Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Sten
|
375fbff4b6 |
@@ -23,29 +23,25 @@ jobs:
|
||||
REVIEW__INLINE_COMMENT_FALLBACK: "false"
|
||||
# LLM configuration
|
||||
LLM__PROVIDER: CLAUDE
|
||||
LLM__META__MODEL: claude-sonnet-5-5
|
||||
LLM__META__REASONING__EFFORT: high
|
||||
LLM__META__MODEL: claude-sonnet-4-20250514
|
||||
LLM__META__MAX_TOKENS: "4096"
|
||||
LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
|
||||
LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v7
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
submodules: true
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.AI_REVIEW_TOKEN }}
|
||||
|
||||
- name: Update submodules to remote
|
||||
run: git submodule update --remote --merge
|
||||
|
||||
- name: Run inline review
|
||||
uses: docker://nikitafilonov/ai-review:v1.1.0
|
||||
uses: docker://nikitafilonov/ai-review:v0.64.0
|
||||
with:
|
||||
args: ai-review run-inline
|
||||
|
||||
- name: Run summary review
|
||||
uses: docker://nikitafilonov/ai-review:v1.1.0
|
||||
uses: docker://nikitafilonov/ai-review:v0.64.0
|
||||
with:
|
||||
args: ai-review run-summary
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v7
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Install TruffleHog
|
||||
run: |
|
||||
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh \
|
||||
| sh -s -- -b /usr/local/bin
|
||||
- name: Secret Scanning
|
||||
run: trufflehog git file://. --fail --no-update --results=verified,unknown
|
||||
@@ -1,5 +1,3 @@
|
||||
[submodule "shared-prompts"]
|
||||
path = shared-prompts
|
||||
url = https://git.forteapps.net/Forte/ai-review-prompts.git
|
||||
branch = main
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 8.0"
|
||||
version = "~> 6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 8.0"
|
||||
version = "~> 6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 8.0"
|
||||
version = "~> 6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 8.0"
|
||||
version = "~> 6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -15,6 +15,9 @@ metadata:
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "1"
|
||||
notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
|
||||
notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
|
||||
notifications.argoproj.io/subscribe.on-degraded.slack: ""
|
||||
labels:
|
||||
app.kubernetes.io/name: dot-ai-stack
|
||||
app.kubernetes.io/part-of: apps
|
||||
|
||||
@@ -7,8 +7,7 @@ metadata:
|
||||
namespace: mcp10x
|
||||
spec:
|
||||
encryptedData:
|
||||
