Repository navigation
fix(console): repair, theme and connect the standalone pages - #79
Open
Mehulsri07 wants to merge 11 commits into
Open
Mehulsri07 wants to merge 11 commits into
Mehulsri07 wants to merge 11 commits into
Conversation
A DevOps pass over the pipeline, container images, Helm chart and observability. Fixes four real defects and closes the hardening gaps around them. Defects fixed - Helm: migrations never re-ran on `helm upgrade`. The migrate Job had a fixed name, so an unchanged spec was skipped (new Alembic revisions not applied) and a changed image tag failed on the immutable pod template. The Job name now carries the release revision, with ttlSecondsAfterFinished for cleanup. - CI: the `postgres`-marked tests (migrations + every Postgres store) were excluded, although Postgres is the store backend everywhere. They use testcontainers, so they now run in the test job; only Kafka stays excluded. - Docker: .dockerignore did not exclude node_modules, so a local build copied host node_modules over the ones `npm ci` installed in the image (and into the Python images via `COPY services/`). Also ignores .env*, dist, .hypothesis, .kiro, .github and the local kubeconfig. - Images were mutable (`latest`, never published). CI now pushes base, full and console images to GHCR tagged with the git SHA on every master commit that passed the smoke test. CI (.github/workflows/ci.yml) - lint and test run in parallel; superseded runs are cancelled. - compose-smoke pre-builds the three images with a GitHub Actions layer cache instead of rebuilding the ~4GB full image cold, then asserts /_metrics is served and the containers do not run as root. - New `helm` job: lint + template in safe, live, sandbox and existing-secret postures. - New advisory jobs: pip-audit on the exported lock, npm audit for both UIs, Trivy on images before publish. These are non-blocking for now because the lockfiles already carry findings (the Meridian UI has 5 high); remove continue-on-error / set exit-code 1 once cleared. - Default `permissions: contents: read`, per-job timeouts. - Add dependabot.yml (actions, uv, npm, docker). Containers - All images run as a non-root user (uid 10001; console uses nginx-unprivileged). Writable paths (/app/data, the HF cache) are owned by that user. - deploy/Dockerfile: one shared `sources` stage instead of two copies of the COPY block; drop the no-op second `uv sync`. - Pin uv (0.12.5) and prom/prometheus (v2.54.1) instead of `latest`. - Compose: one shared image per build target, healthcheck moved into the service anchor (was pasted ten times), Postgres/Redis ports bound to 127.0.0.1 only. Helm chart - Platform services get resource requests/limits (`resources`, `fullResources`) and a non-root, no-privilege-escalation securityContext; same context on migrate, demo-app, Meridian, console. - Redis is now a StatefulSet with AOF on a PVC, probes, resources and `maxmemory` + noeviction, so the event bus survives a pod restart. - RBAC is least-privilege: a namespaced Role by default; the ClusterRole (namespace create/delete) only with the new `rbac.sandbox=true`. - `postgres.existingSecret` lets a pre-created Secret replace the password in values. Observability - services/base.py exposes request count and latency histograms at /_metrics (auth-exempt, labelled by route template). The path is not /metrics because read and feedback already serve token-gated JSON there. Prometheus scrapes all seven services in compose and k8s. Upgrade notes - Existing compose `rca-context` volumes are root-owned; run `docker compose down -v` once (or chown the volume) after pulling. - Redis changes from a Deployment to a StatefulSet on `helm upgrade`. - A live release that set SANDBOX_MODE=k8s must also set rbac.sandbox=true. Not verified locally (no Docker daemon or helm on this machine): image builds, the Helm templates, and the Postgres tests. CI is the first run of all three. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve conflicts with CodexManvik/intelliops master (d0d6baf), keeping both sides' intent: - deploy/Dockerfile, Dockerfile.meridian: upstream's uv pin (0.11.28) and source-COPY-last layer ordering for the full target, combined with this branch's shared sources stage and non-root user. The embedding model is still downloaded as the app user so it owns the cache. - .github/workflows/ci.yml: the compose smoke test runs this branch's /_metrics and non-root checks and upstream's Loki/Grafana checks. - docs/OBSERVABILITY.md: upstream's Grafana section stays section 4; platform self-metrics becomes section 5. - frontend/src/App.tsx: upstream's hash router, extended so the standalone pages are reachable at #/dashboard, #/audit-log, #/product and #/docs and their onNavigate prop is wired (the branch rendered them without the required prop, which did not typecheck). - frontend/package-lock.json: upstream's, matching the merged package.json. - frontend/src/pages/Product.tsx: drop an unused variable that failed tsc -b. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The merge with upstream master dropped the `done` that ends the "images must run unprivileged" loop, so the readiness script failed with "syntax error: unexpected end of file" after every earlier check had passed. Restore it. All run steps now pass `bash -n`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
