Image names now follow {owner}/{repository}/mirror/{registry}/{name}
instead of {owner}/mirror/{registry}/{name}.
- GHCRProvider: add `repository` param + `add_args()`/`from_args()` classmethods
as SPOT for CLI argument registration and provider construction
- sync, resolver: use GHCRProvider.add_args() / from_args() (no duplication)
- Workflows: resolve repository name via scripts/meta/resolve/repository/name.sh
and pass --ghcr-repository to sync and publish
- mirrors.sh: require and forward GHCR_REPOSITORY env var
- deploy/development/mirrors.py: derive repository from GITHUB_REPOSITORY
- Tests: update expected paths, argv and env fixtures
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move iter_role_images + all helpers + ImageRef from cli/mirror/util.py and
cli/mirror/model.py into utils/docker/image_discovery.py; add source_file field
to ImageRef to distinguish config/main.yml vs vars/main.yml entries
- Delete cli/mirror/util.py; update all callers to import from utils.docker.image_discovery
- Move utils into subpackages: utils/docker/ (image_ref, paths_utils, hadolint) and
utils/roles/ (dependency_resolver, resource_validation); update all imports
- Reorganise tests into subpackages: tests/lint/docker/dockerfile/, tests/integration/docker/,
tests/unit/utils/docker/, tests/unit/utils/roles/; fix parents[N] offsets after relocation
- tests/lint/docker/test_image_versions.py now uses iter_role_images (same SPOT as mirror)
- Add vars/main.yml images.<name>.{image,version} support for non-application roles
(test-e2e-playwright, sys-ctl-hlth-csp); eliminate hardcoded duplicates in defaults/tasks
- Add web-app-matrix matrix-chatgpt-bot and web-app-mini-qr mini-qr entries in config/main.yml;
replace hardcoded image strings in vars/templates with lookup('config', ...) references
- Fix sync/__main__.py log line to use correct registry prefix for non-Docker-Hub images
- Update docs/contributing/code/role/dockerfile.md with image declaration rules and SPOT reference
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add ensure_git_safe_directory helper to lib.sh that detects dubious
ownership warnings in mounted containers and adds safe.directory to
the global git config. Call it on lib load and before each step in
the orchestrator.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Opts out of the April 2026 default change that skips file coverage
computation on PRs by setting CODEQL_ACTION_FILE_COVERAGE_ON_PRS=true.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move inline shell from entry-pull-request-change.yml into
scripts/meta/debug/auth_mode.sh and pass secrets via env vars.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reload env layer in install scripts after venv creation so `PYTHON`
points to the virtualenv instead of the system interpreter.
* Reload env in `python.sh` before installing dependencies
* Reload env in `pre-commit.sh` before installing hooks
* Reset env cache flags to force re-evaluation
* Keep centralized environment resolution (no hardcoding)
Fixes PEP 668 `externally-managed-environment` errors and missing
`pre_commit` module during hook installation.
Fixes an issue where `PYTHON` could still point to the system interpreter
when `scripts/install/python.sh` runs after `install-venv`.
* Reload env layer if venv exists and PYTHON is not yet pointing to it
* Reset env caching flags to force re-evaluation
* Preserve central environment resolution logic (no hardcoding)
This resolves Debian/PEP 668 `externally-managed-environment` errors during pip install.
curl returns 000 (no HTTP response) instead of 404 when the TLS handshake
fails because the target subdomain is not listed as a SAN in the deployed
certificate. Updated both assertions and added explanatory comments.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Consolidates into one target. FULL_CYCLE defaults to false (deploy only);
set FULL_CYCLE=true for deploy + update pass. Extracts run_pass function
in fresh-purged-app.sh to eliminate duplicated init+deploy logic. Updates
makefile.md, playwright.md, iteration.md, and environment.sh with correct
FULL_CYCLE usage.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extract inventory/host_vars printing into an inspect() function called
after each deploy. Define HOST_VARS_FILE as a SPOT in inventory.sh.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Unset GITHUB_ACTIONS and ACT in environment.sh to prevent runtime.sh
from detecting a CI environment (GitHub Actions or act).
This ensures deterministic local execution even when the script is
run inside CI-like shells or inherited environments.
Move `source all.sh` to after `make install` so that INFINITO_ENV_PYTHON_LOADED
is not pre-exported into make's environment. This ensures each recipe subshell
re-evaluates PYTHON and picks up the venv interpreter once the venv exists.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Define INVENTORY_FILE="${INVENTORY_DIR}/devices.yml" once in
scripts/meta/env/inventory.sh and export it. Remove all local
inv_file definitions; assert INVENTORY_FILE as required in each
consumer script. Rename CMD variable in container.sh from INSPECT_CMD.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- deploy.py: use find_provider_roles() to map service names (e.g. 'matomo')
to provider app IDs (e.g. 'web-app-matomo') before filtering deploy_ids;
forward SERVICES_DISABLED into the container via extra_env
- container.sh: rename INSPECT_CMD to CMD for consistency; fix indentation
- Makefile: expose CMD variable on exec target for non-interactive use
- environment.sh: source scripts/meta/env/all.sh for INVENTORY_DIR; add
inventory verification after SERVICES_DISABLED deploy using make exec
- variables.md: document CMD variable
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add scripts/meta/resolve/image/local.sh as SPOT for the local Docker
image tag (<repo-basename>/<distro>). Wire it into Makefile build
targets (IMAGE_TAG), compose.py (_base_env sets INFINITO_IMAGE), and
compose.yml (no default fallback). Fix build.sh to accept a pre-set
IMAGE_TAG without requiring REPO_PREFIX. Add make build + build-no-cache
to environment.sh test flow with correct section ordering.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove purge_images: GHCR cleanup is not a local system operation
- Remove sudo from git clean to avoid dubious ownership error in CI
- Remove docker context prune which fails with rc=125 in CI environments
- Update usage string to reflect removed GHCR step
- Add cancel-on-failure via API to test-environment, test-install-make,
test-install-pkgmgr workflows; revert fail-fast to false so all matrix
jobs complete before cancelling the run
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update all Make targets, comments, docs, and scripts to use the plural
form, reflecting that APPS can specify more than one application.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
container-purge-system requires APPS to be set and is app-specific.
It does not belong in the system-wide purge-all flow.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
deploy-fresh-purged-app purges the previous inventory/containers, so the dashboard
deployed in the first step is gone after the matomo deploy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add services_disabler.py: parse SERVICES_DISABLED, disable services in host_vars,
remove provider roles from inventory
- Wire apply_services_disabled_from_env into cli/create/inventory/cli.py after deploy
- Add unit tests for all services_disabler functions
- Update hardware.md and variables.md with SERVICES_DISABLED documentation
- Update environment.sh: deploy dashboard with SERVICES_DISABLED=matomo first,
assert dashboard reachable + matomo not reachable, then deploy matomo and assert
reachable; extract assert_http_status / assert_http_status_not helpers
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
