chore(deps): update actions/checkout action to v7

2026-09-28 00:09:15 +00:00
15 changed files with 32 additions and 54 deletions
@@ -23,8 +23,7 @@ jobs:
      REVIEW__INLINE_COMMENT_FALLBACK: "false"
      # LLM configuration
      LLM__PROVIDER: CLAUDE
-      LLM__META__MODEL: claude-sonnet-5-5
-      LLM__META__REASONING__EFFORT: high
+      LLM__META__MODEL: claude-3-opus
      LLM__META__MAX_TOKENS: "4096"
      LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
      LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -41,11 +40,11 @@ jobs:
      run: git submodule update --remote --merge

    - name: Run inline review
-      uses: docker://nikitafilonov/ai-review:v1.1.0
+      uses: docker://nikitafilonov/ai-review:v0.64.0
      with:
        args: ai-review run-inline

    - name: Run summary review
-      uses: docker://nikitafilonov/ai-review:v1.1.0
+      uses: docker://nikitafilonov/ai-review:v0.64.0
      with:
        args: ai-review run-summary
@@ -29,7 +29,7 @@ spec:
                  topologyKey: kubernetes.io/hostname
          initContainers:
            - name: gitea-dump
-              image: gitea/gitea:1.27.3
+              image: gitea/gitea:1.25.4
              command:
                - sh
                - -c
@@ -1,27 +1,27 @@
 {
  "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
  "packages": [
-    "kubectl@1.36.3",
-    "kubernetes-helm@4.2.4",
+    "kubectl@1.33.2",
+    "kubernetes-helm@3.18.4",
    "k9s@0.51.0",
-    "kubeseal@0.38.4",
-    "argocd@3.4.6",
-    "kubecm@0.35.1",
+    "kubeseal@0.30.0",
+    "argocd@2.14.11",
+    "kubecm@0.33.1",
    "kubectl-tree@0.6.0",
-    "kind@0.32.0",
-    "kustomize@5.8.1",
-    "kyverno@1.19.0",
-    "syft@1.51.0",
+    "kind@0.29.0",
+    "kustomize@5.7.0",
+    "kyverno@1.14.3",
+    "syft@1.29.0",
    "grype@0.118.0",
-    "traefik@3.7.10",
-    "claude-code@2.1.245",
+    "traefik@3.6.7",
+    "claude-code@0.2.122",
    "go@latest",
-    "dotnet-sdk@8.0.424",
-    "opentofu@1.12.5",
-    "_1password@2.30.0",
-    "github-cli@2.23.0",
-    "upcloud-cli@3.36.0",
-    "awscli2@2.35.11"
+    "dotnet-sdk@2.1.810",
+    "opentofu@1.11.6",
+    "_1password@1.12.2",
+    "github-cli@latest",
+    "upcloud-cli@3.29.0",
+    "awscli2@2.34.24"
  ],
  "shell": {
    "init_hook": [
@@ -1469,12 +1469,6 @@ ArgoCD will sync the Keycloak config, and the registrar CronJob will pick up the
 | `k8s.secret.client-id-key` | No | `client-id` | Field name for the client ID in the K8s Secret |
 | `k8s.secret.client-secret-key` | No | `client-secret` | Field name for the client secret in the K8s Secret |

-#### Public CLI Client (Device-Code Login)
-
-`forte-cli` is a shared **public** client (no secret) with the RFC 8628 device-authorization grant enabled (`oauth2.device.authorization.grant.enabled: "true"`, `standardFlowEnabled: false`, `directAccessGrantsEnabled: false`). Downloaded skills and CLI tools that log in through the Auth Sidecar (forte-drop first) use it with `<PREFIX>_CLIENT_ID=forte-cli`; nothing per-tool needs to be registered in Keycloak.
-
-It must be defined in `forte-realm.json` (this legacy path): the self-service registrar hardcodes `publicClient: false` / `standardFlowEnabled: true` and drops `attributes`, so a `client-config` Secret cannot produce a public device-code client. It carries no `k8s.secret.sync` attribute (the registrar's secret sync skips it) and is listed in the cleanup CronJob's protected clients.
-
 ### Retrieving Secrets for External Deployments

 The registrar always writes a **central copy** of every synced secret to the `secrets` namespace, in addition to the target namespace. This allows operators to retrieve client credentials for applications deployed outside this cluster:
@@ -17,7 +17,7 @@ spec:
  source:
    repoURL: https://charts.jetstack.io
    chart: cert-manager
-    targetRevision: "v1.21.2"
+    targetRevision: "v1.14.0"

    helm:
      values: |
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://dl.gitea.com/charts
    chart: actions
-    targetRevision: "0.1.2"
+    targetRevision: "0.0.5"
    helm:
      releaseName: gitea-actions
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://dl.gitea.com/charts
    chart: gitea
-    targetRevision: "12.7.0"
+    targetRevision: "12.6.0"
    helm:
      releaseName: gitea
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://grafana.github.io/helm-charts
    chart: grafana
-    targetRevision: "8.15.0"
+    targetRevision: "8.0.0"
    helm:
      releaseName: grafana
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://grafana.github.io/helm-charts
    chart: loki
-    targetRevision: "7.3.0"
+    targetRevision: "7.0.0"
    helm:
      releaseName: loki
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://opencost.github.io/opencost-helm-chart
    chart: opencost
-    targetRevision: "2.5.32"
+    targetRevision: "1.42.0"
    helm:
      releaseName: opencost
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://prometheus-community.github.io/helm-charts
    chart: prometheus
-    targetRevision: "28.16.0"
+    targetRevision: "28.9.0"
    helm:
      releaseName: prometheus
      valueFiles:
@@ -24,7 +24,7 @@ spec:
  sources:
  - repoURL: https://traefik.github.io/charts
    chart: traefik
-    targetRevision: "28.3.0"
+    targetRevision: "28.0.0"
    helm:
      releaseName: traefik
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://guerzon.github.io/vaultwarden
    chart: vaultwarden
-    targetRevision: "0.46.2"
+    targetRevision: "0.36.4"
    helm:
      releaseName: vaultwarden
      valueFiles:
@@ -186,21 +186,6 @@ keycloakConfigCli:
                }
              }
            ]
-          },
-          {
-            "clientId": "forte-cli",
-            "name": "Forte CLI",
-            "description": "Shared public client for RFC 8628 device-code login from downloaded skills/CLI tools (forte-drop first) against services behind Auth Sidecar. No client secret.",
-            "enabled": true,
-            "protocol": "openid-connect",
-            "standardFlowEnabled": false,
-            "directAccessGrantsEnabled": false,
-            "publicClient": true,
-            "redirectUris": [],
-            "webOrigins": [],
-            "attributes": {
-              "oauth2.device.authorization.grant.enabled": "true"
-            }
          }
        ],
        "browserFlow": "browser-auto-idp",
@@ -686,7 +671,7 @@ extraDeploy:
                MIN_AGE_SEC=$((MIN_AGE_DAYS * 86400))

                # Hardcoded protected clients (never delete these)
-                PROTECTED_JSON='["gitea","grafana","argocd","forte-cli","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'
+                PROTECTED_JSON='["gitea","grafana","argocd","vaultwarden","account","account-console","admin-cli","broker","realm-management","security-admin-console"]'

                echo "Fetching clients from realm '${REALM}'..."
                CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \