Same KeyError class as 28e7c20cf (INFINITO_SERVICES_DISABLED):
roles/sys-svc-container/files/container.py:450 reads
os.environ["INFINITO_CONTAINER_NO_CA"] strictly. The variable is
emitted into the host shell .env via passthrough.STATIC_KEYS, but the
compose `environment:` block did not forward it, so docker compose
substitution was never wired into the container.
Triggers as soon as the DinD-DNS handler (sys-svc-container/handlers)
invokes `container run` from inside test-dns.sh, well past the first
visible failure point. With this entry the inner container.py reads
"" (the env/default.env default) and treats CA injection as enabled
— the intended behaviour.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three inline `run:` blocks moved into `scripts/github/runner/`:
* `images_build_outputs.sh "$distros" "$image_tag"` — replaces the
matrix/image_tag computation in the "Compute matrix JSON" step; emits
both outputs to $GITHUB_OUTPUT in one call.
* `distros_matrix.sh "$distros"` — the matrix-JSON primitive
(`split(" ") | map(select(length>0))`), reused by test-dns.yml's
matrix step. Removes the jq duplicate that lived in both workflows.
* The two pre/post-build `Disk pressure` steps now invoke the already-
existing `disk_pressure_report.sh PRE-BUILD` / `POST-BUILD` instead of
duplicating the df/docker-system-df/buildx-du block inline.
Behaviour unchanged; the workflow runs the same commands via the SPOT
helpers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Commit 5e0036dfa added a strict-read `${INFINITO_SRC_DIR:?...}` to the
docker buildx build-arg in push.sh. The CI workflow images-build-ci
invokes push.sh directly without sourcing scripts/meta/env/load.sh, so
the variable was never populated and the run aborted on attempt 1/7
(run 26200267778, job 77088881319). Sourcing load.sh inline keeps push.sh
self-sufficient regardless of caller and matches the existing pattern in
the lint/install/test wrappers under scripts/.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI deploys (and the local DinD bridge) pull upstream images
(alpine, getfider/fider, matomo, ...) from Docker Hub. The sandbox
network filter previously allowed *.docker.com but not the .docker.io
TLD where Docker Hub's registry/auth endpoints live, so TLS handshakes
from the registry-cache MITM proxy to registry-1.docker.io / auth.docker.io
timed out.
Wildcard matches the existing *.docker.com pattern and covers any
future Docker Hub subdomain (image blob redirects, etc.).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI test-install-make fails (run 26199771241) because the workflow's
`NIX_CONFIG: |` YAML literal block emits a trailing newline. The
writer.py raise-on-newline guard from df66f9541 then rejects the
single-line value `access-tokens = github.com=***\n` even though only
embedded newlines cause the bootstrap-loop the guard was meant to
prevent. Trailing whitespace is benign, so strip it at the producer
(this is normalisation, not silent corruption).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Script-local variable used only inside test-dns.sh -- not part of the
env-var contract with the handler, so the INFINITO_ namespace prefix
was over-zealous. The handler-fed env vars (INFINITO_DNS_IP /
INFINITO_DOMAIN / INFINITO_IP4) remain unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deploy v6 fails at the `Ensure Docker-In-Docker DNS works` handler
because test-dns.sh still asserts legacy short names DNS_IP / DOMAIN
/ IP4 -- the INFINITO_* namespace refactor (a77a57040) only covered
the .env / compose.yml / Python-CLI layers, not this Ansible role
script. The handler passes only BUSYBOX_IMAGE + NODE_IMAGE, so the
strict asserts in test-dns.sh fail with `Missing env DNS_IP` after
7 retries.
Two coordinated changes:
1. test-dns.sh asserts and consumes INFINITO_DNS_IP / INFINITO_DOMAIN /
INFINITO_IP4 throughout (all 9 references migrated).
2. handlers/main.yml's `Ensure Docker-In-Docker DNS works` adds the
three INFINITO_* env entries sourced from the playbook variables
(networks.internet.dns/ip4 + DOMAIN_PRIMARY).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two independent bugs were compounding into a corrupted NIX_CONFIG that
broke every local image rebuild:
1. scripts/tests/code/run.sh non-idempotently appended
"accept-flake-config = true" to whatever NIX_CONFIG it inherited.
On the next source of .env (which carried the previous value back),
the line accumulated -- "true\naccept-flake-config = true\n..." --
until Nix rejected the Boolean. Fix: pipe through `awk '\!seen[$0]++'`
to dedup lines while preserving order.
