59 Commits

Include renames

Author	SHA1	Message	Date
popertots	6fd3d13540	ci: install openssl for nginx dummy cert generation	2026-07-10 11:13:20 +01:00
popertots	f0c5f53f3f	ci: nginx needs dummy TLS certs, frontend major deps now visible ... - nginx-check: generate self-signed certs so nginx -t can resolve ssl_certificate paths without failing - frontend-deps-major: exit(1) when major updates found + continue- on-error: true so it shows as red/visible but doesn't block pipeline	2026-07-10 11:07:02 +01:00
popertots	5246ed3c64	ci: add hosts entries so nginx -t can resolve upstream service names	2026-07-10 11:00:20 +01:00
popertots	6f557257bb	ci: fix nginx http.d dir, golangci-lint timeout, frontend major deps parallel ... - nginx-check: Alpine's nginx package includes /etc/nginx/conf.d at MAIN level and /etc/nginx/http.d at HTTP level. Use http.d so that proxy_cache_path, limit_req_zone, and server blocks are valid. - golangci-lint: add --timeout 5m to prevent timeout on first run when Go module cache is cold and many deps must be downloaded - frontend-deps-major: remove needs dependency so it runs in parallel with frontend-deps (provides visibility even when deps check fails)	2026-07-10 10:53:53 +01:00
popertots	e0f072b593	ci: split dev/prod jobs, add non-blocking frontend major deps check ... Split 3 multi-step jobs into separate dev and prod jobs for clearer parallel execution: - go-vet → go-vet-dev + go-vet-prod - go-staticcheck → go-staticcheck-dev + go-staticcheck-prod - go-gosec → go-gosec-dev + go-gosec-prod Each split job runs independently with its own setup and cache key. Updated test/race needs to reference all split job names. Added frontend-deps-major job (warn-only, exit 0): - Detects major/out-of-range npm updates (wanted !== latest) - Non-blocking informational check alongside the existing blocking frontend-deps job that catches in-range updates	2026-07-10 10:45:29 +01:00
popertots	2a0b81e565	ci: mkdir before cp for nginx config validation	2026-07-10 10:37:59 +01:00
popertots	9e3c9323c3	ci: fix nginx config check cp path, add R2_ENDPOINT to .env.example ... - nginx-check: cp needs trailing filename when copying to a directory - .env.example: uncomment R2_ENDPOINT as an active variable so the env-docs-check script detects it as documented	2026-07-10 10:33:33 +01:00
popertots	3d5b9350bc	ci: install git for gitleaks, use nginx default config for validation ... - secrets-scan: install git before gitleaks (gitleaks needs git in PATH to scan the repository; the node:22-alpine3.21 container lacks it) - nginx-check: copy site config into /etc/nginx/conf.d/ and use 'nginx -t' with default config instead of constructing a custom one (avoids fastcgi_params resolution issues with relative includes)	2026-07-10 10:27:48 +01:00
popertots	fbb8837981	ci: fix gitleaks module path, compose env file, and nginx limit_req_zone scope ... - secrets-scan: gitleaks module path was renamed from github.com/gitleaks/gitleaks/v8 to github.com/zricethezav/gitleaks/v8 - docker-compose-check: create backend/.env from .env.example before running docker compose config (env file required by compose.yml) - nginx: move limit_req_zone directives outside server block to http level, where nginx requires them	2026-07-10 10:22:32 +01:00
popertots	d073172670	ci: fix infra failures — install go/python3/docker/nginx in job containers ... Four CI jobs failed because the runner's node:22-alpine3.21 container lacked required tooling (Go, Python3, Docker CLI, nginx): - secrets-scan: add actions/setup-go@v5 before gitleaks install - env-docs-check: apk add python3 before running check script - docker-compose-check: apk add docker-cli docker-compose - nginx-check: install nginx locally, validate with minimal config	2026-07-10 10:16:01 +01:00
popertotsandSisyphus	9a96a7a8a1	ci: add prod-tag variants to staticcheck and gosec ... Both tools now run under test,dev and test,!dev tags, matching go-vet pattern. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:50:21 +01:00
popertotsandSisyphus	f532b05e72	ci: set coverage threshold to 100%, govulncheck gated behind go-build ... Coverage check now requires 100% (fail on any uncovered line). govulncheck (vulns) now has needs: [go-build], placing it in the gate block alongside vet/lint/staticcheck/gosec. Test and race already depended on vulns, so the chain is: go-build → gate jobs (incl vulns) → test+race. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:44:47 +01:00
popertotsandSisyphus	5f95abf804	ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y ... New jobs in pipeline: secrets-scan: gitleaks detection go-staticcheck: static analysis (complement to golangci-lint) go-gosec: Go security linter test: coverage profiling with 50% threshold gate env-docs-check: verifies all env vars are documented in .env.example docker-compose-check: validates compose.yml syntax nginx-check: validates nginx config frontend-a11y: Svelte a11y accessibility checks Also: remove orphaned Makefile, update .env.example with 11 missing vars, create .gitleaks.toml with allowlist, add check-env-docs.py script. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-10 09:38:07 +01:00
