ci(ai): robust scanners (continue-on-error + no-pipe capture); gate decides hard

.claude/settings.json

@@ -6,12 +6,7 @@
   },
   "outputStyle": "Explanatory",
   "teammateMode": "tmux",
-  "preferences": {
-    "tmuxSplitPanes": "true",
-    "responseFormat": "markdown"
-  },
   "permissions": {
-    "defaultMode": "acceptEdits",
     "allow": [
       "Bash(cmake:*)",
       "Bash(ctest:*)",
@@ -30,56 +25,18 @@
       "Bash(git branch:*)",
       "Bash(git ls-remote:*)",
       "Bash(git ls-files:*)",
-      "Bash(git remote:*)",
-      "Bash(git rev-parse:*)",
-      "Bash(git rev-list:*)",
-      "Bash(git merge-base:*)",
-      "Bash(git diff-tree:*)",
-      "Bash(git describe:*)",
-      "Bash(git tag:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(git switch:*)",
-      "Bash(git checkout:*)",
-      "Bash(git restore:*)",
-      "Bash(git stash:*)",
-      "Bash(git fetch:*)",
-      "Bash(git pull:*)",
-      "Bash(git push:*)",
-      "Bash(git merge:*)",
-      "Bash(git rebase:*)",
-      "Bash(git worktree:*)",
-      "Bash(git init:*)",
-      "Bash(git mv:*)",
       "Bash(ls:*)",
       "Bash(find:*)",
       "Bash(grep:*)",
       "Bash(rg:*)",
       "Bash(wc:*)",
-      "Bash(curl -s*)",
-      "Bash(curl:*)",
-      "Bash(bash -n:*)",
-      "Bash(cat:*)",
-      "Bash(head:*)",
-      "Bash(tail:*)",
-      "Bash(awk:*)",
-      "Bash(jq:*)",
-      "Bash(mkdir:*)",
-      "Bash(cp:*)",
-      "Bash(test:*)",
-      "Bash(echo:*)",
-      "Bash(true)"
+      "Bash(curl -s*)"
     ],
     "deny": [
-      "Bash(git push --force:*)",
-      "Bash(git push -f:*)",
-      "Bash(git clean -fdx:*)",
-      "Bash(git clean -fd:*)",
-      "Bash(rm -rf /)",
-      "Bash(rm -rf /*)",
-      "Bash(rm -rf ~)",
-      "Bash(rm -rf ~/*)",
-      "Bash(sudo rm:*)"
+      "Bash(git push --force* origin main*)",
+      "Bash(git push -f* origin main*)",
+      "Bash(git reset --hard*)",
+      "Bash(rm -rf /*)"
     ]
   }
 }

.forgejo/workflows/cpp-tests.yml

@@ -1,65 +0,0 @@
-# Forgejo Actions — Codeberg (https://codeberg.org)
-#
-# Codeberg counterpart of the eulernest Gitea pipeline
-# (.gitea/workflows/cpp-tests.yml).  Two differences are required because
-# Codeberg's shared runners are not the Pi runner:
-#
-#   * runs-on: docker            — Codeberg shared-runner label (not "eulernest")
-#   * image:   node:20-bookworm  — public image (the private git.eulernest.eu
-#                                  ci-cpp image is unreachable from Codeberg).
-#                                  node:20 ships the Node runtime that
-#                                  actions/checkout@v4 needs; build tools are
-#                                  apt-installed in the first step.
-#
-# Scope: "test-fast" only — the pure-math suite (Eigen vendored, GoogleTest via
-# FetchContent, no CGAL/Boost).  A red job here = a red Codeberg CI badge.
-
-name: C++ Tests (Codeberg)
-
-on:
-  push:
-    branches:
-      - main
-      - "claude/**"
-      - "feature/**"
-      - "review/**"
-  pull_request:
-
-jobs:
-  test-fast:
-    runs-on: docker
-    container:
-      image: node:20-bookworm
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install build deps (cmake, g++, make)
-        run: |
-          apt-get update -qq
-          apt-get install -y --no-install-recommends \
-            cmake g++ make git ca-certificates
-
-      - name: Configure (tests-only — Eigen + GoogleTest)
-        run: cmake -S code -B build -DCMAKE_BUILD_TYPE=Release
-
-      - name: Build
-        run: cmake --build build --target conformallab_tests -j$(nproc)
-
-      - name: Run tests
-        run: >
-          ctest --test-dir build
-          --output-on-failure
-          --output-junit test-results.xml
-
-      - name: Summary
-        if: always()
-        run: |
-          if [ -f build/test-results.xml ]; then f=build/test-results.xml; else f=test-results.xml; fi
-          if [ -f "$f" ]; then
-            total=$(grep -o 'tests="[0-9]*"'     "$f" | grep -o '[0-9]*' | head -1)
-            failed=$(grep -o 'failures="[0-9]*"' "$f" | grep -o '[0-9]*' | head -1)
-            skipped=$(grep -o 'skipped="[0-9]*"' "$f" | grep -o '[0-9]*' | head -1)
-            passed=$(( ${total:-0} - ${failed:-0} - ${skipped:-0} ))
-            echo "FAST  ▸ TOTAL ${total:-0} | PASSED $passed | FAILED ${failed:-0} | SKIPPED ${skipped:-0}"
-          fi

