style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -10,30 +10,30 @@ autonomous: false
|
||||
requirements: [CI-01, CI-02]
|
||||
user_setup:
|
||||
- service: gitea-actions-runner
|
||||
why: "CI cannot run without a registered act_runner; 0 runners currently registered on git.bergerhouse.net"
|
||||
why: 'CI cannot run without a registered act_runner; 0 runners currently registered on git.bergerhouse.net'
|
||||
dashboard_config:
|
||||
- task: "Install + register act_runner on the Unraid host against git.bergerhouse.net, prefer Docker-executor mode (service containers require it)"
|
||||
location: "Unraid Community Applications → act_runner template; register with a runner-registration token from Gitea → Site Admin → Actions → Runners"
|
||||
- task: 'Install + register act_runner on the Unraid host against git.bergerhouse.net, prefer Docker-executor mode (service containers require it)'
|
||||
location: 'Unraid Community Applications → act_runner template; register with a runner-registration token from Gitea → Site Admin → Actions → Runners'
|
||||
- service: gitea-registry-pat
|
||||
why: "Publish job (CI-02) authenticates to the Gitea container registry; GITHUB_TOKEN/GITEA_TOKEN cannot push packages"
|
||||
why: 'Publish job (CI-02) authenticates to the Gitea container registry; GITHUB_TOKEN/GITEA_TOKEN cannot push packages'
|
||||
env_vars:
|
||||
- name: GITEA_REGISTRY_PAT
|
||||
source: "Gitea → Settings → Applications → Generate Token with write:package (+ read:package) scope; add as repo secret GITEA_REGISTRY_PAT"
|
||||
source: 'Gitea → Settings → Applications → Generate Token with write:package (+ read:package) scope; add as repo secret GITEA_REGISTRY_PAT'
|
||||
|
||||
must_haves:
|
||||
truths:
|
||||
- "A runner-probe workflow runs on the gsd/phase-08-gitea-ci branch and prints Node/pnpm versions, runner mode, Docker access, action resolution, and Playwright WebKit dep installability"
|
||||
- "The probe surfaces whether the runner is Docker-executor (services: works) or host-executor (docker run fallback needed) — the answer that forks W1/W2 DB bring-up"
|
||||
- "An act_runner is registered and visible in the Gitea Actions runners list (operator action)"
|
||||
- "A GITEA_REGISTRY_PAT repo secret with write:package scope exists (operator action)"
|
||||
- 'A runner-probe workflow runs on the gsd/phase-08-gitea-ci branch and prints Node/pnpm versions, runner mode, Docker access, action resolution, and Playwright WebKit dep installability'
|
||||
- 'The probe surfaces whether the runner is Docker-executor (services: works) or host-executor (docker run fallback needed) — the answer that forks W1/W2 DB bring-up'
|
||||
- 'An act_runner is registered and visible in the Gitea Actions runners list (operator action)'
|
||||
- 'A GITEA_REGISTRY_PAT repo secret with write:package scope exists (operator action)'
|
||||
artifacts:
|
||||
- path: ".gitea/workflows/runner-probe.yml"
|
||||
provides: "Probe-only workflow answering runner unknowns P-01..P-13"
|
||||
contains: "runner-probe"
|
||||
- path: '.gitea/workflows/runner-probe.yml'
|
||||
provides: 'Probe-only workflow answering runner unknowns P-01..P-13'
|
||||
contains: 'runner-probe'
|
||||
key_links:
|
||||
- from: ".gitea/workflows/runner-probe.yml"
|
||||
to: "the registered act_runner"
|
||||
via: "runs-on: ubuntu-latest (runner has no self-hosted label), on: push to gsd/phase-08-gitea-ci"
|
||||
- from: '.gitea/workflows/runner-probe.yml'
|
||||
to: 'the registered act_runner'
|
||||
via: 'runs-on: ubuntu-latest (runner has no self-hosted label), on: push to gsd/phase-08-gitea-ci'
|
||||
pattern: "runs-on:\\s*ubuntu-latest"
|
||||
---
|
||||
|
||||
@@ -60,9 +60,10 @@ Output: `.gitea/workflows/runner-probe.yml`, a registered runner, and a stored r
|
||||
</context>
|
||||
|
||||
<artifacts_this_phase_produces>
|
||||
|
||||
- `.gitea/workflows/runner-probe.yml` (NEW — this plan)
|
||||
- `.gitea/workflows/ci.yml` (NEW — Plans 02/03/04)
|
||||
</artifacts_this_phase_produces>
|
||||
</artifacts_this_phase_produces>
|
||||
|
||||
<tasks>
|
||||
|
||||
@@ -104,6 +105,7 @@ Output: `.gitea/workflows/runner-probe.yml`, a registered runner, and a stored r
|
||||
Do NOT include P-12 (docker login/push) here — defer registry login to Plan 04 to avoid exercising the PAT before the publish job is designed. Add a final summary step that echoes a one-line verdict per fork (Docker vs host mode; cache usable y/n; WebKit deps ok y/n; upload-artifact fork works y/n) so the SUMMARY can record the answers.