2. utils/env/writer.py silently re-encoded literal newlines as `\n`
escape sequences inside double-quoted values. docker-compose's
--env-file loader does not decode them and neither does bash
`source`, so any multi-line value round-tripped into garbage on the
next read. Fix: raise ValueError instead -- producers must collapse
to a single line before handing off to the env-builder.
Test fixtures for the writer adjusted to assert the new raise
semantics.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Commit a77a57040 dropped the inline default from the Dockerfile's
INFINITO_SRC_DIR ARG so env/default.env stays the only SPOT. The
compose-driven build path already forwards the value via
compose.yml's build.args, but the standalone scripts/image/{build,push}.sh
paths (local `make build`, CI `🏗️ Build (<distro>)`) had not been
updated. Without --build-arg INFINITO_SRC_DIR=..., the ARG resolves
to empty inside the image, so `RUN /bin/bash ${INFINITO_SRC_DIR}/roles/...`
becomes `/bin/bash /roles/...` and exits 127.
Both scripts now assert INFINITO_SRC_DIR (sourced from
scripts/meta/env/load.sh) and pass it through.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
docker build invokes buildx which writes activity timestamps and
instance state under ~/.docker/buildx/{activity,current,defaults,instances,refs}/.
The sandbox previously blocked this with read-only filesystem errors
during local builds (`make build`, `make up`, `make deploy-fresh-purged-apps`).
Restricting the grant to the buildx subdirectory (not all of ~/.docker)
keeps credentials in ~/.docker/config.json and the auth token in
~/.docker/.token_seed protected.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI run 26195893710 surfaced a KeyError when `infinito administration
inventory provision` runs inside the container via
`docker compose exec`. services_disabler.py reads
`os.environ["INFINITO_SERVICES_DISABLED"]` strictly, but the container
env did not carry the variable: it was set on the host shell (from
env/default.env via the env-builder) and forwarded via `-e` only when
the orchestrator detected a non-empty value
(deploy/development/inventory/builder.py:71). With the default empty
value, no `-e` flag was added and the strict read crashed in-container.
Expose the variable through the compose `environment:` block — same
pattern as INFINITO_DNS_IP / INFINITO_DOMAIN / INFINITO_IP4 / IP6 /
PLAYWRIGHT_KEEP / SRC_DIR — so the in-container read is guaranteed
regardless of the orchestrator's `-e` decision.
Validated with `make test` (lint + test-lint + test-external + test-unit
+ test-integration all green).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Closes a stack of env-pipeline regressions left over from the recent
INFINITO_* namespace refactor by:
* DOMAIN_PRIMARY now reads INFINITO_DOMAIN strictly (was: legacy DOMAIN
env var → defaulted to infinito.localhost, which never resolved
because CoreDNS serves the INFINITO_DOMAIN value, infinito.example).
* group_vars/all/08_networks.yml IPs (ip4/ip6/dns) now read
INFINITO_IP4 / INFINITO_IP6 / INFINITO_DNS_IP.
* PLAYWRIGHT_KEEP_ALL renamed to INFINITO_PLAYWRIGHT_KEEP end-to-end
(env-builder, role default, run_one.yml docker exec, playwright.config.js,
lint allowlist, docs anchor, CI workflow vars).
* PKGMGR_IMAGE renamed to INFINITO_PARENT_IMAGE; Dockerfile ARG drops
the inline default so env/default.env is the only SPOT.
* INFINITO_SRC_DIR centralized: Dockerfile ARG (no default) + ENV;
compose forwards it as build-arg, volume mount path, and container env;
every Python CLI + shell helper + CI workflow now reads it strictly
(os.environ[...] / "${INFINITO_SRC_DIR:?...}") instead of the literal
/opt/src/infinito.
* New entries in env/default.env: INFINITO_IP6=::1, INFINITO_PARENT_IMAGE,
INFINITO_PLAYWRIGHT_KEEP=false. All three propagated through
utils/env/handlers/passthrough.STATIC_KEYS and (where consumed in the
container) through compose.yml's environment block.
Validated end-to-end with `make test` (2360 tests across lint, lint-*,
test-lint, test-external, test-unit, test-integration).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
build/install-lint-<hash>.stamp lives on the host-bind-mounted build/
tree, but the lint tools live inside the docker container. When the
infinito image is rebuilt, the tools are gone but the stamp persists --
so the next install-lint short-circuits and downstream lint targets fail
with exit 127 (command not found).
