Commit Graph

945 Commits

Author SHA1 Message Date
renovate[bot]
4dd95f1b6b fix(deps): update weekly-non-major-updates 2026-02-02 14:03:20 +00:00
GitHub Actions
b27fb306f7 fix(ci): force push nightly branch to handle divergence from development 2026-02-02 13:47:36 +00:00
GitHub Actions
f3ed1614c2 fix(ci): improve nightly build sync process by fetching both branches and preventing non-fast-forward errors 2026-02-02 13:45:21 +00:00
GitHub Actions
3261f5d7a1 fix(ci): normalize branch name for Docker tag in security PR workflow 2026-02-02 13:42:49 +00:00
GitHub Actions
60c3336725 COMMIT_MESSAGE_START
fix(docker): update GeoLite2-Country.mmdb checksum + automation

Fixes critical Docker build failure caused by upstream GeoLite2 database
update without corresponding Dockerfile checksum update.

**Root Cause:**
- GeoLite2-Country.mmdb file updated upstream
- Dockerfile still referenced old SHA256 checksum
- Build aborted at checksum verification (line 352)
- Cascade "blob not found" errors for all COPY commands

**Changes:**
- Update Dockerfile ARG GEOLITE2_COUNTRY_SHA256 to current value
- Add automated weekly checksum update workflow (.github/workflows/update-geolite2.yml)
- Implement error handling: retry logic, format validation, failure notifications
- Document rollback decision matrix with 10 failure scenarios
- Create comprehensive maintenance guide (docs/maintenance/geolite2-checksum-update.md)
- Update CHANGELOG.md and README.md with maintenance references

**Verification:**
- Checksum verified against current upstream file: 436135ee...
- Pre-commit hooks: PASSED (EOF/whitespace auto-fixed)
- Trivy security scan: PASSED (no critical/high issues)
- Dockerfile syntax: VALID
- GitHub Actions YAML: VALID
- No hardcoded secrets or injection vulnerabilities

**Automation Features:**
- Weekly scheduled checks (Monday 2 AM UTC)
- Auto-PR creation when checksum changes
- GitHub issue creation on workflow failure
- Comprehensive error handling and retry logic

**Impact:**
- Unblocks all CI/CD Docker image builds
- Enables publishing to GHCR/Docker Hub
- Prevents future checksum failures via automation
- Zero application code changes (no regression risk)

**Documentation:**
- Implementation plan: docs/plans/geolite2_checksum_fix_spec.md
- QA report: docs/reports/qa_geolite2_checksum_fix.md
- Maintenance guide: docs/maintenance/geolite2-checksum-update.md

**Supervisor Recommendations Implemented:**
- #1: Checksum freshness verification before update
- #3: Rollback decision criteria (10 scenarios)
- #4: Automated workflow error handling

