- Build CI images with immutable ci-<sha> tags instead of latest
- Pass CI image tag into deploy workflows via INFINITO_IMAGE_TAG
- Derive CI_TAG from checked-out release tag commit
- Retag CI images to <version> and latest on release (no rebuild)
- Make release scripts independent from GITHUB_SHA coupling
- Improve robustness and reproducibility of release pipeline
https://chatgpt.com/share/696832f6-35e4-800f-a574-178013d4426e
- Replace legacy MODE env with TEST_DEPLOY_TYPE across workflows and scripts
- Route CI deploy and discovery through Makefile targets
- Rename deploy-one-app.sh to deploy-app.sh and update all call sites
- Fix Makefile recursion and ensure scripts are executed directly
- Ensure JSON discovery output is clean via silent make target
- Make MISSING_ONLY default true via Makefile
- Respect INFINITO_NO_BUILD in compose up to avoid implicit rebuilds in CI
- Keep explicit build step before compose up for deterministic CI runs
- Improve deploy logging (test_deploy_type instead of mode)
Result:
- Deterministic CI behaviour
- No accidental docker compose rebuilds on up
- Single source of truth for deploy orchestration
- Cleaner env contract between workflows, make, bash and python
https://chatgpt.com/share/69678024-fe38-800f-b877-add46aa55190
- Rename CI workflow and MODE from "rest" to "universal"
- Extend CLI and test runner to support universal deploy type
- Add tasks/stages/02_universal.yml for universal host type
- Update discover logic to use universal app selection
- Remove legacy rest->server mapping and obsolete select helper
https://chatgpt.com/share/6967625e-81c8-800f-8592-5d5b8edec1e2
- add --debug / --no-debug flag to deploy test CLI and runner
- make Ansible debug mode optional instead of always enabled
- extend deploy.sh with debug flag forwarding
- add make target test-deploy-rapid for fast single-app deploys
https://chatgpt.com/share/6966c80c-661c-800f-8fb9-769659da290d
Ensure systemd is started immediately as PID 1 in the infinito container
to avoid blocking on pkgmgr during boot. Increase compose runner timeout
to match healthcheck window and make healthcheck script executable in the
image.
This fixes containers getting stuck in "starting" state and makes CI
startup deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
Add a systemd-based Docker HEALTHCHECK that verifies:
- systemd readiness
- infinito CLI availability and executability
- infinito CLI smoke test (--help)
Update CI compose runner to wait for Docker health status instead of
manual systemd polling. The runner now:
- resolves the infinito container via docker compose
- waits for healthy state
- dumps journalctl and docker logs on timeout
This removes boot race conditions and makes container readiness deterministic.
https://chatgpt.com/share/696683a2-9350-800f-a0cf-587d4013cb29
- Add reusable build-ci-images workflow to build and push ci-<sha> images for all distros
- Make all deploy test workflows use prebuilt CI images (no local rebuilds)
- Replace ci-version workflow with release workflow
- Retag ci images to <version> and latest on tag push (no rebuild)
- Move stable git tag only if all analyses/tests succeed and version is highest
- Make compose image/pull policy configurable via env
https://chatgpt.com/share/69662869-ee1c-800f-9e6c-bbbf47284fad
Replace inline tail logic in deploy workflows with a shared
scripts/ci/log-tail.sh helper that prints the last N lines of all
log files on failure.
This improves debuggability, avoids code duplication, and ensures
consistent log output across server, universal and workstation
pipelines.
https://chatgpt.com/share/69661d0e-81a8-800f-8b98-6c964672d027
- Rename _deploy-matrix.yml -> _deploy-per-app.yml and drop unused inputs
(tested_lifecycles, only_distro, final_exclude_re).
- Keep one runner per app (matrix.app) and run all distros inside that job.
- Makefile: run deploy tests through act workflow_dispatch (no serial script).
- Add scripts/ci/discover.sh and scripts/ci/deploy-one-app.sh as small SRP helpers.
- Update reusable workflow callers to use the renamed file.