_stamp_is_fresh() now additionally checks shutil.which() for every tool
the all-mode install produces. A missing tool invalidates the stamp,
forcing the per-tool ensure() chain to run (each ensure is idempotent so
this stays cheap when state is clean).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Promote the key from GHA-only (gha_passthrough) to always-emitted (passthrough)
so the deploy CLI can read it strictly via os.environ[...]. The previous
INFINITO_NO_BUILD layout left the key unset locally, which crashed
cli/.../up.py and cli/.../compose.py with KeyError after the env-pipeline
refactor that introduced gha_passthrough.
New semantics:
INFINITO_BUILD=1 build the local image (default; local mode)
INFINITO_BUILD=0 skip build, pull image (CI overrides via -e)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds scripts/make/help.sh which parses the Makefile, joins comment
lines preceding each target as its description, and tails the listing
with a pointer to `infinito --help` (or `python -m cli --help` when
the console script is absent) plus a link to https://docs.infinito.nexus.
The CLI's global help now references `make help` and the docs site.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
dpkg-buildpackage's debhelper sequence auto-detected the project's
Makefile and invoked 'make -j4 clean' from inside the package-build
sandbox at /tmp/infinito-nexus-debian-build. That recipe's BASH_ENV
sources scripts/meta/env/load.sh -> detect.sh, which (per the SPOT
contract) hard-fails when python3 is not yet on PATH — the package
hasn't been installed yet, so its python3 dependency isn't either.
Mirror the existing override_dh_auto_{build,test,install}: : pattern
to silence the auto-clean recurse. The .deb produced is unchanged
(no build artefacts to clean in the first place).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Four system scripts (wsl2-systemd-enable, wsl-dns-setup, tls-trust
linux/wsl2) sourced scripts/meta/env/{runtime,defaults}.sh — both
collapsed into load.sh by the SPOT refactor (80c396b8). Route them
through load.sh so INFINITO_IS_WSL2/INFINITO_CONTAINER resolve via
the generated .env.
Also rename the CoreDNS template placeholders to the INFINITO_*
namespace: \${IP4}/\${DOMAIN_RE} -> \${INFINITO_IP4}/\${INFINITO_DOMAIN_RE}.
env/ci.env carries the prefixed names since the env-prefix lint
(22cf6f38f), so envsubst was rendering empty answers — NXDOMAIN on
every CoreDNS query, breaking test-dns.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
INFINITO_LINT_RUNNER is fixed to host on this workflow, so no docker
interaction happens during the lint — the step was pure log noise.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wrapping the sys-svc-webserver-https include in a block with
`when: run_once_web_opt_rdr_domains is not defined` propagated that
condition to every handler imported through the chain (notably
`svc-prx-openresty : Restart and validate OpenResty`). Handlers
evaluate inherited block-when at flush time, not at registration
time: the very same `utils/once/flag.yml` step inside the block sets
the flag before the late notification arrives, so the queued handler
sees the condition as false and skips its restart.
Result on matrix-deploy round 2: the css.infinito.example redirect
conf was written fresh after the inter-round wipe, but openresty was
never reloaded, kept serving an empty vhost set, and the readiness
probe got `TLSV1_UNRECOGNIZED_NAME`.
sys-svc-webserver-https has its own internal run-once guard, so the
outer skip was redundant. Drop the block; keep the once-flag include
separately gated. The handler is now imported with no inherited when
and fires on every notification.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Virgin pkgmgr containers ship without /opt/venvs, so the prior
'-d /opt/venvs && -w /opt/venvs' check fell through to ${HOME}/.venvs,
breaking the test-install-{make,pkgmgr} workflows that hardcode
'source /opt/venvs/infinito/bin/activate'. Probe the parent instead —
venv.sh mkdir -p's the leaf later.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
00_orchestrator.sh sources common.sh in a vanilla container before
01_install.sh has run; the eager load_repo_env then sources load.sh ->
detect.sh which hard-fails per the new SPOT contract. Skip the load
silently when python3 is absent — the post-install loop iteration
re-runs load_repo_env and picks up the freshly installed interpreter.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`meta/services.yml`'s `services.openproject.ref` referenced
`OPENPROJECT_VERSION`, a role-var from `vars/main.yml`. When
`sys-svc-compose` resolves the ref via `lookup('config', …,
'services.openproject.ref')`, the templar runs outside the
web-app-openproject role's scope and the var renders as
`<< error 1 - 'OPENPROJECT_VERSION' is undefined >>`, breaking
`git checkout stable/<undefined>`.
