Move repo root detection into scripts/ci/discover.sh so it can be executed
from any working directory. Simplify ci-discover-output to just call the
script and rely on its internal path resolution.
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
Restore discover.sh execution on the host to avoid running Docker Compose
from inside the container, and execute only the storage validation logic
inside the infinito CI container.
This fixes "--profile" errors caused by compose-in-compose and keeps the
Python dependency stack isolated inside the container.
- Run scripts/ci/discover.sh directly on host
- Execute sufficient_storage filter via docker compose exec
- Keep CI output and ONLY_APP override unchanged
https://chatgpt.com/share/696e3d20-276c-800f-87a7-a7052989ffe4
- Add best-effort helpers for Postgres and MariaDB database drops
- Avoid connecting to the target DB when dropping Postgres (use template1 for 'postgres')
- Ignore DB drop errors and continue with purge (compose down + rm -rf)
- Protect MariaDB system databases from being dropped
- Update script header to reflect best-effort behavior
- Support purging multiple stacks in one run
- Best-effort detect postgres/mariadb from .env and drop DB if found
- Always run compose down and delete /opt/docker/<stack>/volumes + stack dir
- Skip DB drop with warning when no backend is detected
https://chatgpt.com/share/696cfcd5-2b84-800f-a386-b7d1d38d68b7
- Add host-level AAAA DNS sanity test against CoreDNS
- Fail hard on SERVFAIL (breaks Node/getaddrinfo with EAI_AGAIN)
- Allow empty AAAA responses (IPv4-only setup is valid)
- Keep A-record validation unchanged
This prevents silent IPv6 resolver regressions that break CSP checks.
https://chatgpt.com/share/696abc27-19dc-800f-9ead-6598c2f3c302
sys-svc-docker role as a post-restart validation handler.
This change moves the inner-container DNS validation out of the CI test
suite and into the Docker service lifecycle itself, ensuring that DNS is
verified exactly where it matters: inside the Docker-in-Docker daemon.
Key changes:
- Add roles/sys-svc-docker/files/test-dns.sh:
- Runs inside the DinD container
- Waits for dockerd readiness
- Executes a BusyBox test container with explicit --dns
- Verifies DOMAIN and subdomain resolve to the expected IP
- Fails hard if DNS is broken
- Register DNS self-test as a docker restart handler:
- Runs once per deployment
- Only executed when DOCKER_IN_CONTAINER and MODE_DEBUG are enabled
- Uses ansible.builtin.script with role_path for correct resolution
- Remove inner Docker DNS test from scripts/tests/dns.sh:
- CI test suite now only validates host → CoreDNS → outer container chain
- DinD DNS validation is now part of the Docker service health lifecycle
This ensures that:
- DNS is validated after every Docker restart
- DinD networking failures are detected immediately
- CI and production share the same DNS validation logic
- Docker-in-Docker DNS becomes a first-class health invariant
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Quote dig server argument to avoid word splitting (SC2086)
- Replace &&/|| pseudo-if with proper if/else blocks (SC2015)
- Validate INFINITO_CONTAINER early via required env guard
- Keep DNS test logic unchanged, only harden correctness and linting
This makes scripts/tests/dns.sh fully shellcheck -x compliant and more robust.
https://chatgpt.com/share/696a4053-93f8-800f-959b-f99e2d7d12e2
- Introduce env.ci as single source of truth for CI networking
- Make docker-compose, CoreDNS and Docker daemon fully env-driven
- Render CoreDNS Corefile from template via envsubst
- Replace hardcoded IPs/domains with environment variables
- Integrate env-based networking into Ansible defaults
- Remove static Corefile and daemon.json
This makes DNS and networking deterministic and reproducible across
host, CoreDNS, infinito runner and Docker-in-Docker.
https://chatgpt.com/share/696a3dda-5c6c-800f-8a16-47c0c604e1e3
- Rename act-based targets for clarity:
- test-deploy -> test-act
- test-deploy-app -> test-act-app
- Rename rapid local deploy target:
- test-deploy-rapid -> test-local-rapid
- Add test-local-full target to run a full local deploy against a generated
inventory containing all apps of the selected TEST_DEPLOY_TYPE
- Add scripts/tests/deploy-local-full.sh:
- Discover apps on host via make ci-deploy-discover
- Bootstrap container via scripts/docker/entry.sh
- Generate dedicated inventory with --include list
- Deploy against that inventory
https://chatgpt.com/share/69692ef1-095c-800f-83cb-924fadfaa554
Promote-stable now validates version tags against the real quality gate
(code-analyses.yml) instead of the nightly scheduler wrapper.