Resolves: https://github.com/Wikid82/Charon/actions/runs/21584236523/job/62188372617
COMMIT_MESSAGE_END
2026-02-02 13:31:56 +00:00
renovate[bot]
8794e8948c chore(deps): update github/codeql-action digest to f52cbc8 2026-02-02 11:57:38 +00:00
renovate[bot]
085fa9cb2c chore(deps): update weekly-non-major-updates 2026-02-02 11:57:31 +00:00
GitHub Actions
fcb9eb79a8 chore: Remove dupe Playwright E2E test workflow 2026-02-02 06:44:21 +00:00
renovate[bot]
08cc82ac19 chore(deps): update actions/upload-artifact digest to 47309c9 2026-02-02 05:40:03 +00:00
renovate[bot]
0ad65fcfb1 chore(deps): update renovatebot/github-action action to v46.0.1 2026-02-02 05:39:57 +00:00
GitHub Actions
1defb04fca fix(e2e): streamline Playwright browser installation by caching and removing redundant force install step 2026-01-31 19:32:15 +00:00
GitHub Actions
200cdac3f4 fix(e2e): reorder Playwright browser installation step to ensure proper caching 2026-01-31 19:18:43 +00:00
GitHub Actions
620f566992 fix(e2e): force reinstall Playwright browsers to ensure dependencies are up to date 2026-01-31 18:57:50 +00:00
GitHub Actions
5d118f5159 fix(e2e): avoid passing Chromium-only flags to WebKit during verification; retry without args 2026-01-31 15:13:43 +00:00
GitHub Actions
782b8f358a chore(e2e): verify Playwright browser install and force-reinstall when executables missing
- Print cache contents and Playwright CLI version for diagnostics
- Search for expected browser executables and force reinstall with --force if absent
- Add headless-launch verification via Node to fail fast with clear logs
2026-01-31 15:07:09 +00:00
GitHub Actions
becdb35216 fix(e2e): always clean Playwright browser cache before install
- Add step to delete ~/.cache/ms-playwright before installing browsers
- Guarantees correct browser version for each run
- Prevents mismatched or missing browser binaries (chromium_headless_shell-1208, etc.)
- Should resolve browser not found errors for all browsers
2026-01-31 14:52:18 +00:00
GitHub Actions
13c22fea9a fix(e2e): remove restore-keys to prevent stale browser cache
- Removed restore-keys fallback from Playwright cache
- Only exact cache matches (same package-lock.json hash) are used
- This prevents restoring incompatible browser versions when Playwright updates
- Added cache-hit check to skip install when cache is valid
- Firefox and WebKit were failing because old cache was restored but browsers were incompatible
2026-01-31 08:48:55 +00:00
GitHub Actions
61324bd2ff fix(e2e): include browser name in job titles for visibility
Job names now show: 'E2E chromium (Shard 1/4)' instead of 'E2E Tests (Shard 1/4)'
Makes it easier to identify which browser/shard is passing or failing
2026-01-31 08:33:09 +00:00
GitHub Actions
6e13669e9b fix(e2e): include browser in artifact names and improve install step
- Artifact names now include browser: playwright-report-{browser}-shard-{N}
- Docker logs include browser: docker-logs-{browser}-shard-{N}
- Install step always runs (idempotent) to ensure version match
- Fixed artifact name conflicts when 3 browsers share same shard number
- Updated summary and PR comment to reflect new naming
2026-01-31 08:28:09 +00:00
GitHub Actions
2ecc261960 fix: enhance useImport tests with improved structure and error handling
- Introduced a new wrapper function for query client to facilitate testing.
- Added comprehensive tests for upload, commit, and cancel operations.
- Improved error handling in tests to capture and assert error states.
- Enhanced session management and state reset functionality in tests.
- Implemented polling behavior tests for import status and preview queries.
- Ensured that upload previews are prioritized over status query previews.
- Validated cache invalidation and state management after commit and cancel actions.
2026-01-31 07:30:41 +00:00
renovate[bot]
81e6bdc052 chore(deps): update weekly-non-major-updates 2026-01-31 05:40:01 +00:00
GitHub Actions
a3fea2490d test: add patch coverage tests for Caddy import normalization 2026-01-31 03:08:05 +00:00
Jeremy
01a7c7ffdf fix: add VCS_REF and BUILD_DATE to nightly build workflow 2026-01-30 23:22:44 +00:00
Jeremy
a924b90caa fix(ci): remove failing GoReleaser job and fix propagation workflow 2026-01-30 22:32:25 +00:00
Jeremy
a677b1306e fix: restore correct Renovate and Playwright workflow triggers 2026-01-30 22:17:04 +00:00
Jeremy
26f3183efc chore: simplify GoReleaser to Linux-only builds for Docker deployment 2026-01-30 21:40:49 +00:00
Jeremy
76440c8364 Merge branch 'development' into feature/beta-release 2026-01-30 10:21:48 -05:00
Jeremy
ca80149faa fix(ci): skip Docker artifact steps for Renovate PRs
The "Save Docker Image as Artifact" and "Upload Image Artifact" steps
were running even when skip_build=true, causing CI failures on Renovate
dependency update PRs.

Add skip_build check to artifact saving step condition
Add skip_build check to artifact upload step condition
Aligns artifact steps with existing build skip logic
2026-01-30 15:07:32 +00:00
renovate[bot]
01c9ee2950 chore(deps): update renovatebot/github-action action to v46 2026-01-30 14:58:26 +00:00
Jeremy
b43a5dbae8 choreci): add weekly nightly-to-main promotion workflow
Adds automated workflow that creates a PR from nightly → main every
Monday at 9:00 AM UTC for scheduled release promotion.

