30 Commits

Author	SHA1	Message	Date
Echo	74288e1dfc	fix(ci): add cargo clean and artifact removal before packaging; bump to 1.1.7 ... - Insert 'Clean previous build artifacts' step (cargo clean + rm old .deb) before Build Debian package in both build-deb and build-deb-u2204 jobs. - Bump version to 1.1.7 to ensure a clean build from scratch. - Update debian/changelog with 1.1.7-1 entry.	2026-05-18 17:18:11 +00:00
Echo	f3555c1570	fix(ci): use github.ref_type for upload conditions to fix Gitea runner compatibility	2026-05-17 21:05:43 +00:00
Echo	cea162b048	fix(ci): force IPv4 for rustup download on Alpine runner	2026-05-17 20:35:48 +00:00
Echo	08493fc782	fix(ci): add openssl runtime package for Alpine musl builds	2026-05-17 18:40:47 +00:00
Echo	8b890625f6	fix(ci): disable reqwest default features to eliminate OpenSSL on musl builds ... Requiring default-features=false on reqwest prevents native-tls/openssl-sys from being pulled in as transitive dependencies, which broke static linking on Alpine musl target. Also reverts invalid openssl-static package from CI. - Cargo.toml: add default-features = false to reqwest dependency - ci.yml: revert non-existent openssl-static package	2026-05-17 17:18:35 +00:00
Echo	835c8d79cf	fix(ci): add openssl-static for Alpine musl static linking ... The Alpine build job links against musl which requires static OpenSSL libraries. Adding openssl-static package to resolve -lssl and -lcrypto linker errors.	2026-05-17 17:07:10 +00:00
Echo	8fd7d7620a	fix(ci): add OpenSSL dev dependencies to all build jobs ... Add libssl-dev to Ubuntu-based runners and openssl-devel to Fedora runner to resolve openssl-sys crate compilation failures in CI pipeline. - clippy, test, audit: +libssl-dev - enrollment-tests, verify-enrollment-cli: +libssl-dev - build-deb, build-deb-u2204: +libssl-dev - build-rpm (Fedora): +openssl-devel	2026-05-17 16:48:43 +00:00
Echo	9a129170f8	feat: add self-enrollment workflow for automated PKI provisioning ... - Phase 1: CLI args (--enroll flag), enroll module skeleton, config support - Phase 2: Registration request, polling loop (24h timeout), main.rs integration - Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition - Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline - Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync Security review: APPROVED (0 critical, 0 high findings) Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux	2026-05-17 05:30:42 +00:00
Echo	56de1d73e1	fix(ci): prevent recursive tag triggers and u2204 release duplication ... - Change tag trigger from v* to v*.*.* to prevent recursive CI runs - Upload u2204 deb to same release tag (not creating -u2204 suffix) - Rename u2204 deb filename to include u2204 for differentiation	2026-05-03 02:49:18 +00:00
Echo	6d177c81a4	fix(ci): add apt-get -f install to resolve broken runner dependencies ... Runners may have broken apt state from partial upgrades (e.g., openssh-client version mismatch). Adding apt-get -f install before build deps ensures CI works regardless of runner package state.	2026-05-03 00:31:13 +00:00
Echo	03786d1798	v0.2.0: Fix List Jobs bug, TLS 1.3 enforcement, client_disconnect_timeout, RwLock contention ... Bug fixes: - Fix List Jobs connection reset: Add client_disconnect_timeout (5s) to prevent TLS write truncation - Enforce TLS 1.3 only: Add with_protocol_versions(&[&TLS13]) to rustls ServerConfig - Fix RwLock contention: Release read lock before sorting in list_jobs() - Fix systemd service: Remove ProtectSystem=strict (blocks package management) - Fix systemd service: Change Type=notify to Type=simple (fixes restart hangs) - Fix systemd service: Add DEBIAN_FRONTEND=noninteractive - Fix systemd service: Add ReadWritePaths for apt/dpkg paths CI/CD: - Add Ubuntu 22.04 build job to CI workflow E2E Testing: - Add comprehensive E2E test suite (test_e2e.py) - Tests cover health, packages, patches, jobs, security, and reboot endpoints Other: - Bump version to 0.2.0 - Add lessons learned documentation	2026-05-02 20:59:02 +00:00
Echo	b74d5386d3	fix: resolve all build job failures ... CI workflow (ci.yml): - Proper YAML structure for all steps - curl+tar checkout (act runners lack git) - GITEATOKEN authentication for private repo access - build-essential/gcc added to all jobs - dpkg-buildpackage -d flag (skip apt dep check) Build scripts: - build-alpine.sh: Copy APKBUILD to /home/builduser before abuild - build-arch.sh: Use REPO_DIR variable instead of $(pwd) in su commands	2026-04-27 00:37:51 +00:00
Echo	392a08abb7	fix: resolve all 4 build job failures ... Debian: Add -d flag to dpkg-buildpackage (skip dep check, rustup installed Rust not apt) RPM/Arch: Fix missing run: | YAML syntax in dependency steps Alpine: Fix abuild working directory - use /home/builduser explicitly instead of $(pwd) which referenced act cache path	2026-04-27 00:19:32 +00:00
Echo	256238eae6	fix: add build-essential/gcc for Rust linker ... Rust compilation requires a C compiler (cc) for linking. Act runner containers do not have gcc installed by default. Added build-essential (Ubuntu), gcc (Fedora/Alpine/Arch) to dependency installation steps before Rust compilation.	2026-04-27 00:07:20 +00:00