BENKEN_CLIENT_SECRET: AgBjps8BCn20C8upAaAdb1fG4Qh3eKBbTeFuuWhQb8WoIvHmk+v03mw8i39evkQwlUWvLBWV1mtGiKwpCNhmAAdicRFG6u0m30+21K6ZtYqtKEniPKo/kjPd9nDbtxvIwiaqKs+kvFpqbxKaeqF5THYNxHZBg8gGeSbAkSx+BNIY2iLm8NRBzgC5FME5jbX8pet+DN7tbmsQTtG5f1q+h24aKXjvN5SigPft1BetfleHGlus0hFXpJ7zS4rV7rpSKSiLVV/KtS5YqEDj9uunZKyGT8j93z5xQbj0bCPVF3TU5+RCL6eE/GSgJxM4ePZ2gWZRG4eHDlGK2qE+JaNIng8wWycqLVrbs1kWoP2cdRGq6b8GHwoplAM4h4ud2fac6+5V4alhy8uhRTAX7dUG3UkwOQV/hTRb97pctPwQfltkBpDBhhW3Lfy9whSdqBuD9OqhegTqxCuWXr/P4KVOORUr0V0Iex45oLMqivI3FB2rTq9Lkwpf5YKE14d7RbKWF1G28FCNAcV8vnOIslkztLuu3GgQbVIoIiZGnnYEPofjUxbDZ/Sd1LrGeHEPR+/JJnNhNxv2297UuIIEC8kfiKuwjtLOMVQg51UbESx/+d1XmgLPqkz+jAqEPxvu8u5wO0Dov6vliTbtewJf8+fet3xnFNvyuY5ymmiTla6Gm9XPJscLj5iCzT3VhA/QuhhWXinmE/UnpYP0U4YPl5B/dUA9qT95BA6GBpDXPrDJRWNfpAH1wfG70lEBuBQXgdixYlwvx2JO6OI5+ztBKO0qFkgK
|
||||
FLOWCASE_TOKEN: AgBLN1BWnFs3R2K+Wvb37ABucQWvx8mVVDEhZiIOYYLE8SDdbshxluP4J4IISmHwLX7Q0gYWeypfTCfvMa9c5b9AEjTcpodv4CMhjp5Mq7zUCtTI6pH6QZgLhjGheKCY+RciIK1DBsNk7CZa9MuVUdd1w0/m2C7fwikPPvNDHcNLR7zBBPWVlprgRyMrsdykcm7cmWcyqTwa/55DVPPJsG9x1K2YnjzgWHlX7BoLB/Nx7qX4XVadKEXnV0jVO5isalARxvke32pwebaiFSg8EZMhe4lntOqMSP26y/9RbveeEZS8qxzoR2OmsVrHUpMeppzpVkvQ9sKi2B4Vx8XoiRY6hZR+TmZKTvFa6JKx9gwAOVs53LEUaF7+uOQOrIcFyOXm7Ibj/azf7opqfvGajygRzSUaffTIixj+M5eJnm/iua/BWarW2w4c+ZIKvQ9DhcYpnF9Gj0U7+EWfNZyzlMoLRHsOIyKNUhOeEaSLoVQGyqRY72ZGqs83EPfQYlEu74PGyXPjd11KMhAayluGLadeAH2QDyigpf7REdXAGULNDhkJrqeYMmmGCZCyrvNOoXjYC4jQQEYA4Sd4QJA05q/EW8aFE/++nY8RqhbHqDz6wshAW/WFsTsR4JC6fc5qR+YVSmjKOa7lnk7I9vD7uPEZzCc6ImvA/NxTCfDKCREvLA5G0lYsmiTuxYmBesUgCSVVMxflEl1GXvGpFniZKPyvxIdna9j7XEQjUZsGTiyN1w==
|
||||
FLOWCASE_TOKEN: AgAjQ0Jm779LiB2/EBKtIl18Iky/tgl7VvEvkJfr82mbe7JIp99+I8WPIMgmlXsxWBDfwJ/DZoDEAKG5o8mvwc7DtaE7LkpPSXKRIviLrm+7amNdEpwb1zKjCmZ3vNOPXLnCTD3W1od8u106MEvrZpt1N1Pzav/QUElAA4lqyf4AZPuio0H/7jF8QciVHIN4BdofodOmWWCTxP1aVMylat3txlkzuqwkXc1fKBPmOKC1qWepAG7dlQ3xJ2C5Cinz5IqOYnQPO6sm/Gp+c8yQSS+0NpKO3dp93yuwRsOLOMNpCeeYOyzn2ypFIdiBuLA5k85l5WyI9BCvRjP+kzRX+u69XL7p2eMEg+vRVfoOWNetysYCdK+96bWNVVleQEuPAFxsbJWK5eV8jTZk+QeFES8kkXQwUoTMqh+JULgONakxrzc1LmA+FtKNwHWCHalh8pLQ9KeI2i9E5CtotjHfEGLE6T0ibwwOg1ZrL3irQVII8VFm4Rk+dSicbeEMAtIaII023NWuZlonrwIIy+GSVzskhhcjV7t51hylqFA3yfb+RQCzdGYA5fySlJBWhli8IotvqnDmWduPBHGb/+yrdXHsaiDqWuUu6JBUg4JqM+AMa8FkaFh8SbctbGBoycpzLVFn9N2qWviojhC9s1NJ4MiCegvE6IsCLaHidY4UXeeGjUK6Mx6h4x3y/q7ZIrBIpUOJ+8I4Mgvi9sTCogeR+vWtpP9ZZ/31MXELuu/ho3Wn9Q==
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
|
||||
@@ -77,12 +77,6 @@ spec:
|
||||
mc rm --recursive --force --older-than 30d "obj/${S3_BUCKET}/_pgbackups/" || true
|
||||
echo "backup retention pass complete"
|
||||
env:
|
||||
# mc writes its config under $MC_CONFIG_DIR; point it at the shared
|
||||
# emptyDir (writable by uid 65532 via fsGroup). Without this it tries
|
||||
# to mkdir /.mc on the read-only-to-nonroot root fs -> "mkdir /.mc:
|
||||
# permission denied" and every run fails before uploading.
|
||||
- name: MC_CONFIG_DIR
|
||||
value: "/work/.mc"
|
||||
- name: S3_ENDPOINT
|
||||
valueFrom:
|
||||
secretKeyRef: { name: forte-drop-secrets, key: S3_ENDPOINT }
|
||||
|
||||
@@ -5,9 +5,9 @@ metadata:
|
||||
namespace: argocd
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "1"
|
||||
# notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
|
||||
# notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
|
||||
# notifications.argoproj.io/subscribe.on-degraded.slack: ""
|
||||
notifications.argoproj.io/subscribe.on-sync-succeeded.slack: ""
|
||||
notifications.argoproj.io/subscribe.on-sync-failed.slack: ""
|
||||
notifications.argoproj.io/subscribe.on-degraded.slack: ""
|
||||
labels:
|
||||
app.kubernetes.io/name: forte-drop
|
||||
app.kubernetes.io/part-of: apps
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: keycloak-client-forte-drop
|
||||
namespace: forte-drop
|
||||
labels:
|
||||
keycloak.forteapps.net/client-config: "true"
|
||||
annotations:
|
||||
keycloak.forteapps.net/source-namespace: "forte-drop"
|
||||
stringData:
|
||||
client.json: |
|
||||
{
|
||||
"clientId": "forte-drop",
|
||||
"name": "Forte Drop (web)",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"standardFlowEnabled": true,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": false,
|
||||
"redirectUris": ["https://drop.forteapps.net/auth/callback"],
|
||||
"webOrigins": ["https://drop.forteapps.net"],
|
||||
"defaultClientScopes": ["openid","email","profile"],
|
||||
"secret": {
|
||||
"namespace": "forte-drop",
|
||||
"name": "forte-drop-oidc-credentials",
|
||||
"keys": {
|
||||
"clientId": "client-id",
|
||||
"clientSecret": "client-secret"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- forte-drop.yaml
|
||||
- keycloak-client-forte-drop.yaml
|
||||
- forte-drop-pdb.yaml
|
||||
- forte-drop-secrets-sealed.yaml
|
||||
|
||||
@@ -29,7 +29,7 @@ spec:
|
||||
topologyKey: kubernetes.io/hostname
|
||||
initContainers:
|
||||
- name: gitea-dump
|
||||
image: gitea/gitea:1.27.3
|
||||
image: gitea/gitea:1.25.4
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
|
||||
@@ -24,15 +24,8 @@ spec:
|
||||
name: azuredns-config
|
||||
key: client-secret
|
||||
selector:
|
||||
# NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
|
||||
# matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
|
||||
# named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
|
||||
# instead suffix-matches the zone apex AND every subdomain at any depth, so this single
|
||||
# entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
|
||||
# drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
|
||||
# Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
|
||||
# to match fall through to the http01 solver below.
|
||||
dnsZones:
|
||||
dnsNames:
|
||||
- '*.forteapps.net'
|
||||
- 'forteapps.net'
|
||||
# HTTP-01 fallback for non-wildcard certificates
|
||||
- http01:
|
||||
@@ -65,15 +58,8 @@ spec:
|
||||
name: azuredns-config
|
||||
key: client-secret
|
||||
selector:
|
||||
# NOTE: cert-manager solver selectors are NOT TLS-style wildcards. selector.dnsNames
|
||||
# matches by exact FQDN, so '*.forteapps.net' here would match only a cert literally
|
||||
# named '*.forteapps.net' — it would NOT cover 'drop.forteapps.net'. selector.dnsZones
|
||||
# instead suffix-matches the zone apex AND every subdomain at any depth, so this single
|
||||
# entry routes all forteapps.net ACME challenges (forteapps.net, *.forteapps.net,
|
||||
# drop.forteapps.net, *.drop.forteapps.net, mcp.drop.forteapps.net, ...) through this
|
||||
# Azure dns01 solver. Wildcard names require dns01; non-wildcard names that ever fail
|
||||
# to match fall through to the http01 solver below.
|
||||
dnsZones:
|
||||
dnsNames:
|
||||
- '*.forteapps.net'
|
||||
- 'forteapps.net'
|
||||
# HTTP-01 fallback for non-wildcard certificates
|
||||
- http01:
|
||||
|
||||
@@ -233,10 +233,6 @@ spec:
|
||||
value: "{{ regex_replace_all('https?://[^/]*', request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-callback-path\", '') }}"
|
||||
- name: AUTH_OIDC_SCOPES
|
||||
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-scopes\" || 'openid,profile,email' }}"
|
||||
- name: AUTH_OIDC_COOKIE_DOMAIN
|
||||
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-cookie-domain\" || '' }}"
|
||||
- name: AUTH_OIDC_ALLOWED_RETURN_HOSTS
|
||||
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-allowed-return-hosts\" || '' }}"
|
||||
- name: AUTH_PUBLIC_PATHS
|
||||
value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
|
||||
- name: AUTH_OIDC_COOKIE_SECRET
|
||||
|
||||
+20
-20
@@ -1,27 +1,27 @@
|
||||
{
|
||||
"$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
|
||||
"packages": [
|
||||
"kubectl@1.36.3",
|
||||
"kubernetes-helm@4.2.4",
|
||||
"k9s@0.51.0",
|
||||
"kubeseal@0.38.4",
|
||||
"argocd@3.4.6",
|
||||
"kubecm@0.35.1",
|
||||
"kubectl-tree@0.6.0",
|
||||
"kind@0.32.0",
|
||||
"kustomize@5.8.1",
|
||||
"kyverno@1.19.0",
|
||||
"syft@1.51.0",
|
||||
"grype@0.118.0",
|
||||
"traefik@3.7.10",
|
||||
"claude-code@2.1.245",
|
||||
"kubectl@1.33.2",
|
||||
"kubernetes-helm@3.18.4",
|
||||
"k9s@0.50.7",
|
||||
"kubeseal@0.30.0",
|
||||
"argocd@2.14.11",
|
||||
"kubecm@0.33.1",
|
||||
"kubectl-tree@0.4.3",
|
||||
"kind@0.29.0",
|
||||
"kustomize@5.7.0",
|
||||
"kyverno@1.14.3",
|
||||
"syft@1.29.0",
|
||||
"grype@0.92.2",
|
||||
"traefik@3.6.7",
|
||||
"claude-code@latest",
|
||||
"go@latest",
|
||||
"dotnet-sdk@8.0.424",
|
||||
"opentofu@1.12.5",
|
||||
"_1password@2.30.0",
|
||||
"github-cli@2.23.0",
|
||||
"upcloud-cli@3.36.0",
|
||||
"awscli2@2.35.11"
|
||||
"dotnet-sdk@latest",
|
||||
"opentofu@1.11.6",
|
||||
"_1password@latest",
|
||||
"github-cli@latest",
|
||||
"upcloud-cli@3.29.0",
|
||||
"awscli2@2.34.24"
|
||||
],
|
||||
"shell": {
|
||||
"init_hook": [
|
||||
|
||||
@@ -1469,12 +1469,6 @@ ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the
|
||||
| `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
|
||||
| `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |
|
||||
|
||||
#### Public CLI Client (Device-Code Login)
|
||||
|
||||
`forte-cli` is a shared **public** client (no secret) with the RFC 8628 device-authorization grant enabled (`oauth2.device.authorization.grant.enabled: "true"`, `standardFlowEnabled: false`, `directAccessGrantsEnabled: false`). Downloaded skills and CLI tools that log in through the Auth Sidecar (forte-drop first) use it with `<PREFIX>_CLIENT_ID=forte-cli`; nothing per-tool needs to be registered in Keycloak.
|
||||
|
||||
It must be defined in `forte-realm.json` (this legacy path): the self-service registrar hardcodes `publicClient: false` / `standardFlowEnabled: true` and drops `attributes`, so a `client-config` Secret cannot produce a public device-code client. It carries no `k8s.secret.sync` attribute (the registrar's secret sync skips it) and is listed in the cleanup CronJob's protected clients.
|
||||
|
||||
### Retrieving Secrets for External Deployments
|
||||
|
||||
The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:
|
||||
|
||||
+2
-2
@@ -1326,7 +1326,7 @@ storage:
|
||||
- Shared configuration and prompts live in the `shared-prompts` Git submodule (→ `Forte/ai-review-prompts`)
|
||||
- Review mode: `ONLY_ADDED_WITH_CONTEXT` — reviews only new/changed lines plus surrounding context (token-efficient)
|
||||
- Agent mode: disabled (one-shot review, no multi-turn reasoning)
|
||||
- LLM: Claude Sonnet (`claude-3-opus`)
|
||||
- LLM: Claude Sonnet (`claude-sonnet-4-20250514`)
|
||||
|
||||
**Shared Prompts Structure** (submodule: `Forte/ai-review-prompts`):
|
||||
```
|
||||
@@ -1344,7 +1344,7 @@ shared-prompts/
|
||||
```yaml
|
||||
llm:
|
||||
provider: CLAUDE
|
||||
model: claude-3-opus
|
||||
model: claude-sonnet-4-20250514
|
||||
vcs:
|
||||
provider: GITEA
|
||||
review:
|
||||
|
||||
@@ -1,36 +0,0 @@
|
||||
# Domain Docs
|
||||
|
||||
How the engineering skills should consume this repo's domain documentation when exploring the codebase.