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
- Add reusable _deploy-matrix workflow with discovery + per-app deploy across distros
- Enforce serial execution via strategy.max-parallel=1 and act --concurrent-jobs 1
- Support filters: mode (server|workstation|rest), only_app, only_distro, include/exclude regex
- Refactor test runner: remove discovery, require --app, deploy single app with deps only
- Generalize discover script to discover-apps.sh with INCLUDE_RE/EXCLUDE_RE + lifecycle gating
- Update Makefile targets to drive workflow_dispatch inputs for local act runs
https://chatgpt.com/share/69659ff3-1414-800f-8652-5298fcf55398
Move lifecycle filtering into discover-server-apps.sh so only
lifecycle-eligible web-app-* and web-svc-* roles are discovered.
This prevents invalid per-app deploy tests where applications are
excluded later during inventory generation, causing "not present in
inventory" errors.
- Filter invokable roles by server prefixes
- Apply lifecycle_filter blacklist using TESTED_LIFECYCLES
- Always emit valid JSON for CI matrix generation
https://chatgpt.com/share/695fd936-0ee4-800f-a57f-2d7995e15ba0
* Add `cli.deploy.test` module to orchestrate compose-based CI deploy tests
* Support server per-app runs (including run_after dependencies) and workstation selection
* Add optional image build flags (--no-cache, --missing) and stack retention on failure
* Simplify `scripts/tests/deploy.sh` to a thin wrapper that forwards args to the Python runner
https://chatgpt.com/share/695f9e22-6e9c-800f-9a50-65f553619af2
- Replace clean-container with compose down for predictable teardown
- Add explicit up/down targets to Makefile
- Sync bind-mounted source into internal repo using rsync --chown=root:root
- Prevent git dubious ownership errors in CI containers running as root
https://chatgpt.com/share/695d7045-a1f8-800f-83d0-f5872d85cfcf
* Introduce lifecycle gating to CI deploy tests
* Only allow roles with tested lifecycles (alpha, beta, rc, stable)
* Automatically exclude roles with untested or missing lifecycle metadata
* Simplify static BASE_EXCLUDE by relying on lifecycle filtering
https://chatgpt.com/share/695d16d9-e210-800f-92d7-a1a429644be2
- Always build and publish Docker images for v* tags (version + latest),
independent of test results
- Run full code analyses in parallel and only mark Git + container :stable
when all checks succeed
- Replace rebuild-on-stable with pure imagetools retagging (no rebuild)
- Prevent race conditions by ordering stable tagging after image publish
- Ensure latest always tracks the most recent version image
https://chatgpt.com/share/695bdfa5-dbe0-800f-bb1c-4fe81eba6058
- switch deploy tests to docker compose exec (-T) instead of docker exec
- remove hard dependency on INFINITO_CONTAINER
- ensure clean CI state via compose down -v before deploy tests
- start coredns + infinito exclusively via compose
- enable host cgroup namespace for systemd containers (cgroup: host)
https://chatgpt.com/share/6953e367-b674-800f-bc55-97e8625314cf
- switch workflow to `make test-deploy` with matrix-driven INFINITO_DISTRO
- centralize container naming via INFINITO_CONTAINER
- add clean-container helper for reliable CI reruns
- remove --distro CLI flag and rely on env-based distro selection
- pass NIX_CONFIG as docker build arg for rate-limit-safe builds
https://chatgpt.com/share/6953d266-aa80-800f-88b8-0413926a81f0
- replace localhost special-casing with valid FQDN (infinito.localhost)
- derive system email DOMAIN and HOST directly from DOMAIN_PRIMARY
- align Mailu TLS_FLAVOR with SYSTEM_EMAIL.TLS (mail vs notls)
- tie OIDC_VERIFY_SSL to TLS_ENABLED for consistent test/CI behavior
- update CI deploy script to use new primary domain
https://chatgpt.com/share/695311c0-fbe8-800f-8058-9d40a06b189a
