ansible-lint walked into `.claude/` and tripped on the 0-byte
placeholders `agents`, `commands`, `settings.local.json` left behind
by the Claude Code tooling — load-failure[not-found] is tagged
unskippable so .ansible-lint-ignore can't mute them. Add `.claude/`
to exclude_paths alongside .github/, .venv/, etc. so the pre-push
gate doesn't trip on tooling artefacts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ESLint reported 2 errors after the playwright-spec split refactors:
- `playwright/no-wait-for-navigation` rule "not found" at the inline
disable directive in web-app-fediwall/_shared.js, because the
playwright plugin block was scoped to `playwright.spec.js` only.
- `enterNextcloudLoginThroughVisibleEntryPoint` undefined in the
web-app-nextcloud `_shared.js` module.exports — a refactor
(daefcf146) intentionally dropped the helper but left the export
reference behind.
Widen the playwright plugin glob to `roles/**/files/playwright/**/*.js`
so the same rule set applies to the now-common per-test submodules
(_shared.js, test-*.js splits), and remove the dangling export.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Modern MariaDB images (>=11) dropped the `mysql` symlink, so the
hardcoded `mysql` binary in the mariadb engine spec started failing
with rc=127 ("executable file not found") — visible e.g. in the
Pixelfed users-table check looping through its `until` retries.
Switch `_ENGINES["mariadb"]` to an ordered `binaries=("mariadb",
"mysql")`, try them in sequence, and only fall back when the OCI
runtime reports the exact binary we tried missing — engine-side
rc=127s (SQL errors etc.) are not masked.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The two-line block
# variant pinning every dynamic services.yml flag to false so the
# matrix also exercises the out-of-group_names branch.
sat inside the variant-0 (true-pinning) block of 46 variants.yml files —
inverted relative to its content. Removed across the board along with
the now-orphaned blank line that used to separate it from the
preceding service entry.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The early `/opt/compose/${entity}` check in apps.sh skipped redirect-only
entities (cdn, css, asset, file — no compose stack, only nginx vhost
files) before nginx.sh could run, leaving their per-domain vhosts
behind across matrix-deploy variant transitions.
Concretely chess CI Run 25997888664: variant-0 deployed web-svc-css
which rendered css.infinito.example.conf; the inter-round purge for
variant-1 skipped css with `\!\!\! WARNING: /opt/compose/css not found`;
the vhost survived; hlth-csp's headless browser then probed
https://css.infinito.example/ and got ERR_CERT_COMMON_NAME_INVALID
(the surviving vhost falls back to the default_server cert).
Moves the compose-dir guard from the entity-collection loop into the
purge loop and runs nginx.sh unconditionally before the
compose-dependent purges. The else branch prints the skip reason so
operators retain the trace signal for redirect-only entities.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This reverts commit 94a721414144f710a51c540aa9e441df841bf46088.
Symmetric drift detection broke matrix-deploy variant transitions: when
variant-1 has a smaller wanted_sans set than variant-0, the cert gets
regenerated with the reduced SAN list, dropping coverage for vhosts
left over from variant-0 (concretely chess CI Run 25997888664 — css.*,
cdn.*, asset.*, file.* lost their SAN coverage, hlth-csp then hit
ERR_CERT_COMMON_NAME_INVALID on those hosts).
Going asymmetric again accepts the prior trade-off (env-suite Run
25774452286 may re-regress: dashboard.* SAN stays in cert after
dashboard is dropped, default_server fallback serves the still-valid
cert, probe gets 301 instead of expected 000). Reopens that surface
intentionally — the real fix is at the vhost-purge layer (apps.sh
skips redirect-only entities, leaving their vhost files behind), not
at the cert-drift layer.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes prose block comments, JSDoc headers, and multi-line nocheck
rationale paragraphs added in the previous two commits — keeps only
the bare nocheck markers (which carry actual exception semantics
the lint test enforces) and the unchanged function/test bodies. No
behaviour change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The compose service mounted /opt/compose/friendica/volumes/ldapauth.config.php
unconditionally, but tasks/02_ldap.yml only renders the file when
FRIENDICA_LDAP_ENABLED is true. On the ldap-off variant Docker therefore
created an empty directory at the mount target, and Friendica's
ConfigFileManager threw "Failed to open stream: Success" on every
console boot. Gate the volume entry on the same flag as the render
task.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the shared `assertInjectedAssetLoadsWithoutCspBlock(page, opts)`
helper in personas/utils/csp.js. It installs the CSP violation
observer, navigates the consumer URL with `waitUntil: networkidle`,
and asserts both:
1. the browser observed a successful 2xx/3xx response for the
requested resourceType(s) from one of the injector hosts, AND
2. no `securitypolicyviolation` event named one of those hosts as
its `blockedURI`.