Inline the same lookup against the SSOT (`services.web.version`)
so the rendered ref is scope-independent and resolves to
`stable/17` regardless of the calling role.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pulls VENV/PYTHON/PIP/PYTHONPATH out of the dotenv handler pipeline
into scripts/meta/python/detect.sh. load.sh now sources detect.sh and
prepends ${VENV}/bin to PATH above the INFINITO_ENV_LOADED guard, so
every BASH_ENV re-entry re-resolves PYTHON the moment a venv
materialises mid-chain — the same fix as b79ed2869 but at the SPOT,
which retires the reload-trick from ansible.sh, python.sh and
pre-commit.sh.
Also renames INVENTORY_VARS_FILE → INFINITO_INVENTORY_VARS_FILE under
the new env-prefix lint, drops the 5 dead INFINITO_ENV_*_LOADED unsets
left over from the multi-loader era, and adds a lint guarding the
INFINITO_ prefix invariant on env/*.env keys.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tighten the names shown in the GitHub Actions UI summary so the
job rail reads as a function tag rather than a sentence:
test-code-{lint,unit,integration,external}: "🧪 Run X tests" -> "🧪 Test X"
security-codeql: "🔐 Check security" -> "🔐 Security"
images-build-ci: "🏗️ Build image (<distro>)" -> "🏗️ build (<distro>)"
test-install-make: "🛠️ Test make install" -> "🛠️ Makefile"
test-install-pkgmgr:"📦 Test pkgmgr install" -> "📦 PKGMGR"
test-environment: "🧑💻 Test Environment (<img>)" -> "🧑💻 Environment (<img>)"
fork-prereqs-ready: "🚦 Gate fork prerequisites" -> "🚦 Gate Dependencies"
code-quality-gate: (unnamed, fell back to id) -> "🚦 Gate Quality"
Step labels and workflow-level `name:` fields are untouched -- only
the per-job display names change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The four test-deploy workflows (server/universal/workstation/local)
each started the full compose stack just so scripts/meta/resolve/
apps.sh could call its meta-CLI inside the container. The stack
spin-up dwarfed the actual discovery query.
Introduce INFINITO_APP_DISCOVERY_RUNNER (host|docker, default
`docker` for local dev) alongside the existing INFINITO_TEST_RUNNER
/ INFINITO_LINT_RUNNER dispatch knobs. In host mode apps.sh runs
the meta-CLI through the venv python directly; docker mode keeps
the existing `docker compose --profile ci exec` path.
Workflows switch to host mode and replace `make up` with
actions/setup-python@v5 + `make install`. make install was already
a prereq of make up, so the install cost is unchanged -- only the
docker pull + container start time disappears.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
build-ci-images previously depended on (fork-prereqs-ready,
test-code-gate). That let an image build start while lint or
security-codeql were still in flight. Reorder so the build gate is
code-quality-gate, which already aggregates lint-gate + test-code-gate
+ security-codeql -- a single barrier instead of two halves.
The reordering also removes the redundant `code-quality-gate` edge
on test-dns: with build-ci-images now downstream of code-quality-gate,
test-dns inherits the dependency transitively through build-ci-images.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
scripts/docker/entry.sh's two compile-control reads (INFINITO_COMPILE
and INFINITO_COMPILE_SILENCE) crashed during Dockerfile RUN because
that context has no env-pipeline: env/default.env exists in the repo
but no make/BASH_ENV/load.sh chain materialises it into the running
shell. The bare reads under `set -u` triggered unbound-variable exit
even though the keys were registered in default.env + passthrough.
Move build/silence control from env to script flags so entry.sh is
self-contained at bootstrap time. Each flag now triggers its action
directly inside the parse loop -- no COMPILE/SILENCE state vars:
--compile -> run_local_build (streaming)
--compile-silent -> run_local_build >/dev/null 2>&1
-- -> end flag parsing, rest is the exec target
Drop INFINITO_COMPILE + INFINITO_COMPILE_SILENCE from the whole
registry surface: env/default.env, passthrough.STATIC_KEYS, the
infinito_compile handler (gone entirely), compose.yml's env
injection block, the dotenv-generator baseline test, the
build_env unit-test fixture, and the now-no-op `-e INFINITO_COMPILE=0`
in test-install-{make,pkgmgr} workflows.
