Squashed merge of 440 commits from test-audit-improvements-4086316797618135702.
This PR adds comprehensive test coverage including:
- Edge case tests for various packages
- Error path verification
- Integration test scenarios
- Improved test assertions and helpers
Co-authored-by: Claude <developers@lethean.io>
* docs: update README.md to reflect actual configuration implementation
This commit updates the README.md to accurately describe the project's
decentralized YAML-based configuration management system, as identified
in the Architecture & Design Pattern Audit (PR #208).
Key changes:
- Refactored 'Architecture' section to match actual directory structure
(e.g., pkg/framework/core, pkg/repos, pkg/agentic, pkg/mcp).
- Removed outdated and non-existent references to pkg/config (JSON),
pkg/display, and pkg/workspace.
- Added a new 'Configuration Management' section documenting YAML file
locations (.core/build.yaml, ~/.core/config.yaml, repos.yaml, etc.).
- Updated 'Quick Start' example to use the correct package path and
handle errors.
- Updated 'Current State' table and 'Package Deep Dives' to match
present packages.
- Cleaned up broken links and references to external repos (core-gui).
* docs: update README.md to reflect actual configuration implementation
This commit updates the README.md to accurately describe the project's
decentralized YAML-based configuration management system, as identified
in the Architecture & Design Pattern Audit (PR #208).
Key changes:
- Refactored 'Architecture' section to match actual directory structure
(e.g., pkg/framework/core, pkg/repos, pkg/agentic, pkg/mcp).
- Removed outdated and non-existent references to pkg/config (JSON),
pkg/display, and pkg/workspace.
- Added a new 'Configuration Management' section documenting YAML file
locations (.core/build.yaml, ~/.core/config.yaml, repos.yaml, etc.).
- Updated 'Quick Start' example to use the correct package path and
handle errors.
- Updated 'Current State' table and 'Package Deep Dives' to match
present packages.
- Cleaned up broken links and references to external repos (core-gui).
- Fixed formatting in pkg/io/local/client.go to satisfy CI.
* docs: update README and fix auto-merge CI
This commit completes the README update to reflect the actual
configuration implementation and also fixes a CI failure in the
auto-merge workflow.
Changes:
- README.md: Updated to document the decentralized YAML-based
configuration system and current project structure.
- pkg/io/local/client.go: Fixed minor formatting to satisfy CI.
- .github/workflows/auto-merge.yml: Replaced the broken reusable
workflow call with a local implementation that includes the
'--repo' flag for the 'gh' command. This avoids the 'fatal: not
a git repository' error in environments without a '.git' directory.
* chore: fix merge conflict and address PR comments
- Merged origin/dev into the current branch.
- Resolved merge conflict in .github/workflows/auto-merge.yml.
- Updated auto-merge.yml with the local implementation to avoid git repository requirement in CI.
* docs: update README, fix auto-merge CI, and fix security vulnerability
- README.md: Updated to document decentralized YAML configuration.
- .github/workflows/auto-merge.yml: Fixed CI by implementing auto-merge locally.
- pkg/unifi/client.go: Fixed CodeQL security alert by making TLS verification configurable.
- pkg/unifi/config.go: Added 'unifi.insecure' config support.
- internal/cmd/unifi/: Added '--insecure' flag to CLI commands.
- pkg/io/local/client.go: Minor formatting fix.
* fix: address code review comments
- Document centralized pkg/config service as primary configuration mechanism
- Add pkg/config entry back to package status table
- Document repos.yaml auto-discovery locations (cwd, parents, home paths)
- Clarify pkg/crypt/openpgp subpackage provides asymmetric encryption
- Add ChaCha20-Poly1305 to symmetric encryption list
- Fix InsecureSkipVerify: only use custom HTTP client when insecure=true
- Add security warnings and #nosec annotation for intentional usage
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude <developers@lethean.io>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* Remove StrictHostKeyChecking=no and implement proper host key verification
This commit addresses security concerns from the OWASP audit by enforcing
strict host key verification for all SSH and SCP commands.
Key changes:
- Replaced StrictHostKeyChecking=accept-new with yes in pkg/container and pkg/devops.
- Removed insecure host key verification from pkg/ansible SSH client.