.gitea/workflows/ai-review.yml

@@ -0,0 +1,34 @@
+# Feature A — KI-PR-Review + Summary (ci-ai pilot).
+# Pi-Runner (capacity 1, ~3-4 GB) -> Memory-Cap + schlankes python-Image, keine
+# JS-Actions. ci-ai-Clone braucht ein Token (Instanz verweigert anon). Ohne
+# ANTHROPIC_API_KEY überspringt das Skript den KI-Schritt sauber (Job grün).
+name: AI PR Review
+
+on:
+  workflow_dispatch: {}
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  review:
+    runs-on: eulernest
+    container:
+      image: python:3.12-slim
+      options: "--memory=512m --memory-swap=768m"
+    steps:
+      - name: Tooling (git)
+        run: apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates
+
+      - name: ci-ai-Skripte holen (Token, da Instanz anon verweigert)
+        env:
+          GITEA_TOKEN: ${{ github.token }}
+        run: git clone --depth 1 "https://x-access-token:${GITEA_TOKEN}@git.eulernest.eu/user2595/ci-ai.git" /opt/ci-ai
+
+      - name: KI-Review (überspringt sauber ohne Key)
+        env:
+          AI_PROVIDER: anthropic
+          AI_MODEL: claude-3-5-haiku-latest
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITEA_TOKEN: ${{ github.token }}
+          GITEA_API: https://git.eulernest.eu/api/v1
+        run: python /opt/ci-ai/scripts/ai_review.py

