Дмитрий 34bcc570ad fix(setup-logrotate): add 'su postgres postgres' directive для PG logrotate ...

ремонт: logrotate отказал rotation PG log из-за insecure parent dir permissions

/var/log/postgresql/ имеет permissions drwxrwxr-t (group-writable + sticky).
Logrotate refuses to rotate без явного su directive в config.
Стандарт postgresql-common тоже использует 'su' — копирую идиому.

2026-05-29 14:48:05 +03:00

..

a11y.yml

feat(a11y): migrate Pa11y scope from handoff prototypes to live Vue app

2026-05-14 08:25:14 +03:00

artisan-run.yml

ops(incident): allow audit:rebuild-chain в artisan-run whitelist

2026-05-29 13:15:29 +03:00

brain-l1-watcher-weekly.yml

feat(controller): C1 l1-watcher — settings.json ↔ Tooling drift detector

2026-05-19 06:31:18 +03:00

dependency-check.yml

fix(configs): Windows-fix format:sql:check + lychee/pa11y/composer/ESLint hygiene + npm-outdated CI (audit P0-03 + 5 P1/O)

2026-05-09 18:31:17 +03:00

deploy.yml

fix(ci/deploy): drop ON CONFLICT on migrations marker INSERT (table has no UNIQUE)

2026-05-28 12:38:52 +03:00

disk-recover.yml

ops(incident): disk-recover v2 — laravel.log 8.7G + sudo bash redirect для PG log

2026-05-29 12:48:04 +03:00

disk-usage-alert.yml

ops(prevention): disk-usage-alert workflow — cron every 30min

2026-05-29 13:57:40 +03:00

f1-apply-via-superuser.yml

ops(incident): f1-apply-via-superuser workflow

2026-05-29 13:03:05 +03:00

f1-rebuild-via-superuser.yml

fix(f1-rebuild): canonical ROW(...) expression matching AuditRebuildChain.php

2026-05-29 13:53:18 +03:00

pg-diagnose.yml

ops(incident): pg-diagnose workflow for PostgreSQL recovery diagnosis (on main for gh workflow run dispatch)

2026-05-29 12:39:18 +03:00

sast.yml

feat(ci): Semgrep SAST workflow — push/PR to main (#25)

2026-05-10 08:40:52 +03:00

setup-logrotate.yml

fix(setup-logrotate): add 'su postgres postgres' directive для PG logrotate

2026-05-29 14:48:05 +03:00

sql-runner.yml

fix(review): apply F2 review feedback — sql-runner semicolon guard + RouteSupplierLeadJob original_error log capture

2026-05-29 09:11:28 +03:00

ssh-diagnose.yml

ci(ssh-diagnose): add round 2 — show sshd_config.d/01-claude.conf, full nftables ruleset, ssh.service journal, fail2ban jail.d content, recidive jail check (round 1 showed dev IP not in fail2ban banlist, INPUT policy ACCEPT — narrowing to 01-claude.conf restriction or nftables f2b-table; recidive jail can persist bans beyond regular sshd bantime)

2026-05-29 04:47:10 +03:00

stage5-daily-monitor.yml

feat(stage5): daily monitor workflow + remove non-existent partitions:list from artisan-run whitelist + checklist refinement (GitHub-cron 06:00 UTC daily 29.05-04.06 runs scheduler:check-heartbeats + incidents:watch-failures + migrate:status + 4 SQL signals from incidents_log/project_routing_snapshots/failed_webhook_jobs/scheduler_heartbeats; window auto-stops after 2026-06-05; result to job summary + artifact)

2026-05-29 05:42:30 +03:00

stage5-investigate-day1.yml

ci(stage5-investigate): round 3 schema discovery — list columns of activity_log/balance_transactions/supplier_projects/supplier_leads; SELECT * on broken audit rows (ids 597-601 + 460-464) and stuck supplier_leads (1110, 1157) + sample failed_webhook_jobs raw_payload + all B1 supplier_projects

2026-05-29 06:41:01 +03:00

trivy.yml

feat(tooling): Trivy CI workflow prep — disabled until YC Docker (#26)

2026-05-10 08:45:17 +03:00