copilotcoder
7c06fa3474
Refactor CI and runtime images to two-stage builds
2026-07-06 10:29:31 -04:00
1f6cafa1bc
TASK: Replace integration lane with post-build backend runtime black-box tests ( #72 )
...
CICD Start / Sanity and Base Decision (push) Failing after 11m34s
Renovate Dependency Updates / Renovate Dependencies (push) Failing after 10m12s
## Summary
Replace the existing source-context integration lane with backend runtime black-box integration checks that run against started deployable containers.
This change wires deployable backend image references (both commit tag and immutable digest) from the build workflow into the tests workflow, then validates runtime behavior over network endpoints.
## Why
Integration confidence should come from testing running service artifacts, not only source-mounted or in-process execution.
## What Changed
- Build workflow now:
- Publishes deployable backend image tag reference and digest reference
- Exposes both as job outputs
- Passes both references into CICD Tests dispatch inputs
- CICD Tests workflow now:
- Accepts deployable backend tag and digest inputs
- Propagates these through setup outputs
- Replaces previous integration lane behavior with runtime black-box execution:
- Starts isolated Docker network
- Starts Postgres container
- Starts backend container from digest-pinned deployable image
- Enforces tag-to-digest consistency before running checks
- Runs endpoint checks against live container:
- GET /
- GET /compatibility
- GET /health
- Captures backend/db logs and container state on failure
- Cleans up containers and network via trap
- Documentation updated:
- Runtime contract enforcement section now includes runtime black-box integration checks
- CI success summary now reflects runtime integration lane behavior
## Scope
Included:
- Backend runtime black-box integration replacement for the existing integration lane
- Digest + tag identity enforcement
- Failure diagnostics for triage
Out of scope:
- Frontend runtime smoke checks
- E2E lane redesign
## Acceptance Criteria Mapping
- Integration tests execute against runtime container endpoints: ✅
- Integration lane consumes built image references (not source-mounted execution): ✅
- Failures surface service logs and test logs for triage: ✅
## Verification
- Workflow files pass local validation checks
- Pre-commit hooks pass on committed changes
- Branch pushed and ready for PR review
## Related
- Issue: #61
- Dependency context: #66
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org >
Reviewed-on: #72
2026-07-05 22:48:57 -04:00
c7540e97ad
feat(ci): enforce runtime-validation image separation ( #69 )
...
CICD Start / Sanity and Base Decision (push) Successful in 17s
## Summary
Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images.
This PR:
- Adds automated deployable-runtime boundary checks in CI.
- Verifies deployable backend/frontend artifacts are free of CI/development tooling.
- Documents runtime-vs-validation ownership and enforcement behavior.
## What Changed
### CI workflow enforcement
- Updated `.gitea/workflows/docker-build-main.yaml` to:
- Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories).
- Run `scripts/check-dockerfile-boundaries.sh`.
- Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`).
- Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image.
- Updated `.gitea/workflows/cicd-checks.yaml` to add:
- `dockerfile-boundary-check` job.
- Boundary validation execution inside the CICD validation image.
### New enforcement scripts
- Added `scripts/check-dockerfile-boundaries.sh`:
- Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.).
- Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens.
- Enforces runtime base expectations:
- Backend: `python:3.14-slim`
- Frontend production target: `nginx:alpine`
- Added `scripts/verify-deployable-image-purity.sh`:
- Baseline binary checks for disallowed tooling.
- Backend-specific deep checks:
- Python module import probes for disallowed CI/dev modules.
- `pip show` package metadata checks for disallowed CI/dev packages.
- Frontend-specific deep checks:
- OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks.
- Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths).
## Documentation updates
- Updated `docs/DEVELOPMENT.md`:
- Clarifies runtime-vs-validation enforcement and where checks run.
- Notes purity checks include binaries and metadata artifacts.
- Updated `docs/CICD_MULTI_STAGE_BUILD.md`:
- Adds explicit “Runtime Boundary Enforcement” section.
- Documents metadata-level purity probes.
- Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`:
- Replaces future-only language with current enforcement hooks.
- Documents binary + metadata-level purity enforcement.
