promote: dev → main (v0.3.0) - #461
Merged
Merged
Conversation
…able The dev front door (vogt-dev.sprooty.com) resolves — even on public DNS — to a LAN-only IP the self-hosted tailnet runner cannot route to, and MagicDNS did not resolve on the deploy runner, so the required public_url input had to be hand-set to the dev stack's raw tailnet IP for the live smoke to reach it. Make public_url an optional override and default the smoke base from the VOGT_DEV_SMOKE_URL repository variable (operator configuration, like VOGT_KOMODO_URL), failing fast with a clear message if neither is set. The variable is set to the runner-reachable dev address; no estate IP is hardcoded in the workflow. Closes #452 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRBLneTGgBt4YkFacu9HD7
The android job installed the Infisical CLI and fetched the dev Firebase config (VOGT_FIREBASE_DEV_JSON) from a private-LAN broker on every non-PR build — the same estate coupling removed from the dev deploy. It also required the infisical binary on the runner and reachability to the broker. Read the dev Firebase config from a plain GitHub Actions secret (secrets.VOGT_FIREBASE_DEV_JSON) written by a new broker-free helper (scripts/write_firebase_config.sh) that writes without echoing and verifies the dev Android client is present. Remove the Infisical CLI install and fetch from the android job. PR builds keep using the sanitized example placeholder. The release (prod) APK build is intentionally out of scope and still fetches its prod Firebase project via Infisical; scripts/fetch_infisical_secret.sh is retained for it. Tests split accordingly. Closes #453 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRBLneTGgBt4YkFacu9HD7
…ndings The static demo image failed the now-fatal Trivy gate with CRITICAL:1 and HIGH:10 — all in the npm CLI the node base image bundles (its own transitive deps: tar CVE-2026-59873, brace-expansion, pacote, sigstore, picomatch, ip-address, ...). The demo runtime only ever runs `node demo-server.mjs`, and that file imports node builtins exclusively, so npm is dead weight. Remove npm/npx (and npm's node_modules) in the demo-runtime stage before dropping to the node user. Verified locally against node:22-bookworm: the flagged packages are present before and gone after, while node and its builtins keep working. Add a regression assertion. Closes #454 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRBLneTGgBt4YkFacu9HD7
Bumps the canonical product version across every user-facing manifest and workflow injection (pyproject, __init__, web/mobile package.json, build.yml, ci.yml gate, product-version test) and records the 0.3.0 changelog. No operation renamed/removed and no schema migration (declared 0015 / observed 0004), so this is a non-breaking minor per opensource.md. check_product_version.py 0.3.0 passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GRBLneTGgBt4YkFacu9HD7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fast-forward promotion of
dev→maincarrying the v0.3.0 release commit (2908bcb) plus the accumulated dev work.Opened manually because the
promoteworkflow is broken (#460 —ghmissing on the self-hosted runner). This PR is still fully gated: thepromotion-policyrequired check validates the dev→main edge and fast-forwardability, andci+runner-policymust pass. The dev deployment receipt thatpromote.ymlwould have checked was genuinely produced (deploy-dev run 33167701773, receipt artifact for2908bcb, live smoke passed).Next:
main → prod, then tagv0.3.0. Production deploy is held for explicit go-ahead.🤖 Generated with Claude Code