Features:

Pre-flight health check verifies critical workflows are passing
Skips PR creation if nightly has no new commits
Detects existing PRs and adds comments instead of duplicates
Labels PRs with 'automated' and 'weekly-promotion'
Creates GitHub issue on failure for visibility
Manual trigger via workflow_dispatch with reason input
NO auto-merge - requires human review and approval
This gives early-week visibility into nightly changes and prevents
Friday surprises from untested code reaching main.
2026-01-30 14:32:17 +00:00
Jeremy
14859df9a6 fix(ci): use local image tag instead of bare digest for E2E tests 2026-01-30 13:03:21 +00:00
GitHub Actions
2427b25940 fix: resolve three CI workflow failures blocking deployments 2026-01-30 07:13:59 +00:00
GitHub Actions
6675f2a169 fix: Implement dependency digest tracking for nightly builds
- Updated Docker Compose files to use digest-pinned images for CI contexts.
- Enhanced Dockerfile to pin Go tool installations and verify external downloads with SHA256 checksums.
- Added Renovate configuration for tracking Go tool versions and digest updates.
- Introduced a new design document outlining the architecture and data flow for dependency tracking.
- Created tasks and requirements documentation to ensure compliance with the new digest pinning policy.
- Updated security documentation to reflect the new digest pinning policy and exceptions.
2026-01-30 06:39:26 +00:00
renovate[bot]
55cf3427a6 chore(deps): update weekly-non-major-updates 2026-01-30 02:08:00 +00:00
GitHub Actions
51ac383576 fix(e2e): update E2E test workflow to use per-shard HTML reports for improved debugging 2026-01-30 01:35:45 +00:00
GitHub Actions
98eae4afd9 fix(docs): update Grype version to v0.107.0 in scripts and documentation 2026-01-30 01:04:46 +00:00
GitHub Actions
b5db4682d7 fix(ci): correct Playwright blob report merging in E2E workflow 2026-01-30 00:55:38 +00:00
renovate[bot]
74bb7d711d fix(deps): update weekly-non-major-updates 2026-01-28 21:36:35 +00:00
GitHub Actions
d9024545ee chore: integrate GORM Security Scanner into CI pipeline and update documentation 2026-01-28 10:34:27 +00:00
renovate[bot]
300e89aa9a fix(deps): update weekly-non-major-updates 2026-01-27 23:26:52 +00:00
GitHub Actions
0da6f7620c fix: restore PATCH endpoints used by E2E + emergency-token fallback
register PATCH /api/v1/settings and PATCH /api/v1/security/acl (E2E expectations)
add emergency-token-aware shortcut handlers (validate X-Emergency-Token → set admin context → invoke handler)
preserve existing POST handlers and backward compatibility
rebuild & redeploy E2E image, verified backend build success
Why: unblocked failing Playwright E2E tests that returned 404s and were blocking the hotfix release
2026-01-27 22:43:33 +00:00
GitHub Actions
949eaa243d fix(e2e): update condition for coverage generation to use vars.PLAYWRIGHT_COVERAGE 2026-01-27 05:28:19 +00:00
GitHub Actions
cbd9612af5 fix(ci): add e2e-tests.yml to push event path filters for workflow triggers 2026-01-27 05:23:49 +00:00
GitHub Actions
436b5f0817 chore: re-enable security e2e scaffolding and triage gaps 2026-01-27 04:53:38 +00:00
GitHub Actions
f9f4ebfd7a fix(e2e): enhance error handling and reporting in E2E tests and workflows 2026-01-27 02:17:46 +00:00
GitHub Actions
22aee0362d fix(ci): resolve E2E test failures - emergency server ports and deterministic ACL disable 2026-01-27 01:50:36 +00:00
GitHub Actions
00fe63b8f4 fix(e2e): disable E2E coverage collection and remove Vite dev server for diagnostic purposes 2026-01-26 23:08:06 +00:00
GitHub Actions
a43086e061 fix(e2e): remove reporter override to enable E2E coverage generation 2026-01-26 22:53:16 +00:00
GitHub Actions
f0f7e60e5d fix(ci): update Go cache path in e2e-tests workflow to improve build efficiency 2026-01-26 22:35:25 +00:00
Jeremy
e01750ac81 Merge branch 'feature/beta-release' into renovate/feature/beta-release-major-6-github-artifact-actions 2026-01-26 17:33:38 -05:00