6 Commits

Author	SHA1	Message	Date
copilotcoder	5efe0446d5	Rename runtime images to explicit plex-playlist names	2026-07-20 20:44:58 -04:00
Xlorep DarkHelm	e539f9b0d8	ci: consolidate cicd workflow lanes, clean up helpers, and align CI docs (#86) ... ## Summary This PR simplifies the CICD workflow by merging related lanes, reducing duplicated script logic, and keeping the same overall pipeline behavior and gates. It also updates CI documentation to match the new job topology. ## What Changed ### Workflow consolidation - Merged base and complete CICD image publication into one producer job: - Build and Push CICD Images - Merged dependency audits into one informational lane: - Dependency Audits (Informational) - Merged runtime image build lanes into one release producer: - Build Release Images - Merged tester image build lanes into one tester producer: - Build Tester Images ### Dependency/gate rewiring - Updated downstream needs to consume merged producers. - Kept output contracts for deployable and tester image references. - Updated production and postmortem gates to the new job IDs. ### Cleanup/simplification - Removed duplicate helper-function definition(s) in CICD scripts. - Replaced a manual docker login retry loop with existing retry helper usage. - Removed redundant shell option declarations where behavior was unchanged. - Removed one unused E2E environment variable. ### Documentation alignment - Updated CI architecture documentation to reflect merged workflow lanes. - Updated troubleshooting guidance to reference current job sequencing. ## Why - Reduce job startup overhead on self-hosted runners. - Keep behavior consistent while lowering workflow complexity. - Improve maintainability by removing duplicated/unused script fragments. - Keep docs in sync with operational workflow reality. ## Validation - Workflow file checks passed with pre-commit. - Documentation checks passed with pre-commit (including markdownlint/prettier). - No diagnostics/errors reported for updated workflow/docs files. ## Risk and Impact - Low-to-medium operational risk due to job-ID/needs rewiring. - Mitigated by preserving output keys consumed by integration and e2e lanes. - Audit lane remains informational-only (non-blocking), same intent as before. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #86	2026-07-17 17:14:00 -04:00
Xlorep DarkHelm	f3698b095b	Stabilize self-hosted CI workflows and resolve issue #62 (#73) ... ## Summary Hardens CI workflows for self-hosted Gitea runners by stabilizing E2E execution and Renovate behavior across internal/external network paths. Closes #62 ## What Changed ### E2E workflow reliability - Fixed E2E workspace handoff to ensure expected repository contents are present during test execution. - Added stricter preflight checks for required frontend files before running E2E. - Reduced mount/path fragility while preserving runtime image pull and compose flow. ### Renovate workflow hardening - Added internal-first endpoint reachability selection with fallback handling. - Added token preflight checks for repository access. - Added explicit host-rule auth handling for API/git paths. - Added container-level connectivity preflight diagnostics. - Added git URL override aligned with selected endpoint context. - Removed incorrect forced Dogar host-IP pinning that broke HTTPS clone routing. ## Why CI behavior was sensitive to runner networking and Renovate clone/auth interactions. These changes make the workflow deterministic in our runner topology and address recurring CI failures. ## Scope - Workflow logic only (`cicd.yaml`, `renovate.yml`) - No app feature or API behavior changes ## Validation - Workflow YAML validation passed during updates. - Changes were applied and verified iteratively from real failing run diagnostics. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #73	2026-07-13 11:16:16 -04:00
Xlorep DarkHelm	1f6cafa1bc	TASK: Replace integration lane with post-build backend runtime black-box tests (#72) ... ## Summary Replace the existing source-context integration lane with backend runtime black-box integration checks that run against started deployable containers. This change wires deployable backend image references (both commit tag and immutable digest) from the build workflow into the tests workflow, then validates runtime behavior over network endpoints. ## Why Integration confidence should come from testing running service artifacts, not only source-mounted or in-process execution. ## What Changed - Build workflow now: - Publishes deployable backend image tag reference and digest reference - Exposes both as job outputs - Passes both references into CICD Tests dispatch inputs - CICD Tests workflow now: - Accepts deployable backend tag and digest inputs - Propagates these through setup outputs - Replaces previous integration lane behavior with runtime black-box execution: - Starts isolated Docker network - Starts Postgres container - Starts backend container from digest-pinned deployable image - Enforces tag-to-digest consistency before running checks - Runs endpoint checks against live container: - GET / - GET /compatibility - GET /health - Captures backend/db logs and container state on failure - Cleans up containers and network via trap - Documentation updated: - Runtime contract enforcement section now includes runtime black-box integration checks - CI success summary now reflects runtime integration lane behavior ## Scope Included: - Backend runtime black-box integration replacement for the existing integration lane - Digest + tag identity enforcement - Failure diagnostics for triage Out of scope: - Frontend runtime smoke checks - E2E lane redesign ## Acceptance Criteria Mapping - Integration tests execute against runtime container endpoints: ✅ - Integration lane consumes built image references (not source-mounted execution): ✅ - Failures surface service logs and test logs for triage: ✅ ## Verification - Workflow files pass local validation checks - Pre-commit hooks pass on committed changes - Branch pushed and ready for PR review ## Related - Issue: #61 - Dependency context: #66 Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #72	2026-07-05 22:48:57 -04:00
