6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	420af3af9e	feat(werkbank): runner queue endpoints + result persistence (WB-05) ... The control-plane side of the pull API (implements sharang/werkbank#6), so a Werkbank runner can reach a real queue end-to-end: - POST /api/v1/werkbank/jobs/{lease,heartbeat,complete} — thin handlers over the JobQueue (WB-02), tenant-scoped from the request's `tenant` (db_pool .for_tenant_id). lease→204 when empty; heartbeat→409 on a lost lease. - Machine auth: a static WERKBANK_RUNNER_TOKEN bearer (require_runner_token), mounted only when the token is set — like the admin API, and NOT a Keycloak JWT (a runner acts across tenants). /api/v1/werkbank/* is added to the JWT PUBLIC_PREFIXES so it routes to the runner-token gate, not the customer-JWT one. - On completion, the runner's findings + DAST findings are persisted against the job's target (dedup'd by fingerprint), so a job run by a remote runner lands the same findings an in-process run would. - Shared transport types (LeaseRequest/HeartbeatRequest/CompleteRequest/ CompleteResponse) live in compliance-core so the runner (client) and control plane (server) agree on shapes. Tests: 3 HTTP integration tests against a live Mongo (lease→complete→persist, empty-queue 204, and the bearer-token gate) + a token-compare unit test. Skips cleanly with no Mongo. clippy + fmt clean. Follow-up: wiring the scan pipeline to enqueue plc-provision jobs needs an artifact-fetch path for the runner (so it can pull the program blob); tracked with the on-prem work. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-17 12:28:02 +02:00
Sharang Parnerkar	5cafd13f44	ci: log orca webhook response so deploy steps arent silent	2026-04-08 15:09:27 +02:00
Sharang ParnerkarandClaude Opus 4.6	69209649a5	ci: trigger first orca build for all services ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:10:07 +02:00
Sharang ParnerkarandClaude Opus 4.6	d5439adc0d	ci: trigger build of dashboard, docs, mcp images for orca ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:09:49 +02:00
Sharang ParnerkarandClaude Opus 4.6	bc7cdd35e4	ci: replace coolify webhook with orca deploy ... Each deploy job now builds the per-service image, pushes to the private registry as :latest and :sha, then triggers an HMAC-signed orca redeploy webhook. Coolify webhooks are no longer used. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:06:11 +02:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00