## Acceptance Criteria Mapping
1. **Deployable backend/frontend image paths do not require CI-only tool installation**
- Enforced by:
- `scripts/check-dockerfile-boundaries.sh`
- `scripts/verify-deployable-image-purity.sh`
- `docker-build-main.yaml` pre-publish gates
2. **Checks and tests execute in dedicated validation environment(s)**
- Reinforced by:
- `cicd-checks.yaml` boundary-check job running in CICD validation image
- Existing check/test workflow usage of CICD image
3. **Workflow docs identify runtime vs validation concerns**
- Addressed via updates to:
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
## Scope / Non-Goals
- Included:
- Structural separation enforcement
- Workflow-level guardrails
- Documentation clarity and traceability
- Not included:
- Full staging deployment wiring
- Security policy redesign
## Notes for Reviewers
- Main enforcement path is in `docker-build-main.yaml` before CICD image publish.
- New scripts are intentionally fail-fast and policy-oriented.
- Existing deployable Dockerfiles currently satisfy the new gates.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org >
Reviewed-on: #69
2026-06-22 12:45:20 -04:00
9b742a5a6d
feature/pp-58-runtime-image-contract ( #68 )
...
CICD Start / Sanity and Base Decision (push) Successful in 18s
Renovate Dependency Updates / Renovate Dependencies (push) Failing after 7m19s
## Summary
This PR tightens repository quality enforcement around markdown and documentation. It adds `markdownlint` to the `cicd-checks` workflow, expands pre-commit coverage so markdown files are checked repo-wide, and cleans up the PP-58 documentation set to keep it aligned with the new policy.
## What changed
- Added a `Markdownlint Check` entry to `.gitea/workflows/cicd-checks.yaml`
- Added `markdownlint` to pre-commit and widened prettier coverage to include markdown files across the repo
- Updated `README.md` to satisfy markdownlint line-length rules
- Normalized the PP-58 documentation set:
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
- `docs/adr/ADR003-deployable_runtime_image_contract.md`
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/CICD_TROUBLESHOOTING_GUIDE.md`
- `docs/SECURE_DOCKER_CICD.md`
## Validation
- `pre-commit run markdownlint --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
- `pre-commit run prettier --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
- Workflow YAML validation returned no errors
## Notes
This change does not alter application runtime behavior. It only strengthens CI and documentation quality enforcement.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org >
Reviewed-on: #68
2026-06-19 17:00:57 -04:00
d02039a22e
Backend runtime upgraded to Python 3.14 with exact dependency pinning ( #57 )
...
CICD Start / Sanity and Base Decision (push) Successful in 18s
Runner Canary / Canary Heavy (ubuntu-act-8gb) (push) Has been skipped
Runner Canary / Canary Heavy (ubuntu-act-4gb) (push) Has been skipped
Runner Canary / Canary Burst (ubuntu-act (push) Failing after 11m10s
Runner Canary / Canary (ubuntu-latest) (push) Failing after 12m39s
Runner Canary / Canary (ubuntu-act) (push) Failing after 12m42s
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
## Summary
Upgrades backend runtime baseline and dependency management for issue #10 .
### Changes
1. **Python Baseline**: Updated from 3.13 to 3.14
- Updated `backend/pyproject.toml` requires-python constraint
- Updated `backend/pyrightconfig.json` pythonVersion
- Updated all Dockerfile and CI references
2. **Dependency Pinning**: Switched to exact version pins in `backend/pyproject.toml`
- All dev and runtime dependencies now use `==` instead of `>=`
- `fastapi==0.120.2`, `uvicorn==0.38.0`
- ruff, pyright, pytest suite pinned to current resolved versions
- Regenerated `backend/uv.lock` under Python 3.14
3. **Startup Compatibility Guard** (TDD via RED→GREEN)
- New `compatibility_status()` function evaluates runtime and pinned deps
- Startup raises `RuntimeError` if policy fails
- Implemented via FastAPI lifespan (non-deprecated) handler
4. **Compatibility Status Endpoint**
- New `GET /compatibility` returns policy status, runtime version, and package checks
- Shares single source of truth with startup validation
5. **Integration Tests**
- Added failing-then-passing tests for startup guard and endpoint behavior
- 100% coverage maintained
6. **Direnv Configuration**
- Added `UV_PYTHON="3.14"` pin to repo `.envrc`
- Ensures direnv creates/recreates venv with correct Python version
### Validation
- ✅ ruff format/check
- ✅ pyright strict (0 errors)
- ✅ pytest: 8 passed, 100% coverage (>=95 gate)
- ✅ pydoclint: pass
- ✅ xdoctest: pass
### Notes
- SQLAlchemy/SQLModel introduction deferred to next pass per scope
- Compatibility logic currently validates fastapi/uvicorn pins (runtime deps)
- Ready for container build validation and Renovate bot testing
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org >
Reviewed-on: #57
Co-authored-by: Cliff Hill <xlorep@darkhelm.org >
Co-committed-by: Cliff Hill <xlorep@darkhelm.org >
2026-06-18 11:19:24 -04:00
570bc83295
Making it more resiliant to network problems, fixing playright
...
