gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
89 Commits 1 Branch 0 Tags
0c60ed33e94dbf64fb331c63307cbe7d717cc8f9
Commit Graph
5 Commits
Author SHA1 Message Date
thanhnv ace442da0e Add CASAN CI harness gate 2026-07-06 12:47:18 +09:00
thanhnvandClaude Sonnet 4.6 4386256554 fix(ci): job containers must join gitea_default network to resolve 'gitea' hostname 
The checkout action clones from http://gitea:3000/admin/casan5 — hostname 'gitea'
only resolves on the docker-compose network (gitea_default), not on the default
Docker bridge. Changing container.network: bridge → gitea_default fixes DNS.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 14:22:56 +09:00
thanhnvandClaude Sonnet 4.6 7555e7e800 fix(ci): increase job container memory limit 512m→768m for harness tests 
Sequential jobs (security-gate needs frontend-tests) mean only one container
runs at a time. 768MB + Gitea/Vault/OS ~300MB fits within 1GB+swap headroom.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 13:49:38 +09:00
thanhnvandClaude Sonnet 4.6 6d46e36bf3 fix(ci): remove duplicate docker.sock mount in act-runner options 
act_runner automatically passes /var/run/docker.sock from its own mounts
to job containers. Explicitly adding it in container.options caused
"Duplicate mount point" error, preventing all job containers from starting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 13:13:53 +09:00
thanhnvandClaude Sonnet 4.6 9892e82221 feat(wave5): CI/CD pipeline + Vault KMS + OKR deploy to port 80/3001 
Infrastructure (H3 CI gate, H5 KMS):
- Gitea Actions enabled (GITEA__actions__ENABLED=true)
- act_runner: Docker-outside-of-Docker for deploy job
- Vault Transit RSA-2048 signing keys (casan-audit-key, casan-policy-key)

Vault KMS scripts (H5 governance):
- .specify/scripts/bash/vault-kms.sh — sign/verify/pubkey/ensure-key
- .specify/scripts/bash/sign-audit-head.sh — sign audit chain via Vault
- Updated sign-policy-bundle.sh — Vault path + local fallback
- Updated security-gate.sh — KMS gate added (PASS=11 FAIL=0)

OKR app deployment (port 80/3001):
- Dockerfile.backend — node:22-slim (node:sqlite requires Node 22)
- Dockerfile.frontend — node:20-alpine build + nginx:alpine runtime
- nginx/nginx.conf — React SPA + /api/v1/* proxy to okr-backend:3001
- backend/entrypoint.sh — auto init DB on first run + seed
- .dockerignore

CI pipeline (.gitea/workflows/ci.yml):
- Job 1: Vitest frontend tests (H3)
- Job 2: CASAN security gate + Vault KMS signing (H4/H5)
- Job 3: Deploy OKR → port 80 (runs on push to main after tests pass)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 12:55:17 +09:00