From 22e70bcada1c9915e15f3e94db8b96293cc54458 Mon Sep 17 00:00:00 2001 From: ogt Date: Fri, 17 Jul 2026 11:52:20 +0800 Subject: [PATCH 1/2] test(gitea): track Wazuh credential reference --- ...ea_capability_ci_cd_optimization_readback_api.py | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/apps/api/tests/test_gitea_capability_ci_cd_optimization_readback_api.py b/apps/api/tests/test_gitea_capability_ci_cd_optimization_readback_api.py index 09fe07d73..756dd3aac 100644 --- a/apps/api/tests/test_gitea_capability_ci_cd_optimization_readback_api.py +++ b/apps/api/tests/test_gitea_capability_ci_cd_optimization_readback_api.py @@ -210,14 +210,11 @@ def test_gitea_capability_readback_rolls_up_complete_feature_surface() -> None: ] > 0 ) - assert ( - len( - payload["workflow_source_inventory"]["secret_variable_rollups"][ - "referenced_secret_names" - ] - ) - == 26 - ) + referenced_secret_names = payload["workflow_source_inventory"][ + "secret_variable_rollups" + ]["referenced_secret_names"] + assert "HOST112_ANSIBLE_BECOME_PASSWORD" in referenced_secret_names + assert len(referenced_secret_names) == 27 feature_source_contracts = payload["workflow_source_inventory"][ "gitea_feature_source_contracts" ] From f355a4693c29cee583098c916df516cce321c04d Mon Sep 17 00:00:00 2001 From: AWOOOI CD Date: Fri, 17 Jul 2026 12:05:26 +0800 Subject: [PATCH 2/2] chore(cd): deploy 22e70bc [skip ci] --- k8s/awoooi-prod/06-deployment-api.yaml | 4 ++-- k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml | 2 +- k8s/awoooi-prod/08-deployment-worker.yaml | 2 +- k8s/awoooi-prod/kustomization.yaml | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/k8s/awoooi-prod/06-deployment-api.yaml b/k8s/awoooi-prod/06-deployment-api.yaml index aef1147e1..d8d5068c5 100644 --- a/k8s/awoooi-prod/06-deployment-api.yaml +++ b/k8s/awoooi-prod/06-deployment-api.yaml @@ -157,12 +157,12 @@ spec: - name: AWOOOI_BUILD_COMMIT_SHA # 2026-06-29 Codex: CD rewrites this to the deployed image tag so # production deploy readback does not rely on a stale static snapshot. - value: "32bca98aaf3f12710741f5dd9c1ff4dc74aaff64" + value: "22e70bcada1c9915e15f3e94db8b96293cc54458" - name: AWOOOI_DESIRED_API_IMAGE_TAG # 2026-06-30 Codex: CD rewrites this alongside AWOOOI_BUILD_COMMIT_SHA. # Production readback compares runtime image truth against this # GitOps desired tag instead of doing a slow Gitea raw fetch. - value: "32bca98aaf3f12710741f5dd9c1ff4dc74aaff64" + value: "22e70bcada1c9915e15f3e94db8b96293cc54458" - name: DATABASE_POOL_SIZE # 2026-07-01 Codex: production role `awoooi` currently has a low # connection limit. Keep API pool conservative until DB role diff --git a/k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml b/k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml index 703e4b6c3..afa5de7b4 100644 --- a/k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml +++ b/k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml @@ -66,7 +66,7 @@ spec: - name: DATABASE_NULL_POOL value: "true" - name: AWOOOI_BUILD_COMMIT_SHA - value: "32bca98aaf3f12710741f5dd9c1ff4dc74aaff64" + value: "22e70bcada1c9915e15f3e94db8b96293cc54458" - name: ENABLE_AWOOOP_ANSIBLE_CANDIDATE_BACKFILL_WORKER value: "false" - name: ENABLE_AWOOOP_ANSIBLE_CHECK_MODE_WORKER diff --git a/k8s/awoooi-prod/08-deployment-worker.yaml b/k8s/awoooi-prod/08-deployment-worker.yaml index dc1cc85ea..26e01488d 100644 --- a/k8s/awoooi-prod/08-deployment-worker.yaml +++ b/k8s/awoooi-prod/08-deployment-worker.yaml @@ -178,7 +178,7 @@ spec: - name: DATABASE_BOOTSTRAP_DDL_ENABLED value: "false" - name: AWOOOI_BUILD_COMMIT_SHA - value: "32bca98aaf3f12710741f5dd9c1ff4dc74aaff64" + value: "22e70bcada1c9915e15f3e94db8b96293cc54458" - name: ENABLE_AWOOOP_ANSIBLE_CANDIDATE_BACKFILL_WORKER value: "true" - name: ENABLE_SECURITY_CONTROL_PLANE_MAINTENANCE_WORKER diff --git a/k8s/awoooi-prod/kustomization.yaml b/k8s/awoooi-prod/kustomization.yaml index 22856cdcb..20feb09ba 100644 --- a/k8s/awoooi-prod/kustomization.yaml +++ b/k8s/awoooi-prod/kustomization.yaml @@ -40,9 +40,9 @@ resources: # ⚠️ 重要: name 必須與 deployment YAML 中的 image 完全匹配 (含 tag) # newName + newTag 由 CI 透過 kustomize edit set image 注入 images: -- digest: sha256:bc0e92b93b9ca5f0637946eddbcee394428188fd69961b43fad3a73be9e7d7bd +- digest: sha256:2063e9acebbc4ac24285347831fc76d4fe4365eecc27434bc7c9b24aeb3f98ac name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/api -- digest: sha256:760091fc0f2cc1c726dee92cf349c29a90de251b247d1389ce7ab85abe9e0f3c +- digest: sha256:1f8d934b120442a69aeb72610b577c9381fecad854606c736872b8829f2194fa name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/web