The re-sign rebase failed on empty commits pulled in from upstream
because git refused the --amend. Adding --allow-empty keeps those
commits in place while still GPG-signing them.
Split docs/agents/action/iteration.md into role.md, playwright.md,
workflow.md, and a scope-focused README. Move Certificate Authority
and Inspect rules into role.md. Rewrite playwright.md as a machine-
oriented state machine with explicit preconditions, procedure, exit
gates, and escape path.
Extract Playwright spec content MUSTs into the new contrib SPOT
docs/contributing/artefact/files/role/playwright.specs.js.md. Reduce
the agent-side spec and env.j2 pages to procedure only. Align the
framework SPOT and the test-e2e-playwright role README with the
central templates/package.json.j2 + files/playwright.config.js model
and images.playwright.version as single source of truth.
Sweep em dashes and sentence-case role headings across all touched
docs per documentation.md and readme_md.md rules.
COPY fails in CI because sys-svc-compose only copies Dockerfile to the
compose directory, not additional files. Inline the patch script using
a heredoc so the build context only needs the Dockerfile itself.
The separate patch_decidim.py file is retained for unit testing.
The old derivation read @playwright/test out of
roles/test-e2e-playwright/files/package.json and assembled the tag
as `v{version}-{distro}`. That package.json no longer exists — the
version+distro tag now lives verbatim in defaults/main.yml under
images.playwright.version, so read it from the single source of
truth instead of rebuilding a broken tag from a missing file. The
TEST_E2E_PLAYWRIGHT_IMAGE_DISTRO fallback is no longer referenced
once the distro suffix is baked into the upstream version string.
Upstream ldapauth.php gates autocreation on `$val == 'true'`. Under
PHP 8 a stored bool round-trips as int, so the comparison never
matched and every LDAP-only login was rejected.
Rework the biber/admin Playwright scenario to cover parallel
isolated logins (exercising the autocreate path for the non-admin
identity) instead of the fragile DM flow, so this regression is
caught end-to-end.
Consolidates application-config helpers under utils/applications/ with a
concise public API (config.get). Updates all plugin, role, and test
imports; removes the legacy get_app_conf filter and its tests.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Introduce docs/contributing/design/iam/ with a docs README, common.md
for cross-cutting principles, and per-provider pages oidc.md and ldap.md.
The OIDC page documents the OIDC.* variable tree, claim attribute SPOT
(preferred_username), and the rule that app-specific Keycloak protocol
mappers belong in per-client scopes, not the shared default.json.j2.
The LDAP page documents the LDAP.* variable tree, attribute SPOT, and
the paired-identifier rule with OIDC.
Move services.md from docs/contributing/code/ to docs/contributing/design/
so the design/ folder is the SPOT for cross-cutting platform conventions.
Update the two architecture.md cross-links and the requirement doc.
Cross-link the new guides from 13_oidc.yml, 14_ldap.yml, and the
web-app-keycloak and svc-db-openldap role READMEs. Fix nearby README
compliance issues per readme_md.md (svc-db-openldap H1, missing
Credits section in web-app-jira, Credits formatting drift).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The topbar renders a `btn form-button-search` submit button before the
login form, so `button[type='submit']` would match the search button
first. Target the login form's own "Sign in" button by accessible role
and exact name, and apply the same fix to the DM composer's send
button to survive the same ordering hazard.
- Rename 06..19 → 04..17 so the sequence is dense and gap-free.
- Update hard-coded references in cli/, tests/, and PR template.
- Add README.md describing scope, load order, and naming rules
per docs/contributing/documentation.md standards.
- Extract inline Dockerfile Python script to files/patch_decidim.py (SRP)
- Add 7 unit tests in tests/test_patch_decidim.py covering all patch functions
- Make patch_secrets_yml idempotent (safe to run multiple times)
- Fix escape sequence warning in OMNIAUTH_INJECTION (raw string)
- Remove unnecessary regex from allowed_hosts.rb.j2 (exact domain match is sufficient)
- Rewrite README.md to follow platform documentation conventions
Friendica: admin dashboard login + biber-to-admin direct message flow,
both via the ldapauth addon path (no OIDC redirect). Logout exits
through the universal /logout endpoint.
Joomla: admin control-panel login at /administrator using the local
account provisioned from users.administrator.*, with the universal
/logout confirmed by re-rendering of the admin login form. Joomla is
a CMS, so no cross-user messaging scenario is covered.
Both roles gain templates/playwright.env.j2 (the discovery marker for
test-e2e-playwright) and files/playwright.spec.js.
The shared /_shared/css/default.css and /_shared/js/logout.js are
populated by sys-front-inj-css / sys-front-inj-logout, not by
web-svc-cdn itself. Testing their availability from the CDN spec
conflates two roles' responsibilities and fails on solo CDN deploys
where no asset-producing app is enabled. Keep only the genuine CDN
contract: index served under canonical domain with TLS + HSTS.
