From ed8f59439deb15f7988b4b688ac45e25cc0b456e Mon Sep 17 00:00:00 2001 From: Jens Caers Date: Mon, 31 Aug 2026 09:30:36 +0200 Subject: [PATCH 1/6] docs: record VacatureRadar history blocker --- docs/REPOSITORY_SANITATION.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 docs/REPOSITORY_SANITATION.md diff --git a/docs/REPOSITORY_SANITATION.md b/docs/REPOSITORY_SANITATION.md new file mode 100644 index 0000000..b15d7fc --- /dev/null +++ b/docs/REPOSITORY_SANITATION.md @@ -0,0 +1,9 @@ +# Repository sanitation status + +The accidental deployment log containing live root-SSH/container output was removed from the current tree. Active Unraid examples now use a neutral local hostname and generic appdata/backup paths rather than the operator's private host and storage layout. + +## HISTORY_REWRITE_REQUIRED + +Earlier commits contain the removed `deploy-log.txt` object, including private deployment commands, host information and runtime/database output. Earlier `.env.unraid.example`, `BACKUP_RESTORE.md` and `DEPLOYMENT.md` revisions also contain the original private host and appdata/backup paths. + +Before public review, scan all refs for credentials, SSH targets, personal applicant/job data, production databases, media, backups, logs, archives and large objects. Review fixtures and screenshots for names, contact details, application history and other personal data. No history was rewritten during this campaign. -- 2.54.0 From ebdf3f4f91bc89f5f214a1017855ee214c387545 Mon Sep 17 00:00:00 2001 From: Jens Date: Tue, 1 Sep 2026 15:11:27 +0200 Subject: [PATCH 2/6] ci: provision required Playwright browser gate --- .gitea/workflows/managed-validation.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index 05072fe..c1bd626 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -54,10 +54,11 @@ jobs: "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0 managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv" export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv" - "${managed_uv}" sync --locked + "${managed_uv}" sync --locked --extra browser export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}" if [[ "${profile}" == test || "${profile}" == full ]]; then if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then + "${managed_uv}" run playwright install --with-deps chromium "${managed_uv}" run python -m pytest fi fi -- 2.54.0 From f52a4ef3cf1d209e28cb5e2708d2b2098c666f15 Mon Sep 17 00:00:00 2001 From: Jens Date: Tue, 1 Sep 2026 17:16:53 +0200 Subject: [PATCH 3/6] ci: bound Playwright browser provisioning --- .gitea/workflows/managed-validation.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index c1bd626..ad2d911 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -58,8 +58,12 @@ jobs: export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}" if [[ "${profile}" == test || "${profile}" == full ]]; then if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then - "${managed_uv}" run playwright install --with-deps chromium - "${managed_uv}" run python -m pytest + # Avoid an unbounded apt transaction here: it previously + # kept the job alive for more than an hour before any test + # had started. Missing runtime libraries still fail closed + # when the mandatory browser tests launch Chromium. + timeout --foreground 10m "${managed_uv}" run playwright install chromium + timeout --foreground 20m "${managed_uv}" run python -m pytest fi fi if [[ "${profile}" == lint || "${profile}" == full ]]; then -- 2.54.0 From 9643916f16bef9cbc74d75e4864faf17f1ede49e Mon Sep 17 00:00:00 2001 From: Jens Date: Tue, 1 Sep 2026 17:30:15 +0200 Subject: [PATCH 4/6] ci: run browser gate in pinned Playwright image --- .gitea/workflows/managed-validation.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index ad2d911..97e29d5 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -23,6 +23,11 @@ jobs: name: full runs-on: ubuntu-latest timeout-minutes: 30 + container: + image: mcr.microsoft.com/playwright/python:v1.54.0-noble + options: --ipc=host + env: + PLAYWRIGHT_BROWSERS_PATH: /ms-playwright steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Validate repository with a bounded profile @@ -58,11 +63,8 @@ jobs: export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}" if [[ "${profile}" == test || "${profile}" == full ]]; then if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then - # Avoid an unbounded apt transaction here: it previously - # kept the job alive for more than an hour before any test - # had started. Missing runtime libraries still fail closed - # when the mandatory browser tests launch Chromium. - timeout --foreground 10m "${managed_uv}" run playwright install chromium + # The version-matched Playwright CI image supplies Chromium + # and its runtime libraries without an apt transaction. timeout --foreground 20m "${managed_uv}" run python -m pytest fi fi -- 2.54.0 From 1cd6fc11a4d1f7e5fe675aea4ba7fb768e494b12 Mon Sep 17 00:00:00 2001 From: Jens Date: Tue, 1 Sep 2026 17:47:37 +0200 Subject: [PATCH 5/6] ci: use Node-capable Playwright runner image --- .gitea/workflows/managed-validation.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index 97e29d5..7d4029a 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -24,12 +24,19 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 container: - image: mcr.microsoft.com/playwright/python:v1.54.0-noble + # Gitea's JavaScript actions execute inside the job container, so use + # the version-matched Playwright image that includes Node as well as the + # pinned Chromium browser and native runtime libraries. + image: mcr.microsoft.com/playwright:v1.54.0-noble options: --ipc=host env: PLAYWRIGHT_BROWSERS_PATH: /ms-playwright steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Provision the supported Python runtime + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 + with: + python-version: '3.13.2' - name: Validate repository with a bounded profile shell: bash env: -- 2.54.0 From 256cb986959053d010dccd81a2b36e2861b867e9 Mon Sep 17 00:00:00 2001 From: Jens Date: Tue, 1 Sep 2026 18:07:35 +0200 Subject: [PATCH 6/6] ci: install pinned browser without apt --- .gitea/workflows/managed-validation.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index 7d4029a..055c2a6 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -29,8 +29,6 @@ jobs: # pinned Chromium browser and native runtime libraries. image: mcr.microsoft.com/playwright:v1.54.0-noble options: --ipc=host - env: - PLAYWRIGHT_BROWSERS_PATH: /ms-playwright steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Provision the supported Python runtime @@ -70,8 +68,11 @@ jobs: export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}" if [[ "${profile}" == test || "${profile}" == full ]]; then if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then - # The version-matched Playwright CI image supplies Chromium - # and its runtime libraries without an apt transaction. + # The image supplies the native browser libraries. Install + # only the lockfile-matched browser payload into an explicit + # job-local path; never invoke Playwright's apt workflow. + export PLAYWRIGHT_BROWSERS_PATH="${RUNNER_TEMP}/managed-playwright" + timeout --foreground 5m "${managed_uv}" run playwright install chromium timeout --foreground 20m "${managed_uv}" run python -m pytest fi fi -- 2.54.0