Joseph Spiker

spikerj closed issue spikerj/spikersoft-issues#544

2026-07-15 20:22:28 +00:00

[Security][Infra] OpenBao Phase 0: swarm stack + init/unseal runbook + Keycloak OIDC (epic #543)

spikerj closed issue spikerj/spikersoft-issues#545

2026-07-15 20:22:28 +00:00

[Security][CI] OpenBao Phase 1: Gitea Actions secrets → AppRole fetch; rotate the committed runner token (epic #543)

spikerj commented on issue spikerj/spikersoft-issues#545

2026-07-15 20:22:28 +00:00

[Security][CI] OpenBao Phase 1: Gitea Actions secrets → AppRole fetch; rotate the committed runner token (epic #543)

Phase 1 complete. All three repos migrated to the OpenBao bao-secrets AppRole fetch — spikersoft-backend, spikersoft-angular (PR #192), spikersoft-artpipe (PR #21) — every CI credential…

spikerj commented on issue spikerj/spikersoft-issues#544

2026-07-15 20:22:28 +00:00

[Security][Infra] OpenBao Phase 0: swarm stack + init/unseal runbook + Keycloak OIDC (epic #543)

Phase 0 complete. OpenBao 3-node Raft HA deployed + initialized, bao.spikersoft.com live, audit + rate-limit quotas configured, Keycloak OIDC with group-locked admin-sso working, and the initial…

spikerj closed issue spikerj/spikersoft-issues#604

2026-07-15 20:22:06 +00:00

[Bug][Backend][CodeExecution] GitService stages files by absolute path — 2 unit tests fail on macOS (/var→/private/var symlink), and prod breaks if Git:RepositoryPath is ever a symlinked path

spikerj commented on issue spikerj/spikersoft-issues#604

2026-07-15 20:22:00 +00:00

[Bug][Backend][CodeExecution] GitService stages files by absolute path — 2 unit tests fail on macOS (/var→/private/var symlink), and prod breaks if Git:RepositoryPath is ever a symlinked path

PR spikersoft-backend#308 merged to master (merged: true). Both GitServicePerUserRepositoryTests pass on macOS and the latent symlinked-Git:RepositoryPath prod failure is closed. Closing.…

spikerj commented on issue spikerj/spikersoft-issues#604

2026-07-15 20:21:07 +00:00

[Bug][Backend][CodeExecution] GitService stages files by absolute path — 2 unit tests fail on macOS (/var→/private/var symlink), and prod breaks if Git:RepositoryPath is ever a symlinked path

Confirmed live on macOS/arm64 and fixed — PR spikersoft-backend#308 (open, awaiting merge).

Reproduced

Ran the two named tests on this Mac before touching anything — both fail exactly…

spikerj commented on issue spikerj/spikersoft-issues#545

2026-07-15 20:09:53 +00:00

[Security][CI] OpenBao Phase 1: Gitea Actions secrets → AppRole fetch; rotate the committed runner token (epic #543)

spikersoft-angular fully migrated & cleaned up (2026-07-15). PR #192 (workflows → bao-secrets) merged and green on master; the 3 angular-specific paths secret/ci/angular/{seq,e2e,sonar}…

spikerj opened issue spikerj/spikersoft-issues#605

2026-07-15 19:17:30 +00:00

[Test][E2E] Split authenticated e2e into staff + student roles (two identities)

spikerj commented on issue spikerj/spikersoft-issues#513

2026-07-15 19:12:56 +00:00

[Bug][Infra][Deploy] docker-monitor: new correctly-named stack exits 0 on startup (stuck 0/1) + duplicate misspelled 'spiekersoft-docker-monitor' stack running in parallel

Heads-up on action item (3), the CI startup smoke test: it was failing on teardown (not on the assertion). The container passed the 15s survival check, then docker rm -f dm-smoke failed with…

spikerj commented on issue spikerj/spikersoft-issues#545

2026-07-15 18:52:05 +00:00

[Security][CI] OpenBao Phase 1: Gitea Actions secrets → AppRole fetch; rotate the committed runner token (epic #543)

All 12 orphaned plaintext Actions secrets deleted from spikersoft-backend (Gitea API). The repo now holds only BAO_ROLE_ID + BAO_SECRET_ID; every real secret lives in OpenBao.

