diff --git a/.planning/STATE.md b/.planning/STATE.md index daf7f10..e8cd6b4 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -28,7 +28,7 @@ See: .planning/PROJECT.md (updated 2026-06-10) Phase: 08 (gitea-ci) — COMPLETE Plan: 4 of 4 (08-04 complete) Status: Phase 08 complete — all 4 plans executed, CI-01 + CI-02 delivered -Last activity: 2026-06-11 -- 08-04 complete; publish job green (run #14): both tags pushed, PAT masked, REGISTRY_PAT naming fix applied. Phase 8 fully complete. +Last activity: 2026-06-11 -- Quick task 260611-ozt: split publish into standalone push-only publish.yml (kills orphaned CI / publish (pull_request) pending status, WR-01); release model documented in README + publish.yml. Branch-protection contexts unchanged. ## Performance Metrics @@ -181,6 +181,7 @@ Recent decisions affecting current work: | 260610-jlp | Fix broken "How to enable" link in notifications-blocked UI (Phase 5 UAT Test 4) — extracted InstructionSheet into a shared component; SettingsSheet "How to enable" now opens the OS-step instructions instead of just closing the sheet. 187 pwa tests pass, build green | 2026-06-10 | f82837c | Verified | [260610-jlp-fix-broken-how-to-enable-link-in-notific](./quick/260610-jlp-fix-broken-how-to-enable-link-in-notific/) | | 260610-k1z | Persist OIDC session cookie (AUTH-02) — @hono/oidc-auth 1.8.3 sets a session-scoped `oidc-auth` cookie (no maxAge) so it died on PWA/browser close → re-login almost every return (both devices). Added persistSessionCookie middleware re-issuing the cookie with maxAge(=OIDC_AUTH_EXPIRES)+SameSite=Lax, ONLY when a valid session exists (no resurrection guard). NOT an Authelia/refresh issue. 14 auth tests pass | 2026-06-10 | 8343fad | Verified | [260610-k1z-persist-oidc-session-cookie-with-maxage-](./quick/260610-k1z-persist-oidc-session-cookie-with-maxage-/) | | 260610-ka9 | Fix silent Android push (Phase 5 UAT Test 4) — SW showNotification had only {body,tag,data} → Android Chromium/Edge showed them silently. Added icon/badge/renotify:true/vibrate; generalized re-enable instructions to Chrome-or-Edge. iOS unaffected. Build emits sw.js with renotify; 187 pwa tests pass | 2026-06-10 | c864fc4 | Verified | [260610-ka9-fix-silent-android-push-notifications-en](./quick/260610-ka9-fix-silent-android-push-notifications-en/) | +| 260611-ozt | Split publish job into standalone .gitea/workflows/publish.yml (on: push→main only, no redundant event-guard if:; MILESTONE env moved with it) and strip it + the push trigger from ci.yml — kills the orphaned `CI / publish (pull_request)` pending status (phase-8 code-review WR-01). name:CI + fast-checks/api/harness job ids held stable so the required branch-protection contexts stay valid. Documented the release model in README "Publishing / Releases" + publish.yml header. Both YAML validated (yq) | 2026-06-11 | 92353e1 | | [260611-ozt-split-publish-job-into-standalone-gitea-](./quick/260611-ozt-split-publish-job-into-standalone-gitea-/) | ## Deferred Items diff --git a/.planning/quick/260611-ozt-split-publish-job-into-standalone-gitea-/260611-ozt-SUMMARY.md b/.planning/quick/260611-ozt-split-publish-job-into-standalone-gitea-/260611-ozt-SUMMARY.md new file mode 100644 index 0000000..8657bd1 --- /dev/null +++ b/.planning/quick/260611-ozt-split-publish-job-into-standalone-gitea-/260611-ozt-SUMMARY.md @@ -0,0 +1,92 @@ +--- +phase: quick-260611-ozt +plan: 01 +subsystem: ci +tags: [gitea-actions, ci, publish, workflow-split] +dependency_graph: + requires: [] + provides: [standalone-publish-workflow, clean-ci-pr-statuses] + affects: [.gitea/workflows/ci.yml, .gitea/workflows/publish.yml, README.md] +tech_stack: + added: [] + patterns: [push-only-publish-workflow, branch-protection-safety-gate] +key_files: + created: + - .gitea/workflows/publish.yml + modified: + - .gitea/workflows/ci.yml + - README.md +decisions: + - "D-OZT-01: Safety gate is branch protection