Closes the loophole where the markup-only checks would pass even
when the consumer's CSP `style-src` / `script-src` did not whitelist
the injector host — the `<link>` / `<script>` was in the HTML but
the browser silently dropped the load.
Wires the helper into the three consumer-injection provider specs:
- web-svc-css: replaces the HTML-regex link check with the helper
(`stylesheet` resource type, css.* + cdn.* hosts).
- web-svc-logout: extends the existing `logout.js`-in-HTML check with
the helper (`script` resource type, cdn.* host). Adds CDN_BASE_URL
to the env template since logout.js is served from the CDN.
- web-app-matomo: extends the per-consumer tracker test with the
helper (`script` resource type, matomo canonical host) before the
existing `_paq` / `matomo.php` markup tokens, so the matomo.js
async fetch after DOMContentLoaded is verified end-to-end.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the web-svc-css provider Playwright spec that mirrors the
dashboard/prometheus SPOT-provider pattern: emits CSS_TARGET_ROLES_JSON
via roles_with_service('css') and asserts every consumer's canonical
surface indexes a <link rel="stylesheet"> pointing at the shared CSS
asset host (CSS_BASE_URL / CDN_BASE_URL). The baseline test exercises
CDN reachability first so per-consumer failures unambiguously point
at the consumer's sys-front-inj-css wiring, not at the provider.
Suppresses the per-role playwright env-services-match guard above each
consumer's `css:` key with the canonical `# nocheck:
playwright-service-flag — verified by web-svc-css provider spec`
marker. web-svc-css/meta/services.yml gets the self-provider nocheck
on `css:` and `provider role; no consumer surface to gate` nochecks on
`cdn:` / `matomo:`.
Adds css.{enabled,shared} true/false pinning to every variants.yml
that declared the dynamic flag without coverage so
test_every_dynamic_flag_has_true_and_false_variant passes. Unifies
the css service declaration across espocrm / mediawiki / openproject
(was static enabled: false, shared: true) so the matrix matches the
rest of the consumer fleet.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A reuse-kept redeploy that flips variants (e.g. v0 → v1) left the
previous variant's compose.ca.override.yml on disk; `compose config
--quiet` then failed with "service <X> has neither an image nor a build
context specified" because the stale override declared services no
longer present in the freshly-rendered compose.yml. Moving the Generate
CA trust override handler ahead of Validate (and the rest of the
compose-up chain) makes the override self-heal each run. The inject
command resolves services from compose.yml + compose.override.yml with
include_ca=False so it cannot deadlock on its own stale output.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Split each role's playwright.spec.js into `_shared.js` (env, login/post
helpers, lifecycle hook) plus one `test-*.js` per scenario, registered
from the orchestrator via `require().register(shared)` — matches the
pattern already used by web-app-pixelfed and web-app-taiga so each test
stays atomar and individually inspectable.
Adds two new friendica tests:
- test-anonymous-profile-view.js: pins the oauth2-proxy ACL whitelist
for `/profile/` by asserting an anonymous visitor reaches biber's
profile without being bounced to Keycloak. Materialises the friendica
user row through the LDAP login path first since the profile would
otherwise 404.
- test-admin-follow-biber.js: exercises the local-instance follow flow
end-to-end (POST `/contact/follow` → 302 → `/contact/<id>` with
biber's nick@host on the contact detail page).
Also extends `web-app-friendica/meta/services.yml` `services.oauth2.acl`
with the whitelist surfaces (federation/discovery, public profile +
community feed, theme assets, instance-info pages) the new
anonymous-profile-view test pins.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add the leading `---` document marker to five `meta/variants.yml` files
and align the false-pinning comment with its block in the decidim and
mini-qr variants so the YAML files follow the same shape across roles.
No behavioural change — comments do not affect the YAML data model.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move the Talk env vars, settings-text scraping helpers, spreed
test-button verifier, and the former `verifyNextcloudTalkAdminSettings`
flow out of `_shared.js` into `test-talk-admin-settings.js` so the gate
flag, env-presence guard, and assertion logic live in a single module.
