coreci/orca - orca - Cloudinit Services GIT

Author SHA1 Message Date

Author	SHA1	Message	Date
ciagent	477b08c9a4	fix(P07): harden .gitignore for .env and document pre-existing secret leak Layer-3 security audit during P07 EXECUTE found that .env (containing GITEA_TOKEN) was committed in `0cba1aa` during P00 and remained in git history. The pre-P07 .gitignore only excluded .env.local, not .env. This commit: 1. Adds .env to .gitignore alongside .env.local (forward fix — prevents future re-tracking). 2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md with mitigation steps and required human actions (token rotation, history rewrite, access-log audit, CI secret scanning). The backfill script itself (commit `de69788`) does not leak the secret: it sources .env from disk and never echoes or passes it on the command line. The leak is upstream of P07 and is documented as P0 for the human to remediate out-of-band. ---ci--- project: orca phase: 7 milestone: v0.1 status: execute version: v0.1.7 requirements: covered: [REQ-007] partial: [] ---/ci---	2026-06-03 20:30:56 +00:00
Jon Chery	e1b538575c	feat(P06): CoreCI release flow with .coreci.yml and tea integration - .coreci.yml: 4 pipelines (validate, build, test, release). Release gated on refs/tags/v; builds tarball, generates CHANGELOG, publishes via `tea releases create`. - scripts/release.sh: standalone wrapper that builds, tars, generates notes from ---ci--- commit blocks, and publishes via tea. Sources GITEA_TOKEN from .env if present. - Makefile: target paths fixed for ldflags injection (cli package path); added `version`, `changelog`, `release` targets. - .gitignore: exclude .tar.gz (build artifacts, regenerated on release). - CHANGELOG.md: auto-generated from commit log. Version injection: -ldflags targets internal/cli package vars so `orca version` reports the correct tag, commit, and build time. ---ci--- project: orca phase: 6 milestone: v0.1 status: execute requirements: covered: [REQ-007, REQ-014] partial: [] ---/ci---	2026-06-03 19:27:21 +00:00
Jon Chery	aa3cccead5	feat(P01): CLI skeleton with Cobra, subcommand stubs, pre-push hook Implements Phase 1 of v0.1 Foundation: - go.mod with Go 1.25 - cmd/orca/main.go entry point - internal/cli/root.go with global --json flag - internal/cli/version.go (orca version) - internal/cli/init.go (orca init - creates ~/.orca/) - internal/cli/status.go (orca status - shows daemon info) - internal/cli/node.go (orca node {join,leave,list} - stubs) - internal/cli/job.go (orca job {run,list,stop,logs} - stubs) - Makefile (build, test, lint, fmt, release) - LICENSE (MIT) - README.md with quickstart - .gitignore - .githooks/pre-push + scripts/trigger_coreci.sh (CoreCI trigger) - Smoke tests in internal/cli/root_test.go Verified: go build, go test, go vet, gofmt all pass. ---ci--- project: orca phase: 1 milestone: v0.1 status: execute req_covered: - REQ-001 - REQ-002 - REQ-013 - REQ-015 - REQ-016 - REQ-019 - REQ-024 ---/ci---	2026-06-03 12:23:37 +00:00

ciagent

477b08c9a4

fix(P07): harden .gitignore for .env and document pre-existing secret leak

Layer-3 security audit during P07 EXECUTE found that .env (containing
GITEA_TOKEN) was committed in 0cba1aa during P00 and remained in git
history. The pre-P07 .gitignore only excluded .env.local, not .env.

This commit:
1. Adds .env to .gitignore alongside .env.local (forward fix — prevents
   future re-tracking).
2. Documents the pre-existing leak in .ciagent/PHASE7_SECURITY_AUDIT.md
   with mitigation steps and required human actions (token rotation,
   history rewrite, access-log audit, CI secret scanning).

The backfill script itself (commit de69788) does not leak the secret: it
sources .env from disk and never echoes or passes it on the command line.
The leak is upstream of P07 and is documented as P0 for the human to
remediate out-of-band.

---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
  covered: [REQ-007]
  partial: []
---/ci---

2026-06-03 20:30:56 +00:00

Jon Chery

e1b538575c

feat(P06): CoreCI release flow with .coreci.yml and tea integration

- .coreci.yml: 4 pipelines (validate, build, test, release).
  Release gated on refs/tags/v*; builds tarball, generates CHANGELOG,
  publishes via `tea releases create`.
- scripts/release.sh: standalone wrapper that builds, tars, generates
  notes from ---ci--- commit blocks, and publishes via tea. Sources
  GITEA_TOKEN from .env if present.
- Makefile: target paths fixed for ldflags injection (cli package path);
  added `version`, `changelog`, `release` targets.
- .gitignore: exclude *.tar.gz (build artifacts, regenerated on release).
- CHANGELOG.md: auto-generated from commit log.

Version injection: -ldflags targets internal/cli package vars so
`orca version` reports the correct tag, commit, and build time.

---ci---
project: orca
phase: 6
milestone: v0.1
status: execute
requirements:
  covered: [REQ-007, REQ-014]
  partial: []
---/ci---

2026-06-03 19:27:21 +00:00

Jon Chery

aa3cccead5

feat(P01): CLI skeleton with Cobra, subcommand stubs, pre-push hook

Implements Phase 1 of v0.1 Foundation:
- go.mod with Go 1.25
- cmd/orca/main.go entry point
- internal/cli/root.go with global --json flag
- internal/cli/version.go (orca version)
- internal/cli/init.go (orca init - creates ~/.orca/)
- internal/cli/status.go (orca status - shows daemon info)
- internal/cli/node.go (orca node {join,leave,list} - stubs)
- internal/cli/job.go (orca job {run,list,stop,logs} - stubs)
- Makefile (build, test, lint, fmt, release)
- LICENSE (MIT)
- README.md with quickstart
- .gitignore
- .githooks/pre-push + scripts/trigger_coreci.sh (CoreCI trigger)
- Smoke tests in internal/cli/root_test.go

Verified: go build, go test, go vet, gofmt all pass.

---ci---
project: orca
phase: 1
milestone: v0.1
status: execute
req_covered:
  - REQ-001
  - REQ-002
  - REQ-013
  - REQ-015
  - REQ-016
  - REQ-019
  - REQ-024
---/ci---

2026-06-03 12:23:37 +00:00

3 Commits