This change hardens certificate handler test execution so repeated CI runs are deterministic and no longer fail intermittently under concurrent scheduling and race-mode pressure.
It was necessary because initialization timing and test setup ordering created nondeterministic behavior that produced sporadic failures in the backend test suite.
The result is a stable certificate list test path with explicit validation gates and reproducible test artifacts for auditing.
Known container vulnerability findings remain documented and are treated as an accepted exception for this hotfix scope, with remediation deferred to the dedicated security track.
- Implement tests for BackupService to handle database extraction from backup archives with SHM and WAL entries.
- Add tests for BackupService to validate behavior when creating backups for non-SQLite databases and handling oversized database entries.
- Introduce tests for CrowdSec startup to ensure proper error handling during configuration creation.
- Enhance LogService tests to cover scenarios for skipping dot and empty directories and handling read directory errors.
- Add tests for SecurityHeadersService to ensure proper error handling during preset creation and updates.
- Update ProxyHostForm tests to include HSTS subdomains toggle and validation for port input handling.
- Enhance DNSProviders tests to validate manual challenge completion and error handling when no providers are available.
- Extend UsersPage tests to ensure fallback mechanisms for clipboard operations when the clipboard API fails.
- Implemented a new script `local-patch-report.sh` to generate a local patch report.
- The report computes patch coverage based on changes from the current branch against `origin/main`.
- Integrated backend and frontend coverage inputs, producing both Markdown and JSON output artifacts.
- Updated existing frontend coverage script to validate the presence of LCOV coverage file.
- Added tests for coverage computation and parsing of unified diffs for changed lines.
- Enhanced error handling and validation for coverage inputs and baseline references.
- Increased SIGTERM signal timeout from 500ms to 1000ms
- Go 1.26.0 changed signal delivery timing on Linux
- Test now passes reliably with adequate startup grace period
Related to Go 1.26.0 upgrade (commit dc40102a)
- Implemented a function to create a valid SQLite database for testing in db_health_handler_test.go.
- Replaced dummy database file creation with a proper SQLite setup to ensure tests run against a valid database.
- Set CHARON_ENCRYPTION_KEY environment variable in dns_provider_service_test.go to prevent RotationService initialization warnings.
- Added detailed remediation plan for CI Codecov backend test failures, addressing encryption key requirements and database record not found errors.
- Added tests for transient SQLite errors in emergency_handler_test.go.
- Introduced validation tests for provider errors in notification_provider_handler_validation_test.go.
- Implemented helper tests for settings handling in settings_handler_helpers_test.go.
- Expanded backup_handler_test.go to include SQLite database setup and validation.
- Improved system_permissions_handler_test.go with additional path repair tests.
- Updated backup_service_test.go to ensure proper database handling and error checks during backup operations.
- Refined import_handler_test.go with additional session validation tests.
- Updated test scripts in package.json to set NODE_OPTIONS for increased memory limit.
- Added safety checks for remote servers and domains in ProxyHostForm component to prevent errors.
- Refactored Notifications tests to remove unnecessary use of fake timers and improve clarity.
- Updated ProxyHosts extra tests to specify button names for better accessibility.
- Enhanced Security functional tests by centralizing translation strings and improving mock implementations.
- Adjusted test setup to suppress specific console errors related to act() warnings.
- Modified vitest configuration to limit worker usage and prevent memory issues during testing.
- Created a comprehensive pre-commit blocker report detailing GolangCI-Lint and TypeScript type check failures, including remediation steps and verification commands.
- Enhanced the golangci-lint pre-commit hook to automatically rebuild the tool if a Go version mismatch is detected.
- Introduced a new script `rebuild-go-tools.sh` to rebuild essential Go development tools, ensuring they are compiled with the current Go version.
- Improved error handling and user feedback in the rebuilding process, providing clear instructions for manual intervention if needed.
- Updated supervisor review report to reflect the successful implementation of Go version management and associated documentation.
- Created a comprehensive remediation plan for the security test suite, detailing test results, issues, and implementation roadmap.
- Introduced a separate remediation plan for skipped tests, identifying bugs, locator issues, and accessibility enhancements.
- Implemented SystemPermissionsHandler to check and repair file permissions.