Tests / Build and Push CICD Base Image (push) Successful in 3m27s
Tests / Build and Push CICD Complete Image (push) Failing after 4m6s
Tests / TSDoc Lint Check (push) Has been skipped
Tests / Backend Tests (push) Has been skipped
Tests / Frontend Tests (push) Has been skipped
Tests / Backend Doctests (push) Has been skipped
Tests / Integration Tests (push) Has been skipped
Tests / End-to-End Tests (push) Has been skipped
Tests / Trailing Whitespace Check (push) Has been skipped
Tests / End of File Check (push) Has been skipped
Tests / YAML Syntax Check (push) Has been skipped
Tests / TOML Syntax Check (push) Has been skipped
Tests / Mixed Line Ending Check (push) Has been skipped
Tests / TOML Formatting Check (push) Has been skipped
Tests / Ruff Linting (push) Has been skipped
Tests / Ruff Format Check (push) Has been skipped
Tests / Pyright Type Check (push) Has been skipped
Tests / Darglint Docstring Check (push) Has been skipped
Tests / No Docstring Types Check (push) Has been skipped
Tests / ESLint Check (push) Has been skipped
Tests / Prettier Format Check (push) Has been skipped
Tests / TypeScript Type Check (push) Has been skipped
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-11-01 10:47:02 -04:00
c5660e547a
Trying to make e2e be truly non-interactive and headless.
...
Tests / Mixed Line Ending Check (push) Has been cancelled
Tests / Darglint Docstring Check (push) Has been cancelled
Tests / Frontend Tests (push) Has been cancelled
Tests / End of File Check (push) Has been cancelled
Tests / Build and Push CICD Image (push) Has started running
Tests / YAML Syntax Check (push) Has been cancelled
Tests / TOML Formatting Check (push) Has been cancelled
Tests / Ruff Linting (push) Has been cancelled
Tests / Ruff Format Check (push) Has been cancelled
Tests / No Docstring Types Check (push) Has been cancelled
Tests / End-to-End Tests (push) Has been cancelled
Tests / TOML Syntax Check (push) Has been cancelled
Tests / TSDoc Lint Check (push) Has been cancelled
Tests / Trailing Whitespace Check (push) Has been cancelled
Tests / Pyright Type Check (push) Has been cancelled
Tests / ESLint Check (push) Has been cancelled
Tests / Backend Tests (push) Has been cancelled
Tests / Prettier Format Check (push) Has been cancelled
Tests / Integration Tests (push) Has been cancelled
Tests / TypeScript Type Check (push) Has been cancelled
Tests / Backend Doctests (push) Has been cancelled
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-30 22:32:59 -04:00
aee066d611
Fixing the e2e tests (again).
...
Tests / Build and Push CICD Image (push) Successful in 1h18m58s
Tests / YAML Syntax Check (push) Successful in 40s
Tests / TOML Syntax Check (push) Successful in 33s
Tests / Mixed Line Ending Check (push) Successful in 38s
Tests / TOML Formatting Check (push) Successful in 46s
Tests / Ruff Linting (push) Successful in 35s
Tests / Ruff Format Check (push) Successful in 32s
Tests / Pyright Type Check (push) Successful in 48s
Tests / Darglint Docstring Check (push) Successful in 30s
Tests / No Docstring Types Check (push) Successful in 20s
Tests / ESLint Check (push) Successful in 51s
Tests / Prettier Format Check (push) Successful in 30s
Tests / TypeScript Type Check (push) Successful in 1m4s
Tests / TSDoc Lint Check (push) Successful in 59s
Tests / End of File Check (push) Successful in 10m13s
Tests / Backend Tests (push) Successful in 37s
Tests / Backend Doctests (push) Successful in 20s
Tests / Frontend Tests (push) Successful in 1m30s
Tests / Trailing Whitespace Check (push) Successful in 12m47s
Tests / Integration Tests (push) Successful in 10m43s
Tests / End-to-End Tests (push) Has been cancelled
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-30 18:47:47 -04:00
eb8802eea2
Fixing frontend coverage.
...
