8 Commits

Author	SHA1	Message	Date
Xlorep DarkHelm	19f6428775	ix runtime policy pin mismatch and make dependency audits non-blocking (#81) ... ## Summary This PR fixes backend test breakage caused by stale runtime compatibility pins and updates CI behavior so dependency audits remain informative without blocking delivery. ## What Changed - Updated backend runtime compatibility package pins to match current dependency versions. - Updated backend tests to align with the new compatibility expectations and restore coverage compliance. - Expanded backend unit coverage around runtime policy and health-check behavior. - Changed frontend and backend dependency audit lanes in CI to be non-blocking: - They still run in the same workflow position. - Failures are logged clearly. - Pipeline completion is no longer gated on audit pass/fail. ## Why - Recent dependency updates caused runtime policy startup validation to fail in tests. - Audit jobs are useful for visibility, but they should not prevent system completion when they detect issues. ## Validation - Pre-commit hooks passed on commit. - Backend unit tests with coverage pass, including fail-under threshold. - Branch pushed successfully: `fix/backend-runtime-policy-tests`. ## Notes - Audit failures now signal actionable dependency risk without stopping the release flow. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #81	2026-07-16 07:40:11 -04:00
Xlorep DarkHelm	f627ef018a	feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration (#74) ... ## Summary This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution. ## What changed - Added Bandit to pre-commit backend checks. - Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit. - Added dedicated audit tasks: - backend audit via pip-audit - frontend audit via yarn npm audit - Updated CI/CD workflow to include and gate on frontend/backend audit jobs. - Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI. - Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable. - Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently. ## Validation - Pre-commit hooks run and pass after formatting/autofixes. - Branch commit created successfully after hook-driven file updates. - Branch pushed to remote and tracking is configured. ## Notes - pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout. - Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable. ## Follow-ups (optional) - Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale. - Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #74	2026-07-13 22:19:57 -04:00
Xlorep DarkHelm	f3698b095b	Stabilize self-hosted CI workflows and resolve issue #62 (#73) ... ## Summary Hardens CI workflows for self-hosted Gitea runners by stabilizing E2E execution and Renovate behavior across internal/external network paths. Closes #62 ## What Changed ### E2E workflow reliability - Fixed E2E workspace handoff to ensure expected repository contents are present during test execution. - Added stricter preflight checks for required frontend files before running E2E. - Reduced mount/path fragility while preserving runtime image pull and compose flow. ### Renovate workflow hardening - Added internal-first endpoint reachability selection with fallback handling. - Added token preflight checks for repository access. - Added explicit host-rule auth handling for API/git paths. - Added container-level connectivity preflight diagnostics. - Added git URL override aligned with selected endpoint context. - Removed incorrect forced Dogar host-IP pinning that broke HTTPS clone routing. ## Why CI behavior was sensitive to runner networking and Renovate clone/auth interactions. These changes make the workflow deterministic in our runner topology and address recurring CI failures. ## Scope - Workflow logic only (`cicd.yaml`, `renovate.yml`) - No app feature or API behavior changes ## Validation - Workflow YAML validation passed during updates. - Changes were applied and verified iteratively from real failing run diagnostics. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #73	2026-07-13 11:16:16 -04:00
Xlorep DarkHelm	48a37b943f	PP-11_Add_SQLAlchemy_async_engine_session (#67) ... ## Summary This PR upgrades backend typing tooling and finalizes quality cleanup for the SQLAlchemy async engine/session work on `PP-11_Add_SQLAlchemy_async_engine_session`. ## What Changed - Upgraded pinned `pyright` version from `1.1.406` to `1.1.410`. - Regenerated backend lock state to align with the new pyright pin. - Removed deprecated `pythonPath` from pyright config to eliminate the config notice. - Refined backend DB runtime state handling and cleanup paths. - Updated database tests to avoid brittle singleton assumptions and keep typeguard-compatible async engine test doubles. ## Why - Remove tooling noise and keep checks deterministic. - Keep backend static/type/doc/test quality gates warning-free. - Improve reliability and clarity of DB engine/session lifecycle tests. ## Validation - `uv run ruff format --check .` - `uv run ruff check .` - `uv run pyright .` - `uv run pydoclint --config=pyproject.toml src/` - `uv run xdoctest --module backend` - `uv run pytest` Results: - Pyright: `0 errors, 0 warnings` - Pytest: `21 passed` ## Impact - No API contract changes intended. - No frontend changes. - Backend behavior remains the same; this is tooling/test/runtime-state cleanup. ## Risk - Low risk. - Main touched areas are backend tooling config, lockfile, DB runtime state internals, and tests. ## Checklist - [x] Backend lint clean - [x] Backend type checks clean - [x] Backend doc checks clean - [x] Backend tests passing - [x] Branch pushed and ready for review Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #67	2026-06-19 07:39:56 -04:00
Cliff Hill	d02039a22e	Backend runtime upgraded to Python 3.14 with exact dependency pinning (#57) ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org> ## Summary Upgrades backend runtime baseline and dependency management for issue #10. ### Changes 1. **Python Baseline**: Updated from 3.13 to 3.14 - Updated `backend/pyproject.toml` requires-python constraint - Updated `backend/pyrightconfig.json` pythonVersion - Updated all Dockerfile and CI references 2. **Dependency Pinning**: Switched to exact version pins in `backend/pyproject.toml` - All dev and runtime dependencies now use `==` instead of `>=` - `fastapi==0.120.2`, `uvicorn==0.38.0` - ruff, pyright, pytest suite pinned to current resolved versions - Regenerated `backend/uv.lock` under Python 3.14 3. **Startup Compatibility Guard** (TDD via RED→GREEN) - New `compatibility_status()` function evaluates runtime and pinned deps - Startup raises `RuntimeError` if policy fails - Implemented via FastAPI lifespan (non-deprecated) handler 4. **Compatibility Status Endpoint** - New `GET /compatibility` returns policy status, runtime version, and package checks - Shares single source of truth with startup validation 5. **Integration Tests** - Added failing-then-passing tests for startup guard and endpoint behavior - 100% coverage maintained 6. **Direnv Configuration** - Added `UV_PYTHON="3.14"` pin to repo `.envrc` - Ensures direnv creates/recreates venv with correct Python version ### Validation - ✅ ruff format/check - ✅ pyright strict (0 errors) - ✅ pytest: 8 passed, 100% coverage (>=95 gate) - ✅ pydoclint: pass - ✅ xdoctest: pass ### Notes - SQLAlchemy/SQLModel introduction deferred to next pass per scope - Compatibility logic currently validates fastapi/uvicorn pins (runtime deps) - Ready for container build validation and Renovate bot testing Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #57 Co-authored-by: Cliff Hill <xlorep@darkhelm.org> Co-committed-by: Cliff Hill <xlorep@darkhelm.org>	2026-06-18 11:19:24 -04:00
Cliff Hill	4a14a3ba65	CICD fixes continue. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-30 08:09:45 -04:00
Cliff Hill	debe7e27ea	Did things. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-23 13:45:54 -04:00
Cliff Hill	8aa8d41e8a	Did some things, made more improvements. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-19 21:35:02 -04:00