Merge branch 'main' into fix/pg-backup-mc-config

review
feat(auth-sidecar): inject AUTH_OIDC_COOKIE_DOMAIN (#24 )
2026-07-02 12:43:03 +00:00 · 2026-07-02 12:25:11 +02:00 · 2026-06-30 06:59:37 +00:00 · 2026-06-29 17:02:50 +02:00 · 2026-06-29 16:47:51 +02:00 · 2026-06-11 13:18:20 +02:00
4 changed files with 14 additions and 3 deletions
@@ -23,7 +23,7 @@ jobs:
      REVIEW__INLINE_COMMENT_FALLBACK: "false"
      # LLM configuration
      LLM__PROVIDER: CLAUDE
-      LLM__META__MODEL: claude-sonnet-4-20250514
+      LLM__META__MODEL: claude-3-opus
      LLM__META__MAX_TOKENS: "4096"
      LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
      LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -36,6 +36,9 @@ jobs:
        fetch-depth: 0
        token: ${{ secrets.AI_REVIEW_TOKEN }}

+    - name: Update submodules to remote
+      run: git submodule update --remote --merge
+
    - name: Run inline review
      uses: docker://nikitafilonov/ai-review:v0.64.0
      with:
@@ -1,3 +1,5 @@
 [submodule "shared-prompts"]
 	path = shared-prompts
 	url = https://git.forteapps.net/Forte/ai-review-prompts.git
+	branch = main
+
@@ -77,6 +77,12 @@ spec:
              mc rm --recursive --force --older-than 30d "obj/${S3_BUCKET}/_pgbackups/" || true
              echo "backup retention pass complete"
            env:
+            # mc writes its config under $MC_CONFIG_DIR; point it at the shared
+            # emptyDir (writable by uid 65532 via fsGroup). Without this it tries
+            # to mkdir /.mc on the read-only-to-nonroot root fs -> "mkdir /.mc:
+            # permission denied" and every run fails before uploading.
+            - name: MC_CONFIG_DIR
+              value: "/work/.mc"
            - name: S3_ENDPOINT
              valueFrom:
                secretKeyRef: { name: forte-drop-secrets, key: S3_ENDPOINT }
@@ -1326,7 +1326,7 @@ storage:
 - Shared configuration and prompts live in the `shared-prompts` Git submodule (→ `Forte/ai-review-prompts`)
 - Review mode: `ONLY_ADDED_WITH_CONTEXT` — reviews only new/changed lines plus surrounding context (token-efficient)
 - Agent mode: disabled (one-shot review, no multi-turn reasoning)
- LLM: Claude Sonnet (`claude-sonnet-4-20250514`)
+- LLM: Claude Sonnet (`claude-3-opus`)

 **Shared Prompts Structure** (submodule: `Forte/ai-review-prompts`):
 ```
@@ -1344,7 +1344,7 @@ shared-prompts/
 ```yaml
 llm:
  provider: CLAUDE
-  model: claude-sonnet-4-20250514
+  model: claude-3-opus
 vcs:
  provider: GITEA
 review:
Author	SHA1	Message	Date
danijel.simeunovic	ff2b8fc0f5	Merge branch 'main' into fix/pg-backup-mc-config AI Code Review / ai-review (pull_request) Has been skipped Details / test (pull_request) Successful in 9s Details	2026-07-02 12:43:03 +00:00
danijel.simeunovic	af1e94d85d	review / test (push) Successful in 9s Details	2026-07-02 12:25:11 +02:00
jorgen.stensrud	df35cd0630	feat(auth-sidecar): inject AUTH_OIDC_COOKIE_DOMAIN (#24 ) / test (push) Successful in 10s Details Adds AUTH_OIDC_COOKIE_DOMAIN to the injected OIDC sidecar, from the `policies.forteapps.io/auth-oidc-cookie-domain` annotation. Empty when unset = host-only = unchanged for every app. Pairs with forte-helm + auth-sidecar#23. Safe to merge anytime (opt-in). --------- Co-authored-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com> Reviewed-on: #24 Reviewed-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>	2026-06-30 06:59:37 +00:00
danijel.simeunovic	04b3a210fe	shared-prompts / test (push) Successful in 8s Details	2026-06-29 17:02:50 +02:00
danijel.simeunovic	330c25f241	model / test (push) Successful in 8s Details	2026-06-29 16:47:51 +02:00
Sten	df30877b5e	fix(forte-drop-pg-backup): set MC_CONFIG_DIR so mc can write its config / test (pull_request) Successful in 8s Details The backup CronJob runs as uid 65532 (runAsNonRoot). mc defaulted its config dir to $HOME/.mc = /.mc and failed with "mkdir /.mc: permission denied" on the non-writable root fs — every nightly run died before uploading, so there are currently no backups in s3://drops/_pgbackups/. Point MC_CONFIG_DIR at the shared /work emptyDir (writable via fsGroup). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-11 13:18:20 +02:00