chore: publish clean community baseline

scripts/README.md

@@ -0,0 +1,61 @@
+# Scripts
+
+## `staging-smoke.sh`
+
+Post-deploy smoke helper для staging/production-like окружений.
+
+```bash
+./scripts/staging-smoke.sh https://crank.example.com
+```
+
+## `authenticated-staging-smoke.sh`
+
+Browser-authenticated smoke helper.
+
+Обязательные переменные:
+
+- `CRANK_STAGING_ADMIN_EMAIL`
+- `CRANK_STAGING_ADMIN_PASSWORD`
+
+```bash
+CRANK_STAGING_ADMIN_EMAIL=owner@example.com \
+CRANK_STAGING_ADMIN_PASSWORD=secret \
+./scripts/authenticated-staging-smoke.sh https://crank.example.com
+```
+
+## `staging-note-block.sh`
+
+Генерирует markdown-блок для `docs/staging-regression-notes.md` после реального
+staging pass.
+
+```bash
+./scripts/staging-note-block.sh crank.example.com abc1234 "operator" partial
+```
+
+## `load-openbao-env.sh`
+
+Логинится в OpenBao через AppRole и выгружает deploy/runtime secrets в локальный
+shell env file.
+
+Обязательные переменные:
+
+- `BAO_ADDR`
+- `BAO_ROLE_ID`
+- `BAO_SECRET_ID`
+- `OPENBAO_APP`
+
+Опционально:
+
+- `OPENBAO_ENV_FILE`, default `.openbao-env`
+
+Скрипт читает KV v2 secrets из mount `ci`:
+
+- `shared/registry`
+- `shared/deploy-ssh`
+- `projects/${OPENBAO_APP}/deploy`
+- `projects/${OPENBAO_APP}/runtime`
+
+Также он создает workflow-compatible aliases:
+
+- `REGISTRY_USERNAME -> DEPLOY_REGISTRY_USER`
+- `REGISTRY_PASSWORD -> DEPLOY_REGISTRY_TOKEN`

scripts/authenticated-staging-smoke.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "usage: $0 <base-url>" >&2
+  echo "example: $0 https://rmcp.itexp.me" >&2
+  exit 64
+fi
+
+if [[ -z "${CRANK_STAGING_ADMIN_EMAIL:-}" ]]; then
+  echo "CRANK_STAGING_ADMIN_EMAIL is required" >&2
+  exit 64
+fi
+
+if [[ -z "${CRANK_STAGING_ADMIN_PASSWORD:-}" ]]; then
+  echo "CRANK_STAGING_ADMIN_PASSWORD is required" >&2
+  exit 64
+fi
+
+BASE_URL="${1%/}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+echo "authenticated staging smoke: ${BASE_URL}"
+
+cd "${REPO_ROOT}/apps/ui"
+PLAYWRIGHT_BASE_URL="${BASE_URL}" \
+PLAYWRIGHT_SKIP_WEB_SERVER=1 \
+CRANK_E2E_ADMIN_EMAIL="${CRANK_STAGING_ADMIN_EMAIL}" \
+CRANK_E2E_ADMIN_PASSWORD="${CRANK_STAGING_ADMIN_PASSWORD}" \
+npx playwright test tests/e2e/staging-authenticated.spec.js

