3 Commits

Author	SHA1	Message	Date
shankar0123	8b75e0311b	chore: rename Go module path to github.com/certctl-io/certctl ... Mechanical sed across the main go.mod's module declaration, the f5-mock-icontrol sub-module's go.mod, every Go file's import path (361 files), and a rebuild of the checked-in f5-mock-icontrol binary so its embedded build-info reflects the new module path. No behavior change. Choice B from cowork/transfer-certctl-to-org.md, executed 2026-05-04. Choice A (keep module path declared as github.com/shankar0123/certctl regardless of repo URL) shipped on the day of the org transfer (2026-05-03) since we had no external Go consumers; this commit closes that deferral. Backward-compat: GitHub HTTP redirects continue to forward github.com/shankar0123/certctl → github.com/certctl-io/certctl at the URL level, but Go's module proxy uses the path declared in go.mod as the canonical name. Pre-fix, anyone trying `go get github.com/certctl-io/certctl/...` hit a "module path mismatch" error because go.mod said github.com/shankar0123/certctl and the URL they fetched it from said certctl-io/certctl. Post-fix, the canonical name and the URL agree, so go get / go install / external Go consumers / Go-tooling integrations work cleanly via either the new path (preferred) or the old path (which redirects and Go follows the redirect for source fetch). Anyone still importing the old path inside their own code keeps working provided they update their go.mod's `require` line to match — the module path declared in their consumer's go.sum / go.mod is the authoritative import name, so a mass sed across their import statements is the migration on the consumer side. No external consumers exist today. Diff shape: 361 *.go files — import path replacement only 2 go.mod — module declaration replacement only 1 binary — deploy/test/f5-mock-icontrol/f5-mock-icontrol rebuilt so embedded build-info reflects the new path (8618965 vs 8618933 bytes; 32-byte diff is the build-info change) Total: 364 files, 730 insertions / 730 deletions, net-zero size, pure mechanical substitution. Verification: gofmt: 17 files needed re-alignment after sed (the new path is one char shorter than the old, so column-aligned import groups drifted). Applied `gofmt -w` to fix. go mod tidy: clean exit on both modules. go vet ./...: clean exit. go build ./...: clean exit. go test -short -count=1 on representative packages: all green (internal/domain, internal/validation, internal/crypto, internal/crypto/signer, cmd/agent). Test output now reads `ok github.com/certctl-io/certctl/...` confirming the module path resolves correctly. binary: f5-mock-icontrol rebuilt; `strings | grep shankar0123` returns nothing; `strings | grep certctl-io/certctl` shows the new module path embedded in build-info. Files intentionally NOT touched in this commit: README.md / CHANGELOG.md / docs/ / etc. — already swept to certctl-io URLs in commit 0729ee4 (the post-transfer URL refresh). This commit is purely the Go-tooling layer. Scarf pixels (`shankar0123.docker.scarf.sh/...`) — Scarf-account namespace, not a Go import or GitHub repo URL. Stays. This is a non-blocking, non-customer-impacting change. Operators pulling container images, running `make verify`, hitting the API, or installing the agent see no functional difference. Only Go-tooling consumers (none today) are affected, and they're enabled — not broken — by this commit.	2026-05-04 00:30:29 +00:00
shankar0123	7cb453a336	chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4 ... Mechanical reformat. The new 'gofmt drift' CI step (added in ci-pipeline-cleanup Phase 4, commit 0f205a8) surfaced 111 files with accumulated gofmt drift across cmd/, internal/, and deploy/test/. Each file's diff is gofmt-standard: whitespace adjustments, intra- group import sorting (alphabetical by import path within blank-line- separated groups), and struct-tag column alignment. No semantic changes — verified via 'git diff --ignore-all-space' which shows only the line-position deltas from import reordering. The gate stays in place after this commit. Going forward it catches gofmt drift at PR time.	2026-04-30 22:33:57 +00:00