Tests / Build and Push CICD Image (push) Successful in 46m49s
Tests / YAML Syntax Check (push) Successful in 7m40s
Tests / TOML Syntax Check (push) Successful in 53s
Tests / Mixed Line Ending Check (push) Successful in 54s
Tests / TOML Formatting Check (push) Successful in 52s
Tests / Ruff Linting (push) Successful in 55s
Tests / Ruff Format Check (push) Successful in 59s
Tests / Trailing Whitespace Check (push) Successful in 9m41s
Tests / Pyright Type Check (push) Successful in 1m9s
Tests / No Docstring Types Check (push) Successful in 57s
Tests / Darglint Docstring Check (push) Successful in 1m16s
Tests / ESLint Check (push) Successful in 1m6s
Tests / Prettier Format Check (push) Successful in 1m14s
Tests / TypeScript Type Check (push) Successful in 1m12s
Tests / Backend Tests (push) Successful in 1m3s
Tests / TSDoc Lint Check (push) Successful in 1m37s
Tests / Frontend Tests (push) Successful in 1m23s
Tests / Backend Doctests (push) Successful in 1m7s
Tests / End of File Check (push) Successful in 13m53s
Tests / Integration Tests (push) Successful in 6m23s
Tests / End-to-End Tests (push) Has been cancelled
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-30 14:15:13 -04:00
245169c01e
Fixing jest error.
...
Tests / Build and Push CICD Image (push) Successful in 24m39s
Tests / Trailing Whitespace Check (push) Successful in 6m14s
Tests / YAML Syntax Check (push) Successful in 57s
Tests / TOML Syntax Check (push) Successful in 51s
Tests / Mixed Line Ending Check (push) Successful in 53s
Tests / TOML Formatting Check (push) Successful in 53s
Tests / Ruff Linting (push) Successful in 59s
Tests / Ruff Format Check (push) Successful in 57s
Tests / Pyright Type Check (push) Successful in 1m16s
Tests / Darglint Docstring Check (push) Successful in 1m2s
Tests / No Docstring Types Check (push) Successful in 1m0s
Tests / ESLint Check (push) Successful in 1m7s
Tests / Prettier Format Check (push) Successful in 56s
Tests / TypeScript Type Check (push) Successful in 1m11s
Tests / TSDoc Lint Check (push) Successful in 1m7s
Tests / Backend Tests (push) Successful in 1m3s
Tests / Frontend Tests (push) Failing after 1m8s
Tests / Integration Tests (push) Has been skipped
Tests / End-to-End Tests (push) Has been skipped
Tests / Backend Doctests (push) Successful in 56s
Tests / End of File Check (push) Successful in 12m30s
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-30 12:25:45 -04:00
f410b142c8
Fixing some CICD errors.
...
Tests / Build and Push CICD Image (push) Successful in 24m56s
Tests / Trailing Whitespace Check (push) Successful in 8m47s
Tests / TOML Syntax Check (push) Successful in 1m2s
Tests / Mixed Line Ending Check (push) Successful in 1m3s
Tests / TOML Formatting Check (push) Successful in 1m6s
Tests / Ruff Linting (push) Successful in 1m9s
Tests / Ruff Format Check (push) Successful in 1m8s
Tests / Pyright Type Check (push) Failing after 1m37s
Tests / Darglint Docstring Check (push) Successful in 1m16s
Tests / No Docstring Types Check (push) Successful in 1m3s
Tests / End of File Check (push) Successful in 12m57s
Tests / Prettier Format Check (push) Successful in 1m14s
Tests / YAML Syntax Check (push) Successful in 28s
Tests / ESLint Check (push) Successful in 1m55s
Tests / TypeScript Type Check (push) Successful in 1m34s
Tests / TSDoc Lint Check (push) Successful in 1m54s
Tests / Backend Tests (push) Successful in 46s
Tests / Backend Doctests (push) Successful in 29s
Tests / Frontend Tests (push) Failing after 4m31s
Tests / Integration Tests (push) Has been skipped
Tests / End-to-End Tests (push) Has been skipped
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-30 11:16:45 -04:00
b5170cc39a
Making linters and formatters great.
...
