Feature 01 task 5: Gitea Actions CI workflow #6

2026-10-02T23:59:11-04:00

dev_agent commented

2026-10-02 23:59:11 -04:00

Implements task 384c7756 (Feature 01, task 5 of 6).

Done-condition: .gitea/workflows/ci.yml on the self-hosted act_runner with no container: key; actions/setup-go (go-version-file go.mod, cache: false); a gofmt check failing on any output; go vet ./...; go test -race ./...; actions/setup-node (Node 22) with npm ci, npm run typecheck, npm test, npm run build in web/; a final go build of the embedded binary. Evidence: green CI run on the introducing PR + a scratch-branch gofmt-failure run.

Push-triggered green run on the task branch: https://code.cubecraftlabs.com/Maniacs_Mansion/MealQuest/actions/runs/2912 (completed/success).
Trigger-set decision: on [push, pull_request] with no branch filter, because the required evidence includes a feature-branch PR run and a scratch-branch run that a [dev, main] filter would not produce; dev and main remain covered.
Infrastructure note: Maniacs_Mansion had no Actions runner; an act_runner (maniacs-runner-1, ubuntu-latest) was registered for the org with owner authorization so jobs could execute.

Base: feature/19ad7feb-aba0-4b76-ab70-c47d71ed5e76-repository-scaffold-and-ci (c28dff1).

Implements task 384c7756 (Feature 01, task 5 of 6). Done-condition: .gitea/workflows/ci.yml on the self-hosted act_runner with no container: key; actions/setup-go (go-version-file go.mod, cache: false); a gofmt check failing on any output; go vet ./...; go test -race ./...; actions/setup-node (Node 22) with npm ci, npm run typecheck, npm test, npm run build in web/; a final go build of the embedded binary. Evidence: green CI run on the introducing PR + a scratch-branch gofmt-failure run. Push-triggered green run on the task branch: https://code.cubecraftlabs.com/Maniacs_Mansion/MealQuest/actions/runs/2912 (completed/success). Trigger-set decision: on [push, pull_request] with no branch filter, because the required evidence includes a feature-branch PR run and a scratch-branch run that a [dev, main] filter would not produce; dev and main remain covered. Infrastructure note: Maniacs_Mansion had no Actions runner; an act_runner (maniacs-runner-1, ubuntu-latest) was registered for the org with owner authorization so jobs could execute. Base: feature/19ad7feb-aba0-4b76-ab70-c47d71ed5e76-repository-scaffold-and-ci (c28dff1).

dev_agent added 1 commit 2026-10-02 23:59:11 -04:00

Add Gitea Actions CI workflow

CI / ci (push) Successful in 58s

Details

CI / ci (pull_request) Successful in 23s

Details

Independent review Approved — 0 high findings (#6)

Details

8ec304aaad

Runs gofmt, go vet, go test -race, the web typecheck/test/build and a
static build of the binary with the real PWA embedded, on every push and
pull request using the self-hosted act_runner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent reviewed

2026-10-03 00:12:25 -04:00

review_agent left a comment

Independent review — Codex `gpt-6-sol`, reasoning high

Verdict: APPROVED
Reviewed SHA: 8ec304aaad180cefc35bc74968f628393a6e1013

{
  "verdict": "APPROVED",
  "reviewed_sha": "8ec304aaad180cefc35bc74968f628393a6e1013",
  "summary": "The workflow meets the requested checks and embedded build. The local scratch commit contains a formatting error that the gofmt step would report and fail. The Gitea run pages were inaccessible, so their reported results could not be independently verified.",
  "findings": [
    {
      "id": "F1",
      "severity": "medium",
      "location": ".gitea/workflows/ci.yml:6",
      "failure_case": "If untrusted pull requests are accepted, their code and npm install scripts can execute on the self-hosted runner and access resources available to that runner.",
      "evidence": "The workflow triggers on pull_request, selects the self-hosted runner label, has no container key, and runs npm ci. This setup is required by the done-condition.",
      "suggested_correction": "Run these jobs on a disposable, unprivileged runner with no persistent credentials or sensitive host access."
    }
  ]
}

Posted unaltered by review_agent. This is transport, not a second review.

## Independent review — Codex `gpt-6-sol`, reasoning high Verdict: **APPROVED** Reviewed SHA: `8ec304aaad180cefc35bc74968f628393a6e1013` ```json { "verdict": "APPROVED", "reviewed_sha": "8ec304aaad180cefc35bc74968f628393a6e1013", "summary": "The workflow meets the requested checks and embedded build. The local scratch commit contains a formatting error that the gofmt step would report and fail. The Gitea run pages were inaccessible, so their reported results could not be independently verified.", "findings": [ { "id": "F1", "severity": "medium", "location": ".gitea/workflows/ci.yml:6", "failure_case": "If untrusted pull requests are accepted, their code and npm install scripts can execute on the self-hosted runner and access resources available to that runner.", "evidence": "The workflow triggers on pull_request, selects the self-hosted runner label, has no container key, and runs npm ci. This setup is required by the done-condition.", "suggested_correction": "Run these jobs on a disposable, unprivileged runner with no persistent credentials or sensitive host access." } ] } ``` --- Posted unaltered by `review_agent`. This is transport, not a second review.

approver_agent merged commit ec13423b6f into feature/19ad7feb-aba0-4b76-ab70-c47d71ed5e76-repository-scaffold-and-ci

2026-10-03 00:12:40 -04:00

dev_agent referenced this pull request

2026-10-03 00:27:01 -04:00

Feature 01: Repository Scaffold and CI #8

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Maniacs_Mansion/MealQuest#6

Feature 01 task 5: Gitea Actions CI workflow #6

Independent review — Codex gpt-6-sol, reasoning high

Independent review — Codex `gpt-6-sol`, reasoning high