Task-local `domain:` override does NOT shield against eager evaluation
of the role-layer `domain = lookup('domain', application_id)` template
when application_id is polluted in the role-vars layer by nested
include_role chains. Reverting to inline literal lookup in the shell
arg; task-local `application_id` pin stays (still needed for lazy
MATOMO_* var resolution).
Nested include_role chains (sys-stk-front-base → web-opt-rdr-domains /
svc-prx-openresty) pollute the role-vars layer and make {{ domain }} /
{{ MATOMO_* }} resolve against the wrong application_id. Task-level
vars take precedence over role vars, so pinning them here shields the
lookups from pollution.
BuildKit's private network fails to reach registry.npmjs.org /
raw.githubusercontent.com from inside nested docker-in-docker;
host-net inherits the outer container's working network.
Replace the v1 wait-for-bin/console file-existence probe with a
`bin/console list` invocation, which boots Friendica's full Composer
autoloader and therefore only returns rc=0 once the entrypoint rsync
from /usr/src/friendica/ into /var/www/html has copied every required
vendor file. The v1 probe returned too early: bin/console lands before
vendor/ is complete, so the next invocation failed with
PHP Fatal error: Failed opening required
'.../vendor/composer/../symfony/deprecation-contracts/function.php'
Also adds defence-in-depth retries on the addon-sync loop itself, so
an individual addon command can still absorb a slow final piece of the
rsync or a just-reloaded autoloader.
Refs #161
Restores the weekly scan coverage previously provided by Default Setup,
so CodeQL analysis still runs when no CI triggers land on main.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Remove the direct push-on-main trigger from security-codeql.yml so that
the concurrency group no longer cancels the orchestrator-invoked scan.
CodeQL now runs exactly once per CI run via ci-orchestrator.yml, and
its failure continues to block code-quality-gate and all downstream
deploy, install, and environment tests.
Split the CI documentation along SPOT lines: workflows.md owns the
per-workflow catalog (trigger, inputs, short description); pipeline.md
owns the flow (stages, gates, concurrency, fork handling). Drop the
duplicated entry-points table and per-stage workflow bullet lists from
pipeline.md in favour of cross-references. Fix the stale "push to
latest" wording that pre-dated the current branch prefix list.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Route pushes through scripts/git/sign-push.sh so the operator's GPG key
stays outside the sandbox. Script signs only @{u}..HEAD (or merge-base
with origin/main|master on first push), skips re-signing when all
commits already carry a good signature, and uses --force-with-lease on
rewritten history. settings.json denies git push*, git send-pack*, and
make sign-push* so the agent cannot trigger a push path directly.
CLAUDE.md instructs the agent to hand off to the operator instead.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add `&` to the explicit list of forbidden statement separators and
point operators at the Bash tool's run_in_background parameter as the
correct substitute.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Introduce a single global flag in group_vars/all/10_networks.yml and wire
the previously hardcoded IPv6 settings in nextcloud, bigbluebutton, and
matrix through it. Matches the host-level `make disable-ipv6` policy so
containers no longer stall on AAAA-first lookups (e.g. Nextcloud's
DnsPinMiddleware) while keeping a single knob to flip when v6 is wanted.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Add custom Dockerfile to install omniauth_openid_connect gem and patch
Decidim's OmniAuth initializer for OpenID Connect provider registration
- Patch secrets.yml to add openid_connect section to all environments
- Patch omniauth_helper.rb to return correct icon for openid_connect
- Fix redirect_uri to use APPLICATION_HOST env var for correct callback URL
- Fix SSL cert trust by relying on compose.ca.override.yml at runtime
- Add OIDC omniauth settings to organization (enabled + icon only, no
encrypted credentials - credentials read from env vars at runtime)
- Add biber OIDC login/logout Playwright test and profile access test
- Add SSO button visibility test when OIDC is enabled
- Fix SSO button selector to use href-based locator
- Use form.evaluate() POST with CSRF token for data-method=post links
- Add OIDC_ENABLED to playwright.env.j2
- Add DECIDIM_CUSTOM_IMAGE var for custom built image
- Update compose.yml.j2 to build custom image with OIDC patches
Three related settings.json changes:
1. Replace narrow `Bash(*=* make *)` with three broader rules covering
any prefix + make, plus composites with `> /tmp/*` redirect and
`2>&1` stderr-merge. Needed so multi-env invocations with quoted
multi-word values (e.g. `FOO=a BAR=b APPS="x y z" make target > /tmp/log 2>&1`)
auto-allow without prompting — the prior single-env rule and the
generic `* > /tmp/*` rules did not compose for this shape.
2. Replace inert `WebFetch(domain:*)` with explicit per-domain entries
for `github.com` and `raw.githubusercontent.com`. Tested empirically:
the wildcard form does not suppress the permission prompt, so a
per-domain allowlist is the only mechanism that works.
3. Add `Bash(git -C *)` to deny. Blocks cross-repo escapes via the
`-C <path>` flag, which otherwise lets the agent reach into other
working trees under `additionalDirectories`. Operators needing a
second repo must open a dedicated session there.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
