7 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	ba49a7f0f9	mesh-build-go: a reads-outside marker lists what its tests read, so its package is kept until one of those files changes (issue 1936) ... 47 packages carried the marker and were never kept: about 2000 tests per level ran on every check, whatever it changed. The marker now lists, as paths or globs from the repository's root (? before a path whose absence is read), what the package's tests read outside it; the digest hashes those files with the package's own non-Go files. A marker that lists nothing, names an unclean path, or a line that matches nothing keeps today's never-kept digest. The 46 markers list their reads; checks/deps and checks/trunk lose theirs (their tests read only temporary directories). Digest form 6. Quick fix of issue 1936, chosen by the operator 2026-10-26 21:56; the thorough fix (the Go test log's files kept with each verdict) stays on the issue.	2026-10-26 22:02:58 +01:00
jschoubben	16d7b1898d	Mark the packages whose tests read files outside their directory, found by the review (issue 1935)	2026-10-24 04:38:49 +02:00
jschoubben	a00962871c	Give checks/trunk a full module path, so go mod verify in the checks that use it treats it as the local module it is (R4g group check)	2026-10-23 17:04:08 +02:00
jschoubben	df9e3bd7e2	Run each checks/<x> over the real tree as a Go test, the shrink-only lists against the trunk's copy; the words check within the unit bound (issue 1293, E5a)	2026-10-23 15:28:39 +02:00
mesh-tools	0260ae92f6	Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main	2026-10-16 09:42:45 +00:00
jochen	eb42806379	Make grafana prefer the vault's password, and let the secrets list only shrink (hq issue 342) ... grafana's client logged in with a token setting ahead of the vault's admin password, and its runtime config let a layer set token. The token setting is now ignored and said, token is protected, and the vault's password comes first. checks/secrets/known could gain a line hiding a newly unprotected key. merge-check.sh now judges it against the trunk's copy at the merge base, and refuses an added line.	2026-10-13 07:43:08 +02:00
jochen	fe2040c65e	Keep every password, token and API key the vault's, never a setting (hq issue 342) ... A setting outranked the vault: baserow, grafana, letta and unifi merged a layer's password over the ${secret:...} in their runtime config, and the gitea, home-assistant, icecast, influxdb, mailu and nextcloud clients read the settings file before the vault's file. A secret in a setting cannot be rotated and is read back by the settings verb. The four files now keep their password protected, so the controller refuses a setting of it. The six clients ignore a secret in the settings file and say so once, by key and never with the value; icecast reads its admin password from the vault's file. checks/secrets refuses a mergeable file whose secret a layer could replace; searxng's nested server.secret_key is listed as known until the controller protects a nested key.	2026-10-13 07:32:19 +02:00