From f16974086a13eaacd0c4553c082ddfff551da9c9 Mon Sep 17 00:00:00 2001 From: Wikid82 Date: Tue, 8 Sep 2026 03:57:09 -0400 Subject: [PATCH 1/2] ci: bump integration image artifact retention to 3 days 1-day retention breaks "Re-run failed jobs" on a run older than 24h now that the suite jobs depend on the upstream build job's artifact instead of building the image themselves. 3 days covers realistic re-run windows at negligible cost. Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS --- .github/workflows/integration-tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml index 2c8cadf03..361b090e2 100644 --- a/.github/workflows/integration-tests.yml +++ b/.github/workflows/integration-tests.yml @@ -50,7 +50,7 @@ jobs: with: name: charon-integration-image path: /tmp/charon-image.tar - retention-days: 1 # Only needed for the duration of this run's fan-out jobs. + retention-days: 3 # Outlives the run so "Re-run failed jobs" still works >24h later (suite jobs no longer self-contain the build). if-no-files-found: error cerberus: From 0423373381d325ac01b444f3c8026f6ff9b14626 Mon Sep 17 00:00:00 2001 From: Wikid82 Date: Tue, 8 Sep 2026 10:04:07 -0400 Subject: [PATCH 2/2] ci: use chore prefix for the toolchain bump-bot commits and PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `open-bump-pr` job in toolchain-image.yml opened its daily digest-refresh PR with a `feat(security):` title and commit message. `feat:` makes release-please cut a minor release on every merge to `main`, so a routine toolchain-digest refresh was bumping the version each time. Switch the bot PR title and commit-message to `chore(docker): refresh bundled proxy toolchain image`, matching the sibling `sync-pin-on-pr` commit style (`chore(docker): sync toolchain image pin to …`). The `security` label is kept; only the conventional-commit prefix changes. Also updates docs/plans/current_spec.md so its bot-PR example and commit-convention note no longer contradict the workflow. Affects future bot PRs only. Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS --- .github/workflows/toolchain-image.yml | 4 ++-- docs/plans/current_spec.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/toolchain-image.yml b/.github/workflows/toolchain-image.yml index c280ab440..4681c6024 100644 --- a/.github/workflows/toolchain-image.yml +++ b/.github/workflows/toolchain-image.yml @@ -426,14 +426,14 @@ jobs: base: development branch: bot/bump-toolchain-image delete-branch: true - title: "feat(security): refresh bundled proxy toolchain image" + title: "chore(docker): refresh bundled proxy toolchain image" labels: | dependencies automated docker security commit-message: | - feat(security): refresh bundled proxy toolchain image + chore(docker): refresh bundled proxy toolchain image Rebuilds the prebuilt Caddy/CrowdSec toolchain image so the shipped binaries pick up upstream fixes, and bumps the digest pin in the diff --git a/docs/plans/current_spec.md b/docs/plans/current_spec.md index 5563182f5..b2411dd01 100644 --- a/docs/plans/current_spec.md +++ b/docs/plans/current_spec.md @@ -158,7 +158,7 @@ The composite action's own doc comment (`action.yml:16-33`) instructs CVE-scan c ### 2.5 Constraints from `CLAUDE.md` / `ARCHITECTURE.md` - All frontend in `frontend/`, backend in `backend/` — unaffected (this is CI/build only). -- Conventional commits; `(security)` scope only for genuine security work, subject line vague. The digest-bump and freshness-guard commits *are* security-relevant — use `feat(security):` / `fix(security):` with vague subjects (e.g. `feat(security): pin bundled proxy toolchain to a scanned prebuilt image`). +- Conventional commits; `(security)` scope only for genuine security work, subject line vague. The initial-pin and freshness-guard commits *are* security-relevant — use `feat(security):` / `fix(security):` with vague subjects (e.g. `feat(security): pin bundled proxy toolchain to a scanned prebuilt image`). The routine daily digest-refresh bot PR uses **`chore(docker):`** — `feat:` there makes release-please cut a minor release on every refresh. - Weekly `nightly → main` promotion PRs merge via **merge commit**. This feature's PR targets `development` (normal flow) — **confirmed it does not touch `weekly-nightly-promotion.yml`** and imposes no new constraint on the promotion merge method. (`weekly-nightly-promotion.yml` carries the app image through unchanged; the toolchain digest pin travels with the Dockerfile like any other line.) - `ARCHITECTURE.md` §"Deployment Architecture / Multi-Stage Dockerfile" (`:1082`), §"Infrastructure" table (`:158`), §"Directory Structure" (`:286`), §"Layer 2: CrowdSec Integration" (`:780`) must be updated (§9). - **Ignore-file check (CLAUDE.md "Ignore Files"):** the new files are `scripts/toolchain-key.sh`, `scripts/verify-toolchain-pin.sh`, `scripts/lib/dockerfile-stage.sh`, `scripts/tests/toolchain-key.bats` (+ `verify-toolchain-pin.bats`, `helpers/toolchain_fixture.bash`), `.github/workflows/toolchain-image.yml`, `docs/ci/toolchain-image.md`. **Correction (Rev 2.1):** the earlier claim that `scripts/` is not copied into the image was wrong — `Dockerfile` `COPY scripts/ /app/scripts/` copies the whole directory into the runtime image (it already ships ~40 `scripts/*.sh` + a pre-existing `.bats`). These four build-only helpers are used only by `toolchain-image.yml` and the `quality-checks.yml` `verify-toolchain-pin` / bats jobs from a plain checkout — never from inside a built container — so **`.dockerignore` now excludes `scripts/tests/`, `scripts/toolchain-key.sh`, `scripts/verify-toolchain-pin.sh`, `scripts/lib/dockerfile-stage.sh`** (blacklist semantics, no `!scripts/…` re-includes to fight). `.github/` and `docs/` are already excluded, so `toolchain-image.yml` / `docs/ci/toolchain-image.md` never enter the context. `.gitignore` — these are source files that must be committed; none matches an existing ignore glob → **no `.gitignore` change**. `.codecov.yml` — shell/bats and YAML carry no Go/TS coverage → **no `.codecov.yml` change**. Recorded explicitly per CLAUDE.md. @@ -571,7 +571,7 @@ open-bump-pr: # event == schedule | workflow_dispatch | workflow_ - peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 base: development branch: bot/bump-toolchain-image # updated in place if already open - title: "feat(security): refresh bundled proxy toolchain image" + title: "chore(docker): refresh bundled proxy toolchain image" labels: dependencies, automated, docker, security body: old→new digest, Trivy CRITICAL/HIGH summary, verification checklist - on failure: actions/github-script → open issue "🚨 Toolchain image rebuild failed"