4 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 5.5	64c5617ddd	docs(decisions): record CI runs 500/503 for gate-toolbox-container ... Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-08 00:26:27 -06:00
jakman85andClaude Opus 5.5	27d603f726	fix(ci): umask 0022 in the git checkout step — act's 0000 made Ansible ignore ansible.cfg ... Run 500 (this PR's first CI run) failed L0 prod-baremetal-not-dev-surface: act runs steps with umask 0000, the checkout was world-writable, and Ansible (now present, via the toolbox) refuses a world-writable directory as an ansible.cfg source. Reproduced and fixed locally in the pinned image. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-08 00:20:38 -06:00
jakman85andClaude Opus 5.5	514ed5d5a4	docs(decisions): record local gate result for gate-toolbox-container ... Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-08 00:15:38 -06:00
jakman85andClaude Opus 5.5	9537ca2ddb	feat(ci): run the merge gate inside the CI-built toolbox image, pinned by digest ... The gate job now runs in gitea.home.keithjackson.dev/home-network/toolbox@sha256:83a3501e... (the image images.yaml publishes from infra/devcontainer/Containerfile) instead of catthehacker/ubuntu:act-22.04 plus a per-run download of yamllint, check-jsonschema, kyverno, promtool and chainsaw. Local (dev.sh) and CI now gate on the identical toolchain. - actions/checkout (Node) replaced by a plain-git step with fetch-depth-0 semantics; the toolbox has no Node. The job token is not persisted into .git/config. - The install step is replaced by a check that every ci/versions.env pin equals the image's /etc/dev-toolchain-versions, so the pins stay enforced. - Renovate follows the digest through a `# renovate-digest:` marker; github-actions manager disabled for own images. - install-tools.sh kept (merge-gate.yaml blueprint + alert-rules-unit-tested check use it). Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-08 00:12:03 -06:00