161 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
copilotcoder	f2b79792e2	fix(runners): avoid pids_limit and deploy pids conflict	2026-07-05 14:19:25 -04:00
copilotcoder	eb440bc10f	fix(runners): correct deploy limits memory variable	2026-07-05 13:56:04 -04:00
copilotcoder	f98b4d6857	feat(runners): add configurable stability resource limits	2026-07-05 13:50:43 -04:00
copilotcoder	92549b8edd	feat(runners): add host-share CPU limits	2026-07-05 13:41:45 -04:00
copilotcoder	2eb94d18f3	fix(runners): size limits from host memory share	2026-07-05 13:23:34 -04:00
copilotcoder	9ae4d6eafb	feat(runners): set job container memory below runner	2026-07-05 12:38:15 -04:00
copilotcoder	0a29464d42	fix(runners): update deploy memory without mem_limit conflict	2026-07-05 12:30:46 -04:00
copilotcoder	8f07c3ff86	fix(runners): scale mem cap from current runner limit	2026-07-05 11:41:56 -04:00
copilotcoder	6e2b2f5e3a	feat(runners): cap runner memory by host fraction	2026-07-05 11:40:31 -04:00
copilotcoder	6611c20bbf	style(frontend): apply prettier to index.html	2026-07-05 10:59:13 -04:00
copilotcoder	ad919e6c11	fix(ci): add npm fallback for frontend install OOM	2026-07-05 09:53:34 -04:00
copilotcoder	38741c580c	fix(ci): correct split source-check commands	2026-07-04 23:06:39 -04:00
copilotcoder	32d5e7d4e7	fix(ci): split source checks by toolchain	2026-07-04 15:42:32 -04:00
copilotcoder	07f048f57a	fix(ci): use env-based yarn concurrency tuning	2026-07-04 11:26:45 -04:00
copilotcoder	818c3d43db	fix(ci): reduce yarn install memory in source checks	2026-07-04 10:57:29 -04:00
copilotcoder	98058475cb	fix(backend): set uvicorn app-dir for src layout runtime	2026-07-04 09:15:23 -04:00
copilotcoder	6da60e6beb	fix(ci): correct backend ASGI path for runtime black-box lane	2026-07-03 21:58:36 -04:00
copilotcoder	3a47f3f154	fix(ci): harden runtime integration env and renovate auth checks	2026-07-02 11:09:57 -04:00
copilotcoder	b1607ff6c7	fix(renovate): normalize gitea endpoint and align auth preflight	2026-07-02 10:28:50 -04:00
copilotcoder	1295ffb330	fix(ci): lock backend deps in cicd build and harden renovate auth	2026-07-02 09:47:33 -04:00
copilotcoder	c996d92406	feat(ci): replace integration lane with runtime black-box tests	2026-07-02 08:47:42 -04:00
Xlorep DarkHelm	549469f105	CI: Establish source-first quality gate and simplify pipeline flow (#71) ... This PR establishes a deterministic source-level quality gate before any build promotion and removes redundant post-build quality checks. The new flow makes local developer workflow and CI behavior align: - Developers run pre-commit locally (with auto-fix where appropriate) - CI runs a check-only smoke gate to validate pre-commit cleanliness - Build/test promotion only proceeds after source checks pass ## What Changed ### 1. Added a source-first quality gate - Added a dedicated source gate workflow: - `.gitea/workflows/cicd-source-checks.yaml` - Gate now: - Checks out target SHA - Bootstraps backend/frontend toolchains - Installs dependencies (`backend` via `uv`, `frontend` via `yarn`) - Runs `pre-commit --all-files` as the quality smoke test - Downstream build dispatch only occurs if this gate passes. ### 2. Updated pipeline routing - `cicd-start.yaml` now dispatches the source gate first. - `cicd-start.yaml` push trigger now includes all branches so feature branches run the same gate. - Added explicit routing logs in dispatch steps (route decision, SHA, trace id) for easier debugging. ### 3. Removed redundant checks workflow - Removed: - `.gitea/workflows/cicd-checks.yaml` - Updated: - `.gitea/workflows/docker-build-main.yaml` now dispatches `cicd-tests.yaml` directly after successful main build. ### 4. CI check-only behavior vs local auto-fix behavior Updated `.pre-commit-config.yaml` so hooks that can auto-fix behave as: - **Local developer pre-commit**: auto-fix enabled - **CI source gate**: check-only (no auto-fix) Applied to: - `ruff` / `ruff-format` - `eslint` - `prettier` - `tsdoc-lint` - `markdownlint` - `pretty-format-toml` This keeps CI as a true smoke validation of local pre-commit compliance. ### 5. Renovate workflow hardening - Improved auth/token handling and diagnostics in: - `.gitea/workflows/renovate.yml` - Added support for internal/self-signed TLS endpoints