audit-python found 4 known vulnerabilities in the locked set: - urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175, -4176, -4177) - oauthlib 3.3.1 -> 4.0.0 (PYSEC-2026-4114; transitive via kubernetes) Both are lock-only upgrades (uv lock --upgrade-package); pip-audit is now clean and the test suite passes on the upgraded set. audit-npm reported 5 high findings in each UI, all one dev-only chain: braces -> micromatch -> fast-glob/chokidar -> tailwindcss 3. The only fix npm offers is the breaking tailwindcss 4 migration, and none of it ships to the browser, so the audit is scoped with --omit=dev to runtime dependencies, which are clean in both UIs. With no findings left, drop continue-on-error from both audit jobs so a new vulnerability in a locked dependency fails the PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Dashboard, Audit Log, Product and Docs pages shipped with visible bugs and sat apart from the console. This makes them presentable and wires the one page that has real data behind it. Bugs - Garbled text: Product, Docs and the page data were saved double-encoded (UTF-8 read as cp437), so the UI showed sequences like "→" and "—" in place of arrows and dashes. Re-decoded, and removed the BOMs. - The pages were unreachable: nothing linked to them, and Audit Log had no way back. A fixed PageBar on every page links back to the console and between pages; the console footer links out to them. - Dead links: Docs had four href="#" links, which under hash routing sent the reader to the console overview. The "on this page" list now scrolls to its heading, the help link points at the repository issues, and the two links to pages that do not exist are plain text. - The Docs "copy" button only flashed a tick; it now copies. - Dashboard gradient ids were built from the colour string, which breaks once a colour is a CSS variable. Theme - The pages used ~460 hardcoded hex colours and were always light. They now read a small palette of CSS variables (styles/pages.css) that follows the console's light/dark toggle. Light values are the original colours, so the light theme is unchanged. Real data - Audit Log read 20 hardcoded 2024 rows. It now renders the governance audit trail (GET /audit, mock rows in mock mode) with loading and error states. The date-range filter was ignored and Export CSV did nothing; both work. Type filters match what the trail contains (playbook, situation, other). - Dashboard, Product and Docs still show illustrative content, so the PageBar labels them "sample data". - Deleted data/incidents.ts and data/audit.ts, now unused. Phone layout - Product (771px), Overview (446px) and Incidents (406px) overflowed a 375px viewport. All nine routes now fit: sidebar layouts stack, grids collapse, wide tables scroll inside their card. Quality - The four pages are lazy-loaded; the entry chunk drops from 555 kB to 480 kB. - Clickable rows and cards are keyboard-operable with role, tabIndex and aria-expanded; filter chips expose aria-pressed. - Add ESLint (typescript-eslint + react-hooks) with `npm run lint`, run in the frontend-build CI job. Fixed the handful of findings. Not done: unit tests for the frontend, moving the pages' inline styles to Tailwind, and the auth token compiled into the bundle (needs real auth). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Repairs, themes and connects the four standalone console pages (Dashboard, Audit Log, Product, Docs), and wires the Audit Log to the real governance audit trail.
Bugs fixed
→and—in place of arrows and dashes.href="#"links, which under hash routing sent the reader to the console overview.Other changes
styles/pages.css) that follows the console's light/dark toggle. Light values are the original colours.GET /audit(mock rows in mock mode) with loading and error states, and its type filters match the trail (playbook, situation, other). Dashboard, Product and Docs still show illustrative content and are labelled "sample data".data/incidents.tsanddata/audit.ts.role,tabIndexandaria-expanded; filter chips exposearia-pressed.npm run lint, run in thefrontend-buildCI job.Testing
npm run lintandnpm run build(contrast check,tsc -b,vite build) pass.Not in this PR
Frontend unit tests, moving the pages' inline styles to Tailwind, and the auth token compiled into the bundle.
🤖 Generated with Claude Code