Drop the redundant `verifyNextcloudTalkAdminSettings` calls from the
admin OIDC and native login specs — the dedicated Talk test now owns
that coverage. Add `talk: true` / `talk: false` variant pins for the
new dynamic `services.talk.enabled` flag so coverage stays complete.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Invert dependency direction: talk service is now driven by
`web-svc-coturn in group_names` and the spreed plugin follows
`services.talk.enabled` via config lookup. Adjust turn_server
onboard/standalone flags to match coturn group presence.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mirror the taiga/pixelfed pattern: `playwright.spec.js` shrinks from a
834-LOC monolith to a 28-LOC orchestrator that wires `beforeEach` and
require()s one test module per scenario; all shared env, locator,
modal, login/logout and Talk-admin verification logic moves to
`_shared.js`. Each test stays atomar and individually inspectable via
its filename.
Login coverage is now persona × flavor instead of one monolithic
"nextcloud login" that implicitly assumed OIDC:
- test-login-admin-oidc.js skip \!oidcEnabled
- test-login-admin-native.js skip oidcEnabled (uses
NEXTCLOUD_DIRECT_LOGIN_PASSWORD
via the shared
login helper)
- test-login-biber-oidc.js skip \!oidcEnabled
- test-login-biber-ldap.js skip oidcEnabled || \!ldapEnabled (biber is
not autoprovisioned
in pure-native NC)
Persona scenarios (guest / biber / administrator post-login flows) keep
delegating to the shared `runGuestFlow` / `runBiberFlow` / `runAdminFlow`
helpers and stay universal across all variants.
Also drops an unused helper (`enterNextcloudLoginThroughVisibleEntryPoint`)
that the deleted always-on `test-nextcloud-login.js` was the only
consumer of.
Reason: the lookup only consulted services.ldap.enabled, so even with OIDC
fully disabled it would still return "sociallogin" (or "oidc_login" when
LDAP was on). Nextcloud's services.yml then enables the matching OIDC
plugin, which redirects to Keycloak — but the Keycloak client's
redirectUris correctly excludes apps with oidc.enabled=false, so the
handoff dies with "Invalid parameter: redirect_uri". Caused all 3
nextcloud variant-1 Playwright errors (`nextcloud login`,
`nextcloud talk admin settings`, `biber logs into nextcloud via OIDC`).
The lookup now short-circuits to "" when oidc.enabled is falsy, which
makes all three plugin gates (oidc_login, sociallogin, user_oidc) compare
false and 06_setup_plugin.yml's disable branch take over. Existing
flavor-selection paths (oidc.enabled=true) are unchanged. Adds two
regression tests covering the new short-circuit and updates the
`_apps` test helper to default oidc.enabled=true so existing
flavor-selection tests stay focused on the ldap/flavor axis.
Reason: an unrendered `{{ lookup('env', 'DOMAIN') | default(...) }}` value would
otherwise propagate verbatim into CURRENT_PLAY_DOMAINS / CURRENT_PLAY_REDIRECT_DOMAINS
and end up as an nginx `server_name` — emitting `{{`/`}}` into a vhost makes nginx
fail with `directive "server_name" is not terminated by ";"`, breaking all roles
that share the openresty validation (observed on web-svc-asset/-legal/-file).
The filter now eagerly resolves domain_primary via the existing
`render_ansible_strict` env-lookup fallback, and `_add_default_domain` fails
loudly if any Jinja marker still survives. Adds two regression tests covering
the env-lookup path and the fail-fast guard.
Web Development Iteration prompt now spells out the in-container loop
explicitly: for every failing Playwright test, follow the inner-loop
procedure in role.md together with playwright.md; before every
redeploy run `make exec` and `make run` against the live stack and
fully fix and inspect every failure in-container; the next deploy
iteration only starts once every error is resolved and the fix is
empirically verified. Adds explicit prohibitions on commit/push and
on `ask`-mode approvals, and forbids premature termination — the
iteration is finished only when every role is green end-to-end.
Strips the `Use mode /caveman ultra` postscript from every other
prompt: it was an experimental mode marker that no longer applies
and only added noise. The prompts now stop at the standard
`act autonomously …` sentence.
Reformatted to comply with documentation.md: complete sentences
instead of semicolon chains, no em-dash thought breaks, RFC 2119
keywords used consistently.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Same scope as ad47be06e / 68053913b extended to web-app-gitlab:
add the `---` document marker and reindent per-variant inline
comments to align with the list-item depth.