shankar0123	97b23e98d9	test(repository): close L-1 integration-coverage gap for HealthCheck + RenewalPolicy ... The coverage-gap audit flagged L-1 (P2): `HealthCheckRepository` (453 LOC, 11 methods) and `RenewalPolicyRepository` (289 LOC, 5 methods post-G-1 — the audit's "92 lines, 2 methods" figure was stale) ship to production with zero live-DB integration coverage. The existing `repo_test.go` header self-documents the gap: "15 of 17 PostgreSQL repository files". Operationally load-bearing piece: M48's scheduler calls `HealthCheckRepository.ListDueForCheck` every tick to drive continuous TLS health monitoring. A silent SQL regression there — wrong INTERVAL math, NULL-handling slip, lost ORDER BY — would fail open: operator adds endpoint → scheduler never picks it up → endpoint degrades in production → no alert. The loop continues ticking and logs "processed 0 endpoints" normally, so the failure mode is operationally invisible. Closure shape (test-only; no production code touched): - internal/repository/postgres/health_check_test.go (new file, 7 tests) · TestHealthCheckRepository_CRUD · TestHealthCheckRepository_GetByEndpoint · TestHealthCheckRepository_List_Filters · TestHealthCheckRepository_ListDueForCheck (the load-bearing one — seeds four rows with differing last_checked_at+interval relationships to NOW() plus one NULL-last_checked_at row, asserts the correct subset returns and ORDER BY last_checked_at ASC NULLS FIRST holds) · TestHealthCheckRepository_RecordHistory_GetHistory · TestHealthCheckRepository_PurgeHistory · TestHealthCheckRepository_GetSummary - internal/repository/postgres/renewal_policy_test.go (new file, 3 tests) · TestRenewalPolicyRepository_CRUD (exercises auto-generated rp-<slug(name)> PK, JSONB round-trip of [30,14,7,0] thresholds, UpdatedAt monotonic advance, ORDER BY name for List) · TestRenewalPolicyRepository_DuplicateName (asserts errors.Is(err, repository.ErrRenewalPolicyDuplicateName) on both Create-name-unique and Update-name-unique collision paths, the pg 23505 sentinel mapping) · TestRenewalPolicyRepository_DeleteInUse (raw-INSERTs a managed_certificates row FK'ing the policy, asserts errors.Is(err, repository.ErrRenewalPolicyInUse) from pg 23503 ON DELETE RESTRICT, cleans up, then asserts not-found surfaces distinctly) - internal/repository/postgres/repo_test.go (one-line header flip) "covering 15 of 17 ... repository files" → "17 of 17"; added cross-reference pointing readers at the two sibling files. Both new files use the existing getTestDB(t) + schema-per-test-isolation convention and skip via testing.Short() in CI, matching M26 TICKET-003 scaffolding byte-for-byte. Repository/postgres is not in the CI coverage-gate path (grep -nE "internal/repository/postgres" .github/workflows/ci.yml → no hits), so adding test-only files cannot regress gated coverage elsewhere. Verification gates run locally (sandbox without Docker, so the -short skip gate itself is what's exercised; operator runs the testcontainer path locally): 1. go vet ./... — clean 2. go build ./... — clean 3. go test -short -count=1 ./... — clean 4. go test -race -short ./internal/repository/postgres/... — clean 5. staticcheck — absent; CI checkset holds 6. govulncheck — skipped; test-only, no deps 7. per-layer coverage no-regression — N/A; repo/pg not gated 8. tsc --noEmit — N/A; no frontend change 9. vitest run — N/A; no frontend change 10. vite build — N/A; no frontend change 11. OpenAPI lint — N/A; no spec change No migration, no interface change, no production code diff. The RenewalPolicyRepository drift between audit ("92 lines, 2 methods") and HEAD (289 lines, 5 methods post-G-1) is documented honestly in the audit report's Resolution Log, not papered over. Closes: coverage-gap-audit L-1 (P2)	2026-04-20 20:39:06 +00:00