- Extract repeated systemctl/journalctl diagnostic blocks from
sys-service, sys-service-terminator, sys-svc-container, and
sys-svc-sshd handlers into a reusable files/debug.sh SPOT
- Add tasks/utils/debug.yml as the canonical Ansible wrapper
- Wrap sys-svc-sshd restart handler in block/rescue to emit
diagnostics and sshd -t config validation on failure
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Use workflow-level concurrency matching entry-push-latest.yml to
automatically cancel in-progress runs when a branch is deleted.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The self-exclusion check compared BASH_SOURCE[0] (relative path when
invoked as `bash ./scripts/…/00_orchestrator.sh`) against the glob-built
step paths (always absolute). The mismatch caused the orchestrator to
include itself in the loop, running a full inner pass of steps 01–10
before the outer loop repeated them — doubling the total runtime.
Fix: resolve SELF to an absolute path using SCRIPT_DIR so the comparison
is always path-equivalent regardless of invocation style.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove emojis from all role README headings (MUST NOT per readme_md.md)
- Rename ## Other Resources → ## Further Resources across role READMEs
- Add missing ## Credits section (required) to 16 role READMEs
- Fix Credits format: remove emojis, use canonical 4-line format
- Remove non-standard sections: ## Usage, ## Contributions, ## Documentation, ## Author, ## Role Variables, ## Requirements
- Convert ## Installation → ## Developer Notes (web-app-bluesky)
- Fix section order: Description before Overview (web-app-roulette-wheel)
- Remove text-only bullets from ## Further Resources (sys-ctl-alm-email, sys-ctl-alm-telegram, web-app-gitea)
- Fix ## sys-ctl-hlth-webserver title to human-readable form
- Restructure svc-opt-keyboard-color and sys-svc-sshd to standard section order
- Add ## Description + ## Overview to web-app-fider
- Remove ## Documentation self-reference in web-svc-onlyoffice
- Remove ### Key Features subsection from web-svc-file Overview
- Add missing Part of the Infinito.Nexus Project line in web-app-roulette-wheel Credits
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Apply documentation.md rules across staged files (emojis after headlines, RFC 2119 keywords, correct link text, Credits format)
- Remove expired ChatGPT share URLs from 39+ role READMEs and templates
- Remove orphaned text after link deletion: bare # @see, {# @see #}, Discussion: #}, empty Chat Conversation sections, dangling "Conversation is here available.", "Refer to the conversation with ChatGPT ()", "See ChatGPT Conversation", "ChatGPT Session Transcript" references
- Remove empty ## Further Resources and ## Credits sections where no links remain
- Fix URL reachability test: treat 401/403/405 as ok, 429/500/503 as warn, Timeout as warn; add # nocheck: url suppression (inline and line-above)
- Add lint test for broken relative and repo-root-absolute markdown links
- Add # nocheck: url to AUR git clone URLs, CSP allowlist entries, and other non-browser URLs
- Restore docs.infinito.nexus/setup in documentation.md MUST NOT example
- Fix Mobilizon geospatial endpoints (Addok, Photon) reverted to original values with # nocheck: url
- Add integration test rule: MUST NOT write unit tests for integration test logic
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Change the URL reachability test to fail on 4xx, non-500 5xx, and
request errors (DNS, connection). Only HTTP 500 now emits a warning
annotation, distinguishing temporary upstream breakage from dead links.
Add a unit test for the probe classification logic.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Keep live registry lookups out of the default make test flow.
Add a dedicated external suite, workflow, and docs so the check stays opt-in but still gates code CI when enabled.
Add tests/lint/repository/test_markdown_links.py — a hard-fail lint
test that scans all git-tracked markdown files for broken relative and
repo-root-absolute links. Skips external URLs, anchor-only links, fenced
code blocks, and placeholder targets.
Apply documentation.md rules to all staged files: add emojis after
headlines in docs files, remove emojis from role README headings,
standardize Credits sections to the canonical format, remove empty
sections and orphaned sentences referring to missing documentation files,
fix raw URLs and incorrect link text across role READMEs and docs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move emojis after headline text (CONTRIBUTING.md, actions/, design/, tools/, tests/)
- Replace em dashes with colons, semicolons, or complete sentences throughout
- Add missing emojis to all headlines in exceptions.md, principles.md, services.md, shell.md, setup.md, pull-request.md, commit.md, act.md, docker.md, pr/README.md
- Update H1 titles to reflect renamed directories (actions/, design/)
- Fix broken relative links in workflow.md after directory moves
- Fix full-path link texts in services.md (style.css.md, javascript.js.md)
- Fix broken principles.md link to lint.md after testing/ → actions/testing/ move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Moodle 4.5 is the required LTS version for OIDC compatibility.
The nocheck comment prevents the docker image version updater from
opening automated PRs to bump this version.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The default branch of infinito-nexus-core is main, not master.
Using master caused gh pr create to fail with 'Base ref must be a branch'.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When --repo is passed to gh, the --head argument must include the owner
in owner:branch format so GitHub can resolve the head SHA correctly.
