address recurring CI failures. ## Scope - Workflow logic only (`cicd.yaml`, `renovate.yml`) - No app feature or API behavior changes ## Validation - Workflow YAML validation passed during updates. - Changes were applied and verified iteratively from real failing run diagnostics. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #73	2026-07-13 11:16:16 -04:00
Xlorep DarkHelm	1f6cafa1bc	TASK: Replace integration lane with post-build backend runtime black-box tests (#72) ... ## Summary Replace the existing source-context integration lane with backend runtime black-box integration checks that run against started deployable containers. This change wires deployable backend image references (both commit tag and immutable digest) from the build workflow into the tests workflow, then validates runtime behavior over network endpoints. ## Why Integration confidence should come from testing running service artifacts, not only source-mounted or in-process execution. ## What Changed - Build workflow now: - Publishes deployable backend image tag reference and digest reference - Exposes both as job outputs - Passes both references into CICD Tests dispatch inputs - CICD Tests workflow now: - Accepts deployable backend tag and digest inputs - Propagates these through setup outputs - Replaces previous integration lane behavior with runtime black-box execution: - Starts isolated Docker network - Starts Postgres container - Starts backend container from digest-pinned deployable image - Enforces tag-to-digest consistency before running checks - Runs endpoint checks against live container: - GET / - GET /compatibility - GET /health - Captures backend/db logs and container state on failure - Cleans up containers and network via trap - Documentation updated: - Runtime contract enforcement section now includes runtime black-box integration checks - CI success summary now reflects runtime integration lane behavior ## Scope Included: - Backend runtime black-box integration replacement for the existing integration lane - Digest + tag identity enforcement - Failure diagnostics for triage Out of scope: - Frontend runtime smoke checks - E2E lane redesign ## Acceptance Criteria Mapping - Integration tests execute against runtime container endpoints: ✅ - Integration lane consumes built image references (not source-mounted execution): ✅ - Failures surface service logs and test logs for triage: ✅ ## Verification - Workflow files pass local validation checks - Pre-commit hooks pass on committed changes - Branch pushed and ready for PR review ## Related - Issue: #61 - Dependency context: #66 Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #72	2026-07-05 22:48:57 -04:00
Xlorep DarkHelm	549469f105	CI: Establish source-first quality gate and simplify pipeline flow (#71) ... This PR establishes a deterministic source-level quality gate before any build promotion and removes redundant post-build quality checks. The new flow makes local developer workflow and CI behavior align: - Developers run pre-commit locally (with auto-fix where appropriate) - CI runs a check-only smoke gate to validate pre-commit cleanliness - Build/test promotion only proceeds after source checks pass ## What Changed ### 1. Added a source-first quality gate - Added a dedicated source gate workflow: - `.gitea/workflows/cicd-source-checks.yaml` - Gate now: - Checks out target SHA - Bootstraps backend/frontend toolchains - Installs dependencies (`backend` via `uv`, `frontend` via `yarn`) - Runs `pre-commit --all-files` as the quality smoke test - Downstream build dispatch only occurs if this gate passes. ### 2. Updated pipeline routing - `cicd-start.yaml` now dispatches the source gate first. - `cicd-start.yaml` push trigger now includes all branches so feature branches run the same gate. - Added explicit routing logs in dispatch steps (route decision, SHA, trace id) for easier debugging. ### 3. Removed redundant checks workflow - Removed: - `.gitea/workflows/cicd-checks.yaml` - Updated: - `.gitea/workflows/docker-build-main.yaml` now dispatches `cicd-tests.yaml` directly after successful main build. ### 4. CI check-only behavior vs local auto-fix behavior Updated `.pre-commit-config.yaml` so hooks that can auto-fix behave as: - **Local developer pre-commit**: auto-fix enabled - **CI source gate**: check-only (no auto-fix) Applied to: - `ruff` / `ruff-format` - `eslint` - `prettier` - `tsdoc-lint` - `markdownlint` - `pretty-format-toml` This keeps CI as a true smoke validation of local pre-commit compliance. ### 5. Renovate workflow hardening - Improved auth/token handling and diagnostics in: - `.gitea/workflows/renovate.yml` - Added support for internal/self-signed TLS endpoints used by this environment. ## Why - Faster, earlier feedback on source quality failures - Avoid expensive build/test progression when source hygiene fails - Align CI with developer habits for predictable outcomes - Remove duplicated quality checks and reduce pipeline complexity ## New Effective CI Flow 1. `cicd-start.yaml` 2. `cicd-source-checks.yaml` (pre-commit smoke gate) 3. `docker-build-base.yaml` / `docker-build-main.yaml` 4. `cicd-tests.yaml` ## Acceptance Criteria Mapping (Issue #60) - Source-level lane runs independently and consistently: **Implemented** - Source-lane failure blocks promotion: **Implemented** - Outputs/logging are clear and actionable: **Implemented** ## Notes - Source gate is intentionally check-only in CI. - Developers should continue running local pre-commit before pushing. - Any remaining failures in source gate indicate local pre-commit was not fully clean. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #71	2026-07-02 07:21:18 -04:00
Xlorep DarkHelm	b16ef3a276	Minor adjustments to renovate. (#70) ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org> Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #70	2026-06-22 12:56:59 -04:00