11 Commits

Include renames

Author	SHA1	Message	Date
Mumuni	52c41ca8fb	fix(ci): install python3 via apk — act job container is alpine, not debian ... Run 467 log (job 1985): 'python3 missing — installing on alpine' then 'apt-get: command not found' → exit 127. The act_runner container is node:20-alpine-ish; the provisioning step now detects apk first, apt second, and fails loudly with a diagnostic if neither exists.	2026-09-25 19:39:36 +00:00
MumuniandClaude Opus 5	f477a6a252	fix(ci): install python3+PyYAML in the job when the runner image lacks them ... Runner probe on PR #35 (run 461, log job 1979): checkout@v4 succeeds (network fine) but the act container has node:20 + git 2.52 and NO python3 — 'python3 --version' exited 127, which was the failing check. Every validation step is python3-based, so make step 2 self-provisioning via apt when missing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-25 19:20:23 +00:00
Mumuni	9edc258245	fix(ci): make the validate job actually able to run — it never had ... ci.yml has been invalid YAML since introduction: the 'Config validation' and old inline checks dedented out of their run:| block scalar, so Gitea could never parse the workflow — CI never ran on any PR despite CI_STATUS.md claiming 'Active'. The old 'No secrets check' also always passed (|| echo swallows the grep hit) and never scanned *.yml — where six embedded credentials were living. - validation logic moved to ci_check.py (testable locally: python3 ci_check.py all) - secrets check now FAILS on embedded http-basic URLs and long api_keys, across .py/.ts/.yaml/.yml/.cjs/.sh, with placeholder allowlist - added workflow-YAML parse gate so this class of breakage can't recur - py_compile steps no longer swallow errors with '|| echo skipped' - removed ci.yml's duplicate deploy job: deploy.yml is the sole deploy pipeline (rc tags → Tanko canary only; stable → all agents). The ci.yml copy would have deployed Mumuni on rc tags too, breaking canary policy, and never ran anyway. - CI_STATUS.md rewritten with the real state + caveats (history still contains the old creds — rotation is a server-side task)	2026-09-25 15:50:16 +00:00
Abiba (pi)	3db0d74620	security: remove hardcoded abiba-bot credentials from CI workflow ... Replaced manual 'git clone' with password in URL with actions/checkout@v4. Runner already auto-checkouts the repo - manual clone was redundant. Also fixed YAML syntax issues in Config validation and No secrets check steps. Credentials were exposed in git history since initial commit. (cherry picked from commit aeb79c6286)	2026-09-25 15:25:54 +00:00
Abiba (pi)	a5dc880af1	ci: simplify workflow	2026-06-28 00:47:23 +00:00
Abiba (pi)	6afc46734a	ci: debug checkout step	2026-06-28 00:43:43 +00:00
Abiba (pi)	9ee1919985	ci: add auth to git clone in workflows	2026-06-28 00:42:41 +00:00
Abiba (pi)	c2f91f6e58	ci: replace actions/checkout with native git clone	2026-06-28 00:41:49 +00:00
Abiba (pi)	2d467ef02c	ci: Gitea Actions runner + real deploy workflows + git hooks	2026-06-28 00:31:32 +00:00
Abiba (pi)	d30b480525	ci: update Actions workflow — validate all plugins, auto-deploy on tags	2026-06-27 19:04:09 +00:00
Abiba (pi)	ea262a38bb	feat: add GitOps workflow — branch strategy, PR template, deploy/rollback scripts, CI skeleton ... - docs/GITOPS.md: complete workflow from prototype to production - .gitea/pull_request_template.md: pre-merge checklist for swarm PR review - scripts/deploy.sh: tag-based deployment to all 6 CTs with health checks - scripts/rollback.sh: rollback to previous tag - .gitea/workflows/ci.yml: CI pipeline (activates when Actions runners available) - .gitignore: prevent config.yaml and secrets from being committed - .gitattributes: consistent LF line endings across platforms	2026-06-20 00:07:37 +00:00