67 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
james.maes	88d92df64e	Merge pull request 'windows, macos: release with the job token' (#12) from release-job-token into main	2026-11-08 23:20:19 +00:00
james.maesandClaude Opus 5.5	27192881a6	windows, macos: release with the job token ... The org PACKAGES_TOKEN got HTTP 403 on the release lookup; go.yaml and gradle.yaml already use the job token (contents: write). Do the same here and drop the now-unused PACKAGES_TOKEN secret input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 17:19:00 -06:00
james.maes	752b71960a	Merge pull request 'docs: migration status after the go, gradle and lint workflows' (#11) from docs/small-workflows-status into main	2026-11-08 15:10:58 +00:00
James MaesandClaude Opus 5.5	0ceddad82c	docs: migration status after the go, gradle and lint workflows (2026-11-08) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 09:10:40 -06:00
james.maes	fc670fdee9	Merge pull request 'go, gradle, lint: small shared workflows' (#10) from small-workflows into main	2026-11-08 14:56:12 +00:00
James MaesandClaude Opus 5.5	964d4a8a22	go, gradle: a release without the asset yet is not an error ... grep finds no asset to replace on a fresh release; under pipefail that ended the step silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:50:14 -06:00
James MaesandClaude Opus 5.5	1df074d058	go, gradle: release with the job token ... The org PACKAGES_TOKEN got HTTP 403 on the release lookup (license-tool proof tag); the job token with contents: write creates and fills the release, so the workflows need no secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:47:55 -06:00
James MaesandClaude Opus 5.5	55e4f9f71a	lint: name ansible.cfg explicitly; README: Go, Gradle and Lint ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:44:28 -06:00
James MaesandClaude Opus 5.5	194fc721d6	gradle: gradle:jdk<N> image (checkout needs git); lint: markdownlint in the lint job ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:33:18 -06:00
James MaesandClaude Opus 5.5	7674d24f20	go, gradle, lint: small shared workflows ... go.yaml: gofmt, go vet, optional golangci-lint (pinned, sha256-verified), go test (optional race), extra gate commands, and on v* tags release commands plus artifacts with SHA256SUMS on the Gitea release. gradle.yaml: verified Gradle wrapper (official jar and distribution checksum), ./gradlew task lines, artifacts on v* tags. lint.yaml: opt-in shellcheck, yamllint, JSON, ruff, tofu fmt/validate, markdownlint and ansible-lint; every tool pinned and checksum- or digest-verified; git-crypt files always skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:24:51 -06:00
james.maes	0e0f145b45	Merge pull request 'docs: migration status after npm and release publishing (2026-11-08)' (#9) from docs/release-publishing-status into main v1	2026-11-08 14:12:53 +00:00
james.maesandClaude Opus 5.5	d272b5d0eb	docs: migration status after npm and release publishing (2026-11-08) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 08:12:33 -06:00
james.maes	160f703357	Merge pull request 'docs: native migration status' (#8) from docs/native-migration into main	2026-11-08 13:53:26 +00:00
James MaesandClaude Opus 5.5	1ad6dccbd2	docs: native migration status (Android, Windows, macOS) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:52:50 -06:00
james.maes	20792ea37f	Merge pull request 'native: shared Android, Windows and macOS workflows' (#7) from native-workflows-pr into main	2026-11-08 13:44:54 +00:00
James MaesandClaude Opus 5.5	f66d4c1f19	README: native-exit-code preference and Pester ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:43:36 -06:00
James MaesandClaude Opus 5.5	5c35d6b45d	windows, macos: checksum asset name input; tolerate a concurrent release create; README ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:43:36 -06:00
James MaesandClaude Opus 5.5	69c34b9aaa	macos: optional Git LFS checkout ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:43:35 -06:00
James MaesandClaude Opus 5.5	9a370b1dde	windows: fail on a non-zero exit code left by the commands ... Document that .ps1 files reporting failure with exit codes run as pwsh -File. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:43:35 -06:00
James MaesandClaude Opus 5.5	714ff178bd	native: shared Android, Windows and macOS workflows ... android.yaml runs Gradle gates in the pinned Android image on android-build (optional emulator tasks, optional publish to the Gitea Maven registry on vX.Y.Z tags). windows.yaml and macos.yaml run the caller's commands directly on the Windows / macOS host runners and attach artifacts plus SHA256SUMS to the Gitea release on v* tags. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:43:34 -06:00
james.maes	bbc8fd9c5b	Merge pull request 'node: opt-in publishing on release tags (Gitea npm registry, Gitea release)' (#6) from ci/node-publish into main	2026-11-08 13:26:04 +00:00
james.maesandClaude Opus 5.5	9de94827ae	node: opt-in publishing on release tags (Gitea npm registry, Gitea release) ... publish: true makes a vX.Y.Z[-pre] tag whose version equals version-file publish after the commands pass: npm-publish-dirs (or publish-commands) to the owner's Gitea npm registry with PACKAGES_TOKEN (prerelease -> dist-tag next), and release-files to a Gitea release with SHA256SUMS and the CHANGELOG section as notes. Branches and other tags only verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-08 07:25:38 -06:00
james.maes	5bb0470137	Merge pull request 'docs: migration status after the no-CI Node/Maven batch' (#5) from docs/no-ci-node-maven-batch into main	2026-11-07 23:57:50 +00:00
james.maesandClaude Opus 5.5	9a48431b4d	docs: migration status after the no-CI Node/Maven batch ... Move qqq-frontend-core, qqq-frontend-component-sequential-workflow, qqq-frontend-material-dashboard and obsidian-penny to Done, and re-bucket the triaged repos that turned out not to be Node/Maven (templates, docs, shell, Go, Gradle). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 17:57:30 -06:00
james.maes	986737a710	Merge pull request 'docs: triage of every repository with no CI (proposal)' (#4) from docs/no-ci-triage into main	2026-11-07 23:24:18 +00:00