|
||||
|
||||
## Before exploring, read these
|
||||
|
||||
- **`CONTEXT.md`** at the repo root, or
|
||||
- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
|
||||
- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
|
||||
|
||||
If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
|
||||
|
||||
## File structure
|
||||
|
||||
Single-context repo (most repos):
|
||||
|
||||
```
|
||||
/
|
||||
├── CONTEXT.md
|
||||
├── docs/adr/
|
||||
│ ├── 0001-event-sourced-orders.md
|
||||
│ └── 0002-postgres-for-write-model.md
|
||||
└── src/
|
||||
```
|
||||
|
||||
## Use the glossary's vocabulary
|
||||
|
||||
When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
|
||||
|
||||
If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
|
||||
|
||||
## Flag ADR conflicts
|
||||
|
||||
If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
|
||||
|
||||
> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_
|
||||
@@ -1,39 +0,0 @@
|
||||
# Issue tracker: Gitea
|
||||
|
||||
Issues for this repo live in Gitea at `git.forteapps.net/Forte/launchpad`. Use the Gitea API or `tea` CLI.
|
||||
|
||||
## Conventions
|
||||
|
||||
- **Create an issue**: `tea issue create --title "..." --description "..."`
|
||||
or via API: `curl -X POST "https://git.forteapps.net/api/v1/repos/Forte/launchpad/issues" -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" -d '{"title":"...","body":"..."}'`
|
||||
- **Read an issue**: `tea issue view <number>` or API `GET /api/v1/repos/Forte/launchpad/issues/<number>`
|
||||
- **List issues**: `tea issue list` or API `GET /api/v1/repos/Forte/launchpad/issues?state=open`
|
||||
- **Comment on an issue**: `tea issue comment <number> "..."` or API `POST /api/v1/repos/Forte/launchpad/issues/<number>/comments`
|
||||
- **Apply labels**: API `POST /api/v1/repos/Forte/launchpad/issues/<number>/labels` with `{"labels": [<label_id>]}`
|
||||
- **Close**: API `PATCH /api/v1/repos/Forte/launchpad/issues/<number>` with `{"state": "closed"}`
|
||||
|
||||
Infer the repo from `git remote -v`.
|
||||
|
||||
## Pull requests as a triage surface
|
||||
|
||||
**PRs as a request surface: no.**
|
||||
|
||||
## When a skill says "publish to the issue tracker"
|
||||
|
||||
Create a Gitea issue.
|
||||
|
||||
## When a skill says "fetch the relevant ticket"
|
||||
|
||||
Fetch the issue via API or `tea issue view <number>`.
|
||||
|
||||
## Wayfinding operations
|
||||
|
||||
Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
|
||||
|
||||
- **Map**: a single issue labelled `wayfinder:map`, holding the Destination / Notes / Decisions-so-far / Fog body.
|
||||
- Create: `POST /api/v1/repos/Forte/launchpad/issues` with `{"title":"...","body":"...","labels":[<wayfinder:map label id>]}`
|
||||
- **Child ticket**: an issue carrying `Part of #<map>` at the top of its body and a `wayfinder:<type>` label (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
|
||||
- **Blocking**: Gitea does not have native issue dependencies. Fall back to a `Blocked by: #<n>, #<n>` line at the top of the child body. A ticket is unblocked when every issue it lists is closed.
|
||||
- **Frontier query**: list the map's open children — `GET /api/v1/repos/Forte/launchpad/issues?state=open&labels=wayfinder:research,wayfinder:prototype,wayfinder:grilling,wayfinder:task` — then filter to those whose body starts with `Part of #<map>`. Drop any with an open issue in their `Blocked by` line, or with an assignee. First in map order wins.
|
||||
- **Claim**: `PATCH /api/v1/repos/Forte/launchpad/issues/<n>` with `{"assignees":["<username>"]}` — the session's first write.
|
||||
- **Resolve**: post the answer as a comment (`POST .../comments`), close the issue (`PATCH` with `{"state":"closed"}`), then append a context pointer (gist + link) to the map's Decisions-so-far by editing the map issue body.
|
||||
@@ -1,15 +0,0 @@
|
||||
# Triage Labels
|
||||
|
||||
The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker.
|
||||
|
||||
| Label in mattpocock/skills | Label in our tracker | Meaning |
|
||||
| -------------------------- | -------------------- | ---------------------------------------- |
|
||||
| `needs-triage` | `needs-triage` | Maintainer needs to evaluate this issue |
|
||||
| `needs-info` | `needs-info` | Waiting on reporter for more information |
|
||||
| `ready-for-agent` | `ready-for-agent` | Fully specified, ready for an AFK agent |
|
||||
| `ready-for-human` | `ready-for-human` | Requires human implementation |
|
||||
| `wontfix` | `wontfix` | Will not be actioned |
|
||||
|
||||
When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
|
||||
|
||||
Edit the right-hand column to match whatever vocabulary you actually use.