Dockerfile RUN switches to `entry.sh --compile -- true`; runtime
ENTRYPOINT receives no flags so the default (no-compile) holds and
exec hands off to systemd via the CMD.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
scripts/install/venv.sh
-----------------------
INFINITO_VENV_BASE is a static-default convention; the active VENV
may end up outside that base (e.g. \$HOME/.venvs/<name> when
/opt/venvs is not writable, or a wholly custom override). Probing
writability on the legacy base triggered a spurious sudo branch
whenever VENV lived elsewhere -- fatal in no_new_privs sandboxes
where sudo cannot escalate. Switch the writability + mkdir + chown
chain to \$(dirname "\${VENV}") so the script prepares the directory
it is actually about to create the venv in.
tests/lint/ansible/roles/web-app/playwright/test_app_base_url_uses_role.py
-------------------------------------------------------------------------
New lint: every role's templates/playwright.env.j2 must declare
APP_BASE_URL as a reference to the role's own surface. APP_BASE_URL
feeds the shared guest-persona helper and Playwright's global
baseURL; a role that hardcodes a sibling role name (most commonly
'web-app-dashboard') sends the guest test to the wrong site and
breaks any matrix variant where the sibling is not deployed
(ERR_SSL_UNRECOGNIZED_NAME_ALERT).
The 16 web-app role templates that violated the contract switch
from sibling lookups (`lookup('tls', 'web-app-dashboard', ...)`)
to the canonical `lookup('tls', application_id, ...)` form.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
These three workflows install only their own toolchain (ansible-core +
ansible-lint, ESLint via npm, mbake) and then call `make lint-<type>`.
The make target has `install-lint` as a prereq which dispatches on
INFINITO_LINT_RUNNER (default `docker` from env/default.env), tries
`make up`, imports `cli.administration.deploy.development`, and crashes
because ruamel.yaml / the full Python toolchain isn't installed on the
runner.
Set `INFINITO_LINT_RUNNER: host` as job env so install-lint stays on
the host (delegates to `python3 -m utils.install.lint`) and the lint
wrappers exec the per-type scripts directly. lint-ansible passed by
accident last run but had the same bug -- fixed preventively.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
scripts/install/ansible.sh inherited PYTHON=python3 from all.sh because
the first env-generation runs before the venv exists and the PYTHON
handler falls back to "python3" (literal). On a CI runner that resolves
to actions/setup-python's interpreter, which has no `ansible` distribution
even though pip just installed one into the venv -- `ansible-galaxy
collection install` then fails with ModuleNotFoundError.
Mirror the reload-after-venv pattern that scripts/install/python.sh
already uses: when ${VENV}/bin/python now exists and the inherited
PYTHON still points at the system fallback, drop INFINITO_ENV_LOADED
and re-source load.sh so it prepends ${VENV}/bin to PATH for the
remainder of this subshell.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three new lint tests close gaps in the INFINITO_* SPOT contract:
* tests/lint/filesystem/env/test_default_env_keys_handled.py
Every default.env key must be wired through a handler.
* tests/lint/filesystem/env/test_used_keys_declared.py
Every INFINITO_* in .sh/.py must live in env/{default,ci}.env or
a handler; per-line `# nocheck:` suppresses runtime-only refs.
* tests/lint/filesystem/python/test_no_infinito_get_defaults.py
Forbid ANY default in `.get("INFINITO_*", ...)` -- including the
empty-string fallback (which silently masks an unset key). The
nocheck check walks every physical line the call spans so an
autoformat-split call still honours the marker.
Cache namespace flattens to a single prefix:
INFINITO_PACKAGE_CACHE_* -> INFINITO_CACHE_PACKAGE_*
INFINITO_REGISTRY_CACHE_* -> INFINITO_CACHE_REGISTRY_*
The five previously driver-injected paths (APT_LIST, NPMRC,
PIP_CONF, REGISTRY_PROXY_CONF, FRONTEND_CA_FILE) move into
env/default.env and passthrough.STATIC_KEYS; the
`cache_env_overrides()` helper and its two call sites are gone
along with the test-fixture override for FRONTEND_CA_DIR.
SPOT-strict rewrites:
- 19 sites: `something.get("INFINITO_X", "")` -> subscript
`something["INFINITO_X"]` (loud KeyError when env loader did
not run; all keys live in env/default.env).