- Implemented a synchronous host key discovery mechanism during VM boot
using ssh-keyscan to populate ~/.core/known_hosts.
- Updated the devops Boot lifecycle to wait until the host key is verified.
- Ensured pkg/ansible correctly handles missing known_hosts files.
- Refactored hardcoded SSH port 2222 to a package constant DefaultSSHPort.
- Added CORE_SKIP_SSH_SCAN environment variable for test environments.
* Remove StrictHostKeyChecking=no and implement proper host key verification
Addresses security concerns from OWASP audit by enforcing strict host key
verification.
Changes:
- Replaced StrictHostKeyChecking=accept-new with yes in pkg/container and devops.
- Removed insecure host key verification from pkg/ansible.
- Added synchronous host key discovery using ssh-keyscan during VM boot.
- Updated Boot lifecycle to wait for host key verification.
- Handled missing known_hosts file in pkg/ansible.
- Refactored hardcoded SSH port to DefaultSSHPort constant.
- Fixed formatting issues identified by QA check.
* Secure SSH commands and fix auto-merge CI failure
Addresses OWASP security audit by enforcing strict host key verification
and fixes a CI failure in the auto-merge workflow.
Key changes:
- Replaced StrictHostKeyChecking=accept-new with yes in pkg/container and pkg/devops.
- Removed insecure host key verification from pkg/ansible.
- Implemented synchronous host key discovery using ssh-keyscan during VM boot.
- Handled missing known_hosts file in pkg/ansible.
- Refactored hardcoded SSH port to DefaultSSHPort constant.
- Added pkg/ansible/ssh_test.go to verify SSH client initialization.
- Fixed formatting in pkg/io/local/client.go.
- Fixed auto-merge.yml by inlining the script and providing repository context
to 'gh' command, resolving the "not a git repository" error in CI.
* Secure SSH, fix CI auto-merge, and resolve merge conflicts
This commit addresses the OWASP security audit by enforcing strict host key
verification and resolves persistent CI issues.
Security Changes:
- Replaced StrictHostKeyChecking=accept-new with yes in pkg/container and devops.
- Removed insecure host key verification from pkg/ansible.
- Implemented synchronous host key discovery using ssh-keyscan during VM boot.
- Updated Boot lifecycle to wait for host key verification.
- Handled missing known_hosts file in pkg/ansible.
- Refactored hardcoded SSH port to DefaultSSHPort constant.
CI and Maintenance:
- Fixed auto-merge.yml by inlining the script and adding repository context
to 'gh' command, resolving the "not a git repository" error in CI.
- Resolved merge conflicts in .github/workflows/auto-merge.yml with dev branch.
- Added pkg/ansible/ssh_test.go for SSH client verification.
- Fixed formatting in pkg/io/local/client.go to pass QA checks.
* Secure SSH and TLS connections, and fix CI issues
Addresses security concerns from OWASP audit and CodeQL by enforcing strict
host key verification and TLS certificate verification.
Security Changes:
- Enforced strict SSH host key checking in pkg/container and devops.
- Removed insecure SSH host key verification from pkg/ansible.
- Added synchronous host key discovery during VM boot using ssh-keyscan.
- Updated UniFi client to enforce TLS certificate verification by default.
- Added --insecure flag and config option for UniFi to allow opt-in to
skipping TLS verification for self-signed certificates.
CI and Maintenance:
- Fixed auto-merge workflow by providing repository context to 'gh' command.
- Resolved merge conflicts in .github/workflows/auto-merge.yml.
- Added unit tests for secured Ansible SSH client.
- Fixed formatting issues identified by QA checks.
* fix: gofmt alignment in cmd_config.go
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Secure connections, fix CI auto-merge, and resolve formatting
Addresses OWASP security audit and CodeQL security alerts by enforcing
secure defaults for SSH and TLS connections.
Key changes:
- Enforced strict SSH host key checking (StrictHostKeyChecking=yes).
- Implemented synchronous host key verification during VM boot using ssh-keyscan.
- Updated UniFi client to enforce TLS certificate verification by default.
- Added --insecure flag and config option for UniFi to allow opt-in to
skipping TLS verification.
- Fixed auto-merge workflow by providing repository context to 'gh' command.
- Resolved merge conflicts in .github/workflows/auto-merge.yml.