Tests / Build and Push CICD Image (push) Failing after 1h34m10s
Tests / Trailing Whitespace Check (push) Has been skipped
Tests / End of File Check (push) Has been skipped
Tests / Backend Doctests (push) Has been skipped
Tests / YAML Syntax Check (push) Has been skipped
Tests / Integration Tests (push) Has been skipped
Tests / TOML Syntax Check (push) Has been skipped
Tests / Mixed Line Ending Check (push) Has been skipped
Tests / TOML Formatting Check (push) Has been skipped
Tests / Ruff Linting (push) Has been skipped
Tests / Ruff Format Check (push) Has been skipped
Tests / Pyright Type Check (push) Has been skipped
Tests / Darglint Docstring Check (push) Has been skipped
Tests / No Docstring Types Check (push) Has been skipped
Tests / ESLint Check (push) Has been skipped
Tests / Prettier Format Check (push) Has been skipped
Tests / TypeScript Type Check (push) Has been skipped
Tests / TSDoc Lint Check (push) Has been skipped
Tests / Backend Tests (push) Has been skipped
Tests / Frontend Tests (push) Has been skipped
Tests / End-to-End Tests (push) Has been skipped
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-29 08:40:56 -04:00
cde41ddd38
Fix .yarnrc.yml to use global Yarn Berry instead of local.
...
Tests / Build and Push CICD Image (push) Failing after 22m17s
Tests / Trailing Whitespace Check (push) Has been skipped
Tests / End of File Check (push) Has been skipped
Tests / YAML Syntax Check (push) Has been skipped
Tests / TOML Syntax Check (push) Has been skipped
Tests / Mixed Line Ending Check (push) Has been skipped
Tests / TOML Formatting Check (push) Has been skipped
Tests / Ruff Linting (push) Has been skipped
Tests / Ruff Format Check (push) Has been skipped
Tests / Pyright Type Check (push) Has been skipped
Tests / Darglint Docstring Check (push) Has been skipped
Tests / No Docstring Types Check (push) Has been skipped
Tests / ESLint Check (push) Has been skipped
Tests / Prettier Format Check (push) Has been skipped
Tests / TypeScript Type Check (push) Has been skipped
Tests / TSDoc Lint Check (push) Has been skipped
Tests / Backend Tests (push) Has been skipped
Tests / Frontend Tests (push) Has been skipped
Tests / Backend Doctests (push) Has been skipped
Tests / Integration Tests (push) Has been skipped
Tests / End-to-End Tests (push) Has been skipped
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-27 12:36:08 -04:00
8a3aaeafe8
Getting yarn berry working.
...
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-27 12:23:28 -04:00
2590682425
Making yarn work with vue and vite right.
...
Tests / Build and Push CICD Image (push) Failing after 4m47s
Tests / Trailing Whitespace Check (push) Has been skipped
Tests / End of File Check (push) Has been skipped
Tests / YAML Syntax Check (push) Has been skipped
Tests / Darglint Docstring Check (push) Has been skipped
Tests / TOML Syntax Check (push) Has been skipped
Tests / Mixed Line Ending Check (push) Has been skipped
Tests / TOML Formatting Check (push) Has been skipped
Tests / Ruff Linting (push) Has been skipped
Tests / Ruff Format Check (push) Has been skipped
Tests / Pyright Type Check (push) Has been skipped
Tests / No Docstring Types Check (push) Has been skipped
Tests / ESLint Check (push) Has been skipped
Tests / Prettier Format Check (push) Has been skipped
Tests / TypeScript Type Check (push) Has been skipped
Tests / TSDoc Lint Check (push) Has been skipped
Tests / Backend Tests (push) Has been skipped
Tests / Frontend Tests (push) Has been skipped
Tests / Backend Doctests (push) Has been skipped
Tests / Integration Tests (push) Has been skipped
Tests / End-to-End Tests (push) Has been skipped
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-27 11:50:23 -04:00
2c8f424a81
Fixing everything, making the project structure ready for real code.
...
Tests / Frontend Tests (TypeScript + Vue + Yarn Berry) (push) Failing after 7m49s
Tests / Backend Tests (Python 3.13 + uv) (push) Failing after 14m36s
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-23 12:58:32 -04:00
8aa8d41e8a
Did some things, made more improvements.
...
CI/CD Pipeline / Backend Tests (Python) (push) Has been cancelled
CI/CD Pipeline / Frontend Tests (TypeScript/Vue) (push) Has been cancelled
CI/CD Pipeline / Integration Tests (push) Has been cancelled
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-19 21:35:02 -04:00
6068faf026
Getting all the things working.
...
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-18 21:33:45 -04:00
4502c92f9b
Making pre-commit powerful again.
...
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-18 21:31:34 -04:00
8ab2e1dd28
Did some things.
...
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-18 21:29:28 -04:00
9c4a8d96bc
Initial commit.
...
Signed-off-by: Cliff Hill <xlorep@darkhelm.org >
2025-10-18 09:14:10 -04:00
