style(13-03): apply Prettier formatting across repo
Mechanical reformat — no logic changes. 398 files changed, 19125 insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc (singleQuote:true, semi:true, tabWidth:2, trailingComma:all, printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
@@ -1,6 +1,6 @@
|
||||
---
|
||||
phase: 08-gitea-ci
|
||||
plan: "04"
|
||||
plan: '04'
|
||||
subsystem: infra
|
||||
tags: [gitea, docker, ci, registry, publish, security]
|
||||
|
||||
@@ -18,11 +18,11 @@ affects: [phase-09, phase-10, phase-11, phase-12]
|
||||
tech-stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "docker login --password-stdin (PAT piped via stdin; -p flag forbidden)"
|
||||
- "dual-tag publish: :latest + :<milestone>-<shortsha> (D-04 traceability)"
|
||||
- "docker build from repo root: -f apps/api/Dockerfile . (Dockerfile requires workspace manifest)"
|
||||
- "docker logout in always() step to drop credential from runner after push"
|
||||
- "Gitea secret prefix exclusion: REGISTRY_PAT not GITEA_REGISTRY_PAT (Gitea reserves GITEA_ prefix)"
|
||||
- 'docker login --password-stdin (PAT piped via stdin; -p flag forbidden)'
|
||||
- 'dual-tag publish: :latest + :<milestone>-<shortsha> (D-04 traceability)'
|
||||
- 'docker build from repo root: -f apps/api/Dockerfile . (Dockerfile requires workspace manifest)'
|
||||
- 'docker logout in always() step to drop credential from runner after push'
|
||||
- 'Gitea secret prefix exclusion: REGISTRY_PAT not GITEA_REGISTRY_PAT (Gitea reserves GITEA_ prefix)'
|
||||
|
||||
key-files:
|
||||
created: []
|
||||
@@ -30,15 +30,15 @@ key-files:
|
||||
- .gitea/workflows/ci.yml
|
||||
|
||||
key-decisions:
|
||||
- "D-PAT-NAMING: Gitea runner silently ignores secrets with the GITEA_ prefix; secret renamed from GITEA_REGISTRY_PAT to REGISTRY_PAT in both the Gitea repo secret and ci.yml (commit 73eecf7). This is the load-bearing fix that unblocked the publish job."
|
||||
- "D-SHELL-FORM: Used shell docker login/build/push (not docker/login-action or docker/build-push-action) — matches 08-RESEARCH §Pattern 6 recommendation; simpler and has no marketplace action dependency."
|
||||
- "D-DUAL-TAG: Two docker push calls for :latest and :v1.1-<shortsha>; same digest, two tags. Traceability tag links image to the exact merge commit."
|
||||
- "D-LOGOUT: docker logout in always() step — drops stored credential from runner regardless of push success/failure (security hygiene)."
|
||||
- 'D-PAT-NAMING: Gitea runner silently ignores secrets with the GITEA_ prefix; secret renamed from GITEA_REGISTRY_PAT to REGISTRY_PAT in both the Gitea repo secret and ci.yml (commit 73eecf7). This is the load-bearing fix that unblocked the publish job.'
|
||||
- 'D-SHELL-FORM: Used shell docker login/build/push (not docker/login-action or docker/build-push-action) — matches 08-RESEARCH §Pattern 6 recommendation; simpler and has no marketplace action dependency.'
|
||||
- 'D-DUAL-TAG: Two docker push calls for :latest and :v1.1-<shortsha>; same digest, two tags. Traceability tag links image to the exact merge commit.'
|
||||
- 'D-LOGOUT: docker logout in always() step — drops stored credential from runner regardless of push success/failure (security hygiene).'
|
||||
|
||||
requirements-completed: [CI-02]
|
||||
|
||||
duration: checkpoint-verified
|
||||
completed: "2026-06-11"
|
||||
completed: '2026-06-11'
|
||||
---
|
||||
|
||||
# Phase 08 Plan 04: Publish Job Summary
|
||||
@@ -58,12 +58,12 @@ completed: "2026-06-11"
|
||||
- Added the `publish` job to `.gitea/workflows/ci.yml`: gated on `github.event_name == 'push' && github.ref == 'refs/heads/main'`, never fires on pull_request.
