Merge infinito-nexus/core main (e2a4ecc15d) into feature/store-i18n

Brings #1379 (Fider BASE_URL), #1380 and #1383 (NFS mount point and task name), #1384 (nested agent worktrees out of the build context), the globals bump and the image and pin updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

# Conflicts:
#	roles/web-app-mattermost/meta/services.yml

.dockerignore

@@ -21,6 +21,8 @@ build/*
 .ruff_cache
 .agents
 .claude/skills/
+.claude/worktrees/
+.worktrees/
 .claude-*
 collections/
 .env

.gitignore

@@ -21,6 +21,8 @@ build/*
 .ruff_cache
 .agents
 .claude/skills/
+.claude/worktrees/
+.worktrees/
 .claude-*
 collections/
 .env

Makefile

@@ -291,7 +291,7 @@ compose-system-purge: compose-entity-purge
 
 .PHONY: compose-up
 # Start the development stack.
-compose-up: install
+compose-up: install fix-dockerignore
 	@"$${PYTHON}" -m cli.administration.deploy.development up
 
 .PHONY: console

package-lock.json

@@ -13,7 +13,7 @@
         "@playwright/test": "^1.64.1",
         "eslint": "^10.14.0",
         "eslint-plugin-playwright": "^2.12.1",
-        "globals": "^17.13.0",
+        "globals": "^17.14.0",
         "stylelint": "^17.16.0"
       }
     },
@@ -1260,9 +1260,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.13.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
-      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
+      "version": "17.14.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.14.0.tgz",
+      "integrity": "sha512-UtdkTVyAJePQv0J2M9Xe4L0ruNSDV314XiIJsADI2Zf40bcdAonE/D/OhAU8AT99oij9mhLByb+NvA3QWZYgCg==",
       "dev": true,
       "license": "MIT",
       "engines": {

package.json

@@ -13,7 +13,7 @@
     "@playwright/test": "^1.64.1",
     "eslint": "^10.14.0",
     "eslint-plugin-playwright": "^2.12.1",
-    "globals": "^17.13.0",
+    "globals": "^17.14.0",
     "stylelint": "^17.16.0"
   },
   "overrides": {

roles/svc-storage-nfs-server/tasks/01_prepare.yml

@@ -18,6 +18,14 @@
     group: root
     mode: "0755"
 
+- name: "📁 Pre-create the {{ DIR_BACKUPS }} mount point in the shared state"
+  ansible.builtin.file:
+    path: "{{ [STORAGE_NFS_STATE_PATH, DIR_BACKUPS | relpath(DIR_VAR_LIB)] | path_join }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
 - name: "✅ Assert the state subdir is strictly nested under the export base"
   ansible.builtin.assert:
     that:

roles/web-app-keycloak/meta/services.yml

@@ -90,7 +90,7 @@ keycloak:
 # nocheck: playwright-service-flag — sidecar shape, no probe-able surface flag
 sso_proxy:
   image: quay.io/oauth2-proxy/oauth2-proxy
-  version: "v7.15.5"
+  version: "v7.15.6"
   min_storage: 220MB
   configuration_file: oauth2-proxy-keycloak.cfg
   ports:

roles/web-app-moodle/meta/addons/auth_oidc.yml

@@ -3,7 +3,7 @@ enabled: "{{ lookup('config', 'web-app-moodle', 'services.sso.enabled') | bool }
 required: false
 mechanism: plugin
 source: upstream
-version: "v5.2.1"
+version: "v5.3.0"
 bridges:
   - sso
 update:

roles/web-app-nextcloud/meta/services.yml

@@ -135,7 +135,7 @@ context_agent:
   shared: "{{ lookup('config', 'web-app-nextcloud', 'mcp.enabled') | bool }}"
   name: nextcloud-context-agent
   image: ghcr.io/nextcloud/context_agent
-  version: 2.10.0
+  version: 2.11.0
   backup:
     stop_required: false
   # nocheck: single-replica

roles/web-app-xwiki/meta/addons/oidc-authenticator.yml

@@ -5,7 +5,7 @@ mechanism: extension
 source: upstream
 bridges:
   - sso
-version: "2.29.1"
+version: "2.30.0"
 update:
   type: http_regex
   url: https://maven.xwiki.org/releases/org/xwiki/contrib/oidc/oidc-authenticator/maven-metadata.xml

tests/integration/ansible/filters/test_defined.py

@@ -92,6 +92,7 @@ BUILTIN_FILTERS: set[str] = {
     "items2dict",
     "password_hash",
     "path_join",
+    "relpath",
     "product",
     "quote",
     "split",

tests/lint/repository/test_dockerignore.py

@@ -0,0 +1,31 @@
+import re
+import unittest
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parents[3]
+NESTED_CHECKOUTS = (".claude/worktrees/", ".worktrees/")
+
+
+class TestDockerignore(unittest.TestCase):
+    def test_dockerignore_is_the_gitignore(self) -> None:
+        self.assertEqual(
+            (PROJECT_ROOT / ".gitignore").read_text(),
+            (PROJECT_ROOT / ".dockerignore").read_text(),
+            "Run 'make fix-dockerignore': .dockerignore must be a copy of .gitignore.",
+        )
+
+    def test_nested_checkouts_stay_out_of_the_build_context(self) -> None:
+        lines = (PROJECT_ROOT / ".dockerignore").read_text().splitlines()
+        for entry in NESTED_CHECKOUTS:
+            with self.subTest(entry=entry):
+                self.assertIn(entry, lines)
+
+    def test_compose_up_regenerates_the_dockerignore(self) -> None:
+        makefile = (PROJECT_ROOT / "Makefile").read_text()
+        match = re.search(r"^compose-up:(.*)$", makefile, re.MULTILINE)
+        self.assertIsNotNone(match, "Makefile has no compose-up target")
+        self.assertIn("fix-dockerignore", match.group(1).split())
+
+
+if __name__ == "__main__":
+    unittest.main()