Move inline shell from entry-pull-request-change.yml into
scripts/meta/debug/auth_mode.sh and pass secrets via env vars.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move utils/gha/annotations.py → utils/annotations/message.py
- Move scripts/gha/summarize_annotations.py → utils/annotations/summarize.py
- Keep utils/gha/annotations.py as compatibility shim
- Update all imports across codebase to utils.annotations.message
- Wire tee + summary step into test-code-lint, unit, and integration workflows
- Add unit tests for utils/annotations/summarize (20 tests)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add utils/gha/annotations.py with warning/error/notice helpers and *_each
variants that emit one annotation per list item
- Use warning() in GHCRProvider._set_public for missing GHCR_PAT case
- Expose GHCR_PAT_SET env var in mirror step to distinguish missing-PAT from
real API failures
- Add unit tests for all annotation functions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Root cause: GITHUB_TOKEN in Actions is repo-scoped and cannot change package
visibility in user/org namespaces — all 58 mirror operations failed with 404.
- Use GHCR_PAT (which has write:packages scope) as GITHUB_TOKEN in the mirror
step, falling back to GITHUB_TOKEN if GHCR_PAT is not set
- Remove ensure_public() call from the already-exists skip path (wrong place:
existing images were already made public when first mirrored)
- Update test to assert ensure_public is not called for skipped images
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove redundant `images-mirror-missing` job from entry-pull-request-change.yml
(mirroring already runs via ci-orchestrator for same-repo PRs)
- Set GHCR package visibility to public after each successful mirror via GitHub API
- Add `ensure_public` hook to base class (no-op for other providers)
- Also call `ensure_public` for already-existing images to fix any that are still private
- Pass GITHUB_TOKEN explicitly to the mirror step
- Add unit tests for _set_public (user/org endpoint fallback) and sync skip-path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add ready_for_review trigger so CI starts when a draft PR is marked ready
- Guard detect-pr-scope with draft == false to skip all jobs for draft PRs
- Add converted_to_draft to cancel-pull-request-runs.yml to cancel active
runs when a PR is converted back to draft
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Required so cancel-on-failure jobs in reusable workflows can call
the GitHub API to cancel the run. Permissions propagate down the
workflow_call chain and must be write at every level.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add cancel-on-failure job to test-environment, test-install-make, and
test-install-pkgmgr. After all matrix jobs complete, the job cancels
the entire orchestrator run via the GitHub API if any matrix job failed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Enables fast failure on test-environment, test-install-make, and
test-install-pkgmgr matrix strategies so the overall CI run fails
immediately when a job fails rather than waiting for all jobs to
complete. Trade-off: no cross-distro comparison on failure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Aligns the script name with the workflow and its purpose.
Updates all references in test-environment.yml and setup.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Aligns the workflow filename with its job name and purpose.
Updates all references in ci-orchestrator.yml and act/workflow.sh.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
test-dev-environment-dashboard was triggering test-development.yml a
second time, causing duplicate Environment jobs in the CI run.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Makes clear that multiple space- or comma-separated app ids are
supported. Renames the env var, CLI flag (--app → --apps), and all
references in scripts, workflows, and documentation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add tests/integration/test_docker_image_versions.py that checks all
roles/web-*/config/main.yml for outdated semver-compatible Docker image
versions against Docker Hub
- Non-Docker-Hub images (ghcr.io etc.) are listed as unchecked with their
current version
- Suppress individual checks with # nocheck: docker-version above version:
- GitHub Actions ::warning:: annotations are emitted in CI
- Add .github/workflows/test-docker-image-versions.yml as standalone workflow
- Integrate workflow into ci-orchestrator.yml
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add upload-artifact step to test-deploy-server.yml
- Copy reports from infinito container to runner in dedicated_distro.sh cleanup before volume prune
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Introduces standardized, form-based issue templates for bug reports and feature requests. This improves the quality and consistency of incoming issues.
