From cdd818737694a845327370e643f82871b5ef11b5 Mon Sep 17 00:00:00 2001 From: Public Source Publisher Date: Thu, 1 Oct 2026 19:10:35 +0000 Subject: [PATCH] Publish curated ITWorx_MCP_Hub source from 2a948b17b420decaa9eda9f5754647e4c518bf1e --- PUBLIC_SOURCE_EXPORT.md | 2 +- PUBLIC_SOURCE_MANIFEST.json | 14 ++-- .../images/install-base-security-updates.sh | 4 +- tests/fixtures/wp200-compose-config.env | 1 + tests/test_compose.py | 81 +++++++++++++++++++ tests/test_wp280_runtime_quality.py | 8 +- 6 files changed, 96 insertions(+), 14 deletions(-) diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md index 4dee154..a3ccc6b 100644 --- a/PUBLIC_SOURCE_EXPORT.md +++ b/PUBLIC_SOURCE_EXPORT.md @@ -1,3 +1,3 @@ # Public source export -This source snapshot was generated from the private canonical repository at revision `6c7434368ce2a594005983c5a6601a31a639e7f1`. It contains no private Git history or operational evidence. Changes are published from the canonical repository. +This source snapshot was generated from the private canonical repository at revision `2a948b17b420decaa9eda9f5754647e4c518bf1e`. It contains no private Git history or operational evidence. Changes are published from the canonical repository. diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json index 868d128..c266535 100644 --- a/PUBLIC_SOURCE_MANIFEST.json +++ b/PUBLIC_SOURCE_MANIFEST.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "sourceRevision": "6c7434368ce2a594005983c5a6601a31a639e7f1", + "sourceRevision": "2a948b17b420decaa9eda9f5754647e4c518bf1e", "files": [ { "path": ".dockerignore", @@ -2064,7 +2064,7 @@ }, { "path": "infrastructure/images/install-base-security-updates.sh", - "sha256": "2eb0c60f78bbcbd24855dcce3f5269db95d345dc05ed93ad0cc5d71a4ba4e68a", + "sha256": "96437b1afe5f5539affb4824191c990416205da0148aa5ffa82204d6d3d74f1f", "bytes": 2083 }, { @@ -3024,8 +3024,8 @@ }, { "path": "tests/fixtures/wp200-compose-config.env", - "sha256": "af66f571ad525deb80ae779e5d70f0e59299978cf49ab1fedf5e3a5ba7f7a288", - "bytes": 2169 + "sha256": "beb0865fd116bdf1fae350803735ec15f273f326b0806b5c9bbf330807673aa6", + "bytes": 2208 }, { "path": "tests/test_appops_connector.py", @@ -3069,8 +3069,8 @@ }, { "path": "tests/test_compose.py", - "sha256": "f90782fa6a5de558792acb0d2b0da2fd624cfe04c74888a7b98804cc281cf15b", - "bytes": 12469 + "sha256": "f38ebacf3c4a9fdb510a8adaf3043a1b542537a0afdf9c9a27aab0a90518bf0e", + "bytes": 16265 }, { "path": "tests/test_contextforge.py", @@ -3454,7 +3454,7 @@ }, { "path": "tests/test_wp280_runtime_quality.py", - "sha256": "dca6a2d4305aade1e7af210e343fb4cf372136d81cc0da3a1ca920b1dc30202f", + "sha256": "c379b1e54bedb776a95d14051cab1757960ba79d9171854743cf23bcbb907ac2", "bytes": 5442 }, { diff --git a/infrastructure/images/install-base-security-updates.sh b/infrastructure/images/install-base-security-updates.sh index 43ddc2f..7e1e4c6 100644 --- a/infrastructure/images/install-base-security-updates.sh +++ b/infrastructure/images/install-base-security-updates.sh @@ -5,9 +5,9 @@ set -eu # explicit: a release build must fail rather than silently consume newer OS # packages that were not scanned. gzip_version='1.13-1+deb13u1' -pcre2_version='10.46-1~deb13u2' +pcre2_version='10.46-1~deb13u3' sqlite3_version='3.46.1-7+deb13u2' -openssl_version='3.5.7-1~deb13u2' +openssl_version='3.5.7-1~deb13u3' perl_base_version='5.40.1-6+deb13u1' util_linux_version='2.41.5-0+deb13u1' bsdutils_version='1:2.41.5-0+deb13u1' diff --git a/tests/fixtures/wp200-compose-config.env b/tests/fixtures/wp200-compose-config.env index 13fc07e..b22241c 100644 --- a/tests/fixtures/wp200-compose-config.env +++ b/tests/fixtures/wp200-compose-config.env @@ -21,3 +21,4 @@ NPM_NETWORK_NAME=itworx-mcp-hub-npm INSPECTOR_BIND_IP=127.0.0.1 COMPOSE_PROFILES=observability DEMO_TOKEN_REVOCATIONS_DIR_HOST=/tmp +APPOPS_BUILD_DATE=2026-10-01T18:00:00Z diff --git a/tests/test_compose.py b/tests/test_compose.py index 72974f4..a6fc88f 100644 --- a/tests/test_compose.py +++ b/tests/test_compose.py @@ -228,6 +228,87 @@ class ComposeContractTests(unittest.TestCase): f"{name} retains