5 Commits

Include renames

Author	SHA1	Message	Date
mathias	add5428e2f	ci(cd): call the shared build-image script instead of inlining it (infra#309) ... A template is the highest-leverage copy of anything. This one carried its own inline build step, so every generated repo was born with a private fork of the build logic -- which is how rootless buildah reached a dozen repos before infra#241, and why the fix then had to be rediscovered here weeks after the app repos were done. The step now calls .gitea/build-image.sh, a byte-identical copy of mathias/infra's ci-templates/build-image.sh. Generated repos inherit the script and the call; adding the new repo to infra's adopters.txt puts it under the drift gate. Invoked as `bash .gitea/build-image.sh` rather than relying on the exec bit: files written through the Gitea API land 0644, and a template whose CI depends on a file mode is a trap for every repo generated from it.	2026-08-25 08:52:26 +00:00
mathias	c704fed563	ci: build with buildctl instead of buildah (infra#241) ... Rootless buildah in gitea-runner's hardened securityContext (capabilities: drop [ALL], allowPrivilegeEscalation: false) cannot remap the UID/GID range newuidmap/newgidmap need on a fresh base-image pull, and the pod has no OCI runtime at all. buildctl talks to the host's buildkitd over a socket, so the privileged layer extraction happens on the host and the pod's securityContext stops being in the picture. Same pattern as mathias/infra's segment-embedder.yml and postgres18.yml. A template is the highest-leverage place to fix this. Every repo generated from here inherits its CI, so a buildah-based template does not just carry the bug — it manufactures new instances of it. A fleet inventory for infra#241 found nine repos still invoking buildah, and two of them are the templates. Note the failure is latent, not immediate: warm base-image layers mask it, so a generated repo builds fine until the first genuinely cold pull. That is exactly the situation a NEW repo is in. Verified by running the exact command against this repo's real build context: buildctl --addr unix:///run/buildkit/buildkitd.sock build \ --frontend dockerfile.v0 --local context=. --local dockerfile=. \ --output type=oci,dest=$TAR -> exporting manifest sha256:5a841529... DONE, 6.8MB OCI archive That check matters here because this repo's own CI cannot validate the change: the build job is deliberately skipped on the raw template (2ba2698), since __PROJECT_NAME__ is not a legal image name. The next generated repo is the first place it runs for real. skopeo copy replaces `buildah push` — buildctl has no registry-push equivalent — and runs twice to preserve the :sha and :latest tags the previous version pushed.	2026-08-21 18:29:55 +02:00
mathias	2ba2698ea6	fix(ci): skip build/deploy on the raw template repo itself (template-go-agent#3) ... env.IMAGE: __PROJECT_NAME__ is only substituted with a real, lowercase project name when a repo is *generated* from this template. On the template repo itself it's still the literal placeholder, which buildah/Docker reject outright ("repository name must be lowercase") -- build (and therefore deploy) can never succeed here no matter what else changes. Gate both on github.repository != this template's own path so the template's CI reads green on what it actually validates: the check job (lint/vet/test), the thing every generated repo inherits.	2026-07-24 15:22:04 +02:00
mathias	2c6d1e1149	fix(ci): quote "on" key so Gitea parses workflow triggers ... Bare on: parses as YAML boolean true (Norway problem); Gitea then ignores the triggers and silently skips jobs. Quoting forces the string key.	2026-06-03 08:38:47 +02:00
mathiasandClaude Opus 4.7	b9c64c2694	feat: add agent boundaries, network policy, agent stub, dockerfile, CI ... - AGENT_BOUNDARIES.md: egress allow-list, FS scope, approved/forbidden ops - agent-policy.yaml: k8s NetworkPolicy scoping egress to LiteLLM/brain-mcp/ gitea-mcp/OTLP + default-deny baseline - internal/agent/agent.go: thin ADK runner wrapper (Config + Run) - Dockerfile: distroless multi-stage build, entrypoint cmd/__PROJECT_NAME__ - .gitea/workflows/cd.yml: check → buildah build/push → GitOps deploy Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 20:54:04 +02:00