popertotsandSisyphus	b26bf14419	ci: svelte strict check runs after typecheck QC, not before ... frontend-svelte-strict now needs frontend-qc. QC gates on build+knip. Strict runs after QC completes. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:05:20 +01:00
popertotsandSisyphus	d272eb7cfe	ci: restructure Go gate into separate jobs, add knip and svelte strict check ... Go: go-build gates three parallel jobs (go-vet, golangci-lint, go-mod-tidy) which gate test+race. Frontend: add knip (between deps and QC) and svelte-check --fail-on-warnings (after build). QC now gates on build, knip, and svelte strict. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 18:03:04 +01:00
popertotsandSisyphus	b11dee1c49	ci: add golangci-lint and go-mod-tidy to Go gate job ... Go gate now runs: build, vet(dev+prod), golangci-lint, and go mod tidy check. Test and race jobs depend on this gate + vulns. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:57:37 +01:00
popertotsandSisyphus	53b0507148	ci: run frontend-deps and frontend-build in parallel, both gate QC ... frontend-deps (dep staleness check) and frontend-build now run concurrently. frontend-qc waits for both. Removed (gate) from build job name. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:54:50 +01:00
popertotsandSisyphus	93883602d9	ci: extract frontend deps checks into separate gating job ... frontend-deps runs npm outdated + stale override checks as its own job. frontend-build waits for frontend-deps before starting, so stale deps stop the pipeline before build resources are consumed. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:52:53 +01:00
popertotsandSisyphus	2604f9ab0d	ci: add stale override detection to frontend build gate ... Parses npm explain output for each overridden package. If the parent's required range already satisfies the override target, flags it as stale — dev must remove the override. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:51:32 +01:00
popertotsandSisyphus	4b5d3640bb	ci: add dependency staleness check to frontend build gate ... After npm ci, runs npm outdated --json and fails if any in-range (current != wanted) updates exist. Developer must run npm update locally and commit the lockfile. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:46:54 +01:00
popertotsandSisyphus	914f9993ec	ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns ... - Remove -timeout 180s/240s from go test and race commands - Add concurrency group to cancel stale pipelines on new pushes - Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln - npm audit now at 0 vulnerabilities Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:43:13 +01:00
popertotsandSisyphus	a17d6fd2e6	ci: fail npm audit on any vuln, not just high/critical ... Change audit-level from high to info so low and moderate findings also fail the CI step. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:35:23 +01:00
popertotsandSisyphus	29958620b6	ci: fix literal ${matrix.task} in step names (Gitea does not resolve them) ... Replace with static names. Job names still use matrix templates (those work). Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:29:39 +01:00
popertotsandSisyphus	ef26bd59e9	ci: fix go-version to 1.26 (no patch) and clean up step names ... setup-go resolves '1.26' to latest patch (1.26.5). go.mod follows convention with minor version only. All CI steps now have descriptive names. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:22:23 +01:00
popertotsandSisyphus	c344d6c54d	chore: upgrade Go from 1.25.7 to 1.26.5 ... Go 1.26.5 released Jul 7, 2026. Includes security fix for GO-2026-5856 (crypto/tls ECH leak). Updates: CI runner (4x setup-go), go.mod, README, obsidian docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:11:49 +01:00
popertotsandSisyphus	f59b7df97f	ci: revert go-version to 1.25, add npm ci fallback in frontend QC jobs ... 1.25.12 unavailable in runner toolcache — revert to '1.25' which resolves to latest patch. The GO-2026-5856 vuln requires a Go patch release not yet available. Frontend QC jobs now run npm ci before their command since cache restore alone doesn't guarantee node_modules. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:07:17 +01:00
popertotsandSisyphus	7fd74dc65e	ci: bump Go from 1.25 to 1.25.12 to fix GO-2026-5856 ... govulncheck found crypto/tls vuln fixed in 1.25.12. Bump all 4 setup-go instances. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:03:45 +01:00
popertotsandSisyphus	0a73c07f09	ci: split frontend into build gate then parallel typecheck/lint/audit ... npm run build runs first as the gate. On success, typecheck, lint, and npm audit fire in parallel — all restoring node_modules from the build job's cache. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 17:02:21 +01:00
popertotsandSisyphus	e5f823eecd	ci: gate test and race behind both vet and vulns ... Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-09 16:58:18 +01:00
popertotsandSisyphus	8326b15e72	ci: split dev/prod test and race jobs into parallel matrix ... Extract Build & Vet into a separate gate job. Use matrix strategy for test and race jobs so dev and prod variants run concurrently after vet passes. Cache keys include label to avoid collisions. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:15:25 +01:00