- add --vars-file CLI option to load host_vars overrides from YAML
- merge vars-file overrides before JSON --vars (JSON takes precedence)
- implement deep-merge logic for YAML vars files
- update CI deploy script to use vars file instead of inline JSON
- add unit test for apply_vars_overrides_from_file
- remove obsolete MASK_CREDENTIALS_IN_LOGS TODO entry
https://chatgpt.com/share/6952e51d-6c50-800f-8764-31dc8c609cdb
- switch CI DNS to CoreDNS-based *.localhost resolution (A/AAAA → loopback)
- set PRIMARY_DOMAIN to localhost for CI deploys
- add explicit DNS resolution assert for test.localhost
- deploy explicit default_server vhost returning 404 text/plain
- assert default vhost behavior via HTTP before app domains exist
https://chatgpt.com/share/6952cf2a-bbd4-800f-b2b8-c4baba66e301
- ensure files created by Ansible under /tmp/gh-action are visible to Docker host
- prevent file-vs-directory bind mount errors in GitHub CI
- align container filesystem with docker compose host paths
https://chatgpt.com/share/69528062-ff74-800f-ae11-a658b5917307
- Install systemd and dbus in Docker image for CI service tests
- Run systemd as PID 1 with proper container conventions
- Mark container environment explicitly via ENV container=docker
- Simplify container detection to rely on explicit env flag
- Skip host-only tasks (timezone, systemctl handlers) inside containers
- Adjust docker-compose runner for privileged systemd execution
- Reduce CI parallelism to avoid OOM kills
This makes systemd-based Ansible roles reliable in Docker/CI
and avoids fragile virtualization heuristics.
https://chatgpt.com/share/6950110b-111c-800f-bbcd-83a551d5a3b8
Switch CI deploy tests from docker run to docker compose with a long-lived
infinito service. The container now uses `tail -f /dev/null` as command to
prevent restart loops caused by the default `infinito --help` CMD, which
previously killed exec processes with exit code 137.
Changes include:
- make infinito a stable exec target in compose (no premature restarts)
- add compose helpers (build/up/exec/down) to deploy.sh
- move inventory creation and dedicated deploy into the running container
- add conditional cleanup via EXIT trap (keep stack on failure for debugging)
- support per-distro container naming via INFINITO_DISTRO
This stabilizes CI runs and makes debugging failed deploys possible.
https://chatgpt.com/share/694d3f99-07e4-800f-bc05-3a60c902064d
- Mount /tmp/gh-action into the CI container so Docker can access run-scoped paths
- Scope OpenResty www and nginx volumes to GITHUB_RUN_ID when running in container
- Avoid leaking host /etc/nginx and /var/www into CI runs
- Remove redundant preflight
https://chatgpt.com/share/694918d0-53b4-800f-93a7-ec82946f3e24
* Refactor docker entrypoint to run local build via a single helper function
* Add INSTALL_LOCAL_BUILD_SILENCE flag to fully suppress DEV build output
* Enable INSTALL_LOCAL_BUILD for invokable resolution without noisy logs
* Keep behavior deterministic and non-redundant while preserving failure semantics
https://chatgpt.com/share/694874d7-508c-800f-aa89-d9cef71128dc
- Drop legacy compatibility wrapper in cli.meta.applications.invokable
- Resolve repository root explicitly via pathlib
- Ensure filter_plugins are importable outside Ansible
- Run invokable discovery with INSTALL_LOCAL_BUILD=1 in deploy tests
- Make deploy.sh fail fast when invokable resolution is unavailable
- Normalize sorting and exclusion logic (drv-* roles, locale-safe sort)
- Export NIX_CONFIG in CI jobs and Makefile
- Pass NIX_CONFIG as docker build-arg
- Use NIX_CONFIG only in relevant Dockerfile RUN steps (no secret persistence)
- Forward NIX_CONFIG to test and deploy containers
https://chatgpt.com/share/6947c681-abc8-800f-ba12-de2ff3a7abad
kevinveenbirkenbach