ci: revert to PAT for private tramiton dependency fetch

Use the TRAMITON_FETCH_TOKEN repo secret (Gitea PAT) to fetch tramiton-core over HTTPS. Deploy-key path dropped per preference; the PAT has been added to secrets. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ci: fetch private tramiton dep via read-only SSH deploy key
2026-07-10 16:14:17 +02:00 · 2026-07-10 16:13:02 +02:00 · 2026-07-10 16:08:12 +02:00 · 2026-07-10 16:01:20 +02:00 · 2026-07-10 15:47:55 +02:00 · 2026-07-10 15:41:46 +02:00
1 changed files with 5 additions and 32 deletions
@@ -9,25 +9,13 @@ on:
 env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-D warnings"
-  # Compile cache: sccache -> Hetzner S3 (breakpilot-sccache), runner-independent
-  # and persistent across CI runs (own key prefix). Reuses the shared cluster S3
-  # creds (same bucket as werkpilot). Requires repo secrets HETZNER_S3_ACCESS_KEY
-  # and HETZNER_S3_SECRET_KEY.
+  # sccache caches compilation artifacts within a job so that compiling
+  # both --features server and --features web shares common crate work.
  RUSTC_WRAPPER: /usr/local/bin/sccache
-  SCCACHE_BUCKET: breakpilot-sccache
-  SCCACHE_ENDPOINT: https://nbg1.your-objectstorage.com
-  SCCACHE_REGION: auto
-  SCCACHE_S3_USE_SSL: "true"
-  SCCACHE_S3_KEY_PREFIX: compliance-scanner
-  AWS_ACCESS_KEY_ID: ${{ secrets.HETZNER_S3_ACCESS_KEY }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.HETZNER_S3_SECRET_KEY }}
+  SCCACHE_DIR: /tmp/sccache
  # compliance-agent depends on tramiton-core via git; use the system git so the
  # credential rewrite below (see "Configure git auth ...") is honored on fetch.
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
-  # Throttle cargo so a ~670-crate concurrent download burst doesn't 429 the
-  # Kellnr mirror: fewer concurrent connections (HTTP/1.1) + more retries.
-  CARGO_NET_RETRY: "10"
-  CARGO_HTTP_MULTIPLEXING: "false"

 # Cancel in-progress runs for the same branch/PR
 concurrency:
@@ -51,26 +39,11 @@ jobs:
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "${GITHUB_SHA}"
          git checkout FETCH_HEAD
-      # Resolve crates.io deps through the self-hosted Kellnr mirror (cached,
-      # crates.io-independent). Git deps (tramiton-core) are unaffected — source
-      # replacement only applies to crates.io-sourced crates.
-      - name: Use Kellnr crates.io mirror
-        run: |
-          : "${CARGO_HOME:=/usr/local/cargo}"
-          mkdir -p "$CARGO_HOME"
-          {
-            echo '[source.crates-io]'
-            echo 'replace-with = "kellnr"'
-            echo '[registries.kellnr]'
-            echo 'index = "sparse+https://crates.meghsakha.com/api/v1/cratesio/"'
-          } >> "$CARGO_HOME/config.toml"
-        env:
-          RUSTC_WRAPPER: ""
      - name: Install tools
        run: |
          rustup component add rustfmt clippy
-          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.10.0/sccache-v0.10.0-x86_64-unknown-linux-musl.tar.gz \
-            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.10.0-x86_64-unknown-linux-musl/sccache
+          curl -fsSL https://github.com/mozilla/sccache/releases/download/v0.9.1/sccache-v0.9.1-x86_64-unknown-linux-musl.tar.gz \
+            | tar xz --strip-components=1 -C /usr/local/bin/ sccache-v0.9.1-x86_64-unknown-linux-musl/sccache
          chmod +x /usr/local/bin/sccache
          cargo install cargo-audit --locked
        env:
Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	cdcbf2c714	ci: revert to PAT for private tramiton dependency fetch CI / Check (pull_request) Successful in 9m2s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details Use the TRAMITON_FETCH_TOKEN repo secret (Gitea PAT) to fetch tramiton-core over HTTPS. Deploy-key path dropped per preference; the PAT has been added to secrets. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:14:17 +02:00
Sharang ParnerkarandClaude Fable 5	5f59635bf8	ci: fetch private tramiton dep via read-only SSH deploy key CI / Detect Changes (pull_request) Has been cancelled Details CI / Deploy Agent (pull_request) Has been cancelled Details CI / Deploy Dashboard (pull_request) Has been cancelled Details CI / Deploy Docs (pull_request) Has been cancelled Details CI / Deploy MCP (pull_request) Has been cancelled Details CI / Check (pull_request) Has been cancelled Details Gitea PATs can't be scoped to a single repo and the ephemeral Actions token can't clone a private git dependency (verified: "Repository not found" even with Collaborative Owners + the actions/checkout extraheader form). A read-only Deploy Key is per-repo least privilege: load it from the TRAMITON_DEPLOY_KEY secret and let cargo fetch tramiton over SSH (dep URL is already ssh://…:22222). Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:13:02 +02:00
