The PR `check` job configures git auth for the private tramiton-core dependency,
but the main-branch `deploy-agent` job builds `Dockerfile.agent` where cargo also
fetches tramiton-core — inside the image build, with no credentials — so agent
image builds on main failed.
Inject the PAT as a BuildKit secret (never baked into a layer):
- Dockerfile.agent: `RUN --mount=type=secret,id=tramiton_token` configures the
same https-insteadOf rewrite + CARGO_NET_GIT_FETCH_WITH_CLI before cargo build.
- deploy-agent: `DOCKER_BUILDKIT=1 docker build --secret id=tramiton_token,env=
TRAMITON_FETCH_TOKEN ...`, reusing the existing TRAMITON_FETCH_TOKEN secret.
Only the agent image depends on tramiton-core; dashboard/mcp/docs builds are
unaffected. Self-tests on merge (deploy-agent runs when Dockerfile.agent changes).
Refs #118.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each deploy job now builds the per-service image, pushes to the
private registry as :latest and :sha, then triggers an HMAC-signed
orca redeploy webhook. Coolify webhooks are no longer used.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New `compliance-mcp` crate providing a Model Context Protocol server
with 7 tools: list/get/summarize findings, list SBOM packages, SBOM
vulnerability report, list DAST findings, and DAST scan summary.
Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT).
Includes Dockerfile, CI clippy check, and Coolify deploy job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #5
Deploys agent, dashboard, and docs independently based on which
files changed. Only triggers on main after tests pass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Format, clippy, security audit, and test stages adapted from certifai.
Clippy and tests run per-crate with proper feature gating for the
dashboard's server/web split.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sharang