wehub-resource-sync
161ef94b4f
Check engine pin consistency / Dockerfile / CI pin consistency (push) Successful in 8s
Sirius CI/CD Pipeline / Detect Changes (push) Successful in 23s
Validate Docker Configuration / Validate Docker Compose Configuration (push) Successful in 47s
Sirius CI/CD Pipeline / Build API (${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Build UI (${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Engine Manifest (push) Has been cancelled
Sirius CI/CD Pipeline / Merge API Manifest (push) Has been cancelled
Sirius CI/CD Pipeline / Merge UI Manifest (push) Has been cancelled
Sirius CI/CD Pipeline / Build Engine (${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Build Infra (${{ matrix.service }}, ${{ matrix.platform }}) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Infra Manifest (sirius-postgres) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Infra Manifest (sirius-rabbitmq) (push) Has been cancelled
Sirius CI/CD Pipeline / Merge Infra Manifest (sirius-valkey) (push) Has been cancelled
Sirius CI/CD Pipeline / Integration Test (push) Has been cancelled
Sirius CI/CD Pipeline / Public Stack Contract (push) Has been cancelled
Sirius CI/CD Pipeline / Dispatch Demo Deployment (sirius-demo branch) (push) Has been cancelled
Sirius CI/CD Pipeline / Dispatch Demo Canary (main branch) (push) Has been cancelled
Sirius CI/CD Pipeline / Guard Registry Namespace (push) Has been cancelled
168 lines
8.4 KiB
JSON
168 lines
8.4 KiB
JSON
[
|
|
{
|
|
"id": "0",
|
|
"title": "PHASE 0: Contract Baseline",
|
|
"description": "Capture the hard-cutover scope for the internal API key redesign.",
|
|
"details": "Track the shift to a single file-backed internal API key contract shared by sirius-ui, sirius-api, and sirius-engine.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": [],
|
|
"subtasks": [
|
|
{
|
|
"id": "0.1",
|
|
"title": "Create API key contract plan",
|
|
"description": "Document the file-only contract and hard-cutover rollout.",
|
|
"details": "Plan records the kill chain, target contract, verification matrix, and implementation order for installer, compose, runtime consumers, and validation.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": [],
|
|
"testStrategy": "Verify the plan exists and covers installer, compose, services, validation, and task reconciliation."
|
|
},
|
|
{
|
|
"id": "0.2",
|
|
"title": "Align task tracking to the contract work",
|
|
"description": "Make the project tracker reflect the actual API key unification scope.",
|
|
"details": "Replace stale dual-mode rollout phases with the concrete file-only contract tasks implemented in this workstream.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["0.1"],
|
|
"testStrategy": "Validate JSON structure and confirm task statuses match the implemented work."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "1",
|
|
"title": "PHASE 1: Installer Single Source",
|
|
"description": "Stop persisting the internal API key as normal runtime env in .env files.",
|
|
"details": "Installer now keeps SIRIUS_API_KEY_FILE in generated config, writes the secret file as the runtime source of truth, and migrates from an existing legacy env value only when needed to preserve the current secret.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["0"],
|
|
"subtasks": [
|
|
{
|
|
"id": "1.1",
|
|
"title": "Remove SIRIUS_API_KEY from generated .env output",
|
|
"description": "Keep only SIRIUS_API_KEY_FILE in the installer-generated environment template/output.",
|
|
"details": "Template and installer rendering no longer persist the duplicate SIRIUS_API_KEY runtime entry in .env.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["0.2"],
|
|
"testStrategy": "Installer tests confirm required values still render and SIRIUS_API_KEY_FILE defaults correctly."
|
|
},
|
|
{
|
|
"id": "1.2",
|
|
"title": "Preserve the file-backed secret lifecycle",
|
|
"description": "Generate or reuse the secret file as the canonical API key source.",
|
|
"details": "Installer reuses an existing secret file when appropriate, migrates a legacy env value when necessary, and verifies the written file contents.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["1.1"],
|
|
"testStrategy": "Installer command tests and gofmt/go test pass for the installer module."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "2",
|
|
"title": "PHASE 2: Compose File-Only Wiring",
|
|
"description": "Remove duplicated SIRIUS_API_KEY env injection from runtime containers.",
|
|
"details": "Base, dev, prod, and CI test compose definitions now mount the sirius_api_key secret and pass only SIRIUS_API_KEY_FILE into sirius-ui, sirius-api, and sirius-engine.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["1"],
|
|
"subtasks": [
|
|
{
|
|
"id": "2.1",
|
|
"title": "Update local runtime compose overlays",
|
|
"description": "Remove legacy env-based API key injection from base/dev/prod compose files.",
|
|
"details": "docker-compose.yaml, docker-compose.dev.yaml, and docker-compose.prod.yaml now rely solely on the mounted secret file for internal API auth.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["1.2"],
|
|
"testStrategy": "docker compose config succeeds for base, dev, and prod with a mounted secret file present."
