- Move utils/gha/annotations.py → utils/annotations/message.py
- Move scripts/gha/summarize_annotations.py → utils/annotations/summarize.py
- Keep utils/gha/annotations.py as compatibility shim
- Update all imports across codebase to utils.annotations.message
- Wire tee + summary step into test-code-lint, unit, and integration workflows
- Add unit tests for utils/annotations/summarize (20 tests)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace copy-pasted ::warning prints and _gha_escape helpers across lint
tests and utils with a shared utility that emits GHA workflow commands in
CI and plain [WARNING]/[ERROR]/[NOTICE] lines locally. Update
test_role_resource_validation to capture stdout instead of stderr.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add utils/gha/annotations.py with warning/error/notice helpers and *_each
variants that emit one annotation per list item
- Use warning() in GHCRProvider._set_public for missing GHCR_PAT case
- Expose GHCR_PAT_SET env var in mirror step to distinguish missing-PAT from
real API failures
- Add unit tests for all annotation functions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
/users/{username}/packages does not support PATCH — it is a read-only endpoint
for public data. The correct endpoint for updating visibility of the authenticated
user's packages is /user/packages (without username).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
A freshly pushed package may not be immediately visible in the GitHub
Packages API. Add up to 5 retries with 10s delay before failing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Root cause: GITHUB_TOKEN in Actions is repo-scoped and cannot change package
visibility in user/org namespaces — all 58 mirror operations failed with 404.
- Use GHCR_PAT (which has write:packages scope) as GITHUB_TOKEN in the mirror
step, falling back to GITHUB_TOKEN if GHCR_PAT is not set
- Remove ensure_public() call from the already-exists skip path (wrong place:
existing images were already made public when first mirrored)
- Update test to assert ensure_public is not called for skipped images
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove redundant `images-mirror-missing` job from entry-pull-request-change.yml
(mirroring already runs via ci-orchestrator for same-repo PRs)
- Set GHCR package visibility to public after each successful mirror via GitHub API
- Add `ensure_public` hook to base class (no-op for other providers)
- Also call `ensure_public` for already-existing images to fix any that are still private
- Pass GITHUB_TOKEN explicitly to the mirror step
- Add unit tests for _set_public (user/org endpoint fallback) and sync skip-path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Introduces a configurable default for password authentication in sshd,
allowing controlled exceptions (e.g. local E2E test targets) while
keeping the secure default of disabled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds 'shared: true' to the 'oauth2', 'logout', 'dashboard', and 'css'
services in 'roles/web-app-prometheus/config/main.yml'.
This change resolves consistency violations reported by
'test_service_shared_consistency.py', which requires that all services
marked as 'enabled: true' must also explicitly declare their 'shared' status.
Replaces the fragile pipe lookup calling ssh-keyscan at runtime with a
static PKGMGR_GITHUB_HOST_KEY variable to avoid CI failures where TCP:22
to github.com may be blocked.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds MATOMO_ENABLED to the Playwright env template, derived from the
Ansible application config, so the matomo tracking assets test can be
skipped when SERVICES_DISABLED=matomo is set (e.g. in the minimal CI
deploy step).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
feat(web-app-mattermost): add Playwright E2E test coverage: Seems good. All relevant tests passed. Code makes sense :) Thanks a lot for the implementation <3
Transient issues (DNS timeout, slow CI runner) no longer cause immediate
failure — each test gets up to 2 retries before being marked as failed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Accept 1xx/2xx/3xx (status < 400) instead of only [200, 302] so that apps
returning 301 (e.g. simpleicons redirecting to sphinx docs) are correctly
recognised as ready. Also set follow_redirects=none so the wait checks the
app itself rather than its redirect target.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove leading dot from setCookieDomain in matomo-tracking.js.j2 to prevent
Chromium from rejecting _pk_id/_pk_ses cookies
- Refactor dashboard Playwright spec: extract console error helpers, add dedicated
matomo tracking test, fix iframeTargetUrl to use matomoBaseUrl for real
cross-subdomain coverage
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The root `/` handler intentionally redirects to Sphinx docs when
`web-app-sphinx` is in `group_names`. The previous test assumed the
landing page always stays on `icon.infinito.example`, causing a
consistent failure in the sphinx deploy CI job.
Use `{ maxRedirects: 0 }` to capture the raw response and accept both
HTTP 200 (standalone) and 301/302 (sphinx context) as valid outcomes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add role-local spec and env template to verify that the Simple Icons
service serves SVG, PNG, and 404 responses correctly on its own domain.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extend root AGENTS.md with a convention for per-role agent instruction
files, and introduce the first instance for the shared Playwright runner
to enforce minimal, confirmed changes only.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