|
||||
- Run #14 (merge commit 98acff8 pushed to main) confirmed SUCCESS (1m): docker login succeeded, both image tags pushed (same digest sha256:ce724852…) — `familysync-api:latest` and `familysync-api:v1.1-98acff8` present in Gitea Packages API.
|
||||
- Security audit of the CI log passed: PAT masked as `***` throughout (Gitea secret scrubber); `--password-stdin` used exclusively; no `-p`/`--password` form anywhere; `docker logout` ran in the `always()` cleanup step. No plaintext token anywhere in the log.
|
||||
- Identified and fixed the GITEA_-prefix secret naming bug: Gitea runner silently drops secrets whose names start with `GITEA_`; renamed secret from `GITEA_REGISTRY_PAT` to `REGISTRY_PAT` in both the repo secret and ci.yml (commit 73eecf7).
|
||||
- Identified and fixed the GITEA*-prefix secret naming bug: Gitea runner silently drops secrets whose names start with `GITEA*`; renamed secret from `GITEA_REGISTRY_PAT`to`REGISTRY_PAT` in both the repo secret and ci.yml (commit 73eecf7).
|
||||
|
||||
## Task Commits
|
||||
|
||||
1. **Task 1: Add the publish job** - `ebcc38d` (feat)
|
||||
2. **Task 1 fix: REGISTRY_PAT naming** - `73eecf7` (fix — GITEA_ prefix exclusion)
|
||||
2. **Task 1 fix: REGISTRY_PAT naming** - `73eecf7` (fix — GITEA\_ prefix exclusion)
|
||||
3. **Pre-merge cleanup: remove throwaway runner-probe.yml** - `dcf4242` (chore)
|
||||
4. **Task 2: Human-verify checkpoint** — verified green (run #14); no code commit required
|
||||
|
||||
@@ -82,6 +82,7 @@ completed: "2026-06-11"
|
||||
### Auto-fixed Issues
|
||||
|
||||
**1. [Rule 1 - Bug] GITEA_REGISTRY_PAT secret prefix rejected by Gitea runner**
|
||||
|
||||
- **Found during:** Task 1 → human-verify checkpoint (run #14 initially failed login)
|
||||
- **Issue:** Gitea Actions runner silently ignores secrets with the `GITEA_` prefix (reserved namespace). The `GITEA_REGISTRY_PAT` secret was never injected into the job environment, causing `docker login` to fail with an empty password.
|
||||
- **Fix:** Renamed the Gitea repo secret from `GITEA_REGISTRY_PAT` to `REGISTRY_PAT` and updated the ci.yml reference accordingly (commit 73eecf7).
|
||||
@@ -96,7 +97,7 @@ completed: "2026-06-11"
|
||||
|
||||
## Issues Encountered
|
||||
|
||||
The GITEA_-prefix restriction was not documented in the plan or research notes; it was discovered empirically when the first publish run failed at docker login. The fix was straightforward once identified. No other issues encountered.
|
||||
The GITEA\_-prefix restriction was not documented in the plan or research notes; it was discovered empirically when the first publish run failed at docker login. The fix was straightforward once identified. No other issues encountered.
|
||||
|
||||
## Next Phase Readiness
|
||||
|
||||
@@ -107,5 +108,6 @@ The GITEA_-prefix restriction was not documented in the plan or research notes;
|
||||
- Phase 9 (Faster Write-Back) is fully independent and can start immediately.
|
||||
|
||||
---
|
||||
*Phase: 08-gitea-ci*
|
||||
*Completed: 2026-06-11*
|
||||
|
||||
_Phase: 08-gitea-ci_
|
||||
_Completed: 2026-06-11_
|
||||
|
||||
Reference in New Issue
Block a user