No functional change — variant payloads are byte-identical.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captures the unified `services.sso.{flavor,...}` target schema, the
per-role mapping for the 3 dual-block roles (bookwyrm → oauth2,
gitea/friendica → oidc), the 6-layer touchpoint inventory, the 7-step
atomic migration sequence, and the validation set. Plan only; no code
changes yet.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The bespoke `taiga login and logout` test always failed with a 60s
Keycloak-username-field timeout because `page.goto(baseUrl + "/")`
auto-redirects to `/discover` (a public showcase that exposes a top-
of-page `Login` link but NOT the SSO button). The detector matched the
discover-page `Login` link, classified the page as `taiga-login-page`,
clicked it, then immediately waited for the Keycloak username field —
never re-detecting the OIDC entry on `/login`. Trace from the live
stack confirmed: no request to `/oidc/authenticate/` was ever made.
Two-part fix in the OIDC login flow:
- `page.goto(baseUrl + "/login")` directly so the SSO button is on
the first navigated view and the Angular `tg-oidc-login-button`
directive has bound its click handler by the time we click.
- In the `taiga-login-page` branch, re-detect via
`waitForTopLevelLoginRequirement` after the Login-link click so the
SSO entry can be clicked before we expect the Keycloak URL.
Verified empirically against the live taiga stack via `make run` —
the test now passes in 4s and the trace shows the full Keycloak
round-trip (POST `/login-actions/authenticate?session_code=...` →
302 `/oidc/callback/?code=...` → 200 `/login?id=…&username=…`).
Also splits the spec into one file per test scenario, mirroring the
pixelfed layout (a66fb1d48):
- `playwright.spec.js` orchestrator: `test.use` + `beforeEach` +
`require()`
- `_shared.js` env, locator helpers, OIDC + native login/
logout flows, `beforeEach`
- `test-login-oidc.js` OIDC/oauth2 round-trip; skipped when both
services are off
- `test-login-native.js` NEW — drives Taiga's stock `/login` form
(LDAP federation when `loginFormType=ldap`,
local DB otherwise) against the same
`loginUsername` + `loginPassword` env;
skipped when either OIDC or oauth2 is on
(the OIDC test owns that journey)
- `test-public-discover.js`
- `test-themed-routes.js`
- `test-guest-persona.js`
- `test-biber-persona.js`
- `test-administrator-persona.js`
Gating logic on the two login tests is complementary: variant 0
(OIDC on) runs the OIDC test and skips the native one; variant 1
(everything off) does the inverse. Together they cover both auth
flavours without duplication.
The deploy's existing `with_fileglob: "*.js"` copies every companion
module into `tests/`; Playwright's testMatch only discovers
`playwright.spec.js`, so the `test-*.js` modules are pure `require()`
targets, not auto-discovered specs. The persona-naming and
service-env-gate lints already glob the role's playwright dir (set up
in a66fb1d48), so the split layout passes both without further
changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Replace 13 raw `container exec mysql/psql` invocations across
web-app-pixelfed, web-app-fider, and web-app-mattermost with the
canonical `database_query` module + `query_file:` + `named_args:`
pattern. The module already speaks both shared (central `svc-db-*`)
and non-shared (per-role `<entity>-database`) modes via the
`database` lookup, so the same task shape works regardless of DB
topology — the per-role hardcoded container-exec argv was the only
blocker.
- Extract every inline SQL body into per-role `files/sql/` trees.
Pixelfed splits further into `files/sql/oidc-mapping/` because the
OIDC-mapping cluster is a distinct concern from the bootstrap /
administrator queries. Each SQL file is single-purpose and named by
verb-noun (count-users, select-admin-id, upsert, etc.) to match the
precedent set by web-app-odoo.
- Fider's existing `files/{create_admin_user,configure_oidc_provider}.sql`
move to `files/sql/` and switch from psql-specific `:'var'`
variable substitution (which forced `stdin:` piping with `-v`
flags) to engine-neutral `%(name)s` placeholders the module
escapes per backend.
- Pixelfed loses `PIXELFED_MARIADB_ARGS` + 3 derived DB vars
(`*_CONTAINER`, `*_USERNAME`, `*_PASSWORD`) from `vars/main.yml` —
they were the manual argv bundle for the old container-exec
pattern and become orphan once `lookup('database', application_id)`
takes over.
- Every refactored task carries `mask_values:
MASK_CREDENTIALS_IN_LOGS` (module-level credential redaction);
tasks that previously used `no_log: MASK_CREDENTIALS_IN_LOGS`
keep both directives so the task-level masking stays alongside
the module-level one.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Same scope as 68053913b extended to 5 more roles: add the `---`
document marker and reindent per-variant inline comments to align
with the list-item depth so the file reads as a flat YAML sequence
of overrides instead of mixing top-level and nested commentary.
