ic-builder
5023c21dff
Merge pull request 'cr-gate workflow: PR bodies must carry the GLPI CR deep link' ( #2 ) from ic-builder/cr-gate into main
ci / audit (push) Successful in 24s
2026-09-06 14:56:40 +00:00
ic-builder
86b208a33d
cr-gate workflow: PR bodies must carry the GLPI CR deep link
...
ci / audit (pull_request) Successful in 22s
cr-gate / cr-link (pull_request) Failing after 3s
Reference implementation of the CR-gating ruling 2026-09-06.
Grep-safe env indirection (no injection through ${{ }} in shell).
Standard: https://projects.knownelement.com/issues/820#note-1
Ticket: https://projects.knownelement.com/issues/820
2026-09-06 09:55:50 -05:00
ic-builder
d18ab408ca
Merge pull request '[ca] fix SC2015 for CI shellcheck 0.9' ( #1 ) from ic-builder/ci-shellcheck-v09 into main
ci / audit (push) Successful in 24s
2026-09-06 14:26:05 +00:00
ic-builder
99a634e944
[ca] fix SC2015 for CI shellcheck 0.9
...
ci / audit (pull_request) Successful in 23s
Unambiguous if-form for the two-condition guard. CI (node:20-bookworm,
Debian shellcheck 0.9) flags the A && B || C pattern where the koalaman
stable docker path passed. No behavior change.
CI evidence: https://git.knownelement.com/KNEL/ca/actions/runs/117821
Ticket: https://projects.knownelement.com/issues/784
2026-09-06 09:24:59 -05:00
mrcharles
0f607c1e41
[ #800 ] STATUS: 2026-09-05 lane state
...
ci / audit (push) Failing after 59s
https://projects.knownelement.com/issues/800
2026-09-05 18:01:39 -05:00
mrcharles
01197dd761
[ #385 ] SSH CA live on fleet step-ca: user cert issuance + e2e ssh auth PROVEN
...
ci / audit (push) Failing after 39s
ED25519 user/host CA keys generated; enableSSHCA on JWK provisioner;
24h root principal cert issued and used to ssh into sectestbed 5104
(passwordless, no static key). Host onboarding = 1 file + reload.
Rollout role queued in KNELIAC. Public CA key committed (private keys
never leave tsys-ca).
https://projects.knownelement.com/issues/385
2026-09-05 17:08:16 -05:00
mrcharles
d2541647f2
[ #800 ] ACME e2e proof: IP-identifier issuance validated on sectestbed 5104
...
ci / audit (push) Failing after 54s
http-01 validation, issuance, and chain all verified against the fleet
root via the prod endpoint; 5104 shut back down after the test.
https://projects.knownelement.com/issues/800
2026-09-05 10:16:30 -05:00
mrcharles
d923b5f34b
[ #800 ] ACME prod runbook: endpoint usage + http-01 root-cause debug log
...
ci / audit (push) Failing after 1m1s
https://projects.knownelement.com/issues/800
2026-09-05 10:06:35 -05:00
mrcharles
6e4f794b03
[ #800 ] prod step-ca ACME endpoint LIVE on tsys-ca (fleet-root chain); http-01 validation fetch open
...
ci / audit (push) Failing after 1m1s
compose.yaml: host networking (bridge+embedded-DNS broke rooted-name
lookups), :8443 via ca.json address, image digest-pinned; init-stepca.sh:
scaffold + ECDSA-P256 intermediate signed by /root/ca-root fleet root
(verified), ACME provisioner, managed password. Directory serving
RFC8555 on tailnet. OPEN: step-ca validation GET fails instantly with
zero dial attempts (authz says could-not-connect) — bisected caps,
read_only, bridge vs host, container DNS. Debug continues next run
(GODEBUG=netdns=2 + strace plan).
https://projects.knownelement.com/issues/800
2026-09-05 09:35:25 -05:00
mrcharles
c66430a397
[ #784 ] framework: set-e-safe cn_count fallback (|| true, not bare removal)
...
ci / audit (push) Successful in 1m21s
https://projects.knownelement.com/issues/784
2026-09-05 07:29:02 -05:00
mrcharles
f9096e19b6
[ #784 ] framework fix: cn_count double-count (grep -c prints 0 + || echo 0 appended second line)
...
ci / audit (push) Successful in 1m5s
https://projects.knownelement.com/issues/784
2026-09-05 07:12:19 -05:00
mrcharles
55f59e9a7e
[ #784 ] CI gate alignment: prune legacy/agent dirs from shellcheck; fix SC2015/SC2002
...
ci / audit (push) Successful in 44s
Debian shellcheck (CI job container) vs koalaman:stable skew resolved by
fixing real findings + exempting ported legacy suites and non-shell agent
scripts, mirroring the archive/ treatment.
https://projects.knownelement.com/issues/784
2026-09-05 06:21:17 -05:00
mrcharles
674b2cec29
[ #784 ] add fleet CI workflow (shellcheck + secret scan + rule audit)
...
ci / audit (push) Failing after 52s
https://projects.knownelement.com/issues/784
2026-09-05 06:10:16 -05:00
mrcharles
525ade2908
[ #697 ] point questions file at Redmine (model retired)
...
https://projects.knownelement.com/issues/697
2026-09-05 05:33:18 -05:00
mrcharles
a66dbaf20f
feat(ca): step-ca ACME pilot — mechanics verified e2e with lego [ #697 ]
...
test-root container pilot (loopback+bridge binds); HTTP-01 issuance
proven; phase design for prod ACME/k8s/SSH on t/327#2 .
https://community.turnsys.com/t/327/2
2026-09-04 17:30:39 -05:00
mrcharles
af7c0f3478
feat: port legacy TSYS-CA (admin-code PKI + tsys-bits) [ #769 ][ #783 ]
...
Excluded admin-code/*SECRETS.inc (real Nitrokey HSM PINs in the public
source repo) — SECRETS.inc.example template added in their place.
Rotation/history-purge ruling pending in #783 . legacy-* trees exempt
from lint/pointer checks (historical verbatim code).
https://projects.knownelement.com/issues/769#note-4152
2026-09-04 07:01:46 -05:00
mrcharles
2eca50490d
chore: initial import from KNEL/PFVCluster@041d311 [ #769 ]
...
Split per O&M lane work order. Full history: KNEL/PFVCluster.
https://projects.knownelement.com/issues/769#note-4152
2026-09-03 21:30:47 -05:00
ic-builder
mrcharles