scripts/load-openbao-env.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${BAO_ADDR:?BAO_ADDR is required}"
+: "${BAO_ROLE_ID:?BAO_ROLE_ID is required}"
+: "${BAO_SECRET_ID:?BAO_SECRET_ID is required}"
+: "${OPENBAO_APP:?OPENBAO_APP is required}"
+
+output="${OPENBAO_ENV_FILE:-.openbao-env}"
+payload="$(mktemp)"
+merged="$(mktemp)"
+trap 'rm -f "$payload" "$merged"' EXIT
+
+export BAO_ADDR
+BAO_TOKEN="$(bao write -field=token auth/approle/login role_id="$BAO_ROLE_ID" secret_id="$BAO_SECRET_ID")"
+export BAO_TOKEN
+
+printf '{}\n' > "$merged"
+
+merge_secret() {
+  local path="$1"
+
+  bao kv get -mount=ci -format=json "$path" > "$payload"
+
+  python3 - "$payload" "$merged" <<'PY'
+import json
+import sys
+from pathlib import Path
+
+payload = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+merged_path = Path(sys.argv[2])
+merged = json.loads(merged_path.read_text(encoding="utf-8"))
+
+data = payload.get("data", {})
+if isinstance(data, dict) and isinstance(data.get("data"), dict):
+    data = data["data"]
+
+if not isinstance(data, dict):
+    raise SystemExit("OpenBao response does not contain an object secret payload")
+
+merged.update({key: value for key, value in data.items() if value is not None})
+merged_path.write_text(json.dumps(merged), encoding="utf-8")
+PY
+}
+
+merge_secret "shared/registry"
+merge_secret "shared/deploy-ssh"
+merge_secret "projects/${OPENBAO_APP}/deploy"
+merge_secret "projects/${OPENBAO_APP}/runtime"
+
+python3 - "$merged" "$output" <<'PY'
+import json
+import re
+import shlex
+import sys
+from pathlib import Path
+
+data = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
+output_path = Path(sys.argv[2])
+
+if "REGISTRY_USERNAME" in data and "DEPLOY_REGISTRY_USER" not in data:
+    data["DEPLOY_REGISTRY_USER"] = data["REGISTRY_USERNAME"]
+
+if "REGISTRY_PASSWORD" in data and "DEPLOY_REGISTRY_TOKEN" not in data:
+    data["DEPLOY_REGISTRY_TOKEN"] = data["REGISTRY_PASSWORD"]
+
+name_re = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+lines = [
+    "# Generated by scripts/load-openbao-env.sh",
+    "# Do not commit this file.",
+]
+
+for key in sorted(data):
+    if not name_re.match(key):
+        raise SystemExit(f"Unsupported environment variable name from OpenBao: {key}")
+    value = data[key]
+    if isinstance(value, bool):
+        value = "true" if value else "false"
+    elif not isinstance(value, str):
+        value = str(value)
+    lines.append(f"export {key}={shlex.quote(value)}")
+
+output_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+output_path.chmod(0o600)
+print(f"Loaded {len(lines) - 2} OpenBao values into {output_path}", file=sys.stderr)
+PY

scripts/staging-note-block.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ $# -lt 3 ]]; then
+  echo "usage: $0 <environment> <deploy-commit> <checked-by> [smoke-status]" >&2
+  echo "example: $0 rmcp.itexp.me abc1234 \"codex + operator\" partial" >&2
+  exit 64
+fi
+
+ENVIRONMENT="$1"
+DEPLOY_COMMIT="$2"
+CHECKED_BY="$3"
+SMOKE_STATUS="${4:-partial}"
+STAMP="$(TZ="${TZ:-Europe/Moscow}" date '+%Y-%m-%d %H:%M %Z')"
+
+cat <<EOF
+## ${STAMP} — ${ENVIRONMENT} (authenticated pass)
+
+- deploy commit: \`${DEPLOY_COMMIT}\`
+- checked by: \`${CHECKED_BY}\`
+- smoke status: \`${SMOKE_STATUS}\`
+- scope:
+  - auth
+  - ui shell
+  - operations
+  - wizard
+  - agents
+  - api keys
+  - secrets
+  - logs
+  - usage
+  - rest smoke
+  - mcp smoke
+
+### Passed
+
+- login/logout completed
+- shell pages open after auth
+- secrets/auth profile flow status: \`<passed|partial|failed>\`
+- REST smoke: \`<passed|partial|failed>\`
+- MCP smoke: \`<passed|partial|failed>\`
+
+### Findings
+
+- none
+
+### Infra notes
+
+- ...
+
+### Follow-up
+
+- ...
+EOF