No functional change — only the YAML header + comment placement
move; the variant payloads are byte-identical.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The bespoke `pixelfed oidc login (biber)` test always timed out at the
1200s Ansible-task wrapper because pixelfed's first-time OIDC user-
creation runs Laravel's `email:strict,filter_unicode,dns,spoof`
validator. Egulias `DNSCheckValidation` hard-rejects any TLD in its
RESERVED_DNS_TOP_LEVEL_NAMES list (`test`, `example`, `invalid`, …)
BEFORE any DNS lookup, so `biber@infinito.example` always fails and
Laravel auto-redirects `back()` to the Keycloak Referer — breaking the
SSO callback chain and never returning to pixelfed.
The fix mutates biber's Keycloak profile to `biber@infinito.nexus` for
the duration of this spec (real TLD, real MX) and restores the original
afterwards via the Keycloak admin API. Verified empirically against
the live stack: `pixelfed oidc login (biber)` was 1200s timeout, is
now 20s pass; the `afterAll` restorer puts `biber@infinito.example`
+ `emailVerified=true` back cleanly.
Also splits the spec into one file per test so each scenario stays
atomar and individually inspectable:
- `playwright.spec.js` orchestrator: `test.use` + lifecycle + `require()`
- `_shared.js` env, locator candidates, login/logout flow,
keycloak admin helpers, `beforeAll`/`afterAll`
- `test-oidc-login-biber.js`
- `test-oidc-login-administrator.js`
- `test-native-login-administrator.js` new — exercises pixelfed's
stock email+password `/login` form (no infinito-specific selectors),
gated to run only when OIDC is disabled
- `test-guest-persona.js`
- `test-biber-persona.js`
- `test-administrator-persona.js`
The deploy's existing `with_fileglob: "*.js"` copies the companions
into `tests/`; Playwright's testMatch only discovers `playwright.spec.js`
so the `test-*.js` modules are pure `require()` targets, not auto-
discovered specs.
Updates two lints to scan the whole `files/playwright/` directory so
both monolithic and split layouts pass:
- `tests/lint/ansible/roles/web-app/playwright/persona/test_naming.py`
aggregates persona titles across all sibling `.js` files.
- `tests/integration/roles/playwright/test_spec_env_gates.py`
globs `*.js` for service-gate helper calls instead of reading only
the main spec.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add the missing `---` document-start marker to two `meta/variants.yml`
files and re-indent the inline comment in web-app-mattermost so it
aligns with its enclosing block, matching the convention applied across
the other variants files in 5cfb24277.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The `image` lookup inferred `role_id` from `role_name` when only
`service_name` was passed. Inference broke lazy re-evaluation: a default
like `HEALTH_CSP_IMAGE: "{{ lookup('image', 'csp-checker', 'ref') }}"`
defined in sys-ctl-hlth-csp got re-evaluated inside sys-service's
systemctl.service.j2 template (via `system_service_tpl_exec_start`),
where `role_name='sys-service'`. The lookup then searched
`roles/sys-service/meta/services.yml` for `csp-checker` and aborted with
`no image mapping found for role 'sys-service' service 'csp-checker'`.
CI run 25976825584 surfaced this on six apps (web-app-{bridgy-fed,chess,
mig,hugo,mini-qr,postmarks}) whose deploy reached sys-svc-webserver-core
outside the service-loader preload context, which is what actually
triggers the sys-ctl-hlth-csp -> sys-service include chain.
Make `role_id` mandatory in the plugin signature, remove `_infer_role_id`,
and update the three callsites that relied on inference
(sys-ctl-hlth-csp, sys-svc-container, test-e2e-playwright) to pass the
owning role id explicitly. A migration guard catches the removed
`(service_name, want)` form and emits a clear error instead of the
confusing "missing services.yml" file-not-found message.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add the leading `---` document marker and align top-level comments
with the indentation of the YAML block they describe, across 16
additional web-app and web-svc variant files surfaced by the
autoformatter sweep. No semantic changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Matrix-deploy orchestrator now pushes `VARIANT_INDEX` (0-based round
id) alongside the existing `ASYNC_ENABLED` extra var for both PASS 1
(sync) and PASS 2 (async) runs. Test-e2e-playwright's archive step
consumes both to derive a per-(variant, pass) destination so a
subsequent round cannot overwrite the previous one's reports.
- New `roles/test-e2e-playwright/files/archive_playwright_reports.sh`
moves the playwright-junit.xml / playwright-report/ / test-results/
outputs into `variant-<N>/<sync|async>/` under the role's reports
dir, idempotently (re-running the same tuple replaces rather than
fails). `run_one.yml` invokes the script via `ansible.builtin.script`
so the YAML stays a single 7-line task.