- Added endpoints for retrieving and repairing permissions.
- Introduced utility functions for permission checks and error mapping.
- Created tests for the new handler and utility functions.
- Updated routes to include the new permissions endpoints.
- Enhanced configuration to support new logging and plugin directories.
- Added URL validation for notification providers to ensure only valid http/https URLs are accepted.
- Implemented tests for URL validation scenarios in the Notifications component.
- Updated translations for error messages related to invalid URLs in multiple languages.
- Introduced new hooks for managing security headers and access lists in tests.
- Enhanced the ProviderForm component to reset state correctly when switching between add and edit modes.
- Improved user feedback with update indicators after saving changes to notification providers.
- Added mock implementations for new hooks in various test files to ensure consistent testing behavior.
- Created a comprehensive QA Definition of Done (DoD) Verification Report detailing the status of E2E tests, coverage, type safety, pre-commit hooks, linting, and security scans.
- Documented findings on React rendering issues, test execution times, and recommendations for CI scheduling.
- Updated the Vulnerability Assessment Phase 2 report with detailed CVE findings, risk assessments, and remediation plans for identified vulnerabilities in dependencies.
- Implemented tests for domain and DNS management including adding domains, viewing DNS records, and SSL certificate management.
- Created monitoring and audit tests for log display, filtering, searching, and export functionality.
- Developed backup and recovery tests covering manual backups, scheduling, restoration, and data integrity verification.
- Added emergency operations tests for emergency token usage, break-glass recovery procedures, and security module management.
- Included a comprehensive README for the UAT test suite detailing test coverage, execution instructions, and success criteria.
- Implemented tests for the emergency server (Tier 2) to validate health checks, security reset functionality, and independent access.
- Created a comprehensive suite for system settings feature toggles, ensuring proper state management and API call metrics reporting.
- Removed redundant feature toggle tests from the system settings spec to maintain clarity and focus.
- Enhanced test isolation by restoring default feature flag states after each test.
Update CI pipeline to pass the built Docker image to integration tests as a file artifact instead of pulling from a registry.
Adds explicit list of integration tests to build-image job outputs logic
Adds step to export charon:local image to tarball in linux/amd64 architecture
Updates integration jobs to download and load the image artifact
Resolves "invalid reference format" errors when registry tags are missing or invalid
Enables integration testing on PRs that do not push to registry
Removed log masking for image refs to enable debugging
Added whitespace trimming for digest output
Implemented 'docker manifest inspect' gate to fail fast on invalid refs
Switched to printf for safer output logging
Added explicit validation for IMAGE_NAME and DEFAULT_TAG to prevent empty values
Implemented per-tag validation loop to catch empty or malformed tags before build
Added debug step to echo generated tags immediately before build-push-action
Ensures invalid Docker references are caught early with descriptive errors
Rewrote the Emit image outputs step in the build-image job to robustly handle Docker image references.
Replaced fragile grep parsing with a safe while read loop for multiline tags.
Implemented deterministic prioritization: Digest > Matching Tag > First Tag.
Added explicit error handling to fail the build immediately if no valid reference is found, preventing "invalid reference format" errors in downstream integration jobs.
Changed 4 files
Detailed explanation of:
- What behavior changed: Removed the `integration_gate_ok` shell variable from the `pipeline-gate` job.
- Why the change was necessary: The variable was defined but not used, causing `shellcheck` (via `actionlint`) to fail the pre-commit hook.
- Any important side effects or considerations: None; the logic relying on this condition recalculates it inline using GitHub Actions expressions.
- Updated quality-checks.yml to support manual dispatch with frontend checks.
- Modified rate-limit-integration.yml to remove workflow_run triggers and adjust conditions for execution.
- Removed pull request triggers from repo-health.yml, retaining only scheduled and manual dispatch.
- Adjusted security-pr.yml and supply-chain-pr.yml to eliminate workflow_run dependencies and refine execution conditions.
- Cleaned up supply-chain-verify.yml by removing workflow_run triggers and ensuring proper execution conditions.
- Updated waf-integration.yml to remove workflow_run triggers, allowing manual dispatch only.
- Revised current_spec.md to reflect the consolidation of CI workflows into a single pipeline, detailing objectives, research findings, and implementation plans.
