load_app.yml uses public: false, so cdn_paths_all was undefined after
removing the explicit sys-svc-cdn task. Restore include_role with
public: true solely for var exposure; deployment stays in 01_services.yml.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sets inj_enabled.matomo=false when the Matomo token is empty so the NGINX
template skips body/head snippets and avoids 'matomo_site_id is undefined'.
Removes the explicit CDN load task — CDN is now covered by the generic
frontend service loader in 01_services.yml (loaded only when needed).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Use default('') so the template renders safely when
matomo_tracking_code_one_liner is not set (e.g. token not yet available).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add Recording Tests section: Playwright codegen (built-in) and
playwright-recorder (Docker/X11-based) with usage examples
- Replace duplicated spec/env requirement blocks with links to their
SPOT pages in docs/agents/files/role/
- Extend Development Procedure to include optional recording step
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Splits injection logic into inject.yml and guards execution via main.yml
when the Matomo API token is empty (e.g. first deployment or bootstrap not
yet run). Documents the exception and its retry behaviour in
docs/contributing/code/exceptions.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
selectattr('value.type', '==', 'frontend') fails in Python 3.13 / current Jinja2
because dict.type is not a Python attribute and the fallback to dict['type'] does
not trigger. Move the frontend type check into a when condition using .get('type')
and guard role access with 'is defined'.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Convert backtick path references to clickable hyperlinks, apply MUST/SHOULD
language where appropriate, and link to services.md and workflow.md as SPOTs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Introduces a SPOT for all frontend service loading in sys-front-inj-all/tasks/01_services.yml,
driven by a new generic `service` lookup plugin that resolves services by key or role name
and returns {id, role, enabled, shared, needed}. Needed = enabled AND shared (direct or
transitive). The canonical key→role mapping moves to group_vars/all/20_services.yml
(previously scattered hardcoded rules). Removes per-role service loads from bigbluebutton,
nextcloud, and dashboard. Renames 01_dependencies.yml→01_services.yml and
08_services.yml→08_daemons.yml. Adds flush_handlers after each service load.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extract inventory/host_vars printing into an inspect() function called
after each deploy. Define HOST_VARS_FILE as a SPOT in inventory.sh.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Unset GITHUB_ACTIONS and ACT in environment.sh to prevent runtime.sh
from detecting a CI environment (GitHub Actions or act).
This ensures deterministic local execution even when the script is
run inside CI-like shells or inherited environments.
Move `source all.sh` to after `make install` so that INFINITO_ENV_PYTHON_LOADED
is not pre-exported into make's environment. This ensures each recipe subshell
re-evaluates PYTHON and picks up the venv interpreter once the venv exists.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Define INVENTORY_FILE="${INVENTORY_DIR}/devices.yml" once in
scripts/meta/env/inventory.sh and export it. Remove all local
inv_file definitions; assert INVENTORY_FILE as required in each
consumer script. Rename CMD variable in container.sh from INSPECT_CMD.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Scans roles_dir to find every role whose config/main.yml defines the
disabled service, then creates or updates the compose.services entry in
host_vars for each matching role — including roles not yet present in
applications. roles_dir is now a required parameter (no Optional fallback).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- deploy.py: use find_provider_roles() to map service names (e.g. 'matomo')
to provider app IDs (e.g. 'web-app-matomo') before filtering deploy_ids;
forward SERVICES_DISABLED into the container via extra_env
- container.sh: rename INSPECT_CMD to CMD for consistency; fix indentation
- Makefile: expose CMD variable on exec target for non-interactive use
- environment.sh: source scripts/meta/env/all.sh for INVENTORY_DIR; add
inventory verification after SERVICES_DISABLED deploy using make exec
- variables.md: document CMD variable
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add scripts/meta/resolve/image/local.sh as SPOT for the local Docker
image tag (<repo-basename>/<distro>). Wire it into Makefile build
targets (IMAGE_TAG), compose.py (_base_env sets INFINITO_IMAGE), and
compose.yml (no default fallback). Fix build.sh to accept a pre-set
IMAGE_TAG without requiring REPO_PREFIX. Add make build + build-no-cache
to environment.sh test flow with correct section ordering.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
compose.exec runs inside the container, so host env vars are not
inherited. Pass SERVICES_DISABLED via -e so services_disabler.py
can suppress the correct entries when creating the inventory.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace per-directory README.md index files with automatic glob toctree
in root index.rst (docs/**). Add lint test that fails if any README.md
appears under docs/. Document the no-README rule in documentation.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add branch.md as SPOT for branch naming patterns and CI scope table
- Update pull-request.md: link to branch.md, add fork CI decision matrix,
draft PR rules including convert-back-to-draft requirement
- Update workflow.md: replace inline branch prefix table with link to
branch.md, replace forum link with hub discussion reference
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add ready_for_review trigger so CI starts when a draft PR is marked ready
- Guard detect-pr-scope with draft == false to skip all jobs for draft PRs
- Add converted_to_draft to cancel-pull-request-runs.yml to cancel active
runs when a PR is converted back to draft
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Required so cancel-on-failure jobs in reusable workflows can call
the GitHub API to cancel the run. Permissions propagate down the
workflow_call chain and must be write at every level.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove purge_images: GHCR cleanup is not a local system operation
- Remove sudo from git clean to avoid dubious ownership error in CI
- Remove docker context prune which fails with rc=125 in CI environments
- Update usage string to reflect removed GHCR step
- Add cancel-on-failure via API to test-environment, test-install-make,
test-install-pkgmgr workflows; revert fail-fast to false so all matrix
jobs complete before cancelling the run
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add cancel-on-failure job to test-environment, test-install-make, and
test-install-pkgmgr. After all matrix jobs complete, the job cancels
the entire orchestrator run via the GitHub API if any matrix job failed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Enables fast failure on test-environment, test-install-make, and
test-install-pkgmgr matrix strategies so the overall CI run fails
immediately when a job fails rather than waiting for all jobs to
complete. Trade-off: no cross-distro comparison on failure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Document required OS targets for deployed roles and local setup scripts,
including Red Hat SLA/security rationale, WSL2 and Homebrew requirements,
and RFC 2119 rules for cross-distro script behaviour.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update all Make targets, comments, docs, and scripts to use the plural
form, reflecting that APPS can specify more than one application.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
container-purge-system requires APPS to be set and is app-specific.
It does not belong in the system-wide purge-all flow.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