**#545 is…

spikerj commented on issue spikerj/spikersoft-issues#545

2026-07-15 18:49:14 +00:00

[Security][CI] OpenBao Phase 1: Gitea Actions secrets → AppRole fetch; rotate the committed runner token (epic #543)

Phase 1 code-complete & CI-verified (2026-07-15). All backend workflows fetch from OpenBao; batch 4 (sonar-scan + wasm, PR #306) merged and both ran green — wasm published its bundle on the…

spikerj closed issue spikerj/spikersoft-issues#381

2026-07-15 18:23:18 +00:00

[NodeAgent/SystemRemediation] Host disk-space probe — detect/alert on low disk before it stalls services

spikerj commented on issue spikerj/spikersoft-issues#381

2026-07-15 18:23:13 +00:00

[NodeAgent/SystemRemediation] Host disk-space probe — detect/alert on low disk before it stalls services

Implemented and merged — closing.

Landed in spikersoft-backend PR #100 (feature/host-disk-space-probe-381, commit 3878c55), verified present on current origin/master. All four…

spikerj commented on issue spikerj/spikersoft-issues#545

2026-07-15 18:21:29 +00:00

[Security][CI] OpenBao Phase 1: Gitea Actions secrets → AppRole fetch; rotate the committed runner token (epic #543)

Batch 4 up (PR #306) — sonar-scan + wasm, the last two backend workflows on plaintext Actions secrets. Bao paths populated on the swarm via infra provision-batch4-secrets.sh (infra PR…

spikerj closed issue spikerj/spikersoft-issues#594

2026-07-15 18:19:18 +00:00

[Bug][Backend][Observability] Serilog MinimumLevel is hardcoded to Debug in EventHandlerHostBuilder — EVERY appsettings log-level setting is dead config, and ~2.9M Debug events/day are shipped to Seq

spikerj commented on issue spikerj/spikersoft-issues#594

2026-07-15 18:19:15 +00:00

[Bug][Backend][Observability] Serilog MinimumLevel is hardcoded to Debug in EventHandlerHostBuilder — EVERY appsettings log-level setting is dead config, and ~2.9M Debug events/day are shipped to Seq

Resolved and merged — closing.

Verified on current origin/master (be41048):

Fix commit 7977b57 + merge PR #298 (3fc5233) are in the tree. Both Serilog builders are corrected:…

spikerj commented on issue spikerj/spikersoft-issues#590

2026-07-15 18:08:34 +00:00

[Bug][CI][Deploy] cancel-in-progress on master kills DEPLOY jobs — back-to-back merges cancel each other and fixes silently never ship

Resolved in spikersoft-backend PR #305 (merged to master, be410487). Gated cancel-in-progress to ${{ github.ref != 'refs/heads/master' }} on the 14 remaining workflows; api/blog-media/sched…

spikerj closed issue spikerj/spikersoft-issues#590

2026-07-15 18:08:34 +00:00

[Bug][CI][Deploy] cancel-in-progress on master kills DEPLOY jobs — back-to-back merges cancel each other and fixes silently never ship

spikerj commented on issue spikerj/spikersoft-issues#590

2026-07-15 18:07:26 +00:00

[Bug][CI][Deploy] cancel-in-progress on master kills DEPLOY jobs — back-to-back merges cancel each other and fixes silently never ship

Fleet fix up as spikersoft-backend PR #305. Gates cancel-in-progress to ${{ github.ref != 'refs/heads/master' }} on the 14 remaining workflows that still cancelled master deploys (the batch-1…