This ensures the stable tag only points to versions that passed the full
CI matrix (lint, security, build, deploy, install, tests).
https://chatgpt.com/share/69691ebf-a380-800f-80fc-bd44d59e90dd
- Add daily stable promotion workflow with CI-gated highest-version selection
- Ensure GHCR images exist before moving stable tag
- Retag version images to :stable without rebuild
- Unify release workflows under infinito-release concurrency group
- Remove legacy highest-version/stable-move scripts and inline logic
https://chatgpt.com/share/696909c1-781c-800f-b52d-d9f967e9698c
- Build CI images with immutable ci-<sha> tags instead of latest
- Pass CI image tag into deploy workflows via INFINITO_IMAGE_TAG
- Derive CI_TAG from checked-out release tag commit
- Retag CI images to <version> and latest on release (no rebuild)
- Make release scripts independent from GITHUB_SHA coupling
- Improve robustness and reproducibility of release pipeline
https://chatgpt.com/share/696832f6-35e4-800f-a574-178013d4426e
- Replace legacy MODE env with TEST_DEPLOY_TYPE across workflows and scripts
- Route CI deploy and discovery through Makefile targets
- Rename deploy-one-app.sh to deploy-app.sh and update all call sites
- Fix Makefile recursion and ensure scripts are executed directly
- Ensure JSON discovery output is clean via silent make target
- Make MISSING_ONLY default true via Makefile
- Respect INFINITO_NO_BUILD in compose up to avoid implicit rebuilds in CI
- Keep explicit build step before compose up for deterministic CI runs
- Improve deploy logging (test_deploy_type instead of mode)
Result:
- Deterministic CI behaviour
- No accidental docker compose rebuilds on up
- Single source of truth for deploy orchestration
- Cleaner env contract between workflows, make, bash and python
https://chatgpt.com/share/69678024-fe38-800f-b877-add46aa55190
- Rename CI workflow and MODE from "rest" to "universal"
- Extend CLI and test runner to support universal deploy type
- Add tasks/stages/02_universal.yml for universal host type
- Update discover logic to use universal app selection
- Remove legacy rest->server mapping and obsolete select helper
https://chatgpt.com/share/6967625e-81c8-800f-8592-5d5b8edec1e2
- add --debug / --no-debug flag to deploy test CLI and runner
- make Ansible debug mode optional instead of always enabled
- extend deploy.sh with debug flag forwarding
- add make target test-deploy-rapid for fast single-app deploys
https://chatgpt.com/share/6966c80c-661c-800f-8fb9-769659da290d
Ensure systemd is started immediately as PID 1 in the infinito container
to avoid blocking on pkgmgr during boot. Increase compose runner timeout
to match healthcheck window and make healthcheck script executable in the
image.
This fixes containers getting stuck in "starting" state and makes CI
startup deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
Add a systemd-based Docker HEALTHCHECK that verifies:
- systemd readiness
- infinito CLI availability and executability
- infinito CLI smoke test (--help)
Update CI compose runner to wait for Docker health status instead of
manual systemd polling. The runner now:
- resolves the infinito container via docker compose
- waits for healthy state
- dumps journalctl and docker logs on timeout
This removes boot race conditions and makes container readiness deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
- Add reusable build-ci-images workflow to build and push ci-<sha> images for all distros
- Make all deploy test workflows use prebuilt CI images (no local rebuilds)
- Replace ci-version workflow with release workflow
- Retag ci images to <version> and latest on tag push (no rebuild)
- Move stable git tag only if all analyses/tests succeed and version is highest
- Make compose image/pull policy configurable via env
https://chatgpt.com/share/69662869-ee1c-800f-9e6c-bbbf47284fad
Replace inline tail logic in deploy workflows with a shared
scripts/ci/log-tail.sh helper that prints the last N lines of all
log files on failure.