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
source:
|
||||
repoURL: https://charts.jetstack.io
|
||||
chart: cert-manager
|
||||
targetRevision: "v1.21.2"
|
||||
targetRevision: "v1.14.0"
|
||||
|
||||
helm:
|
||||
values: |
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://fluent.github.io/helm-charts
|
||||
chart: fluent-bit
|
||||
targetRevision: 0.58.2
|
||||
targetRevision: 0.47.10
|
||||
helm:
|
||||
releaseName: fluent-bit
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://dl.gitea.com/charts
|
||||
chart: actions
|
||||
targetRevision: "0.1.2"
|
||||
targetRevision: "0.0.5"
|
||||
helm:
|
||||
releaseName: gitea-actions
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://dl.gitea.com/charts
|
||||
chart: gitea
|
||||
targetRevision: "12.7.0"
|
||||
targetRevision: "12.5.0"
|
||||
helm:
|
||||
releaseName: gitea
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://grafana.github.io/helm-charts
|
||||
chart: grafana
|
||||
targetRevision: "8.15.0"
|
||||
targetRevision: "8.0.0"
|
||||
helm:
|
||||
releaseName: grafana
|
||||
valueFiles:
|
||||
|
||||
@@ -36,7 +36,7 @@ spec:
|
||||
source:
|
||||
chart: kyverno
|
||||
repoURL: https://kyverno.github.io/kyverno/
|
||||
targetRevision: 3.9.1
|
||||
targetRevision: v3.7.0 # Update to latest stable version
|
||||
helm:
|
||||
releaseName: kyverno
|
||||
valuesObject:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://grafana.github.io/helm-charts
|
||||
chart: loki
|
||||
targetRevision: "7.3.0"
|
||||
targetRevision: "6.0.0"
|
||||
helm:
|
||||
releaseName: loki
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://opencost.github.io/opencost-helm-chart
|
||||
chart: opencost
|
||||
targetRevision: "2.5.32"
|
||||
targetRevision: "1.42.0"
|
||||
helm:
|
||||
releaseName: opencost
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://prometheus-community.github.io/helm-charts
|
||||
chart: prometheus
|
||||
targetRevision: "28.16.0"
|
||||
targetRevision: "28.9.0"
|
||||
helm:
|
||||
releaseName: prometheus
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: ghcr.io/renovatebot/charts
|
||||
chart: renovate
|
||||
targetRevision: "46.318.0"
|
||||
targetRevision: "46.109.0"
|
||||
helm:
|
||||
releaseName: renovate
|
||||
valueFiles:
|
||||
|
||||
@@ -16,8 +16,8 @@ spec:
|
||||
|
||||
source:
|
||||
chart: sealed-secrets
|
||||
repoURL: https://bitnami.github.io/sealed-secrets
|
||||
targetRevision: 2.20.0
|
||||
repoURL: https://bitnami-labs.github.io/sealed-secrets
|
||||
targetRevision: 2.16.2 # Update to latest stable version
|
||||
helm:
|
||||
releaseName: sealed-secrets
|
||||
parameters:
|
||||
|
||||
@@ -24,7 +24,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://traefik.github.io/charts
|
||||
chart: traefik
|
||||
targetRevision: "28.3.0"
|
||||
targetRevision: "28.0.0"
|
||||
helm:
|
||||
releaseName: traefik
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://helm.releases.hashicorp.com
|
||||
chart: vault
|
||||
targetRevision: "0.34.1"
|
||||
targetRevision: "0.32.0"
|
||||
helm:
|
||||
releaseName: vault
|
||||
valueFiles:
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
sources:
|
||||
- repoURL: https://guerzon.github.io/vaultwarden
|
||||
chart: vaultwarden
|
||||
targetRevision: "0.46.2"
|
||||
targetRevision: "0.36.4"
|
||||
helm:
|
||||
releaseName: vaultwarden
|
||||
valueFiles:
|
||||
|
||||
@@ -31,7 +31,7 @@ gitea:
|
||||
ENABLE_PASSWORD_SIGNIN_FORM: false
|
||||
AUTO_WATCH_ON_CHANGES: false
|
||||
AUTO_WATCH_NEW_REPOS: false
|
||||
ENABLE_NOTIFY_MAIL: true
|
||||
ENABLE_NOTIFY_MAIL: false
|
||||
ENABLE_TIMETRACKING: false
|
||||
|
||||
openid:
|
||||
|
||||
@@ -186,35 +186,6 @@ keycloakConfigCli:
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"clientId": "forte-cli",
|
||||
"name": "Forte CLI",
|
||||
"description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"standardFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"publicClient": true,
|
||||
"redirectUris": [],
|
||||
"webOrigins": [],
|
||||
"attributes": {
|
||||
"oauth2.device.authorization.grant.enabled": "true"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "audience-forte-drop-mcp",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-audience-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"included.custom.audience": "https://mcp.drop.forteapps.net/mcp",
|
||||
"access.token.claim": "true",
|
||||
"id.token.claim": "false",
|
||||
"introspection.token.claim": "true"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"browserFlow": "browser-auto-idp",
|
||||
@@ -319,7 +290,6 @@ extraDeploy:
|
||||
namespace: keycloak
|
||||
spec:
|
||||
schedule: "*/2 * * * *"
|
||||
timeZone: "Europe/Oslo"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 1
|
||||
failedJobsHistoryLimit: 3
|
||||
@@ -332,7 +302,7 @@ extraDeploy:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: registrar
|
||||
image: alpine:3.24
|
||||
image: alpine:3.20
|
||||
command: [ "/bin/sh", "-c" ]
|
||||
args:
|
||||
- |
|
||||
@@ -647,9 +617,7 @@ extraDeploy:
|
||||
name: keycloak-client-cleanup
|
||||
namespace: keycloak
|
||||
spec:
|
||||
schedule: "0 3 1 * *"
|
||||
timeZone: "Europe/Oslo"
|
||||
startingDeadlineSeconds: 3600
|
||||
schedule: "0 3 * * 0"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 1
|
||||
failedJobsHistoryLimit: 3
|
||||
@@ -662,7 +630,7 @@ extraDeploy:
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: cleanup
|
||||
image: alpine:3.24
|
||||
image: alpine:3.20
|
||||
command: [ "/bin/sh", "-c" ]
|
||||
args:
|
||||
- |
|
||||
@@ -674,7 +642,7 @@ extraDeploy:
|
||||
ADMIN_USER="admin"
|
||||
ADMIN_PASS=$(cat /secrets/admin-password)
|
||||
DRY_RUN="${DRY_RUN:-true}"
|
||||
MIN_AGE_DAYS="${MIN_AGE_DAYS:-14}"
|
||||
MIN_AGE_DAYS="${MIN_AGE_DAYS:-7}"
|
||||
if [ -z "$CLIENT_ID_PATTERN" ]; then
|
||||
CLIENT_ID_PATTERN='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
|
||||
fi
|
||||
@@ -700,21 +668,19 @@ extraDeploy:
|
||||
MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))
|
||||
|
||||
# Hardcoded protected clients (never delete these)
|
||||
PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
|
||||
PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
|
||||
|
||||
echo "Fetching clients from realm '${REALM}'..."
|
||||
CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
|
||||
"${KEYCLOAK_URL}/admin/realms/${REALM}/clients")
|
||||
|
||||
CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" \
|
||||
--argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
|
||||
CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
|
||||
[
|
||||
.[]
|
||||
| select(.clientId as $cid | $protected | index($cid) | not)
|
||||
| select(.attributes["k8s.secret.sync"] != "true")
|
||||
| select(.clientId | test($pattern; "i"))
|
||||
| select(.attributes["client.secret.creation.time"] != null)
|
||||
| select((.attributes["client.secret.creation.time"] | tonumber) < ($now - $min_age))
|
||||
| select((.createdTimestamp // 0) / 1000 < ($now - $min_age))
|
||||
]
|
||||
')
|
||||
|
||||
@@ -762,7 +728,7 @@ extraDeploy:
|
||||
- name: DRY_RUN
|
||||
value: "false"
|
||||
- name: MIN_AGE_DAYS
|
||||
value: "60"
|
||||
value: "7"
|
||||
volumeMounts:
|
||||
- name: keycloak-credentials
|
||||
mountPath: /secrets
|
||||
|
||||
@@ -17,14 +17,7 @@ loki:
|
||||
period: 24h
|
||||
object_store: filesystem # we're storing on filesystem so there's no real persistence here.