scripts/staging-smoke.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "usage: $0 <base-url>" >&2
+  echo "example: $0 https://rmcp.itexp.me" >&2
+  exit 1
+fi
+
+BASE_URL="${1%/}"
+TIMEOUT_SECONDS="${SMOKE_TIMEOUT_SECONDS:-20}"
+
+check_head() {
+  local path="$1"
+  local expected_prefix="${2:-2}"
+  local url="${BASE_URL}${path}"
+  local code
+
+  code="$(curl -k -sS -o /dev/null -I -L --max-time "${TIMEOUT_SECONDS}" -w '%{http_code}' "${url}")"
+  printf '%-36s %s\n' "${path}" "${code}"
+
+  if [[ "${code}" != ${expected_prefix}* ]]; then
+    echo "unexpected status for ${url}: ${code}" >&2
+    return 1
+  fi
+}
+
+check_json() {
+  local path="$1"
+  local expected_status_one="$2"
+  local expected_status_two="${3:-}"
+  local url="${BASE_URL}${path}"
+  local headers
+  local code
+  local content_type
+
+  headers="$(mktemp)"
+  code="$(curl -k -sS -o /dev/null -D "${headers}" --max-time "${TIMEOUT_SECONDS}" -w '%{http_code}' "${url}")"
+  content_type="$(awk -F': *' 'tolower($1) == "content-type" {print $2}' "${headers}" | tr -d '\r' | tail -n1)"
+  rm -f "${headers}"
+
+  printf '%-36s %s (%s)\n' "${path}" "${code}" "${content_type:-unknown}"
+
+  if [[ "${code}" != "${expected_status_one}" && ( -z "${expected_status_two}" || "${code}" != "${expected_status_two}" ) ]]; then
+    echo "unexpected status for ${url}: ${code}" >&2
+    return 1
+  fi
+
+  if [[ "${code}" == "200" && "${content_type}" != application/json* ]]; then
+    echo "unexpected content-type for ${url}: ${content_type:-missing}" >&2
+    return 1
+  fi
+}
+
+check_get() {
+  local path="$1"
+  local expected_prefix="${2:-2}"
+  local url="${BASE_URL}${path}"
+  local code
+
+  code="$(curl -k -sS -o /dev/null --max-time "${TIMEOUT_SECONDS}" -w '%{http_code}' "${url}")"
+  printf '%-36s %s\n' "${path}" "${code}"
+
+  if [[ "${code}" != ${expected_prefix}* ]]; then
+    echo "unexpected status for ${url}: ${code}" >&2
+    return 1
+  fi
+}
+
+check_redirect() {
+  local path="$1"
+  local expected_location_suffix="$2"
+  local url="${BASE_URL}${path}"
+  local headers
+  local code
+  local location
+
+  headers="$(mktemp)"
+  code="$(curl -k -sS -o /dev/null -D "${headers}" --max-time "${TIMEOUT_SECONDS}" -w '%{http_code}' "${url}")"
+  location="$(awk -F': *' 'tolower($1) == "location" {print $2}' "${headers}" | tr -d '\r' | tail -n1)"
+  rm -f "${headers}"
+
+  printf '%-36s %s -> %s\n' "${path}" "${code}" "${location:-missing}"
+
+  if [[ "${code}" != 30* ]]; then
+    echo "expected redirect for ${url}, got ${code}" >&2
+    return 1
+  fi
+
+  if [[ "${location}" != *"${expected_location_suffix}" ]]; then
+    echo "unexpected redirect location for ${url}: ${location:-missing}" >&2
+    return 1
+  fi
+}
+
+echo "staging smoke: ${BASE_URL}"
+echo
+echo "public routes"
+check_head "/" 2
+check_head "/login" 2
+check_head "/agents" 2
+check_head "/secrets" 2
+check_head "/wizard/" 2
+check_get "/mcp/health" 2
+check_json "/api/auth/session" 200 401
+
+echo
+echo "legacy redirects"
+check_redirect "/html/login.html" "/login"
+check_redirect "/html/agents.html" "/agents"
+check_redirect "/html/wizard/" "/wizard/"
+
+echo
+echo "smoke completed"