This improves debuggability, avoids code duplication, and ensures
consistent log output across server, universal and workstation
pipelines.
https://chatgpt.com/share/69661d0e-81a8-800f-8b98-6c964672d027
- Rename _deploy-matrix.yml -> _deploy-per-app.yml and drop unused inputs
(tested_lifecycles, only_distro, final_exclude_re).
- Keep one runner per app (matrix.app) and run all distros inside that job.
- Makefile: run deploy tests through act workflow_dispatch (no serial script).
- Add scripts/ci/discover.sh and scripts/ci/deploy-one-app.sh as small SRP helpers.
- Update reusable workflow callers to use the renamed file.
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
- Add reusable _deploy-matrix workflow with discovery + per-app deploy across distros
- Enforce serial execution via strategy.max-parallel=1 and act --concurrent-jobs 1
- Support filters: mode (server|workstation|rest), only_app, only_distro, include/exclude regex
- Refactor test runner: remove discovery, require --app, deploy single app with deps only
- Generalize discover script to discover-apps.sh with INCLUDE_RE/EXCLUDE_RE + lifecycle gating
- Update Makefile targets to drive workflow_dispatch inputs for local act runs
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
Move lifecycle filtering into discover-server-apps.sh so only
lifecycle-eligible web-app-* and web-svc-* roles are discovered.
This prevents invalid per-app deploy tests where applications are
excluded later during inventory generation, causing "not present in
inventory" errors.
- Filter invokable roles by server prefixes
- Apply lifecycle_filter blacklist using TESTED_LIFECYCLES
- Always emit valid JSON for CI matrix generation
https://chatgpt.com/share/695fd936-0ee4-800f-a57f-2d7995e15ba0
* Add `cli.deploy.test` module to orchestrate compose-based CI deploy tests
* Support server per-app runs (including run_after dependencies) and workstation selection
* Add optional image build flags (--no-cache, --missing) and stack retention on failure
* Simplify `scripts/tests/deploy.sh` to a thin wrapper that forwards args to the Python runner
https://chatgpt.com/share/695f9e22-6e9c-800f-9a50-65f553619af2
- Replace clean-container with compose down for predictable teardown
- Add explicit up/down targets to Makefile
- Sync bind-mounted source into internal repo using rsync --chown=root:root
- Prevent git dubious ownership errors in CI containers running as root
https://chatgpt.com/share/695d7045-a1f8-800f-83d0-f5872d85cfcf
* Introduce lifecycle gating to CI deploy tests
* Only allow roles with tested lifecycles (alpha, beta, rc, stable)
* Automatically exclude roles with untested or missing lifecycle metadata
* Simplify static BASE_EXCLUDE by relying on lifecycle filtering
https://chatgpt.com/share/695d16d9-e210-800f-92d7-a1a429644be2
- Always build and publish Docker images for v* tags (version + latest),
independent of test results
- Run full code analyses in parallel and only mark Git + container :stable
when all checks succeed
- Replace rebuild-on-stable with pure imagetools retagging (no rebuild)
- Prevent race conditions by ordering stable tagging after image publish
- Ensure latest always tracks the most recent version image
https://chatgpt.com/share/695bdfa5-dbe0-800f-bb1c-4fe81eba6058
- switch deploy tests to docker compose exec (-T) instead of docker exec
- remove hard dependency on INFINITO_CONTAINER
- ensure clean CI state via compose down -v before deploy tests
- start coredns + infinito exclusively via compose
- enable host cgroup namespace for systemd containers (cgroup: host)
https://chatgpt.com/share/6953e367-b674-800f-bc55-97e8625314cf
kevinveenbirkenbach