computer-playbook/docs/changelog/007.000.000-2026-05-08.md

7.0.0 (2026-05-08)

[7.0.0] - 2026-05-08

This major release migrates every role to the new meta/ layout with explicit per-role networks, ports, run_after, and info.yml metadata, introduces a variant-aware matrix-deploy planner, ships a process-wide YAML / file / registry caching stack, promotes 13+ apps from alpha to beta, and adds a lint corpus that pins the new conventions in CI.

Major Changes

• Migrated every role's meta/ to the req-008/009/010/011 layout: per-role services.yml is the single source of truth for service flags, server.yml carries per-role local subnets, ports live next to the service that owns them, run_after / lifecycle move next to the entity, and a new meta/info.yml carries non-Galaxy descriptive metadata
• Replaced the legacy single-pass deploy with a variant-aware combined resolver and per-round include path: each role can declare a meta/variants.yml, the matrix-deploy planner produces one folder per round, and Playwright specs run once per variant
• Routed every YAML touchpoint and every project-tree walk through utils.cache.{yaml,files} and consolidated the cache modules into a single utils/cache/ package; integration tests now share one parse and one walk per make test invocation
• Promoted 13 web-app roles from alpha to beta with full per-role baselines: native OIDC for Joomla via plg_system_keycloak, in-role login-broker for Bluesky (variant A+), real OIDC integration for four further roles, and the matching Playwright SSO coverage
• Added two new pull-through caches: a Sonatype Nexus 3 OSS package cache (req-012) and a registry cache with TLS frontend, override-only gating, and dev-only Compose profiles

Added

• Added new application roles: web-app-opencloud and web-app-opentalk with shared OIDC + LDAP, web-app-hugo for static-site hosting (req-016), web-app-moodle self-built image with OIDC+LDAP hybrid and LDAP-only variants (req-015), web-app-fediwall as multi-wall public-timeline aggregator, plus web-app-mig and web-app-sphinx E2E coverage
• Added the per-role matrix-deploy variant model with folder-per-round inventories, meta/variants.yml declarations, and variant-aware Playwright env wiring
• Added hierarchical /roles// RBAC paths, service-gated Playwright specs, and the WordPress ↔ Discourse round-trip flow
• Added lookup(email) as the shared SMTP resolution layer and wired email integration into pretix, gitlab, openwebui, flowise, and others
• Added the package-cache (Nexus 3 OSS) and registry-cache stacks with inner-build override, TTL env vars, and SPOT documentation
• Added the diff-driven app whitelist for deploy tests, the unified # noqa / # nocheck suppression grammar, and the info.yml per-role metadata file
• Added web-app-keycloak per-app mapper SPOT via filter plugin and shell-script extraction; OpenLDAP schema for Moodle; web-app-mediawiki install/update via composer_install_extension.sh
• Added new lint guards: project-walk, cache-read, project-root-import, noqa-only-ruff-codes, no-direct-yaml, no-inline-multiline-php-in-sh, no-inline-multiline-sql, no-lookup-config-jinja-default, role-meta-layout, web-role-no-web-dependency, run-once-on-shared-services, redundant-bool-patterns, sed-escape, no-sh-pipefail, compose-resource-limits, dynamic-flag, auth-coverage, variant-coverage, variants-services-match

Changed

• Routed every yaml.safe_load / yaml.safe_dump / glob.glob / os.walk / Path.rglob / Path.read_text callsite in tests through utils.cache.{yaml,files} so the project walk and reads are shared across the pytest session
• Reworked the combined resolver to be variant-aware, dropped non-Galaxy keys (license_url, repository, documentation) from meta/main.yml, and consumed web-svc-html via the service registry from web-svc-legal
• Registered web-app-{mastodon,friendica,pixelfed} as shared services for the Fediwall aggregator
• Consolidated update to a single role with per-package-family task files; replaced the MODE_CI flag with a direct RUNTIME check
• Pinned image versions explicitly: SuiteCRM PHP 8.2, Nextcloud 33-fpm-alpine, Moodle PHP 8.3-fpm, Hugo nginx 1.30.0-alpine; opted Ubuntu's docker-compose-v2 out of the package selection
• Migrated Decidim, OpenLDAP schema, Postgres grant-schema, Fider, Odoo OIDC, and svc-db-postgres SQL into dedicated files/*.sql so the inline-multiline-SQL lint stays at zero
• Tightened the compose-resource-limits lint and reconciled the entire role corpus against it
• Adopted the unified # nocheck: <kebab-rule> suppression marker repo-wide; reserved # noqa: markers for real ruff/flake8 codes