- 2 handler-internal bootstrap reads suppressed with
`# nocheck: handler-bootstrap-read`.
- 30 runtime-only / driver-injected / test-fixture references
annotated with `# nocheck: <reason>` per-line.
- Unit tests that previously removed SPOT-guaranteed keys via
`{k: v ... if k \!= KEY}` or `clear=True` switch to setting
the key to "" explicitly, matching the new contract.
Side fixes:
- INFINITO_DNS_DOMAIN + INFINITO_DNS_HOSTS_FILE move from
shell-side defaults in common.sh to env/default.env and
passthrough.STATIC_KEYS.
- dns_systemd_is_operational() drops the dead
INFINITO_DNS_FORCE_HOSTS_FALLBACK override branch (the
variable was never set anywhere).
- INFINITO_WORKER_FETCH switches from `os.environ.get(KEY, "1")`
to `os.environ[KEY]`.
- scripts/tests/code/wrapper.sh exec args move into a bash
array so `# nocheck:` on INFINITO_TEST_TYPE can live on its
own element line (SC2215 fix).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rename env/static.env → env/default.env across the entire repo
(string label, doc links, Python file-path constants) — the
`parse_static_env*` function names stay as a stable API surface.
Sort all `*.env` / `*.env.j2` entries alphabetically (52 in
default.env, 4 in ci.env, 46 of 49 j2 templates; 3 templates
with Jinja2 `{% %}` control flow are skipped because conditional
blocks would tear apart under a naive sort). Sort all 83
Makefile target blocks alphabetically; .PHONY group headers
stay in place.
Collapse the two remaining multi-line Makefile recipe comments
(dotenv-force, test-signed) to single-line WHY comments.
Add four lint tests under tests/lint/filesystem/ to keep the
invariants enforced going forward:
- env/test_alphabetical_sort.py
- env/test_single_line_comments.py (# nocheck: markers exempt)
- makefile/test_alphabetical_targets.py
- makefile/test_single_line_comments.py (# nocheck: markers exempt)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The four test-code workflows (lint/unit/integration/external) now
run unittest discover directly on the GitHub-hosted runner via
INFINITO_TEST_RUNNER=host, bypassing the docker compose container.
A fresh Python 3.11 from actions/setup-python feeds make install,
which builds the venv on the runner — no `make up`, no docker
image pull, no `INFINITO_IMAGE_TAG` / `NIX_CONFIG` plumbing.
The orchestrator reverses the dependency direction: build-ci-images
now needs test-code-gate so a broken commit never produces images.
Tests start in parallel with fork-prereqs-ready instead of waiting
for the build chain.
Galaxy lint workflow stays dropped alongside the earlier
galaxy-importer removal.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`make test` already runs at pre-commit. Re-running the full
suite at pre-push doubled the wait without adding signal —
the pre-push gate is now exclusively for `make test-signed`,
which is the cheap signature check the heavy hook was hiding.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`make test-signed` checks `git log -1 --pretty=%G?`; `N` (no
signature attached) aborts and the pre-push hook gates pushes
of unsigned tips. Sign locally via `git-sign-push` (already a
dev dep) or `git commit -S`.
Move the `.git` entry from a Makefile `echo … >> .dockerignore`
appendage into `.gitignore` itself (no-op for Git, required for
Docker). `make dockerignore` collapses to a single `cat .gitignore
> .dockerignore` which converges on the same content under any
parallel interleaving — previously 5 concurrent `make setup`
invocations from `make test` could append 3-5 stacked `.git`
lines and make pre-commit revert on "files modified by hook".
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The URL-reachability probe now bounds its wall-clock end-to-end:
allow_redirects=False (a redirect chain previously stacked
timeouts), a 5h30m global deadline that marks in-flight probes
as warnings on expiry, and live `[done/total]` progress every 50
probes. Submission order is shuffled so same-host URLs no longer
batch at the front and self-DoS one origin.
The Docker image-version test drops its bespoke sequential
fetch loop and calls find_outdated_updates() from utils.update.docker,
so it now shares the INFINITO_WORKER_FETCH-sized worker pool with
the repository-refs check.
`scripts/tests/code/wrapper.sh` propagates BASH_ENV into the
container exec — without it INFINITO_WORKER_FETCH was unset
inside the container and the URL probe collapsed to 1 worker.