|
||||
|
||||
Keep the workflow non-destructive: no migrations, no pushes, no writes to main. All probe steps that may fail on this runner use `continue-on-error: true` or `|| true` so the probe reports findings instead of red-failing on an expected unknown.
|
||||
|
||||
</action>
|
||||
<verify>
|
||||
<automated>test -f .gitea/workflows/runner-probe.yml && grep -q "runs-on: self-hosted" .gitea/workflows/runner-probe.yml && grep -q "healthcheck.sh --connect --innodb_initialized" .gitea/workflows/runner-probe.yml && grep -q "ChristopherHX/gitea-upload-artifact@v4" .gitea/workflows/runner-probe.yml && ! grep -q "actions/upload-artifact@v4" .gitea/workflows/runner-probe.yml && ! grep -q "mysqladmin" .gitea/workflows/runner-probe.yml && echo PROBE_OK</automated>
|
||||
@@ -131,20 +133,22 @@ Output: `.gitea/workflows/runner-probe.yml`, a registered runner, and a stored r
|
||||
</tasks>
|
||||
|
||||
<threat_model>
|
||||
|
||||
## Trust Boundaries
|
||||
|
||||
| Boundary | Description |
|
||||
|----------|-------------|
|
||||
| Boundary | Description |
|
||||
| -------------------------------- | --------------------------------------------------------------------------------- |
|
||||
| CI workflow → self-hosted runner | Untrusted-ish: workflow YAML executes on operator infra with Docker socket access |
|
||||
| Repo secret store → workflow env | PAT crosses into the job; must never echo |
|
||||
| Repo secret store → workflow env | PAT crosses into the job; must never echo |
|
||||
|
||||
## STRIDE Threat Register
|
||||
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
|-----------|----------|-----------|-------------|-----------------|
|
||||
| T-08-01 | Information Disclosure | runner-probe.yml | mitigate | Probe NEVER references `secrets.GITEA_REGISTRY_PAT` or any secret; no `docker login` in the probe (P-12 deferred to Plan 04). Verified by checkpoint log audit. |
|
||||
| T-08-02 | Elevation of Privilege | Docker socket on runner | accept | Docker socket access is inherent to act_runner Docker-executor mode; accepted per Gitea self-hosted docs (08-RESEARCH Security Domain). |
|
||||
| T-08-SC | Tampering | gitea-upload-artifact@v4 (only new external action) | mitigate | [VERIFIED] in 08-RESEARCH Package Legitimacy Audit (github.com/ChristopherHX/gitea-upload-artifact) as the cited Gitea fix for the upload-artifact@v4 GHES block; pinned at @v4. All other actions are official GitHub/Docker actions. No [ASSUMED]/[SUS] packages → no install checkpoint required. |
|
||||
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|
||||
| --------- | ---------------------- | --------------------------------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| T-08-01 | Information Disclosure | runner-probe.yml | mitigate | Probe NEVER references `secrets.GITEA_REGISTRY_PAT` or any secret; no `docker login` in the probe (P-12 deferred to Plan 04). Verified by checkpoint log audit. |
|
||||
| T-08-02 | Elevation of Privilege | Docker socket on runner | accept | Docker socket access is inherent to act_runner Docker-executor mode; accepted per Gitea self-hosted docs (08-RESEARCH Security Domain). |
|
||||
| T-08-SC | Tampering | gitea-upload-artifact@v4 (only new external action) | mitigate | [VERIFIED] in 08-RESEARCH Package Legitimacy Audit (github.com/ChristopherHX/gitea-upload-artifact) as the cited Gitea fix for the upload-artifact@v4 GHES block; pinned at @v4. All other actions are official GitHub/Docker actions. No [ASSUMED]/[SUS] packages → no install checkpoint required. |
|
||||
|
||||
</threat_model>
|
||||
|
||||
<verification>
|
||||
@@ -155,10 +159,11 @@ Output: `.gitea/workflows/runner-probe.yml`, a registered runner, and a stored r
|
||||
</verification>
|
||||
|
||||
<success_criteria>
|
||||
|
||||
- Maps to CI-01/CI-02 prerequisites and Pitfall 12: the runner environment is probed BEFORE any real test/build/publish step is designed.
|
||||
- The Docker-vs-host fork (A1) is answered; the answer is recorded so Plans 02–04 pick the correct DB bring-up path.
|
||||
- Operator infra (runner + PAT) is in place.
|
||||
</success_criteria>
|
||||
</success_criteria>
|
||||
|
||||
<output>
|
||||
Create `.planning/phases/08-gitea-ci/08-01-SUMMARY.md` when done. MUST record the probe fork answers (runner mode, service-container hostname, cache usable y/n, WebKit deps y/n, upload-artifact fork y/n) — Plans 02–04 consume them.
|
||||
|
||||
Reference in New Issue
Block a user