Xlorep DarkHelm	c7540e97ad	feat(ci): enforce runtime-validation image separation (#69) ... ## Summary Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images. This PR: - Adds automated deployable-runtime boundary checks in CI. - Verifies deployable backend/frontend artifacts are free of CI/development tooling. - Documents runtime-vs-validation ownership and enforcement behavior. ## What Changed ### CI workflow enforcement - Updated `.gitea/workflows/docker-build-main.yaml` to: - Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories). - Run `scripts/check-dockerfile-boundaries.sh`. - Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`). - Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image. - Updated `.gitea/workflows/cicd-checks.yaml` to add: - `dockerfile-boundary-check` job. - Boundary validation execution inside the CICD validation image. ### New enforcement scripts - Added `scripts/check-dockerfile-boundaries.sh`: - Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.). - Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens. - Enforces runtime base expectations: - Backend: `python:3.14-slim` - Frontend production target: `nginx:alpine` - Added `scripts/verify-deployable-image-purity.sh`: - Baseline binary checks for disallowed tooling. - Backend-specific deep checks: - Python module import probes for disallowed CI/dev modules. - `pip show` package metadata checks for disallowed CI/dev packages. - Frontend-specific deep checks: - OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks. - Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths). ## Documentation updates - Updated `docs/DEVELOPMENT.md`: - Clarifies runtime-vs-validation enforcement and where checks run. - Notes purity checks include binaries and metadata artifacts. - Updated `docs/CICD_MULTI_STAGE_BUILD.md`: - Adds explicit “Runtime Boundary Enforcement” section. - Documents metadata-level purity probes. - Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`: - Replaces future-only language with current enforcement hooks. - Documents binary + metadata-level purity enforcement. ## Acceptance Criteria Mapping 1. **Deployable backend/frontend image paths do not require CI-only tool installation** - Enforced by: - `scripts/check-dockerfile-boundaries.sh` - `scripts/verify-deployable-image-purity.sh` - `docker-build-main.yaml` pre-publish gates 2. **Checks and tests execute in dedicated validation environment(s)** - Reinforced by: - `cicd-checks.yaml` boundary-check job running in CICD validation image - Existing check/test workflow usage of CICD image 3. **Workflow docs identify runtime vs validation concerns** - Addressed via updates to: - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` ## Scope / Non-Goals - Included: - Structural separation enforcement - Workflow-level guardrails - Documentation clarity and traceability - Not included: - Full staging deployment wiring - Security policy redesign ## Notes for Reviewers - Main enforcement path is in `docker-build-main.yaml` before CICD image publish. - New scripts are intentionally fail-fast and policy-oriented. - Existing deployable Dockerfiles currently satisfy the new gates. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #69	2026-06-22 12:45:20 -04:00
Xlorep DarkHelm	9b742a5a6d	feature/pp-58-runtime-image-contract (#68) ... ## Summary This PR tightens repository quality enforcement around markdown and documentation. It adds `markdownlint` to the `cicd-checks` workflow, expands pre-commit coverage so markdown files are checked repo-wide, and cleans up the PP-58 documentation set to keep it aligned with the new policy. ## What changed - Added a `Markdownlint Check` entry to `.gitea/workflows/cicd-checks.yaml` - Added `markdownlint` to pre-commit and widened prettier coverage to include markdown files across the repo - Updated `README.md` to satisfy markdownlint line-length rules - Normalized the PP-58 documentation set: - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - `docs/adr/ADR003-deployable_runtime_image_contract.md` - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/CICD_TROUBLESHOOTING_GUIDE.md` - `docs/SECURE_DOCKER_CICD.md` ## Validation - `pre-commit run markdownlint --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - `pre-commit run prettier --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - Workflow YAML validation returned no errors ## Notes This change does not alter application runtime behavior. It only strengthens CI and documentation quality enforcement. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #68	2026-06-19 17:00:57 -04:00