`make test` gains test-external; `make dotenv-force` regenerates
.env with a stripped environment so stale BASH_ENV-preloaded
INFINITO_* values cannot pin old numbers via setdefault.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace the single `make -j ... --output-sync=target` invocation with
a shell-level fan-out that times each target individually and reports
a status table at the end. Output for each target is buffered to a
log file and dumped under a ✅/❌ header as soon as that target
finishes (preserving the per-target grouping `--output-sync` gave us).
Non-zero exit codes propagate; the run aborts at the first failure
once all already-launched children drain.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`make test` and `make lint` now delegate to a generic parallel-make
wrapper that caps `-j` at INFINITO_WORKER_CPU, syncs per-target
output, and prints wall-clock elapsed time. `make test` gains the
full `lint` sweep and drops the phantom `test-deploy` target (PHONY
without recipe); pre-commit hooks consolidate around a single
`make test` invocation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rename INFINITO_PARALLEL -> INFINITO_WORKER_ENABLED and add two derived
keys so consumers no longer multiply by their own factor: the env
generator resolves the cascade once at `make dotenv` time and bakes
the integer counts into `.env`.
Chain:
- INFINITO_WORKER_ENABLED (operator toggle, default true)
- INFINITO_WORKER_CPU = cpu_count() when ENABLED truthy, else 1
- INFINITO_WORKER_FETCH = CPU * 20 for I/O-bound bulk fetches,
collapsing to 1 when CPU == 1
Handlers:
- utils/env/handlers/infinito_worker.py (the prior single key)
removed
- utils/env/handlers/infinito_worker_cpu.py + infinito_worker_fetch.py
added; registry orders them after `passthrough` so the cascade
reads its dependency from the env-builder state.
Consumers (now 1-liners):
- tests/external/repository/test_urls_reachable.py reads
INFINITO_WORKER_FETCH directly.
- utils/update/base.py::resolve_max_fetch_workers() reads it directly;
utils/update/{docker,repository}.py keep using that helper plus a
ThreadPoolExecutor for the actual bulk fetch (with `dict(pool.map(...))`
satisfying PERF403).
- scripts/lint/autoformat.sh + docs/contributing/tools/make.md
rename INFINITO_PARALLEL -> INFINITO_WORKER_ENABLED.
Tests:
- EXPECTED_BASELINE_KEYS in test_dotenv_generator updated to track the
three new keys.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
env/static.env:
Drop the stale "and 'make lint-galaxy'" reference from
INFINITO_PARALLEL's comment (lint-galaxy was removed earlier).
tests/external/repository/test_urls_reachable.py:
Make _MAX_WORKERS network-aware. URL reachability is I/O-bound, so
cpu_count() is the wrong proxy; scale by 20x to saturate the wait
budget. Respects INFINITO_PARALLEL=false for sequential fallback.
tests/unit/utils/install/test_github_release.py:
Replace the github.com/x/y/ dummy URLs with example.com/x/y/ so the
URL-reachability test (which scans source for HTTP literals) skips
them via its example.* allowlist. The github.com URLs were probed
for real and returned 404.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
galaxy-importer's legacy-role mode was dropped upstream in 0.5.0
(CLI no longer accepts --legacy-role / --namespace), and the project
does not publish roles to Ansible Galaxy. The check enforces a
publishing schema that never gets exercised, against an abandoned API
that can only be kept alive via pinning galaxy-importer==0.4.39 +
setuptools<81 in an isolated venv. The cost has stopped buying
anything.
Removed:
- scripts/lint/galaxy.sh
- utils/install/lint/galaxy_importer.py
- install_isolated_pip_pkg() in utils/install/pip.py (only galaxy_importer
used it)
- Makefile lint-galaxy target + the entry in the `lint:` aggregate
- pre-commit make-lint-galaxy hook
- The galaxy_importer ensure() call in _install_ansible_tools
- Test assertion against cli.galaxy_importer in test_main.py
- Documentation rows mentioning lint-galaxy / galaxy-importer
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Refactor scripts/install/lint.sh (~870 LOC bash) into a Python package
under utils/install/. scripts/install/lint.sh becomes a 7-line wrapper
that delegates to `python3 -m utils.install.lint`.
Layout:
- utils/install/{primitives,pip,npm,github_release,system_pkg}.py:
channel-agnostic installers
- utils/install/lint/<tool>.py: one ensure() per tool (actionlint,
shfmt, mbake, ruff, ansible_lint, galaxy_importer, markdownlint_cli2,
eslint, shellcheck, ansible_commands, ansible_collections)
- utils/install/lint/__main__.py: CLI + group dispatch + stamp logic
INFINITO_LINT_RUNNER dispatch:
- New env var (host | docker, default docker), tracked in env/static.env
+ passthrough handler + drift test.
