Retain all applicable checks behind one result and use native CircleCI reporting.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Overlay mutable external SNAPSHOT dependencies as well as locally installed reactor outputs so downstream jobs do not read older snapshots from the immutable cache.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Give the differently parameterized production build a distinct name so CircleCI retains build-and-test for pull requests.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Keep restore and save keys stable across release version rewrites, avoid inherited cross-version caches, skip unused OWASP setup, upload test results once and pack the orb once before gated publication.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Force fresh base-image metadata and package upgrades for supplemental images while retaining enforced vulnerability scans before publication.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
- run_trivy.sh: `trivy fs` ran without --exit-code, so it always exited 0
and security-scan passed with HIGH/CRITICAL findings in the report. Add
--exit-code 1 and print the findings table on failure.
- Semgrep 1.61.1 cannot parse the current `auto` ruleset, so sast-scan ran
zero rules on zero files and passed. Move the executor to
semgrep/semgrep:1.181.0, and fail the job when the report shows no files
scanned or a rule configuration error (even in warn-only mode). Print a
findings summary in the job output.
- tests/test_scan_gates.sh covers both gates with tool stubs.
Consumers pick this up when they bump their pinned orb version; repos with
existing HIGH/CRITICAL or Semgrep findings will need to triage them then.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CircleCI renders the boolean push parameter as 1/0 in the step
environment, but build_push_supplemental.sh only pushed when
PUSH_IMAGES was the string "true". Since 0.3.5 every release build
built and scanned supplemental images and never pushed them, so
deployments referencing them hit ImagePullBackOff (kof22 0.1.75).
PUSH_IMAGES now accepts true/1/yes/on and false/0/no/off/empty; unset
still means push, and an unrecognised value fails before any build.
Tests cover release-mode pushes (1, true, TRUE) of every supplemental
image, PR-mode non-pushes (0, false, empty), and the invalid value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
New munitor/docker_scan job (image-scan) in the pr-checks workflow of
java-webapp, gradle-webapp, node-api and node-webapp: builds the app
image and every supplemental image, runs the same Trivy 0.69.3
HIGH/CRITICAL --exit-code 1 scan as the release pipeline (same
.trivyignore), stores the JSON results, and never pushes.
build_push_supplemental gains push (default true, unchanged behavior).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two main merges built minutes apart both computed the same GitVersion
version. The later pipeline overwrote the image tag in GHCR, github-release
tagged whatever main pointed at (--target main), and the GitOps bump was a
no-op, so production ran an image without the later merge (Website-Backend
0.1.24 and 0.1.32).
- allocate_version: on main, reserve vX.Y.Z by creating the git tag through
the GitHub refs API (create-if-absent). On conflict with another commit,
take the next patch; reruns of the same commit reuse their tag. Existing
tags are never moved. Runs in mvn/gradle/node build-and-test before the
version is baked into artifacts.
- guard_image_tags: refuse to push a main or supplemental version tag that
already exists for a different commit (org.opencontainers.image.revision
label, now set on every build); fail closed on registry errors.
- update_cd_repo: verify vX.Y.Z belongs to this commit before bumping the
GitOps repo; record the source commit in the GitOps commit message.
- github_release: target CIRCLE_SHA1 instead of main and refuse when the tag
points elsewhere.
- Generator: render cd_path only when cd.path is set, so manifests pinned to
orb versions predating the parameter (website develop branches, Concilium,
makers4) stop failing with "Unexpected argument(s): cd_path".
Tests: tests/test_allocate_version.sh (incl. 8 concurrent allocators against
an atomic fake refs API) and tests/test_release_guards.sh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New pipeline type for Obsidian plugins: builds with esbuild, runs
quality gates, and publishes main.js/manifest.json/styles.css to
GitHub Releases. Extends github_release job with release_artifacts
parameter for artifact uploads. 616 tests passing.
* feat: add gradle-webapp pipeline type
Add full Gradle build support mirroring the existing Maven pipeline.
New commands, scripts, jobs, and templates for Gradle projects with
multi-module JaCoCo aggregation, graceful code quality plugin detection,
and shadow JAR discovery via configurable server_module field.
* fix: extract inline test collection to included script
Move the multi-line mkdir/find command into
collect_gradle_test_results.sh to satisfy RC009 orb review
(commands >64 chars must use include syntax).
* fix: embed gradle templates in packed orb scripts
Add gradle-webapp.yml.tpl and gradle-webapp-deploy.yml.tpl to the
pack_generate_config.sh template/partial embed loops so they are
available at runtime when the orb executes on CircleCI.
* fix: improve gradle_jacoco.sh diagnostics and error messaging
Add directory listing of JaCoCo report output before CSV search to
help diagnose missing reports. Improve error message with exact
build.gradle.kts snippet needed to enable CSV report format.
Adds curl HEAD checks for every pinned binary version (Trivy, gh,
gitleaks, kube-linter, terragrunt, yq, kustomize, kubesec, OpenTofu,
sonar-scanner). Also bumps install_tfsec.sh Trivy to 0.69.3.
The job definition was missing the supplemental_images parameter,
so CircleCI silently dropped it even though the template and command
both had it. Added parameter declaration and forwarding, plus
functional upsert tests.
Build, Trivy-scan, and push N additional images (e.g. Liquibase migrations)
alongside the main app image via supplemental_images config in .munitor.yml.
Supports auto-generated Dockerfiles from base+copy or user-provided Dockerfiles,
and updates CD repos with all image tags atomically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a new pipeline type for ArgoCD app-of-apps repositories that use
environment directories (envs/) instead of the standard base/overlays/
kustomize layout. Makes kustomize_validate configurable with overlay_dir
parameter and conditional base build skip.
- Add KUSTOMIZE_OVERLAY_DIR env var and overlay_dir parameter to
kustomize_validate command/job
- Skip base build when base_path is empty string
- Use unset-only default (-) for KUSTOMIZE_BASE_PATH so "" is honored
- Use explicit null check for base_path in extract_munitor_vars (yq //
treats "" as falsy)
- Pipeline-aware yamllint_paths defaults for argocd-apps
- New template, example, fixtures, and tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LiquibaseRunner.getDatabaseConnectionInfo() requires all six RDBMS_*
env vars. Missing VENDOR/DATABASE_NAME/USERNAME/PASSWORD caused
NumberFormatException on startup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a new `java` Docker executor using cimg/openjdk images so 6 Java
jobs (build, code-quality, coverage, e2e, sbom, sonar) get pre-installed
Java/Maven with zero download overhead. Jobs that must stay on the
machine executor (security_scan) now install Java via the Adoptium APT
repository instead of SDKMAN, eliminating an unreliable external
dependency. Also fix node-webapp Dockerfile tests to match the
auto-generation behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Node.js webapps have too much build variety for auto-generated Dockerfiles.
The node-webapp pipeline reuses all npm_* jobs from node-api but requires
a user-provided Dockerfile and adds package_manager config support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The CircleCI orb namespace is kof22, not KofTwentyTwo. Update orb slug
from KofTwentyTwo/munitor to kof22/munitor across CI config, scripts,
examples, tests, and docs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rename files, variables, functions, container names, temp paths,
and config file names to complete the migration to the Munitor
namespace. Regenerate packed scripts. All 362 tests pass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
james.maesandCodex