Sharang ParnerkarandClaude Fable 5	03e39a883d	ci: authenticate tramiton fetch via extraheader (actions/checkout form) CI / Deploy MCP (pull_request) Has been skipped Details CI / Check (pull_request) Failing after 1m30s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details The placeholder-username URL form returned "Repository not found". Switch to the canonical http.extraheader Basic-auth used by actions/checkout (x-access-token:<token>) to remove the username variable. Definitive test of whether the Collaborative Owner grant covers a cargo git-dep clone. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:08:12 +02:00
Sharang ParnerkarandClaude Fable 5	1d346324c5	ci: fetch private tramiton dep via ephemeral Actions token, not a PAT CI / Check (pull_request) Failing after 1m27s Details CI / Detect Changes (pull_request) Has been skipped Details CI / Deploy Agent (pull_request) Has been skipped Details CI / Deploy Dashboard (pull_request) Has been skipped Details CI / Deploy Docs (pull_request) Has been skipped Details CI / Deploy MCP (pull_request) Has been skipped Details sharang/tramiton lists sharang as a Collaborative Owner (tramiton → Settings → Actions), so this repo's Actions can read tramiton. Use ${{ github.token }} in the git credential rewrite instead of a TRAMITON_FETCH_TOKEN PAT — no secret to manage. If cargo's git fetch 403s (feature scoped to uses:-actions only), fall back to a PAT. Refs #118. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 16:01:20 +02:00
Sharang ParnerkarandClaude Fable 5	43a1900850	feat(onboarding): use tramiton-core natively for firmware detection CI / Check (pull_request) Has been cancelled Details CI / Detect Changes (pull_request) Has been cancelled Details CI / Deploy Agent (pull_request) Has been cancelled Details CI / Deploy Dashboard (pull_request) Has been cancelled Details CI / Deploy Docs (pull_request) Has been cancelled Details CI / Deploy MCP (pull_request) Has been cancelled Details Replace the `tramiton detect --json` CLI shell-out with a direct dependency on tramiton-core (same-company IP), so firmware bare-metal/RTOS classification runs in-process and the whole tramiton suite is available to onboarding. - compliance-agent depends on tramiton-core (git, tag v0.4.0). - classify/firmware.rs: TramitonNative runs tramiton_core::provider::analyze on a blocking thread and maps its BuildPlan → a minimal FirmwareDetection. Drops the mirrored JSON structs and the CLI wrapper. FirmwareDetector port + a deterministic MockFirmwareDetector are kept so unit tests need neither the tramiton sources nor a firmware tree. - CI: enable CARGO_NET_GIT_FETCH_WITH_CLI and add a git-auth step so the runner can fetch the private tramiton repo. Requires a repo secret TRAMITON_FETCH_TOKEN (Gitea PAT with read access to sharang/tramiton). Refs #118, #121, #135. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 15:47:55 +02:00
Sharang ParnerkarandClaude Fable 5	c6e82bc331	feat(onboarding): artifact ingest + classifier + suite-integration seams Steps 3-4 of the onboarding plan, plus the sibling-product reconciliation seams. Ingest (compliance-agent/src/ingest, #120): - ingest_all / ingest_artifact normalize each artifact to a working path + metadata. Every blob is SHA-256 hashed (content-addressed store, dedup) — that digest is also the tramiton reconciliation key. - git via GitOps reuse; zip archives + mobile packages extracted; firmware stored as blob; live URL / plaintext / container = metadata only. - IngestContext decoupled from the full AgentConfig (testable in isolation). Classify (compliance-agent/src/classify, #121): - FirmwareDetector port + TramitonCli (shell out `tramiton detect --json`, parse a mirrored BuildPlan subset — no dependency on the proprietary crate) + a deterministic MockFirmwareDetector so CI never needs the binary. - HeuristicClassifier: artifact-kind priors + source-marker fingerprinting (web/backend/mobile/desktop/PLC). - classify_target merges + ranks verdicts into a Classification. Suite-integration seams (compliance-core, #135/#136/#137): - Model: ExternalRef/ExternalSystem (reconcile with tramiton/werkpilot/breakpilot), ComplianceProfile/ComplianceFramework + default_compliance_profile per type. - Ports: EvidenceProvider (fetch external SBOM/VEX/lock/attestation) and ControlsProvider (built-in OSCAL vs breakpilot RAG). - TargetType now derives Hash; AgentConfig gains artifact_store_base_path. 44 unit tests (23 core + 8 ingest + 13 classify). Passes fmt + clippy -D warnings across agent, dashboard (server + web), and mcp. Additive; legacy paths untouched. Refs #118, #120, #121, #135, #136, #137. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-10 15:41:46 +02:00