- Move emojis after headline text (CONTRIBUTING.md, actions/, design/, tools/, tests/)
- Replace em dashes with colons, semicolons, or complete sentences throughout
- Add missing emojis to all headlines in exceptions.md, principles.md, services.md, shell.md, setup.md, pull-request.md, commit.md, act.md, docker.md, pr/README.md
- Update H1 titles to reflect renamed directories (actions/, design/)
- Fix broken relative links in workflow.md after directory moves
- Fix full-path link texts in services.md (style.css.md, javascript.js.md)
- Fix broken principles.md link to lint.md after testing/ → actions/testing/ move
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move iter_role_images + all helpers + ImageRef from cli/mirror/util.py and
cli/mirror/model.py into utils/docker/image_discovery.py; add source_file field
to ImageRef to distinguish config/main.yml vs vars/main.yml entries
- Delete cli/mirror/util.py; update all callers to import from utils.docker.image_discovery
- Move utils into subpackages: utils/docker/ (image_ref, paths_utils, hadolint) and
utils/roles/ (dependency_resolver, resource_validation); update all imports
- Reorganise tests into subpackages: tests/lint/docker/dockerfile/, tests/integration/docker/,
tests/unit/utils/docker/, tests/unit/utils/roles/; fix parents[N] offsets after relocation
- tests/lint/docker/test_image_versions.py now uses iter_role_images (same SPOT as mirror)
- Add vars/main.yml images.<name>.{image,version} support for non-application roles
(test-e2e-playwright, sys-ctl-hlth-csp); eliminate hardcoded duplicates in defaults/tasks
- Add web-app-matrix matrix-chatgpt-bot and web-app-mini-qr mini-qr entries in config/main.yml;
replace hardcoded image strings in vars/templates with lookup('config', ...) references
- Fix sync/__main__.py log line to use correct registry prefix for non-Docker-Hub images
- Update docs/contributing/code/role/dockerfile.md with image declaration rules and SPOT reference
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The test was still pointing to templates/Dockerfile.j2 and checking for
Jinja2 syntax. Update path to files/Dockerfile and assertion to ARG/Docker
variable syntax after the Dockerfile.j2 → files/Dockerfile refactor.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace stale unit test README with a pointer to the canonical unit.md guide.
Add index README to tests/ and per-directory READMEs for e2e, integration,
lint, and regression — each linking to the matching docs/contributing page.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extracts the shared frontend service loader from sys-front-inj-all into
tasks/utils/load_services.yml and tasks/utils/_load_frontend_service.yml,
called once from tasks/stages/02_server.yml before web-svc and web-app
roles. This decouples service loading from per-app injection and makes
load order explicit via SERVICE_REGISTRY entry order. Updates docs,
comments, and adds an integration test enforcing the new SPOT.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add 'email' key (role: web-app-mailu, type: frontend) to SERVICE_REGISTRY
- Declare compose.services.email with enabled: true and shared: true in all
33 app roles that reference web-app-mailu or use SYSTEM_EMAIL_* variables
- Add integration test test_mailu_service_dependency.py that enforces this
constraint for any future role additions
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add shared: true to logout, oauth2, and greenlight services wherever
enabled: true was set without a shared declaration
- Add # noqa: shared comment before role-local internal containers
(redis, worker, web, opensearch, search) that are intentionally
not shared
- Add missing enabled: false to ollama in svc-ai-ollama (shared was
declared without enabled, violating the new consistency rule)
- Add integration test test_service_shared_consistency to enforce:
Rule 1: enabled=true requires shared=true or a # noqa: shared comment
Rule 2: shared key requires enabled key to be present
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds canonical: cdn to css/javascript entries in 20_services.yml so that
role-based reverse lookup (web-svc-cdn → cdn) is deterministic. Updates
_build_role_to_key to use the canonical field. Adds an integration test
verifying bidirectional resolution and a lint test enforcing canonical
consistency rules (exactly one primary, no chaining, matching roles).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Support docker.io/ prefix by stripping it and querying Docker Hub
- Add ghcr.io support via anonymous Bearer token flow (no secrets needed)
- Depth-aware version comparison: version: "15" compares only x tags,
version: "8.3" only x.x tags, version: "2.12.0" only x.x.x tags
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add tests/integration/test_docker_image_versions.py that checks all
roles/web-*/config/main.yml for outdated semver-compatible Docker image
versions against Docker Hub
- Non-Docker-Hub images (ghcr.io etc.) are listed as unchecked with their
current version
- Suppress individual checks with # nocheck: docker-version above version:
- GitHub Actions ::warning:: annotations are emitted in CI
- Add .github/workflows/test-docker-image-versions.yml as standalone workflow
- Integrate workflow into ci-orchestrator.yml
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