|
|
},
|
|
{
|
|
"id": "2.2",
|
|
"title": "Update CI/runtime test compose wiring",
|
|
"description": "Remove SIRIUS_API_KEY from CI integration compose definitions and related scripts.",
|
|
"details": "CI health checks and local validation scripts now read the mounted secret file instead of injecting a duplicate env key.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["2.1"],
|
|
"testStrategy": "CI compose snippets and validation scripts render without requiring SIRIUS_API_KEY in the container env."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "3",
|
|
"title": "PHASE 3: Service Resolution Unification",
|
|
"description": "Make sirius-ui, sirius-api, and sirius-engine all fail fast on the same file-only contract.",
|
|
"details": "Runtime consumers now resolve the internal API key from SIRIUS_API_KEY_FILE only, and startup paths reject missing, unreadable, or empty secret files.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["2"],
|
|
"subtasks": [
|
|
{
|
|
"id": "3.1",
|
|
"title": "Make sirius-api file-only",
|
|
"description": "Remove env fallback from the Go internal API key loader.",
|
|
"details": "sirius-api now requires SIRIUS_API_KEY_FILE, returns clear errors for missing/unreadable/empty files, and no longer accepts SIRIUS_API_KEY as a supported runtime source.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["2.2"],
|
|
"testStrategy": "Focused Go tests cover readable, missing, unreadable, and empty file cases."
|
|
},
|
|
{
|
|
"id": "3.2",
|
|
"title": "Make sirius-ui file-only",
|
|
"description": "Align UI env resolution and startup scripts with the mounted secret file.",
|
|
"details": "env.mjs and apiClient.ts read the file-backed key, while start-prod.sh and start-dev.sh require a readable SIRIUS_API_KEY_FILE before boot.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["2.2"],
|
|
"testStrategy": "Build/contract tests confirm UI startup scripts require SIRIUS_API_KEY_FILE and do not require SIRIUS_API_KEY."
|
|
},
|
|
{
|
|
"id": "3.3",
|
|
"title": "Make sirius-engine file-only",
|
|
"description": "Treat the mounted secret file as the only valid incoming key source for engine startup.",
|
|
"details": "start-enhanced.sh now requires a readable secret file, rejects empty content, and exports the resolved value only for child processes that still expect env access.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["2.2"],
|
|
"testStrategy": "Build/contract tests confirm engine startup script enforces SIRIUS_API_KEY_FILE and no longer reconciles env/file mismatch."
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "4",
|
|
"title": "PHASE 4: Runtime Validation",
|
|
"description": "Prove the hard-cutover contract across tests, CI, and a live source-built stack.",
|
|
"details": "Validation now rejects legacy env injection, verifies file-backed parity across UI/API/engine, checks authenticated and unauthenticated API behavior, and confirms the source-built stack boots under the new contract.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["3"],
|
|
"subtasks": [
|
|
{
|
|
"id": "4.1",
|
|
"title": "Tighten automated contract checks",
|
|
"description": "Update scripts and tests to enforce the file-only runtime model.",
|
|
"details": "verify-runtime-auth-contract.sh, container test scripts, CI compose snippets, and installer/API tests now treat env-based API key injection as legacy drift rather than a valid runtime path.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["3.3"],
|
|
"testStrategy": "Go tests, shell syntax checks, compose render checks, and build contract tests all pass."
|
|
},
|
|
{
|
|
"id": "4.2",
|
|
"title": "Run the source-image verification matrix",
|
|
"description": "Validate UI/API/engine behavior with the branch's actual images, not the last GHCR release.",
|
|
"details": "Run the runtime contract against locally built source images to confirm startup, key parity, authenticated /host/, unauthenticated /host/, and postgres credential probes all succeed under the file-only contract.",
|
|
"status": "done",
|
|
"priority": "high",
|
|
"dependencies": ["4.1"],
|
|
"testStrategy": "Source-built docker compose stack boots successfully and scripts/verify-runtime-auth-contract.sh completes without failures."
|
|
}
|
|
]
|
|
}
|
|
]
|