popertotsandSisyphus	f4969645c4	chore: update CI, DB init, and documentation ... Update CI workflow, PostgreSQL init script, README, and obsidian technical docs. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-07 00:10:18 +01:00
popertotsandSisyphus	d8dfad2b32	ci: add Go and npm dependency caching via actions/cache ... Add actions/cache@v4 to all four CI jobs. Go module cache (go/pkg/mod + go-build) keyed on go.sum for test, race, and vulns jobs. npm cache (~/.npm + node_modules) keyed on package-lock.json for frontend job. Cuts dependency download time to near-zero on cache hit. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>	2026-07-05 20:37:59 +01:00
popertots	a00ed3c283	ci: re-add test and race jobs alongside lint and vulns	2026-06-25 19:39:09 +01:00
popertots	82e6f75354	ci: split govulncheck and frontend checks into parallel jobs	2026-06-25 16:41:18 +01:00
popertots	c481400215	ci: strip to lint/vulns only, fix Post-step node toolcache ... Remove test and race jobs until lint + vulns are fully green. The node:22-alpine3.21 base image ships node at /usr/local/bin but actions/setup-node expects it in the toolcache at /opt/hostedtoolcache. Create a symlink so all Post-action cleanup steps (cache-save) find node and don't exit 255.	2026-06-25 14:05:57 +01:00
popertots	3f0155597a	ci: add CGO_ENABLED, build-base for race; auto-fix prettier before lint ... - Race job: install build-base (gcc) and set CGO_ENABLED=1 for Go's race detector on Alpine (requires cgo) - Quality job: run npm run format (prettier --write) before lint to auto-fix formatting issues instead of failing CI for style nits - Runner config on server updated to capacity: 8 (parallel jobs)	2026-06-25 13:15:15 +01:00
popertots	a4a475a07d	ci: fix quality job working-directory and adjust timeouts ... working-directory wasn't being honored for npm steps in the quality job. Switch to explicit cd frontend && commands. Reduce race timeout from 300s to 240s.	2026-06-25 13:03:50 +01:00
popertots	aa875339b5	ci: add race detector, govulncheck, and frontend quality jobs ... Three parallel jobs: - test: existing Go tests (unchanged) - race: Go tests with -race flag (catches data races) - quality: govulncheck + svelte-check + eslint/prettier (no PG needed) Race job has its own PG service container so all three can run in parallel.	2026-06-25 12:57:15 +01:00
popertots	1b982b118b	fix: use ./... in CI and restore local dev host connection ... CI test command: switch from explicit package list to ./... so new packages are automatically included. local-dev-2.sh: override POSTGRES_HOST=localhost for the host-side go run -tags dev ./main.go. The dev-tagged Connect() now reads POSTGRES_HOST from env (needed for CI where service containers use Docker DNS). Locally, .env sets POSTGRES_HOST=postgres, but that name only resolves inside Docker — not from the host where the dev server runs. Override to localhost so it connects via Docker's port forwarding.	2026-06-25 12:11:45 +01:00
popertots	3fd66d5414	ci: remove -a flag and debug log now fix is confirmed	2026-06-25 12:04:56 +01:00
popertots	2db552db44	ci: add -a flag and debug print for savedPOSTGRESHost	2026-06-25 11:52:22 +01:00
popertots	248756a1fe	fix(db): prevent POSTGRES_HOST env var leakage between tests ... resetEnv() conditionally set POSTGRES_HOST only when empty. When TestConnect_InvalidCredentials explicitly set it to 'localhost' and then called resetEnv(), the value was preserved because it wasn't empty. This leaked into TestConcurrentQueries, which then tried to connect to localhost:5432 instead of the workflow-configured postgres hostname. Fix: capture the POSTGRES_HOST value at init() time in a package-level variable (savedPOSTGRESHost) and always restore it in resetEnv(), so the correct value is always used regardless of which tests ran before.	2026-06-25 01:21:15 +01:00
popertots	b646497eb7	ci: add TEST_DB_HOST and debug echo to verify env propagation	2026-06-25 01:17:25 +01:00
popertots	0ac69a92c7	fix(db): use POSTGRES_HOST env var in dev Connect() ... The dev-tagged Connect() in db_dev.go hardcoded localhost:5432 in the DSN instead of reading the POSTGRES_HOST env var. Since CI tests run with -tags "test,dev", db_dev.go is compiled and the POSTGRES_HOST=postgres env var was silently ignored, causing db package tests to try connecting to 127.0.0.1:5432 where no PostgreSQL is listening (service container is only reachable via Docker DNS hostname postgres). Also remove the -a flag from the workflow now that caching is no longer suspected of causing issues.	2026-06-25 01:08:28 +01:00
popertots	30d4e75b16	ci: force full rebuild with -a flag	2026-06-25 01:03:23 +01:00
popertots	3cb6a7f6ad	ci: set POSTGRES_HOST directly in workflow	2026-06-25 00:56:45 +01:00
popertots	ca86e223c0	ci: add PGPASSWORD to create db step	2026-06-25 00:54:17 +01:00
popertots	3aefc7ae43	ci: create crussell_test_db for db package tests	2026-06-25 00:52:48 +01:00
popertots	f3a41585d2	ci: add TEST_DB_HOST env var for service container connectivity	2026-06-25 00:47:18 +01:00
popertots	ab06c7e596	ci: use service name postgres for db host	2026-06-25 00:43:22 +01:00