Docker was decommissioned 2026-08-02 but docker-build-push.yml and
deploy-docker.yml were left behind. They still listened to
repository_dispatch: [submodule-updated], so every app push queued a
redundant Docker build alongside the intended Nix deploy.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
DeterminateSystems/nix-installer-action defaults to determinate:true
which tries to auth with FlakeHub via GitHub JWT. We don't use any
FlakeHub flakes, so disable it — skipping the auth entirely.
Separate deploy job failed because it used ls to find store paths
by name, finding OLD local paths instead of the freshly copied CI
paths. Now each service builds, copies, and updates its profile
in a single job using the exact store path from the build output.
No more guessing which path is the right one.
- Fix nix copy URL: ***@ → $VPS_USER@
- Store path from build output, passed across jobs
- Deploy job waits for all builds via needs: build
- SSH key setup in its own step, guarded by main branch
- Only deploy on main branch pushes
- Remote deploy script fetches from VPS nix store
The Sync submodule locally step had an identical duplicate block: after
cd-ing into SUBNODULE_PATH in the first block, the second block tried
cd SUBNODULE_PATH again, causing 'No such file or directory' since
the working directory was already inside the submodule path.
Also added cd $GITHUB_WORKSPACE at the end of the first block to
ensure the next step starts from the workspace root.
Tools repo is now public so GITHUB_TOKEN can clone it.
Revert the token injection workaround since it's no longer needed.
Co-Authored-By: Kilo <kilo@kilo.ai>
Using only :sha-<short> tags ensures deterministic image references
and prevents stale :latest caches from serving wrong images.
Co-Authored-By: Asep Haryana Saputra <asepharyana@users.noreply.github.com>
- Remove dashboard container from observability.yml
- Remove infra/docker/dashboard.Dockerfile
- Remove dashboard route from Traefik apps.yaml
- Mount Docker socket on hub container for /api/dashboard
- Remove dashboard build from CI/CD (docker-build-push.yml)
- Update submodule pointer to hub with Next.js dashboard rewrite
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(infra): update NATS configuration for OpenTelemetry tracing and JetStream support
refactor(dapr): modify Dapr sidecar configuration to use new resources path and config file
chore(docs): update deployment documentation to include observability services
docs(commit-convention): establish commit message guidelines for Asepharyana Hub
docs(deploy-workflow): outline CI/CD pipeline and manual deployment steps for Asepharyana Hub
feat(event-driven): implement event-driven architecture patterns with Dapr and NATS
docs(hub-rules): define repository structure, submodule strategy, and infrastructure patterns
Scraper services depend on dapr-placement (dapr.yml) and nats (nats.yml).
When only scraper.yml changed, docker compose pull/up failed with
'undefined service' because dependent compose files were excluded.
Now always include ALL compose files for dependency resolution, but
selectively pull and up only the target services during partial updates.
The update-submodule.yml workflow used apps/${SERVICE} directly,
but the submodule path is apps/scraper, not apps/scraper-api.
Added a case statement to map service names to correct paths.
The security.yml CodeQL job fails because:
1. The Rust project is in apps/scraper/, not at the repo root
2. CodeQL v4's autobuilder can't find Cargo.toml at the root
3. CodeQL v4 requires the Rust code to be built for analysis
Also removes javascript-typescript language since this repo has no JS/TS code.
The repo only has Rust source code (no JS/TS). CodeQL v4 fails when
a specified language has no code to analyze, which blocks PR #5
(dependabot bumping codeql-action from v3 to v4).
- Simplified Dockerfile for scraper by removing unnecessary Node.js installation and optimizing build stages.
- Updated Traefik environment configuration to use shorter variable names for certificate paths.
- Removed commented-out middleware configurations in dynamic middlewares.yaml.
- Cleaned up legacy SSL configurations in ssl.yaml.
- Disabled insecure API access in Traefik configuration.
- Deleted unused renovate.json file.
- Modified update environment script to only process apps directory.
- Updated GHCR cleanup script to target specific package.
- Streamlined dependency update script to focus on app submodules.
- Removed setup script for Prometheus as it is no longer needed.
