fix: security, dead code, idempotence, and documentation cleanup #11

Merged

emil merged 4 commits from GRM-32-codebase-review into master 2026-06-21 00:14:32 +00:00

Conversation 0 Commits 4 Files Changed 20

+351 -476

emil commented 2026-06-20 23:36:43 +00:00

Owner

Copy Link

Copy Source

Summary

Comprehensive codebase review addressing security, dead code, bugs, and documentation.

Security (CWE-214)

• Registration/admin tokens no longer passed via on command line
• Now written to temp JSON file with permissions and passed via

Dead Code Removal

• (legacy system-level service template)
• (never included)
• • test (replaced by )
• Dead "Reload systemd" handler

Bug Fixes

• Duplicate includes in
• apt cache idempotence ( -> )
• Incomplete cleanup (lingering, subuid/subgid)
• Unguarded template tasks in and
• Stale (wrong status check contexts)
• version mismatch (py311 -> py312)
• matching as a type

Deduplication

• sources platform list from

Config

• API URLs now overridable via environment variables

Documentation

• Updated CHANGELOG, TROUBLESHOOTING, README
• Created AGENTS.md with project conventions

Closes GRM-32

## Summary Comprehensive codebase review addressing security, dead code, bugs, and documentation. ### Security (CWE-214) - Registration/admin tokens no longer passed via on command line - Now written to temp JSON file with permissions and passed via ### Dead Code Removal - (legacy system-level service template) - (never included) - + test (replaced by ) - Dead "Reload systemd" handler ### Bug Fixes - Duplicate includes in - apt cache idempotence ( -> ) - Incomplete cleanup (lingering, subuid/subgid) - Unguarded template tasks in and - Stale (wrong status check contexts) - version mismatch (py311 -> py312) - matching as a type ### Deduplication - sources platform list from ### Config - API URLs now overridable via environment variables ### Documentation - Updated CHANGELOG, TROUBLESHOOTING, README - Created AGENTS.md with project conventions Closes GRM-32

emil added 1 commit 2026-06-20 23:36:44 +00:00

fix: security, dead code, idempotence, and documentation cleanup ... c43c403381

Security:
- Pass extra-vars via temp JSON file (0600) instead of command line (CWE-214)
- Make API URLs configurable via environment variables

Dead code removal:
- Remove gitea-runner.service.j2 (legacy system-level service template)
- Remove tasks/config.yml (never included by any playbook)
- Remove scripts/run_molecule_parallel.py + test (replaced by molecule_ci_guard.py)
- Remove dead "Reload systemd" handler (system-level, never notified)

Bug fixes:
- Remove duplicate prune.yml and integration_test.yml includes from install_runner.yml
- Fix apt cache idempotence (cache_valid_time: 0 -> 3600)
- Add lingering disable and subuid/subgid cleanup to remove-runner.yml
- Guard template tasks with docker_rootless_setup in service.yml and prune.yml
- Fix pyproject.toml ruff/pyright target version (py311 -> py312)
- Fix CONVENTIONAL_RE to not match BREAKING CHANGE as a commit type
- Update BRANCH_PROTECTION_CONFIG with correct Gitea Actions contexts

Deduplication:
- molecule_all.sh sources platform list from distribute_molecule.py

Documentation:
- Update CHANGELOG, TROUBLESHOOTING, README
- Create AGENTS.md with project conventions

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

emil added the ready-to-merge label 2026-06-20 23:36:48 +00:00

emil added 1 commit 2026-06-20 23:39:10 +00:00

fix: trigger CI only on opened and synchronize PR events ... decb1c60ce

The pull_request trigger without types fires on all events (opened,
labeled, synchronize, etc.), causing duplicate runs when a label is
added after PR creation. Restrict to opened and synchronize only.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

emil added 1 commit 2026-06-20 23:45:35 +00:00

fix: only update apt cache when Docker repo file changes ... 742d0012ba

The previous fix (cache_valid_time: 3600) broke molecule tests: when
the Docker apt repo is first added, the cache must be refreshed to
find docker-ce. But cache_valid_time: 3600 skips the update if the
cache was refreshed within the last hour.

Register the repo file task and only run apt update when it changes.
This is both idempotent (no unnecessary updates on subsequent runs)
and correct (always refreshes when the repo is newly added).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

emil removed the ready-to-merge label 2026-06-20 23:46:03 +00:00

emil added 1 commit 2026-06-20 23:52:28 +00:00

fix: revert docker_rootless_setup guard on template tasks ... e9e7a1199f

The docker_rootless_setup guard on service.yml and prune.yml template
tasks broke molecule tests: molecule sets docker_rootless_setup: false
(because it can't run rootless Docker inside Docker), but the verify
playbook still checks that the service file and prune timer exist.

Template tasks just create files — they don't need Docker. Remove the
guard so templates are always created, matching the original behavior.

Also fix apt cache update to only run when the Docker repo file changes
(register + is changed), which is both idempotent and correct.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

emil added the ready-to-merge label 2026-06-21 00:14:26 +00:00

emil merged commit 1717d55013 into master 2026-06-21 00:14:32 +00:00

emil deleted branch GRM-32-codebase-review 2026-06-21 00:14:32 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

ci-improvement

CI workflow improvements

doc-improvement

Documentation improvements

feedback

Issues from subagent or agent feedback

ready-to-merge

Auto-merge PR when all CI checks pass

tooling

Tool-related feedback or improvements

workflow-improvement

Workflow alignment or pattern improvements

No labels ready-to-merge

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

emil (emil User) kireto

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: oblachno-oss/grm#11