Echo	9cef189d57	fix: use curl+tar checkout (act runners lack git) ... Act runner containers do not have git installed. Using curl+tar to download repo archive instead. GITEATOKEN secret already verified working independently.	2026-04-27 00:00:49 +00:00
Echo	4956004ab9	fix: match secret name case GITEATOKEN (uppercase) ... Gitea secrets are case-sensitive. The encrypted secret in DB is named GITEATOKEN (uppercase). Workflow was using giteatoken (lowercase) which caused decryption failures in Gitea runner. Also unblocked stuck action_run #166 in database (status=1 queued).	2026-04-26 23:36:43 +00:00
Echo	65465efdfe	fix: SSH checkout bypasses Gitea secret encryption issue ... Gitea logs show: "decrypt secret giteatoken: failed to decrypt by secret, the key might be incorrect" - secrets must be encrypted with Gitea SECRET_KEY, not plaintext in DB. Solution: Use SSH git clone for checkout which requires no secrets. Runners are already registered with Gitea and have SSH access.	2026-04-26 23:29:39 +00:00
Echo	1f2fe167ed	fix: simplified curl+tar checkout now that giteatoken secret is in DB ... Secret was inserted directly into Gitea MySQL database. Checkout now uses simple authenticated curl to download archive.	2026-04-26 23:07:14 +00:00
Echo	7a58cf0303	fix: use SSH git clone for checkout to bypass Gitea API 404 ... Gitea archive API returns 404 for private repos. Switched to SSH-based git clone which uses runner SSH keys for authentication. - Replace curl+tar archive download with git clone over SSH - Add ssh-keyscan for host key verification - Alpine job installs openssh-client and git - All other runners have git/ssh pre-installed	2026-04-26 21:16:07 +00:00
Echo	e1376dd060	fix: add GITEA_TOKEN auth to archive download ... Gitea returns 404 for private repo archives without authentication. Added Authorization header with token to curl command for all checkout steps.	2026-04-26 21:05:01 +00:00
Echo	b72730a7a0	fix: replace git clone with curl+tar for act runner compatibility ... The act runner images do not include git. Previous attempt used git clone which failed with "git: command not found". - Replace all git clone with curl downloading Gitea archive tarball - Use tar to extract the archive into the working directory - No dependency on git for checkout step	2026-04-26 20:52:35 +00:00
Echo	0f0e0169fe	fix: use git clone instead of fetch/checkout for act runner compatibility ... The Gitea runner uses act which does not auto-checkout when using shell commands instead of JS actions. The previous git fetch/checkout failed silently because there was no .git directory. - Replace all checkout steps with git clone into current directory - Add safe.directory config to avoid git ownership errors - Use GITEA_TOKEN for authenticated clone if available	2026-04-26 20:18:58 +00:00
Echo	0e43fe2f6e	fix: quote "on" key in YAML to prevent boolean parsing ... YAML 1.1 reserves "on" as a boolean keyword (meaning True). Without quotes, Gitea Actions could not parse workflow triggers, resulting in no jobs being scheduled. This quotes the key as "on": to ensure it is parsed as a string event trigger key.	2026-04-26 20:13:39 +00:00
Echo	40f7c10a55	fix: replace actions/checkout with manual git commands ... Gitea runners do not have Node.js installed, which is required for all JavaScript-based GitHub Actions including actions/checkout. - Replace all actions/checkout@v4 with manual git fetch/checkout - All checkout logic now uses shell commands only - No JavaScript-based actions remain in the workflow	2026-04-26 20:04:16 +00:00
Echo	007fb7988f	fix: replace JS-based actions with shell commands for Gitea compatibility ... - Remove dtolnay/rust-toolchain (JS action) → use rustup via curl - Remove Swatinem/rust-cache (JS action) → no replacement, builds from scratch - All jobs now install Rust toolchain via shell commands - Alpine job installs rustup directly with musl target support - Ensures compatibility with Gitea Actions runners	2026-04-26 19:40:59 +00:00
Echo	a4026a471a	refactor: update CI for native per-OS runners ... - Replace generic "linux" runner label with dedicated per-OS labels (ubuntu-24.04, fedora, alpine, arch) - Remove all container declarations (native runner execution) - Add build gate dependencies: build jobs need fmt+clippy+test - Extract release upload logic into reusable scripts/upload-release.sh - Fix build-alpine.sh: remove hardcoded container paths, add SKIP_CARGO_BUILD support - Fix build-arch.sh: remove hardcoded container paths, add SKIP_CARGO_BUILD support - Fix build-rpm.sh: remove sudo, native runner compatible - Remove Dockerfile.rpm and Dockerfile.arch (no longer needed) - Add sudo to Ubuntu/Fedora/Arch package installs for safety - Add nodejs to Alpine deps for Gitea Actions compatibility - Make upload-release.sh POSIX sh compatible (Alpine) - Fix curl -sf to curl -s in upload-release.sh (404 on new releases)	2026-04-26 19:21:09 +00:00
Echo	44c182764e	fix: Update dependencies (rand vulnerability fix) and add audit exception for rustls-pemfile (RUSTSEC-2025-0134)	2026-04-24 13:59:13 +00:00
Echo	d4961d5606	fix: Remove release.yml workflow - ci.yml is the single master workflow	2026-04-24 13:49:56 +00:00
Echo	ffb4abaafa	feat: Consolidate CI and Release into single master workflow	2026-04-24 13:15:29 +00:00
Echo	8b49f30774	fix: Move workflows to .gitea/workflows/ for Gitea Actions compatibility	2026-04-14 19:45:08 +00:00