6 Commits

Include renames

Author	SHA1	Message	Date
Latte	904e96a559	ci(docker): publish image to Gitea registry (dev + main), mirror AegisGitea-MCP ... Replace the opt-in docker workflow with the AegisGitea-MCP-style pipeline: lint -> test -> build -> smoke-test -> push to git.hiddenden.cafe. - Image git.hiddenden.cafe/hiddenden/familiar; main -> :latest + :main, dev -> :dev, every build also tagged :sha-<12>. Push gated to main/dev push events, authenticated with the REGISTRY_TOKEN secret; scoped cleanup after each run. - docker-compose.yml pulls the published image (FAMILIAR_IMAGE, default :latest) with local build as a fallback; .env.example + docs/deployment.md document the channels and the pull-based deploy.	2026-07-03 20:17:44 +02:00
Latte	f4d2dcb1d8	feat(serve): HTTP transport + hardened Docker image for secure public serving ... Add an opt-in streamable-HTTP transport alongside the default stdio, so familiar can be reached from a home lab over HTTPS behind a TLS reverse proxy. - config.http_settings(): env-driven transport/host/port/path/token settings. - serve.run(): dispatch stdio vs http; fail closed on a non-loopback bind without a bearer token (FAMILIAR_ALLOW_INSECURE_BIND escape hatch). - server.build_http_auth(): FastMCP StaticTokenVerifier bearer gate; add an unauthenticated /healthz route for container/proxy probes. - `familiar serve` CLI alias; clean exit on InsecureBind. - docker/Dockerfile (multi-stage, non-root) + hardened docker-compose.yml (read-only rootfs, cap_drop ALL, no-new-privileges, Traefik TLS labels), .dockerignore, .env.example. Token store mounts at /data; writes off by default. - .gitea/workflows/docker.yml: build + smoke-test, opt-in image publish. - docs/deployment.md + README/CLAUDE.md notes; tests for settings, fail-closed validation, and the bearer verifier.	2026-07-03 19:55:20 +02:00
LatteandClaude Opus 4.8	edf2298e20	ci: authenticate twine with REGISTRY_TOKEN secret ... The repo already has a REGISTRY_TOKEN secret (Gitea access token with package scope); the workflow referenced a non-existent PACKAGE_REGISTRY_TOKEN and fell back to the auto GITHUB_TOKEN, which is not granted package-write, so every upload was rejected. Point twine at REGISTRY_TOKEN. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 18:01:22 +02:00
LatteandClaude Opus 4.8	d76c8f87a8	ci: drop unsupported --skip-existing from twine upload ... Gitea's PyPI registry rejects twine's --skip-existing flag (UnsupportedConfiguration), which failed every publish run. Remove it and instead tolerate an "already exists" conflict in the shell, so dev (unique .devN versions) always publishes and a main re-run of an existing release is treated as success rather than a hard failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 17:57:50 +02:00
LatteandClaude Opus 4.8	a136853126	ci: grant contents:read so publish can checkout private repo ... Setting `permissions: packages: write` alone dropped every other scope to none, so actions/checkout could not clone the private repo and the publish job failed before building. Add contents:read, and use github.actor (more reliably populated than gitea.actor) as the twine username. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 17:52:14 +02:00
LatteandClaude Opus 4.8	585acc766c	ci: add Gitea Actions workflow (lint, test, publish) ... Lint (ruff) and test (pytest, fail under 80% coverage) on every PR and push to main/dev. On a merge to main/dev, build the sdist+wheel and publish to the Gitea PyPI registry — main as a clean release, dev as a unique .devN pre-release. No Docker; runs on uv. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 17:34:59 +02:00