- Fixed formatting in internal/cmd/unifi/cmd_config.go and pkg/io/local/client.go.
- Added unit tests for secured Ansible SSH client.
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Claude <developers@lethean.io>
* docs: add user guide, faq, and enhance troubleshooting
- Created docs/user-guide.md with key concepts and workflows.
- Created docs/faq.md with common questions and answers.
- Enhanced docs/troubleshooting.md with AI/Agentic issues.
- Updated README.md with CLI Quick Start and Getting Help sections.
- Refactored mkdocs.yml to reflect actual file structure and include new docs.
* docs: add user documentation and fix mkdocs navigation
- Created docs/user-guide.md and docs/faq.md.
- Enhanced docs/troubleshooting.md with AI/Agentic issues.
- Updated README.md with CLI Quick Start and Help links.
- Restored original mkdocs.yml navigation and added new user documentation sections.
- Fixed formatting in pkg/io/local/client.go to ensure CI passes.
* docs: add user documentation and fix auto-merge workflow
- Created docs/user-guide.md and docs/faq.md with user-focused content.
- Enhanced docs/troubleshooting.md with AI/Agentic issue solutions.
- Updated README.md with CLI Quick Start and organized help links.
- Refactored mkdocs.yml to include new documentation while preserving technical sections.
- Fixed .github/workflows/auto-merge.yml by inlining the logic and adding git repository context (checkout and -R flag) to resolve CI failures.
- Verified that docs/workflows.md is present in the repository.
* docs: add user documentation and resolve merge conflict
- Created docs/user-guide.md and docs/faq.md.
- Enhanced docs/troubleshooting.md with AI/Agentic issue solutions.
- Updated README.md with CLI Quick Start and Help sections.
- Merged latest base branch changes and resolved conflict in .github/workflows/auto-merge.yml.
- Verified and organized mkdocs.yml navigation.
* docs: add user documentation and fix UniFi security issue
- Created docs/user-guide.md and docs/faq.md.
- Enhanced docs/troubleshooting.md.
- Updated README.md with CLI Quick Start.
- Fixed UniFi security vulnerability (CodeQL alert) by making TLS verification configurable.
- Added --insecure flag to UniFi CLI commands.
- Verified all documentation links and navigation.
* docs: add user documentation and fix formatting/security
- Created docs/user-guide.md and docs/faq.md.
- Enhanced docs/troubleshooting.md.
- Updated README.md with CLI Quick Start.
- Fixed UniFi security vulnerability by making TLS verification configurable.
- Added --insecure flag to UniFi CLI commands.
- Fixed formatting in internal/cmd/unifi/cmd_config.go.
- Verified all documentation links and navigation.
---------
Co-authored-by: Claude <developers@lethean.io>
* feat(release): add Homebrew tap support and fix artifact naming
- Fix platform naming: binaries now named core-{os}-{arch} instead of
just 'core', preventing collision when artifacts merge
- Add tar.gz archives for non-Windows builds (Homebrew requirement)
- Add update-tap job to alpha-release workflow that auto-updates
host-uk/homebrew-tap with checksums on each alpha release
- Add homebrew publisher to .core/release.yaml for formal releases
- Update install instructions to include brew install
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(unifi): add UniFi Go SDK integration and CLI commands
- Add pkg/unifi SDK wrapping unpoller/unifi with TLS, config resolution,
and typed accessors for sites, clients, devices, networks, and routes
- Add CLI commands: unifi sites, clients, devices, networks, routes, config
- Register unifi commands in full variant build
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(release): set AppVersion ldflags, git config, and tap token
- Set -X pkg/cli.AppVersion in ldflags so core --version reports the
correct version instead of "dev"
- Add git config user.name/email in update-tap job so commit succeeds
- Use HOMEBREW_TAP_TOKEN secret instead of GITHUB_TOKEN for cross-repo
push to host-uk/homebrew-tap
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(unifi): address CodeRabbit review feedback
- Reject conflicting --wired and --wireless flags in clients command
- Complete --type flag help text with bgp and ospf route types
- URL-escape site name in routes API path
- Wrap all command errors with log.E for contextual diagnostics
- Set TLS MinVersion to 1.2 on UniFi client
- Simplify redundant fmt.Sprintf in Print calls
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Snider