space/pr-preview
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
27 Commits 2 Branches 0 Tags
main
Commit Graph

3 Commits

Author SHA1 Message Date
luna 2fb966542b fix(v2): deterministic Docker build — pin pnpm, fix supply-chain policy, workspace-level install 
- Add workspace-level pnpm install in Dockerfile so pnpm-workspace.yaml
  supply-chain settings (onlyBuiltDependencies, allowBuilds) apply uniformly
- Pin pnpm@11.5.2 via corepack with sha1 hash to prevent future policy drift
- Downgrade postcss to ^8.5.22 (8.5.23 was <24h old, violated minimumReleaseAge)
- Regenerate frontend/pnpm-lock.yaml and add root pnpm-lock.yaml for full workspace
- Add binaryTargets to Prisma schema for linux-musl (Alpine) + debian compatibility
- Run pnpm approve-builds to set allowBuilds for esbuild, ssh2, prisma, @prisma/*
- Fix docker-compose.yml: postgres:18-alpine volume at /var/lib/postgresql (not /data)
- Add .env.docker.example; ignore .env.docker in .gitignore

Integration tests (Docker Compose against real Gitea 1.26.2):
✅ Docker image builds cleanly (pnpm frozen-lockfile, no policy violations)
✅ postgres:18-alpine starts healthy
✅ Prisma migrations run on startup
✅ Founder registration and session auth
✅ Gitea connection validated (PAT scope check)
✅ Webhook registered on test repo (Hook ID 11)
✅ PR opened → HMAC verified → preview created → DEPLOY job queued
✅ Gitea PR comment posted (write:issue scope confirmed working)
✅ Deploy fails correctly at AWS step: "Region is missing" (no creds in test env)
✅ PR closed → STOP job created and completed (status DONE)
✅ HMAC rejection: wrong signature → 401
✅ /pp stop via issue_comment webhook → accepted

Blocked (expected): EC2 provisioning requires AWS credentials not present in CI/test env.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-25 12:31:46 +00:00
luna 25f3612561 fix(v2): critical bug fixes — root SSH, bootstrap wait, SG deletion order, PAT masking 
- EC2 bootstrap now enables root SSH (copies authorized_keys to root, sets
  PermitRootLogin without-password, reloads sshd) so all commands run as
  root and NVM at /root/.nvm is accessible
- Added /var/lib/pp-bootstrap-done sentinel; deploy waits for it before
  running any user commands — prevents race between SSH availability and
  user-data completion (docker/nvm install can take 3-5+ min)
- Fixed stopPreview: terminate instance first, delete key pair next, then
  delete security group with 30s delay — SG deletion was previously
  attempted before termination causing it to fail
- Fixed redeploy to always fetch fresh instanceIp/sshPrivateKey from DB
  rather than using potentially-stale preview parameter
- Fixed .env writing to use base64 encoding via echo|base64-d to safely
  handle values with special characters, single quotes, and newlines
- PAT and git clone URL now masked in preview logs (shows **** for password)
- Fixed inactivity cron: removed dead inactivityMs variable, use join on
  repoConfig to avoid N+1, deduplicate pending INACTIVITY_STOP jobs
- Fixed IAM policy UI: ec2:CreateKeyPair (backend uses CreateKeyPair, not
  ImportKeyPair which is a different AWS operation)
- Admin panel: added Edit button with username/password form for users
- Privacy page: fetch and display admin contactEmail from settings
- pnpm-workspace.yaml: fix allowBuilds→onlyBuiltDependencies for pnpm 9

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-25 08:34:50 +00:00
space f9a2253742 docs: add comprehensive README with setup instructions and pnpm workspace config 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-25 00:32:12 +02:00