a build definition; local build fallback is possible", ) + def test_autodeploy_builds_every_owned_service_with_controller_provenance(self) -> None: + overlay = yaml.safe_load( + (ROOT / "infrastructure/compose/docker-compose.autodeploy.yml").read_text( + encoding="utf-8" + ) + ) + owned = {name for name, service in self.document["services"].items() if "build" in service} + self.assertTrue(owned) + for name in owned: + with self.subTest(service=name): + self.assertIn(name, overlay["services"]) + service = overlay["services"][name] + self.assertIn("${GITEA_COMMIT_SHA:?", service["image"]) + arguments = service["build"].get("args", {}) + self.assertEqual( + arguments.get("GIT_REVISION"), + "${GITEA_COMMIT_SHA:?GITEA_COMMIT_SHA is required}", + ) + self.assertEqual( + arguments.get("BUILD_DATE"), + "${APPOPS_BUILD_DATE:?APPOPS_BUILD_DATE is required}", + ) + original_arguments = self.document["services"][name]["build"].get("args", {}) + for key, value in original_arguments.items(): + self.assertEqual(arguments.get(key), value) + + def test_real_autodeploy_preserves_intake_digest_and_owned_build_revision(self) -> None: + docker = shutil.which("docker") + if docker is None: + self.skipTest("docker CLI is not available in this environment") + revision = "a" * 40 + built_at = "2026-10-01T18:00:00Z" + with tempfile.TemporaryDirectory() as secrets_dir: + for name in self.document["secrets"]: + (Path(secrets_dir) / name).write_text("test-fixture-secret\n", encoding="utf-8") + command = [docker, "compose", "--profile", "knowledge-intake"] + for filename in ( + "docker-compose.yml", + "docker-compose.prod.yml", + "docker-compose.autodeploy.yml", + "docker-compose.ingestion.prod.yml", + ): + command.extend(["-f", str(COMPOSE.parent / filename)]) + command.extend( + [ + "--env-file", + str(ROOT / "tests/fixtures/wp200-compose-config.env"), + "config", + "--format", + "json", + ] + ) + completed = subprocess.run( # noqa: S603 + command, + capture_output=True, + text=True, + check=False, + env={ + **os.environ, + "SECRETS_DIR": secrets_dir, + "COMPOSE_PROFILES": "", + "CONNECTOR_INGESTION_IMAGE": f"registry.example.test/intake@sha256:{'b' * 64}", + "GITEA_COMMIT_SHA": revision, + "APPOPS_BUILD_DATE": built_at, + }, + ) + self.assertEqual(completed.returncode, 0, completed.stderr) + rendered = json.loads(completed.stdout) + self.assertEqual(len(rendered["services"]), 17) + self.assertEqual( + rendered["services"]["connector-ingestion"]["image"], + f"registry.example.test/intake@sha256:{'b' * 64}", + ) + self.assertNotIn("build", rendered["services"]["connector-ingestion"]) + for name, service in rendered["services"].items(): + if "build" not in service: + continue + self.assertEqual(service["build"]["args"]["GIT_REVISION"], revision, name) + self.assertEqual(service["build"]["args"]["BUILD_DATE"], built_at, name) + self.assertTrue(service["image"].endswith(f":{revision}"), name) + def test_unraid_folder_view_groups_the_complete_production_stack(self) -> None: definition_path = ROOT / "infrastructure" / "unraid" / "folder-view3-itworx-mcp-hub.json" definition = json.loads(definition_path.read_text(encoding="utf-8")) diff --git a/tests/test_wp280_runtime_quality.py b/tests/test_wp280_runtime_quality.py index 72b9daf..a89f2a0 100644 --- a/tests/test_wp280_runtime_quality.py +++ b/tests/test_wp280_runtime_quality.py @@ -67,11 +67,11 @@ def test_base_security_layer_pins_and_verifies_staging_fixed_versions() -> None: ) fixed_packages = { "gzip": ("gzip", "1.13-1+deb13u1"), - "libpcre2-8-0": ("pcre2", "10.46-1~deb13u2"), + "libpcre2-8-0": ("pcre2", "10.46-1~deb13u3"), "libsqlite3-0": ("sqlite3", "3.46.1-7+deb13u2"), - "libssl3t64": ("openssl", "3.5.7-1~deb13u2"), - "openssl": ("openssl", "3.5.7-1~deb13u2"), - "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u2"), + "libssl3t64": ("openssl", "3.5.7-1~deb13u3"), + "openssl": ("openssl", "3.5.7-1~deb13u3"), + "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u3"), "perl-base": ("perl_base", "5.40.1-6+deb13u1"), } for package, (variable, version) in fixed_packages.items():