used by this environment. ## Why - Faster, earlier feedback on source quality failures - Avoid expensive build/test progression when source hygiene fails - Align CI with developer habits for predictable outcomes - Remove duplicated quality checks and reduce pipeline complexity ## New Effective CI Flow 1. `cicd-start.yaml` 2. `cicd-source-checks.yaml` (pre-commit smoke gate) 3. `docker-build-base.yaml` / `docker-build-main.yaml` 4. `cicd-tests.yaml` ## Acceptance Criteria Mapping (Issue #60) - Source-level lane runs independently and consistently: **Implemented** - Source-lane failure blocks promotion: **Implemented** - Outputs/logging are clear and actionable: **Implemented** ## Notes - Source gate is intentionally check-only in CI. - Developers should continue running local pre-commit before pushing. - Any remaining failures in source gate indicate local pre-commit was not fully clean. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #71	2026-07-02 07:21:18 -04:00
Xlorep DarkHelm	b16ef3a276	Minor adjustments to renovate. (#70) ... Signed-off-by: copilotcoder <copilotcoder@darkhelm.org> Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #70	2026-06-22 12:56:59 -04:00
Xlorep DarkHelm	c7540e97ad	feat(ci): enforce runtime-validation image separation (#69) ... ## Summary Implements issue #59 by enforcing a hard boundary between CI validation tooling and deployable runtime images. This PR: - Adds automated deployable-runtime boundary checks in CI. - Verifies deployable backend/frontend artifacts are free of CI/development tooling. - Documents runtime-vs-validation ownership and enforcement behavior. ## What Changed ### CI workflow enforcement - Updated `.gitea/workflows/docker-build-main.yaml` to: - Checkout additional verification inputs (`Dockerfile.backend`, `Dockerfile.frontend`, scripts, backend/frontend directories). - Run `scripts/check-dockerfile-boundaries.sh`. - Build deployable runtime images (`Dockerfile.backend`, `Dockerfile.frontend --target production`). - Run `scripts/verify-deployable-image-purity.sh` against both images before publishing CICD image. - Updated `.gitea/workflows/cicd-checks.yaml` to add: - `dockerfile-boundary-check` job. - Boundary validation execution inside the CICD validation image. ### New enforcement scripts - Added `scripts/check-dockerfile-boundaries.sh`: - Ensures deployable Dockerfiles do **not** reference CICD image paths (`cicd-base`, `CICD_BASE_IMAGE`, `Dockerfile.cicd*`, etc.). - Ensures deployable Dockerfiles do **not** include disallowed CI-only tooling tokens. - Enforces runtime base expectations: - Backend: `python:3.14-slim` - Frontend production target: `nginx:alpine` - Added `scripts/verify-deployable-image-purity.sh`: - Baseline binary checks for disallowed tooling. - Backend-specific deep checks: - Python module import probes for disallowed CI/dev modules. - `pip show` package metadata checks for disallowed CI/dev packages. - Frontend-specific deep checks: - OS package metadata checks (`apk`/`dpkg` when available) for disallowed runtime leaks. - Directory-based checks for development package trees (`node_modules`, `.venv`, `site-packages`, `dist-packages` in sensitive paths). ## Documentation updates - Updated `docs/DEVELOPMENT.md`: - Clarifies runtime-vs-validation enforcement and where checks run. - Notes purity checks include binaries and metadata artifacts. - Updated `docs/CICD_MULTI_STAGE_BUILD.md`: - Adds explicit “Runtime Boundary Enforcement” section. - Documents metadata-level purity probes. - Updated `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`: - Replaces future-only language with current enforcement hooks. - Documents binary + metadata-level purity enforcement. ## Acceptance Criteria Mapping 1. **Deployable backend/frontend image paths do not require CI-only tool installation** - Enforced by: - `scripts/check-dockerfile-boundaries.sh` - `scripts/verify-deployable-image-purity.sh` - `docker-build-main.yaml` pre-publish gates 2. **Checks and tests execute in dedicated validation environment(s)** - Reinforced by: - `cicd-checks.yaml` boundary-check job running in CICD validation image - Existing check/test workflow usage of CICD image 3. **Workflow docs identify runtime vs validation concerns** - Addressed via updates to: - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` ## Scope / Non-Goals - Included: - Structural separation enforcement - Workflow-level guardrails - Documentation clarity and traceability - Not included: - Full staging deployment wiring - Security policy redesign ## Notes for Reviewers - Main enforcement path is in `docker-build-main.yaml` before CICD image publish. - New scripts are intentionally fail-fast and policy-oriented. - Existing deployable Dockerfiles currently satisfy the new gates. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #69	2026-06-22 12:45:20 -04:00
Xlorep DarkHelm	9b742a5a6d	feature/pp-58-runtime-image-contract (#68) ... ## Summary This PR tightens repository quality enforcement around markdown and documentation. It adds `markdownlint` to the `cicd-checks` workflow, expands pre-commit coverage so markdown files are checked repo-wide, and cleans up the PP-58 documentation set to keep it aligned with the new policy. ## What changed - Added a `Markdownlint Check` entry to `.gitea/workflows/cicd-checks.yaml` - Added `markdownlint` to pre-commit and widened prettier coverage to include markdown files across the repo - Updated `README.md` to satisfy markdownlint line-length rules - Normalized the PP-58 documentation set: - `docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - `docs/adr/ADR003-deployable_runtime_image_contract.md` - `docs/DEVELOPMENT.md` - `docs/CICD_MULTI_STAGE_BUILD.md` - `docs/CICD_TROUBLESHOOTING_GUIDE.md` - `docs/SECURE_DOCKER_CICD.md` ## Validation - `pre-commit run markdownlint --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - `pre-commit run prettier --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md` - Workflow YAML validation returned no errors ## Notes This change does not alter application runtime behavior. It only strengthens CI and documentation quality enforcement. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #68	2026-06-19 17:00:57 -04:00
Xlorep DarkHelm	48a37b943f	PP-11_Add_SQLAlchemy_async_engine_session (#67) ... ## Summary This PR upgrades backend typing tooling and finalizes quality cleanup for the SQLAlchemy async engine/session work on `PP-11_Add_SQLAlchemy_async_engine_session`. ## What Changed - Upgraded pinned `pyright` version from `1.1.406` to `1.1.410`. - Regenerated backend lock state to align with the new pyright pin. - Removed deprecated `pythonPath` from pyright config to eliminate the config notice. - Refined backend DB runtime state handling and cleanup paths. - Updated database tests to avoid brittle singleton assumptions and keep typeguard-compatible async engine test doubles. ## Why - Remove tooling noise and keep checks deterministic. - Keep backend static/type/doc/test quality gates warning-free. - Improve reliability and clarity of DB engine/session lifecycle tests. ## Validation - `uv run ruff format --check .` - `uv run ruff check .` - `uv run pyright .` - `uv run pydoclint --config=pyproject.toml src/` - `uv run xdoctest --module backend` - `uv run pytest` Results: - Pyright: `0 errors, 0 warnings` - Pytest: `21 passed` ## Impact - No API contract changes intended. - No frontend changes. - Backend behavior remains the same; this is tooling/test/runtime-state cleanup. ## Risk - Low risk. - Main touched areas are backend tooling config, lockfile, DB runtime state internals, and tests. ## Checklist - [x] Backend lint clean - [x] Backend type checks clean - [x] Backend doc checks clean - [x] Backend tests passing - [x] Branch pushed and ready for review Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #67	2026-06-19 07:39:56 -04:00
Cliff Hill	d02039a22e	Backend runtime upgraded to Python 3.14 with exact dependency pinning (#57) ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org> ## Summary Upgrades backend runtime baseline and dependency management for issue #10. ### Changes 1. **Python Baseline**: Updated from 3.13 to 3.14 - Updated `backend/pyproject.toml` requires-python constraint - Updated `backend/pyrightconfig.json` pythonVersion - Updated all Dockerfile and CI references 2. **Dependency Pinning**: Switched to exact version pins in `backend/pyproject.toml` - All dev and runtime dependencies now use `==` instead of `>=` - `fastapi==0.120.2`, `uvicorn==0.38.0` - ruff, pyright, pytest suite pinned