james.maesandClaude Opus 5.5	f828753ca3	docs: triage of every repository with no CI (proposal) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 17:24:01 -06:00
james.maes	a27f6e8bbf	Merge pull request 'node: shared Node.js verify workflow' (#3) from ci/node-workflow into main	2026-11-07 22:11:52 +00:00
james.maesandClaude Opus 5.5	3112ea5758	node: shared Node.js verify workflow ... Installs locked dependencies and runs the caller's commands in order in the official node:<version>-bookworm image; optional pinned, sha256-verified uv for repositories with Python script checks. Verify only, no publishing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 16:11:29 -06:00
james.maes	e0353712f2	Merge pull request 'docs: migration status after website and backend cutover' (#2) from docs/migration-status into main	2026-11-07 19:59:24 +00:00
james.maesandClaude Opus 5.5	c7cbc4acad	docs: migration status after website and backend cutover ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 13:59:04 -06:00
james.maes	85fb5e4fdf	Merge pull request 'maven: deploy all modules at the end of the build' (#1) from ci/deploy-at-end into main	2026-11-07 19:24:58 +00:00
james.maesandClaude Opus 5.5	45eb310ce4	maven: deploy all modules at the end of the build ... A multi-module release that fails midway (e.g. a Testcontainers ryuk flake) left some modules published, so reruns hit 409 and needed a new RC number. With deployAtEnd nothing is uploaded until every module has built and tested. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 13:24:36 -06:00
james.maesandClaude Opus 5.5	caacaddb39	docs: migration backlog (all repos still to move to ci-workflows) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 07:32:59 -06:00
james.maesandClaude Opus 5.5	0fe1fa2269	fix(manifests): fetch the blueprint linter from main ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 07:26:30 -06:00
james.maesandClaude Opus 5.5	f9f55de587	feat: manifests.yaml for GitOps repositories (port of the old manifest CI) ... Renders Kustomize roots with the pinned kubectl, lints Authentik blueprints (central linter copied from platform-ci) and scans for secrets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 07:14:57 -06:00
james.maesandClaude Opus 5.5	e24ef92028	feat: Central via the in-cluster Maven proxy; -T1C builds ... maven.kof22.com caches Central (one download per artifact, no 429s); -T1C uses one thread per runner core instead of a fixed 4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 06:43:26 -06:00
james.maesandClaude Opus 5.5	e7c472a0c2	fix: tag releases commit back to main only if main exists ... qbit-document-generation v1.0.0 published but went red pushing to a missing main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 17:38:54 -06:00
james.maesandClaude Opus 5.5	e7313e8e3a	fix(container): never overwrite an existing deploy tag ... A re-run keeps the run number, so it would rebuild under the same tag (geoip downloads data at build time). If ci-<sha12>-run-<n> exists in the registry, reuse it instead of pushing; deploys keep pointing at the original bytes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:54:43 -06:00
james.maesandClaude Opus 5.5	49c4412279	fix(container): 180-minute job limit (Website-Backend release took up to 180) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:48:01 -06:00
james.maesandClaude Opus 5.5	ba739ac4a4	fix: parallel deploy (-T4) and 120-minute job limit ... qqq's sequential publish would take ~58 min against a 60-minute limit; PR checks already build with -T4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:45:48 -06:00
james.maesandClaude Opus 5.5	bc145c8dcd	fix(container): secret-scan the current tree before the build, verbose and redacted ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:43:28 -06:00
james.maesandClaude Opus 5.5	626b2cfd95	feat(container): scan input (block default, report for apps that never scanned) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:29:50 -06:00
james.maesandClaude Opus 5.5	9c9441a48a	fix: retry transient repository errors (429/5xx) in Maven ... The Google Central mirror returned a one-off 500 that failed a build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:13:16 -06:00
james.maesandClaude Opus 5.5	f42d8f0851	fix(container): scan the OCI layout directory ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:11:36 -06:00
james.maesandClaude Opus 5.5	6bc05760af	feat: container.yaml for applications (test, scan, BuildKit build, push, GitOps deploy) ... Replaces the old publisher path: images build with the runner-provided buildctl, Trivy HIGH/CRITICAL and Gitleaks block, the publish branch pushes ci-<sha12>-run-<n> to the Gitea registry and bumps images[].newTag in cluster-gitops through the contents API (server-signed), which Argo deploys. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 16:04:05 -06:00
james.maesandClaude Opus 5.5	1b09d2902b	chore(rollout): shell-style repo list parsing, quoted input values ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 15:38:21 -06:00
james.maesandClaude Opus 5.5	d3389278cd	feat: node-version and prebuild inputs; publish RC release tags ... - node-version installs the official Node tarball (SHASUMS256 verified) - prebuild runs a shell command before Maven (frontend builds Maven packages) - vX.Y.Z-RC.N tags publish that version without committing back Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 15:33:47 -06:00
james.maesandClaude Opus 5.5	839f8d37d3	feat: snapshot-branch input for repositories without develop ... Default develop keeps existing behavior; a main-only library sets snapshot-branch: main to publish SNAPSHOTs from main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 12:04:10 -06:00
james.maesandClaude Opus 5.5	133b05f7a8	fix(rollout): add migrated repos to the dispatcher's known list so not-enrolled skips ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 10:07:29 -06:00
james.maesandClaude Opus 5.5	4693c5f155	feat(rollout): per-repo workflow inputs in the repo list ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 08:17:41 -06:00