- `VARIANT_INDEX: 0` lives in `defaults/main.yml` to keep the variable
defined for dev / non-matrix invocations. Role defaults are not
considered SPOT, so the `| default(0)` belt-and-suspenders inside
the script invocation stays valid against the spot-default lint.
- Summary script now renders an 8-column table: Time | App | Variant |
Pass | Test | Status | Duration | Message. Per-test ISO timestamps
are derived from the JUnit `<testsuite timestamp>` attribute plus the
cumulative duration of preceding cases; file mtime is the fallback
when the attribute is absent. App / Variant / Pass are extracted
from the artefact path layout produced by the archive script.
- Matrix-deploy unit tests refreshed to expect the new
`extra_ansible_vars` shape; summary unit tests gain coverage for
`_to_iso_z`, `_parse_iso_timestamp`, the four supported path
layouts, and the file-mtime fallback (55 tests total).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bespoke `test(...)` blocks that drive a real Keycloak SSO round-trip
(odoo, fider, mattermost, peertube) had no `test.skip(\!oidcEnabled, ...)`
guard. In matrix variants that render `OIDC_SERVICE_ENABLED=false`, the
Playwright locator for the SSO button never resolves; each test waits
300s, retries 2x, and 2-3 such tests in series blow past the 1200s
Ansible task-wrapper timeout — Bundle α odoo variant 1 reproduced this.
Pattern parity with `roles/web-app-moodle/files/playwright/playwright.spec.js`:
import `service-gating`, derive `<flag>Enabled` once, prefix each
affected test with `test.skip(\!<flag>Enabled, "...")`.
- odoo (verified empirically against running variant-1 stack via
`make run`: 4 skipped, 1 passed, 2.2s — was 1200s timeout)
- fider, mattermost, peertube: same pattern, 2 bespoke tests each
- kix: gates on `oauth2Enabled` + `ldapEnabled` instead — the role's
variant matrix has no `oidc` flag, the flow is
KIX → OAuth2-proxy → Keycloak → KIX-LDAP, both can be independently
disabled per variant.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- New `utils/github/playwright_summary.py` parses every
`playwright-junit.xml` under a given artefact directory and prints a
markdown table to stdout with one row per test case: App, Test,
Status (🟢 passed / 🔴 failed / 🔵 skipped), Duration (sub-second
precision), Message. Sub-second formatting keeps useful per-test
signal that integer rounding would erase. Edge cases (missing dir,
no junit files, all-unparseable) emit a friendly placeholder note
instead of crashing. Covered by 26 unit tests in
`tests/unit/utils/github/test_playwright_summary.py`.
- `test-deploy-server.yml` runs the script with `if: always()` after
the deploy step and pipes its output into `$GITHUB_STEP_SUMMARY`, so
every matrix job's run page surfaces a per-app test table without
needing to download artefacts.
- Playwright config adds the `github` reporter so failing tests also
emit inline `::error file=...,line=...::`-annotations directly on the
workflow run page and in PR diffs.
- New lint `tests/lint/filesystem/test_plugin_paths_files.py` enforces
that files under the Ansible plugin source directories declared in
`ansible.cfg` (`action_plugins`, `filter_plugins`, `lookup_plugins`,
`library`, `module_utils`) are Python source files (README.md
exempt). Paths are read live from `ansible.cfg` so a future config
edit automatically extends the lint's coverage. Counterpart to the
existing `test_scripts_folder_files.py` lint that enforces
`scripts/` contains only `.sh`.
Known limitation (pre-existing pipeline behaviour, not introduced by
this change): when a role runs through multiple matrix variants, the
container path `/var/lib/infinito/logs/test-e2e-playwright/<app_id>/`
has no variant component, so each variant overwrites the previous
variant's reports. The summary therefore reflects only the LAST
variant per role. A future change to namespace the reports per
variant (or copy them after each variant pass) will make the table
cover every variant without touching the script or workflow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`# nocheck: url` on the literal wiki.manjaro.org link inside the
README's install snippet. The wiki returns 404 to the URL probe
intermittently while the page itself is reachable when visited
interactively, so the failing external URL test is noise rather than
a real broken reference.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add MCR_REGISTRY constant, is_mcr / mcr_repo / fetch_mcr_tags helpers
mirroring the Docker Hub and GHCR pattern. Tags are fetched via the
Docker Registry V2 API with RFC 5988 Link-header pagination (anonymous
access; MCR is a public read mirror). Wire MCR into both the external
test_image_versions warning surface and the find_outdated_updates
orchestrator in utils.update.docker.