Fixed

• Fixed Joomla admin-password handling ($ no longer eaten by bash), plugin manifest waits, and Playwright login hardening
• Fixed Moodle deploy: PHP 8.3-fpm pin, serialized PHP-ext build to avoid modules/ race, dropped msmtp from the FPM healthcheck, aligned meta/services.yml with the image+version mirror convention
• Fixed Nextcloud Talk admin spec, Settings-menu locator drift, Metadata plugin incompatibility, OIDC alt-login click, and the files_bpm plugin entry
• Fixed WordPress multisite wp-config quoting, hardcoded plugin-enable lookups, discourse-integration ordering, and per-variant Discourse toggle gating
• Fixed Mig + Sphinx container_port pointing at a non-existent flat .port key (added a wildcard-path validator)
• Fixed OpenCloud / OpenTalk Playwright OIDC scenarios; added the OpenTalk recorder; fixed OpenCloud SPA wait after the OIDC callback
• Fixed Discourse asset compilation by setting DISCOURSE_FORCE_HTTPS; marked Discourse as a discourse-service provider; dropped the WordPress run_after dep
• Fixed env-test suites: dynamic Fedora release resolution in the cache probe, compose-network discovery for the DiD probe, and oauth2-proxy allowed_groups slash normalization
• Fixed meta drift: req-008 sweep gaps (lost suppressions, silent test breakage, one prod bug), host-bound port collisions on 8071/8072, subnet collisions on 192.168.105.{48,64}/28, and Moodle resource limits
• Fixed utils.cache Ansible coupling: data is importable without ansible, the GID resolver works without ansible, and the YAML cache invalidates per-path entries when mtime/size changes
• Fixed the sys-svc-container package selection on Ubuntu; the Makefile clean target is resilient to container-owned pycache files
• Fixed Bluesky cross-variant recovery + URL-test failures (req-013)

CI and Tests

• Added a diff-driven app whitelist so deploy tests run only against roles touched in the change
• Added the lint corpus for: project-walk / cache-read / project-root-import / no-direct-yaml / no-inline-multiline-php-in-sh / no-inline-multiline-sql / no-lookup-config-jinja-default / role-meta-layout / web-role-no-web-dependency / run-once-on-shared-services / redundant-bool-patterns / sed-escape / no-sh-pipefail / compose-resource-limits / dynamic-flag / auth-coverage / variant-coverage / variants-services-match / Ansible Galaxy schema / inline literal script-block size cap / production Python file-size cap / SPOT-of-truth for domain literals / oauth2 proxy-port allocation
• Added the unified # noqa / # nocheck suppression grammar and the noqa-only-ruff-codes guard that forbids project rules in # noqa:
• Routed every fixture write through utils.cache.yaml.dump_yaml and every fixture read through utils.cache.files.read_text
• Added the rbac-group-path static guard, the run-once guard for shared service-registry roles, the Mattermost SSO-button + onboarding dismissal coverage, and the WordPress discourse-roundtrip + finally-cleanup-bound spec
• Promoted the docker-raw-call guard onto the unified suppression grammar and scoped it to roles/
• Centralized INFINITO_DISTRO / INFINITO_CONTAINER SPOT and moved INFINITO_MAKE_DEPLOY defaults into scripts/meta/env/ci.sh

Contributors

• Kevin Veen-Birkenbach