|
||||
schema: v13
|
||||
compactor:
|
||||
working_directory: /var/loki/compactor
|
||||
retention_enabled: true
|
||||
delete_request_store: filesystem
|
||||
compaction_interval: 10m
|
||||
retention_delete_delay: 2h
|
||||
limits_config:
|
||||
retention_period: 168h # 7 days
|
||||
reject_old_samples: true
|
||||
reject_old_samples_max_age: 168h
|
||||
ingestion_rate_mb: 15
|
||||
@@ -35,8 +28,6 @@ chunksCache:
|
||||
resultsCache:
|
||||
enabled: false
|
||||
singleBinary:
|
||||
persistence:
|
||||
size: 20Gi
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
|
||||
@@ -21,11 +21,6 @@ renovate:
|
||||
"assignees": ["danijel.simeunovic"],
|
||||
"reviewers": ["danijel.simeunovic"]
|
||||
},
|
||||
{
|
||||
"matchRepositories": ["**/launchpad"],
|
||||
"assignees": ["danijel.simeunovic"],
|
||||
"reviewers": ["danijel.simeunovic"]
|
||||
},
|
||||
{
|
||||
"matchRepositories": ["**/forte-helm"],
|
||||
"assignees": ["danijel.simeunovic"],
|
||||
|
||||
@@ -59,6 +59,10 @@ config:
|
||||
href: https://benken.hackathon.forteapps.net
|
||||
description: Teknisk kompetanse fra offentlige anbud
|
||||
icon: forte
|
||||
- Forte Drop:
|
||||
href: https://drop.forteapps.net
|
||||
description: Self-hosted HTML-drops + MCP for Claude
|
||||
icon: forte
|
||||
- Forte Feedback:
|
||||
href: https://feedback.forteapps.net
|
||||
description: Fortes internal feedback app
|
||||
|
||||
@@ -1,67 +0,0 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"config:recommended",
|
||||
"group:allNonMajor",
|
||||
":dependencyDashboard",
|
||||
":semanticCommits"
|
||||
],
|
||||
"timezone": "Europe/Oslo",
|
||||
"labels": ["renovate"],
|
||||
"reviewers": ["danijel.simeunovic"],
|
||||
|
||||
"prConcurrentLimit": 10,
|
||||
"prHourlyLimit": 4,
|
||||
"minimumReleaseAge": "3 days",
|
||||
|
||||
"ignorePaths": [
|
||||
"**/*-sealed.yaml",
|
||||
"cluster-resources/policies/**",
|
||||
"private/**",
|
||||
".devbox/**"
|
||||
],
|
||||
|
||||
"argocd": {
|
||||
"description": "ArgoCD Applications live under infra/, apps/ and the root app-of-apps files. The manager skips any file without an argoproj.io apiVersion, so matching broadly is safe.",
|
||||
"managerFilePatterns": [
|
||||
"/^_app-of-apps-.+\\.yaml$/",
|
||||
"/^apps/.+\\.yaml$/",
|
||||
"/^infra/.+\\.yaml$/"
|
||||
]
|
||||
},
|
||||
|
||||
"helm-values": {
|
||||
"description": "Values files are named <app>-values.yaml, not the default values.yaml.",
|
||||
"managerFilePatterns": ["/^infra/values/.+\\.ya?ml$/"]
|
||||
},
|
||||
|
||||
"kubernetes": {
|
||||
"description": "Plain manifests with inline image references. Kyverno policies are excluded via ignorePaths - their images are Go templates, not tags.",
|
||||
"managerFilePatterns": [
|
||||
"/^cluster-resources/.+\\.yaml$/",
|
||||
"/^apps/.+/resources/.+\\.yaml$/"
|
||||
]
|
||||
},
|
||||
|
||||
"packageRules": [
|
||||
{
|
||||
"description": "Every Application carries a second source pointing at this repo at HEAD for $values. HEAD is not a version.",
|
||||
"matchDatasources": ["git-tags"],
|
||||
"matchDepNames": ["/forteapps\\.net/"],
|
||||
"enabled": false
|
||||
},
|
||||
{
|
||||
"description": "Platform chart majors usually carry values-schema or CRD breaks - flag them for a careful read.",
|
||||
"matchFileNames": ["infra/**"],
|
||||
"matchUpdateTypes": ["major"],
|
||||
"labels": ["renovate", "breaking-change"],
|
||||
"minimumReleaseAge": "7 days"
|
||||
},
|
||||
{
|
||||
"description": "Patch-level platform bumps are routine - let them through faster.",
|
||||
"matchFileNames": ["infra/**"],
|
||||
"matchUpdateTypes": ["patch"],
|
||||
"minimumReleaseAge": "1 day"
|
||||
}
|
||||
]
|
||||
}
|
||||
+1
-1
Submodule shared-prompts updated: 97057a4436...b79858d73c
Reference in New Issue
Block a user