- Bump mcr.microsoft.com/playwright in test-e2e-playwright from
v1.59.1-noble to v1.60.0-noble — the update was surfaced by the new
MCR detection path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Matcher in web-app-prometheus's parametrized scrape test now also
reads `labels.app`. Native scrape jobs (set `app="web-app-<id>"` via
each role's `templates/prometheus.yml.j2` fragment) now match alongside
blackbox-healthz targets. A single iteration asserts up=1 for both
surfaces per consumer, so per-app native tests become redundant.
- Scenario I (`/metricz`) iterates `prometheusTargetRoles` and asserts
each consumer's `app="<role_id>"` label is present in the
lua-resty-prometheus output. Subsumes the per-app metricz-label spot
checks.
- Remove four redundant per-app prometheus tests from web-app-gitea and
web-app-mattermost playwright specs (metricz-label + native-scrape
up=1), drop the orphaned `PROMETHEUS_BASE_URL=` declarations from
their env.j2 files, and clean up `OIDC_ISSUER_URL=` in gitea's env.j2
(only used by the removed scenarios).
- Drop the dead `const prometheusBaseUrl` declarations plus their
eslint-disable shut-up comments from web-app-fider, web-app-odoo, and
web-app-taiga playwright specs, along with the matching
`PROMETHEUS_BASE_URL=` blocks in those roles' env.j2.
- Correct the persona-required-envs lint: only `MATOMO_BASE_URL` is
actually consumed (by `personas/utils/csp.js`). `DASHBOARD_BASE_URL`
and `PROMETHEUS_BASE_URL` were aspirationally required by a lint
whose docstring described persona-collapse behaviour that no persona
implements. Update `_REQUIRED_URLS` and the docstring, and drop the
unused `\!dashboardBaseUrl` token from `_ALLOWED_SKIP_GUARDS` in
test_strict_mode.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The shell wrapper was a thin pipe around an inline PHP heredoc — only
needed because the actual count + retry logic lives in PHP land. Move
the logic into a standalone `verify_addon_hooks.php` so the PHP code
is lintable, syntax-highlightable, and free of double quoting.
The ansible task now pipes the file content via stdin into
`compose exec -T friendica php -- ldapauth 2`. PHP reads the script
from stdin and picks up addon + min-hooks from $argv. Logic
unchanged: count rows in `hook` for `%addon/<X>/<X>.php`, recycle
disable+enable on a miss, re-check, fail loud if still empty.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Gitea's persona OIDC flow goes through Keycloak's account-picker as a
two-step redirect that the shared persona helper cannot navigate
reliably, and Gitea has no bespoke biber/administrator login tests
that would otherwise exercise the real surface. Block both personas
in the rendered Playwright env so the generic flows route through the
documented escape clause and the role can pass the spec while the
helper limitation is addressed separately.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Empirically, `bin/console addon enable ldapauth` on a fresh stack
writes `config[cat=addons,k=ldapauth]` but the Hook::register() rows
from `_install()` are silently dropped — `addon list enabled` passes
while the `hook` table stays empty, so every authenticate hook is a
no-op and biber/admin login silently re-renders the form. The race
recovers on a second disable+enable cycle from a clean shell.
Add a post-sync verifier (verify_addon_hooks.sh) that PDO-queries
the hook table for `%addon/ldapauth/ldapauth.php` and, if fewer than
MIN_HOOKS rows are present, runs one disable+enable cycle and
re-checks. Fails loud on the second miss so the broken state surfaces
in the deploy instead of as a downstream Playwright login regression.
Wire it into 04_addons.yml after the existing addon sync loop,
gated on FRIENDICA_LDAP_ENABLED.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add the leading `---` document marker and align top-level comments with
the indentation of the YAML block they describe, across 9 web-app role
variant files. No semantic changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- New bidirectional contract test ensures `services.prometheus.native_metrics.enabled`
and `roles/<role>/templates/prometheus.yml.j2` stay consistent across the roles tree,
replacing per-role spot checks for gitea/mattermost/matrix. Document the `native-metrics`
suppression rule and apply it to web-app-mattermost (prepared-but-default-off fragment).
- Move every test in `tests/integration/meta/config/` into the per-domain layout under
`tests/integration/roles/meta/{services,server}`. Group prometheus tests under
`services/prometheus/`, repositories tests under `services/repositories/`, the
`server.csp` shape test under `server/`. Move `test_non_empty.py` one level up
(scans all meta/*.yml, not just services.yml).
