57 Commits

Include renames

Author	SHA1	Message	Date
autonomic-botandClaude Opus 4.7	c277029f84	M10/D10: enable real-!testme path — fetch upstream tags + enroll 6 recipes in POLL_REPOS ... fetch_recipe (SRC+REF/PR path) now read-only fetches published version tags from the public upstream into the mirror clone, so the upgrade stage finds a previous published version (mirror PR branches carry no tags → upgrade would skip). Guardrail-safe: only fetches tags, never pushes to the recipe repo; plain git so the bot token isn't sent to upstream. Adds the 6 D10 recipes to the bridge POLL_REPOS so !testme on their PRs triggers runs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 08:21:43 +01:00
autonomic-botandClaude Opus 4.7	fc07d15800	M7/D6: secrets rotation doc + log redaction filter ... docs/secrets.md documents the 3 secret classes (A1 external, A2 internal-generated, B recipe-app), the sops-nix decryption chain, and rotation procedures for each (cert version bump, sops re-encrypt + swarm-secret version bump, recipe-app ephemeral). run_recipe_ci streams each stage's output through a redaction filter that masks any /run/secrets/* value (>=8 chars) before it reaches Drone logs — belt-and-suspenders over 'harness never prints secrets + abra doesn't echo'. Live streaming + exit code preserved (locally tested). Recipe-ci clones cc-ci fresh per build, so this applies next run. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 07:44:53 +01:00
autonomic-botandClaude Opus 4.7	7aa0346902	harness: backup/restore pass -C -o; catalogue fetch re-clones clean ... Two fixes surfaced by the first real recipe-ci run through Drone: - abra app backup/restore now pass -C -o (current checkout, no remote fetch) like every other recipe-touching call — without -o they fetch recipe tags from the (private) remote and fail 'authentication required: Unauthorized'. - fetch_recipe's catalogue path rm's the recipe dir first so a leftover private-mirror remote from a prior SRC+REF run can't poison version resolution / backup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 03:05:03 +01:00
autonomic-botandClaude Opus 4.7	9b33fdf6e6	M6: D4 recipe-local discovery + recipe #2 (keycloak, DB-backed) enrolled; M6 CLAIMED ... D4 snapshots recipe-shipped tests/ and runs them against the live app. abra -C -o everywhere + token clone for private mirror PRs. keycloak install green with no harness surgery (D5). docs/enroll-recipe.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 01:48:06 +01:00
autonomic-botandClaude Opus 4.7	7fc26fae68	M6 (part 1): per-recipe meta + D4 recipe-local discovery + shared naming helper ... Recipe-agnostic harness (no surgery to enroll a recipe): recipe_meta.py for health path/codes/timeouts; run_recipe_local discovers + runs recipe-shipped tests/ against the live app. install non-regressed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 01:16:29 +01:00
autonomic-botandClaude Opus 4.7	7eb0dd3c77	M5: upgrade + backup/restore stages green (custom-html); backup-bot-two oneshot ... 3-stage run green (install/upgrade/backup), clean teardown. backupbot deployed via reconcile oneshot; PTY (script) for abra backup/restore; -m for secret generate (no value leak). M5 CLAIMED. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 00:53:16 +01:00
autonomic-botandClaude Opus 4.7	38a145fd9c	M4: harness + green install stage (custom-html + Playwright); guaranteed teardown; M4 CLAIMED ... run_recipe_ci.py + conftest + abra/lifecycle wrappers + Nix python/playwright env. deploy_app forces LETS_ENCRYPT_ENV='' (addresses A1). Short per-run domain scheme for the 64-char swarm name limit. 2 passed; teardown leaves zero orphans. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 00:23:55 +01:00