CircleCI renders the boolean push parameter as 1/0 in the step
environment, but build_push_supplemental.sh only pushed when
PUSH_IMAGES was the string "true". Since 0.3.5 every release build
built and scanned supplemental images and never pushed them, so
deployments referencing them hit ImagePullBackOff (kof22 0.1.75).
PUSH_IMAGES now accepts true/1/yes/on and false/0/no/off/empty; unset
still means push, and an unrecognised value fails before any build.
Tests cover release-mode pushes (1, true, TRUE) of every supplemental
image, PR-mode non-pushes (0, false, empty), and the invalid value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
New munitor/docker_scan job (image-scan) in the pr-checks workflow of
java-webapp, gradle-webapp, node-api and node-webapp: builds the app
image and every supplemental image, runs the same Trivy 0.69.3
HIGH/CRITICAL --exit-code 1 scan as the release pipeline (same
.trivyignore), stores the JSON results, and never pushes.
build_push_supplemental gains push (default true, unchanged behavior).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
update_cd_repo creates the CD commit through the GraphQL
createCommitOnBranch mutation so GitHub signs it, letting the GitOps
repository require signed commits without a bypass actor. Concurrent
bumps retry against the refreshed head.
CI pins circleci/orb-tools to 12.5.0 and adds a test job running the
script, template and BATS suites. Feature branches publish only the
immutable dev:<sha> tag; develop keeps dev:snapshot (#26). The
generator accepts the documented org key (#27). Adds .editorconfig.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Add an "Adopting in another app" section to the README (version,
.munitor.yml example, CircleCI settings, contexts and secrets, branch
model, deployment infrastructure, known limitations, 0.3.3 upgrade
notes), a tier and standards statement, and reference rows for the
previously undocumented .munitor.yml keys. Add SECURITY.md,
.github/CODEOWNERS and a CONTRIBUTING workflow section (branches,
Conventional Commits, DCO sign-off, local checks), and fix the
nonexistent `make test` target in CLAUDE.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Two main merges built minutes apart both computed the same GitVersion
version. The later pipeline overwrote the image tag in GHCR, github-release
tagged whatever main pointed at (--target main), and the GitOps bump was a
no-op, so production ran an image without the later merge (Website-Backend
0.1.24 and 0.1.32).
- allocate_version: on main, reserve vX.Y.Z by creating the git tag through
the GitHub refs API (create-if-absent). On conflict with another commit,
take the next patch; reruns of the same commit reuse their tag. Existing
tags are never moved. Runs in mvn/gradle/node build-and-test before the
version is baked into artifacts.
- guard_image_tags: refuse to push a main or supplemental version tag that
already exists for a different commit (org.opencontainers.image.revision
label, now set on every build); fail closed on registry errors.
- update_cd_repo: verify vX.Y.Z belongs to this commit before bumping the
GitOps repo; record the source commit in the GitOps commit message.
- github_release: target CIRCLE_SHA1 instead of main and refuse when the tag
points elsewhere.
- Generator: render cd_path only when cd.path is set, so manifests pinned to
orb versions predating the parameter (website develop branches, Concilium,
makers4) stop failing with "Unexpected argument(s): cd_path".
Tests: tests/test_allocate_version.sh (incl. 8 concurrent allocators against
an atomic fake refs API) and tests/test_release_guards.sh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New pipeline type for Obsidian plugins: builds with esbuild, runs
quality gates, and publishes main.js/manifest.json/styles.css to
GitHub Releases. Extends github_release job with release_artifacts
parameter for artifact uploads. 616 tests passing.
Move SESSION-STATE.md, TODO.md, and reference docs from the ClaudeCode
sidecar repo into docs/. Update .gitignore to allow tracking. Add
CLAUDE.md with project context.
Secondary jobs (code-quality, coverage, security-scan, e2e, sonar, sbom)
now run install_node with package_manager to activate corepack/pnpm.
Coverage check supports glob patterns for monorepo summary aggregation
via test.coverage.summary_path in .munitor.yml.
james.maesandCodex