- Delete `tests/integration/meta/spots/` — both files were only `assertIn` over file
contents (brittle, no behavioural coverage, knowledge belongs in code comments or
proper integration tests).
- Harden `test_project_root_import.py` to catch chained `Path(__file__)…parent.parent.…`
walks (the attribute-access twin of `parents[N]` that previously slipped through).
Refactor 6 surfaced sites to import canonical `PROJECT_ROOT` / `ROLES_DIR`, plus
delete the now-redundant `_find_roles_dir` / `_find_project_root` helpers in
`native_metrics_apps` lookup and `invokable_paths` filter plugin.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI run 25976825584 surfaced a broad failure cluster (web-svc-{file,
html,legal,asset}, bookwyrm, bridgy-fed, mig, mini-qr) where the
rendered nginx vhost configs contained an un-evaluated Jinja
expression as `server_name`:
server_name rdr-domains.{{ lookup('env', 'DOMAIN') | default('infinito.localhost', true) }};
nginx parses `server_name rdr-domains.` (line 3, no `;`), hits `{`
on the next line, and aborts with
`directive "server_name" is not terminated by ";"`.
Bisect points at commit 96e6a3daa which switched the initializer for
`CURRENT_PLAY_REDIRECT_DOMAINS` from a literal `[]` (with
`redirect_domain_mappings | default([])` folded in via merge_mapping)
to using `redirect_domain_mappings | default([])` directly as the
base. The role `web-opt-rdr-domains/defaults/main.yml` defaults
`redirect_domain_mappings: "{{ CURRENT_PLAY_REDIRECT_DOMAINS }}"`,
creating a lazy circular reference: in the new shape, Ansible no
longer forces evaluation of `DOMAIN_PRIMARY` (itself a Jinja-deferred
`{{ lookup('env', 'DOMAIN') | default(...) }}`) at this set_fact, and
the deferred body leaks into the downstream `domain_mappings(...)`
filter that builds entries like `rdr-domains.<DOMAIN_PRIMARY>`. Those
literal Jinja strings end up as `domain` for the redirect template
and reach nginx verbatim.
Restore the original `[]` base + `merge_mapping(redirect_domain_mappings | default([]), 'source')`
pattern. Functionally identical to the pre-96e6a3daa state for this
set_fact; the role-local redirects added by that commit
(web-svc-{asset,css}) stay in place.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The generic `runBiberFlow` / `runAdminFlow` helpers in
roles/test-e2e-playwright/files/personas/{biber,admin}.js single-click
the role's "Sign In" link and expect the next URL to contain
`openid-connect/auth`. Odoo's login page is a two-step OIDC flow
(landing → username/password form with OIDC button below → click OIDC
button → Keycloak), which the helper does not navigate. The
`biber/administrator: app → universal logout` tests fail with
`no in-app logout control reachable on the current authenticated
surface` because the test lands back on the public Odoo landing page.
The role already ships bespoke biber+admin coverage:
- `odoo: admin sso login, verify ui, logout`
- `odoo: biber sso login, verify ui, logout`
Both drive the full OIDC flow through Odoo's own login surface and
both have been passing in CI. The generic persona tests are
redundant for Odoo and add nothing on top.
Set `PERSONA_BIBER_BLOCKED=true` / `PERSONA_ADMINISTRATOR_BLOCKED=true`
in `templates/playwright.env.j2` so the generic helpers cleanly
`test.skip(...)` per the documented escape clause.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI run 25973408947's `test-development` matrix failed on dashboard
variant 1 (all shared services off): three tests ran and failed
because they either had no service gate or their gate pointed at a
flag that stayed literal `true`. Switching dashboard onto the
web-svc-css opt-in pattern plus adding the missing cdn/matomo gates
makes variant 1 skip cleanly while variant 0 keeps running the full
assertion path.
- `meta/services.yml`: migrate the `css` block from hardcoded
`{ enabled: true, shared: true }` to dynamic
`{ "{{ 'web-svc-css' in group_names }}" }` so variant pinning takes
effect on the gate.
- `meta/variants.yml`: add a `css: { enabled: true/false, shared: ... }`
entry to both variant blocks to give the dynamic flag the
two-polarity matrix coverage the lint requires.
- `files/playwright/playwright.spec.js`: add the missing
`skipUnlessServiceEnabled` calls to test 546 (`cdn`) and test 570
(`cdn` + `matomo`). Both tests were ungated; variant 1 ran them
and failed because the resources they depend on were not served.
Verified that variant 0 keeps running every assertion (the gates only
fire when the upstream service is pinned `false`).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