to current resolved versions - Regenerated `backend/uv.lock` under Python 3.14 3. **Startup Compatibility Guard** (TDD via RED→GREEN) - New `compatibility_status()` function evaluates runtime and pinned deps - Startup raises `RuntimeError` if policy fails - Implemented via FastAPI lifespan (non-deprecated) handler 4. **Compatibility Status Endpoint** - New `GET /compatibility` returns policy status, runtime version, and package checks - Shares single source of truth with startup validation 5. **Integration Tests** - Added failing-then-passing tests for startup guard and endpoint behavior - 100% coverage maintained 6. **Direnv Configuration** - Added `UV_PYTHON="3.14"` pin to repo `.envrc` - Ensures direnv creates/recreates venv with correct Python version ### Validation - ✅ ruff format/check - ✅ pyright strict (0 errors) - ✅ pytest: 8 passed, 100% coverage (>=95 gate) - ✅ pydoclint: pass - ✅ xdoctest: pass ### Notes - SQLAlchemy/SQLModel introduction deferred to next pass per scope - Compatibility logic currently validates fastapi/uvicorn pins (runtime deps) - Ready for container build validation and Renovate bot testing Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #57 Co-authored-by: Cliff Hill <xlorep@darkhelm.org> Co-committed-by: Cliff Hill <xlorep@darkhelm.org>	2026-06-18 11:19:24 -04:00
Cliff Hill	5d74dd8d8f	Adding some stuff for the new structure to work with my system. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2026-04-08 09:45:49 -04:00
Cliff Hill	18dc1c887a	Retrying run.	2025-11-06 08:22:48 -05:00
Cliff Hill	d3a839489e	Retrying run.	2025-11-06 08:22:45 -05:00
Cliff Hill	e401d852f4	Fixing renovate (again). ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-06 07:09:55 -05:00
Cliff Hill	de5fde5460	Trying this again.	2025-11-05 18:10:10 -05:00
Cliff Hill	4454e9aef5	Adding renovate stuff. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-04 12:40:53 -05:00
Cliff Hill	a142bc46c2	CICD workflow is now valid. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-03 12:14:44 -05:00
Cliff Hill	b9c6b604b1	Make the e2e test use docker in the same way all the others do. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-03 08:40:19 -05:00
Cliff Hill	bf1f3f30df	Making the e2e tests more resiliant for network issues. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 18:33:19 -04:00
Cliff Hill	e16141cdbd	Better dependency processing for the frontend in the CICD. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 16:13:30 -04:00
Cliff Hill	125e889501	Even more dependency fixing happening here. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 15:24:59 -04:00
Cliff Hill	9203e4ff73	More frontend dependency fixes for the CICD build. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 13:27:56 -04:00
Cliff Hill	c34c6e45d6	Adding CICD troubleshooting documentation. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 13:04:39 -04:00
Cliff Hill	b0115e33d3	Attempting to fix how the frontend dependencies are handled in the CICD build. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 13:03:18 -04:00
Cliff Hill	91e6dd7ae1	Fixing the build. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 12:45:11 -04:00
Cliff Hill	aee570e8c3	Trying to improve how images are built, using docker caching the best I can ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 11:20:56 -04:00
Cliff Hill	570bc83295	Making it more resiliant to network problems, fixing playright ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 10:47:02 -04:00
Cliff Hill	941106d59a	Fixing playright again ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-11-01 00:20:31 -04:00
Cliff Hill	a9db4d64bc	Fixing playright ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-31 22:39:31 -04:00
Cliff Hill	6747b03957	More CICD image fisex, part 2 ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-31 18:42:23 -04:00
Cliff Hill	728cebcca2	More CICD image fixes ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-31 15:37:54 -04:00
Cliff Hill	cad7c7fea9	Fixing how uv is being used in the base image, adding Poe the Poet to everything. ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-31 13:25:03 -04:00
Cliff Hill	772c4cfab5	Fixing the optimization ... Signed-off-by: Cliff Hill <xlorep@darkhelm.org>	2025-10-31 12:48:40 -04:00