on main (not needs:) — publish.yml runs in a separate workflow invocation from ci.yml PR jobs" + - "D-OZT-02: README is the documentation home for the release model (not a separate docs/RELEASE.md) — consistent with this project's single-maintainer pattern" + - "D-OZT-03: Dropped the redundant if: github.event_name == 'push' guard — push-to-main trigger in publish.yml fully replaces it" +metrics: + duration: ~5 minutes + completed: "2026-06-11" + tasks_completed: 2 + tasks_total: 2 + files_changed: 3 +--- + +# Quick Task 260611-ozt: Split publish job into standalone Gitea workflow + +Split the `publish` job out of `.gitea/workflows/ci.yml` into a new standalone `.gitea/workflows/publish.yml`. Mechanical refactor — no CI behavior change beyond the split. + +## What Changed + +### .gitea/workflows/publish.yml (created) + +New standalone push-only workflow: +- `name: Publish`, `on: push: branches: [main]` only +- Workflow-level `MILESTONE: v1.1` env (moved from ci.yml) +- Single `publish` job with all four steps verbatim from ci.yml: checkout, compute image tags, docker login, build+push, docker logout +- All inline comments preserved including load-bearing rationale (Pitfall 13 PAT-via-stdin, D-PAT-NAMING REGISTRY_PAT naming, T-08-10 build-from-repo-root, D-04 two-tag scheme) +- Header comment block documenting trigger, tags, REGISTRY_PAT requirement, safety gate, and MILESTONE bump instruction +- Dropped the redundant `if: github.event_name == 'push' && github.ref == 'refs/heads/main'` guard — push-to-main trigger is sufficient + +### .gitea/workflows/ci.yml (modified) + +- Removed `publish:` job (was lines 314-362) +- Removed `push: branches: [main]` trigger — now `pull_request` only +- Removed workflow-level `env: MILESTONE: v1.1` block (was only referenced by the publish job) +- `name: CI` unchanged +- Job ids `fast-checks`, `api`, `harness` unchanged +- `if: github.event_name == 'pull_request'` guards on all three jobs unchanged + +### README.md (modified) + +Added "Publishing / Releases" section between "Deployment" and "License" covering: +- Auto-trigger on push to main (PR merge) +- Image name and two-tag scheme (:latest + :-) +- REGISTRY_PAT secret requirement and naming rationale +- Branch-protection safety gate (why no needs: in publish.yml) +- How to bump the MILESTONE tag + +## Why This Matters + +`ci.yml`'s `on:` previously included `push:` so Gitea registered a `CI / publish (pull_request)` commit status on every PR that sat pending forever — skipped jobs never resolve their status in Gitea Actions. Moving publish to a push-only `publish.yml` stops this orphaned status from ever being created, keeping PR status views clean and the branch-protection required-checks list unambiguous. + +## Commits + +| Hash | Message | +|------|---------| +| 6efc062 | chore(260611-ozt): split publish job into standalone publish.yml | +| 0c9139b | docs(260611-ozt): document release model in README Publishing/Releases section | + +## YAML Verification + +Both workflow files validated with `docker run --rm -i mikefarah/yq:4 e '.' -`: +- `.gitea/workflows/publish.yml`: **VALID** +- `.gitea/workflows/ci.yml`: **VALID** + +## Deviations from Plan + +None — plan executed exactly as written. The header comment block in publish.yml was created in Task 1 (the plan referenced it as "see Task 2" but it is part of the publish.yml file created in Task 1; both tasks committed separately as planned). + +## Self-Check: PASSED + +- `.gitea/workflows/publish.yml` exists with `name: Publish`, `push:` trigger, `REGISTRY_PAT`, `MILESTONE: v1.1`, no redundant guard +- `.gitea/workflows/ci.yml` has no `publish:` job, no `push:` trigger, no `MILESTONE`, retains `name: CI` and three PR job ids +- `README.md` has Publishing/Releases section with all six required elements +- Commits 6efc062 and 0c9139b confirmed in git log +- Both YAML files parse clean under yq:4