- scripts/install/wrapper.sh routes `make install-lint` to host or
container based on the runner.
- scripts/lint/wrapper.sh already dispatched; container branch now uses
bash (not --login) so /etc/profile does not reset PATH, and forwards
BASH_ENV so the .env keys land in the lint script's env.
Stamp logic:
- Per-interpreter stamp at build/install-lint-<sha256(sys.executable)>.stamp
so host venv and container venv track installs independently despite
bind-mounted build/.
- `--force` drops the stamp; group args bypass the stamp.
Tests + docs:
- 43 unit tests under tests/unit/utils/install/{,lint/} cover primitives,
pip/npm/github_release/system_pkg fallback chains, and the main CLI
(stamp logic, group dispatch, error path).
- utils/install/README.md + utils/install/lint/README.md document the
structure and the per-tool ensure() contract.
- docs/contributing/tools/make.md install-lint row updated to mention
the runner dispatch + per-env stamp + install-lint-force.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`export VAR=$(cmd)` masks the inner command's exit code with export's own.
Splitting the assignment lets a failing `dirname "$PYTHON"` propagate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace 8 bash env modules with a single Python generator
(cli.meta.env) that materialises env/static.env + runtime context
into a gitignored .env. Each variable lives in its own handler
under utils/env/handlers/; defaults carry inline one-line `# ...`
comments.
Rename to the INFINITO_* schema:
- workflow inputs: APPS, SERVICES_DISABLED, CMD, DEBUG, WHITELIST,
BUNDLES, FULL_CYCLE, VARIANT, RUN_FLAGS, LIMIT_HOST, PARALLEL
- inventory: INVENTORY_DIR / INVENTORY_FILE / HOST_VARS_FILE,
PW_FILE -> INVENTORY_PASSWORD_FILE
- venv: VENV_BASE / VENV_FALLBACK / VENV_NAME
- new SPOT defaults: COMPILE_SILENCE, CONTAINER_NO_CA,
WAIT_HEALTH_TIMEOUT_S, PACKAGE_CACHE_FRONTEND_INIT_IMAGE,
promoted IMAGE_TAG from GHA-only to general passthrough
compose.yml hardening:
- inline \${VAR:-default} removed; strict \${VAR:?...} everywhere
- new integration lint blocks regressions
Tooling:
- scripts/install/all.sh owns the stamp-file install logic
(Makefile target delegates)
- scripts/meta/env/load.sh is the single shell entry point;
8 bash modules deleted
- new shell lint: no INFINITO_* defaults outside env/static.env
Tests:
- 93 new unit tests for utils/env/{builder,parser,runtime,writer}
- restructure tests/lint into repository/ (file-content rules) vs
filesystem/{shell,python,env}/ (filesystem-shape rules)
- drift + smoke integration tests against the generator
Docs:
- variables.md is now a pointer; per-variable docs live next to
the key in env/static.env / env/ci.env
- compose.yml.md drops the Default column
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Promote kix to beta so it enters the CI-tested lifecycle set
({alpha, beta, rc, stable}) used by scripts/meta/resolve/apps.sh, and
no longer trips the "non-CI-tested lifecycle" warning emitted by
tests/lint/ansible/roles/meta/test_invokable_lifecycle.py.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a meta-layout lint that enforces a `lifecycle:` declaration on the
primary entity of every invokable role (those matched by the paths in
roles/categories.yml). Missing lifecycle is a hard error because the
lifecycle-filtered deploy tooling (`cli meta roles applications type
--lifecycles ...`) silently drops a role without it, so the role would
quietly disappear from any selection.
Additionally emit a GitHub Actions warning annotation (via
utils.annotations.message.warning) for each invokable role whose
lifecycle sits outside the CI-tested set {alpha, beta, rc, stable}. This
is informational only and never fails the test, so the project can keep
shipping pre-alpha / unsupported apps while making it visible at PR
review time which apps lack deploy-test coverage. The CI-tested set
mirrors scripts/meta/resolve/apps.sh:80 (single source of truth).
Allowed-value enforcement remains with TestLifecycleAllowedValues in
tests/lint/ansible/roles/meta/test_layout.py -- this new test only
covers existence and CI-coverage signaling.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