Without it the GraphQL API returns 'Head sha can't be blank'.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
--force-with-lease requires a remote-tracking ref to exist locally. In a
fresh CI checkout the update branch has no tracking ref, so the push is
rejected as stale. The update branch is always owned by automation, so
--force is safe here.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix login form submission using form.evaluate() to bypass hidden button
- Add administrator and biber user creation with accepted_tos_version
- Use double quotes for passwords to handle special characters
- Only set password on new users to avoid reuse validation errors
- Simplify conversation tests to verify UI accessibility
- Disable sidekiq service (not needed for basic deployment)
- Add allowed_hosts.rb.j2 initializer to fix Rails host authorization
- Mount allowed_hosts initializer into decidim container
- Fix DATABASE_URL password encoding for special characters
- Strip trailing slash from RAILS_HOSTS
- Remove Dockerfile.j2 (using prebuilt image)
- Use ENVIRONMENT variable instead of hardcoded production
Without --repo, gh targets the wrong repository context when GH_TOKEN is
used in a workflow that runs outside the target repo. Infer the repo from
the git remote URL and pass it to gh pr list, gh pr edit, and gh pr create.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- document docs README purpose and scope in a dedicated SPOT
- add scope-focused README.md files across docs directories
- remove lint rule that banned README.md files under docs
- Remove duplicated role README requirement from documentation.md (SPOT is readme_md.md)
- Add cross-reference from readme_md.md to documentation.md for general rules
- Fix em dashes in readme_md.md
- Apply RFC 2119 keywords where missing
- Add emojis to all headlines in both files
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move flow/security/ghcr.md to tools/ghcr/authentication.md
- Move flow/security/mirror-cleanup.md to tools/ghcr/cleanup.md
- Move flow/security/branch.md to tools/github/branch.md
- Move flow/security/repository.md to tools/github/repository.md
- Move code/frameworks/ansible.md to tools/ansible.md
- Merge code/frameworks/Makefile.md into tools/make.md and extract file rules to artefact/files/makefile.md
- Rename tools/makefile.md to tools/make.md
- Add .github/workflows/images-mirror-cleanup.yml for manual GHCR cleanup
- Apply documentation.md standards: emojis on headlines, no em dashes, filename link text
- Fix all cross-references broken by directory restructuring
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename artefact/image.md to artefact/image/origin.md and merge code/role/image.md into it
- Move artefact/mirror.md to artefact/image/mirror.md
- Move docs/contributing/code/role/ to docs/contributing/artefact/files/role/
- Rename readme_base.md to readme_md.md
- Apply documentation.md standards (emojis, RFC 2119, link text) to all modified files
- Fix all cross-references broken by the directory restructuring
- Remove publish section from mirror.md (module deleted in prior commit)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds cli.mirror.cleanup for deleting GHCR container packages by prefix
and visibility via the GitHub Packages REST API. Supports dry-run mode.
Requires a classic PAT with delete:packages scope (GITHUB_TOKEN from
gh auth or GitHub Actions does not include this scope).
Also adds unit tests and a usage guide at
docs/contributing/flow/security/mirror-cleanup.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces GHCR_PAT-based authentication with GITHUB_TOKEN across all
mirror and build workflows. Packages pushed from a public repository
with GITHUB_TOKEN are automatically linked to the repository and
inherit its public visibility — no publish step required.
Removes cli.mirror.publish (used a non-existent GitHub REST API
endpoint for changing package visibility), the associated unit tests,
and the GHCR_PAT debug helper. Cleans up all GHCR_PAT/GHCR_USERNAME
references and rewrites the GHCR authentication documentation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The publish step was filtering packages by prefix 'mirror/' but images
are pushed to ghcr.io/{ns}/{repo}/mirror/... so the package names in
the GitHub Packages API are '{repo}/mirror/...'. The new packages were
never found and thus remained private.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add scripts/install/skills/install.sh to restore skills from
skills-lock.json via npx skills experimental_install
- Add scripts/install/skills/update.sh to update all skills by
re-running skills add for each source in skills-lock.json
- Add make install-skills and make update-skills targets
- Add .github/workflows/update-skills.yml for daily automated updates
matching Dependabot schedule (00:00 UTC), opens PR on lock changes
- Add docs/agents/meta/caveman.md as SPOT for caveman mode, startup
notification, and token-budget tier progression
- Update AGENTS.md with RFC 2119-compliant skills installation check
- Update docs/agents/action/commit.md: replace ALWAYS with MUST
- Update pyproject.toml: respect-gitignore = true, exclude .agents
- Track skills-lock.json and add .agents to .gitignore
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds scripts/lint/autoformat.sh that checks tool availability before
running ruff, shfmt, and shellcheck autofixes. Updates Makefile with
the new autoformat target, documents it in makefile.md, and adds a
commit.md rule requiring autoformat to be run before every commit.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Usernames are not sensitive — storing them as secrets only adds friction
without security benefit. Replace secrets.GHCR_USERNAME with vars.GHCR_USERNAME
across all workflows and remove GHCR_USERNAME from secrets: input blocks in
reusable workflows. Update ghcr.md to document it as a variable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace safe="/" with safe="" so package names like
mirror/docker.io/openresty/openresty are encoded as a single URL path
segment (mirror%2Fdocker.io%2Fopenresty%2Fopenresty). With literal
slashes GitHub's router matched only "mirror" as the package name → 404.
- _set_public now returns bool; main() only prints "✓ set to public" and
increments updated when True. Previously a 404-skip returned None which
still triggered the success path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Old packages (pre-rename) have no versions left in GHCR and return 404
on PATCH. This caused an early exit that skipped all remaining packages.
404 means the package is gone; actual token scope failures return 401/403.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
publish only needs namespace + prefix to list and update GHCR packages
via the API. The repository argument was erroneously copied from the sync
step and caused an argparse error.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
