- Support docker.io/ prefix by stripping it and querying Docker Hub
- Add ghcr.io support via anonymous Bearer token flow (no secrets needed)
- Depth-aware version comparison: version: "15" compares only x tags,
version: "8.3" only x.x tags, version: "2.12.0" only x.x.x tags
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add tests/integration/test_docker_image_versions.py that checks all
roles/web-*/config/main.yml for outdated semver-compatible Docker image
versions against Docker Hub
- Non-Docker-Hub images (ghcr.io etc.) are listed as unchecked with their
current version
- Suppress individual checks with # nocheck: docker-version above version:
- GitHub Actions ::warning:: annotations are emitted in CI
- Add .github/workflows/test-docker-image-versions.yml as standalone workflow
- Integrate workflow into ci-orchestrator.yml
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migrates large parts of the legacy util-* role structure to inventory-driven
bundles and standardizes AUR installation via central system roles.
- Adds `web-svc-legal`, `web-svc-asset`, and `web-app-dashboard` to all server bundles.
- Removes `util-srv-corporate-identity` entirely.
- Introduces new workstation bundle inventories:
`admin`, `admin-network`, `browser`, `design`, `dev-*`, `game-*`, `office`.
- Uses bundle variables `SYS_PACKAGES` and `SYS_AUR_PACKAGES` as the primary
installation mechanism.
- Removes/replaces obsolete util-desk/util-dev roles where fully covered.
- Renames dev roles:
`util-desk-dev-core` -> `dev-core`,
`util-desk-dev-python` -> `dev-python`,
`util-desk-dev-arduino` -> `dev-arduino`.
- Adds missing `application_id` vars for renamed roles.
- Removes the entire `util` section from `roles/categories.yml`.
- Replaces direct `kewlfft.aur.aur` calls in desktop/driver roles with
a centralized wrapper role.
- Introduces new role `sys-aur-install` as AUR installation wrapper.
- Migrates `dev-yay` to `sys-aur` and adds `SYS_AUR_PACKAGES: []` default.
- Extends constructor stage:
auto-load `sys-package` when `SYS_PACKAGES` is set,
and `sys-aur` + `sys-aur-install` when `SYS_AUR_PACKAGES` is set.
- Cleans up stage loading:
removes util-srv from `02_server.yml`,
reduces workstation loading to `desk-roles.yml` + `drv-non-free`.
- Updates integration/unit tests for the new invokable and include behavior.
- Integration test now accepts static `include_tasks` references.
- Fixes recursion risk between `sys-aur` and `sys-aur-install` by setting
`run_once_sys_aur` at the beginning of `sys-aur/tasks/01_core.yml`.
BREAKING CHANGE:
- `util-*` categories and bundle paths are no longer part of stage loading.
- Multiple `util-desk-*`, `util-dev-*`, and `util-srv-*` roles were removed.
- Deployment groups must be migrated to the new bundle/role naming.
* replace compose.services.desktop with compose.services.dashboard across all roles
* rename role web-app-desktop to web-app-dashboard
* rename sys-front-inj-desktop to sys-front-inj-dashboard
* update resolver mapping to include web-app-dashboard when dashboard is enabled
* adjust CSP filters to reference dashboard for frame-ancestors handling
* update lookup plugins, filter plugins, templates, vars and run_once flags
* migrate all tests to dashboard naming and service key
* update role dependencies and port mappings
* remove legacy desktop role and variables
BREAKING CHANGE:
The service key compose.services.desktop has been renamed to compose.services.dashboard.
All custom configs, inventories, or overrides must be updated accordingly.
https://chatgpt.com/share/698da7ad-1978-800f-82b4-4755b17be026
- Import unittest.mock to fix F821 undefined name error
- Simplify test documentation and inline comments
- Remove redundant assertions while keeping semantic coverage
- Improve readability of inventory manager integration test
https://chatgpt.com/share/6988d352-a064-800f-8a2d-f836e2279305
- Rename all docker-compose.yml templates to compose.yml
- Update override and CA override filenames accordingly
- Adjust compose wrapper, lookup plugins, filters and path helpers
- Update roles, tasks, handlers and scripts to use compose CLI
- Rewrite documentation and admin guides to reference compose
- Update unit and integration tests to expect compose.yml
- Keep internal variable keys for backward compatibility where needed
https://chatgpt.com/share/69870272-b168-800f-84c3-6417398e441f
Renamed docker-compose and docker-compose-ca roles to sys-svc-compose and sys-svc-compose-ca, updated template includes, handlers, lookups, tests, and variables, and moved compose instances to /opt/compose.
https://chatgpt.com/share/6985ab2c-8344-800f-9e9a-768f562d138d
- Introduce database_consumer_id_passed to avoid fact/vars collisions
- Explicitly pass consumer context into svc-db-postgres via include_role
- Strengthen context assertion in postgres init tasks
- Move once-flag include to the beginning of postgres core tasks
- Make POSTGRES_EXEC_SHELL non-interactive by injecting PGPASSWORD
- Improve test coverage to detect facts overridden by include-time vars
https://chatgpt.com/share/69833e56-93a0-800f-8e3d-d970cf87daef
Add an integration test that statically scans all Ansible task files under
roles/*/tasks/** and tasks/** and fails if a variable set via set_fact is
also passed via vars: on include/import tasks or roles.
This guards against scope leaks and accidental host-fact overrides caused
by mixing context variables with set_fact.
https://chatgpt.com/share/6983220c-29f4-800f-bb9b-5145b1c1cf75