.gitea/workflows/security.yml

@@ -0,0 +1,76 @@
+# Feature B (+C) — Security-Scan (HART blockierend) + KI-Klartext-Erklärung.
+# Pilot: läuft auf Push zum Branch ci-ai/pilot (Validierung) und auf PRs.
+# python:3.12-slim (Debian: bash) + Memory-Cap (Pi-Runner). ⚠ ARM64-Binaries!
+# Scanner-Schritte: continue-on-error + Exit-Code ohne Pipe abgefangen -> der
+# Gate-Schritt entscheidet ALLEIN hart. Clones brauchen ein Token (anon verboten).
+name: Security
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches: ["ci-ai/pilot"]
+  pull_request:
+
+env:
+  GITLEAKS_VERSION: "8.18.4"
+
+jobs:
+  scan:
+    runs-on: eulernest
+    container:
+      image: python:3.12-slim
+      options: "--memory=768m --memory-swap=1024m"
+    steps:
+      - name: Tooling
+        run: apt-get update -qq && apt-get install -y -qq --no-install-recommends git curl ca-certificates tar
+
+      - name: Repo auschecken (Auto-Token; LAN via Runner-add-host)
+        env:
+          GITEA_TOKEN: ${{ github.token }}
+        run: git clone --depth 1 "https://x-access-token:${GITEA_TOKEN}@git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
+
+      - name: Gitleaks (Secret-Scan, ARM64)
+        id: gl
+        continue-on-error: true
+        run: |
+          set +e
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_arm64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          cd src
+          gitleaks detect --no-git --source . --redact > /tmp/gl.log 2>&1
+          echo "code=$?" >> "$GITHUB_OUTPUT"
+          tail -n 3 /tmp/gl.log; cat /tmp/gl.log >> /tmp/scan.log
+
+      - name: Trivy (IaC/config, leicht)
+        id: tv
+        continue-on-error: true
+        run: |
+          set +e
+          curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+            | sh -s -- -b /usr/local/bin
+          cd src
+          trivy config --severity HIGH,CRITICAL --exit-code 1 . > /tmp/tv.log 2>&1
+          echo "code=$?" >> "$GITHUB_OUTPUT"
+          tail -n 8 /tmp/tv.log; cat /tmp/tv.log >> /tmp/scan.log
+
+      - name: Gate — hart blockieren bei Funden
+        run: |
+          echo "gitleaks=${{ steps.gl.outputs.code }}  trivy=${{ steps.tv.outputs.code }}"
+          if [ "${{ steps.gl.outputs.code }}" != "0" ] || [ "${{ steps.tv.outputs.code }}" != "0" ]; then
+            echo "Security-Funde -> Check schlägt fehl (hart blockierend)."; exit 1
+          fi
+          echo "Keine HIGH/CRITICAL-Funde."
+
+      - name: KI erklärt die Funde (nur bei Fehler; braucht ci-ai-Zugriff + Key)
+        if: failure()
+        continue-on-error: true
+        env:
+          AI_PROVIDER: anthropic
+          AI_MODEL: claude-3-5-haiku-latest
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITEA_TOKEN: ${{ github.token }}
+          GITEA_API: https://git.eulernest.eu/api/v1
+        run: |
+          git clone --depth 1 "https://x-access-token:${GITEA_TOKEN}@git.eulernest.eu/user2595/ci-ai.git" /opt/ci-ai \
+            && python3 /opt/ci-ai/scripts/ai_explain.py security /tmp/scan.log \
+            || echo "AI-Erklärung übersprungen (ci-ai-Zugriff/Key noch offen)."

.woodpecker.yml

@@ -1,31 +0,0 @@
-# Woodpecker CI — Codeberg (https://ci.codeberg.org)
-#
-# Runs on every push / PR.  Mirrors the "test-fast" job of the
-# eulernest Gitea pipeline (.gitea/workflows/cpp-tests.yml), but uses a
-# plain public Debian image instead of the private ci-cpp registry image,
-# because Codeberg's shared runners cannot pull git.eulernest.eu.
-#
-# Pure-math test suite only (Clausen, ImLi2, hyper-ideal geometry):
-#   * Eigen is vendored      → code/deps/eigen-3.4.0
-#   * GoogleTest via FetchContent (network at configure time)
-#   * No CGAL / Boost / Wayland needed  → fast, headless, < 2 min
-#
-# A failing build or any failing ctest makes the Codeberg CI badge red.
-
-when:
-  - event: [push, pull_request]
-
-steps:
-  test-fast:
-    image: debian:bookworm
-    commands:
-      - apt-get update -qq
-      - >-
-        apt-get install -y --no-install-recommends
-        cmake g++ make git ca-certificates
-      - cmake -S code -B build -DCMAKE_BUILD_TYPE=Release
-      - cmake --build build --target conformallab_tests -j$(nproc)
-      - >-
-        ctest --test-dir build
-        --output-on-failure
-        --output-junit test-results.xml

README.md

@@ -142,7 +142,6 @@ Layout2D layout = euclidean_layout(mesh, res.x, maps);
 | **geometry-central comparison** — shared core, demarcation, adoption candidates, scientific added value | [doc/architecture/geometry-central-comparison.md](doc/architecture/geometry-central-comparison.md) |
 | **Design decisions** — key architectural choices + rationale | [doc/architecture/design-decisions.md](doc/architecture/design-decisions.md) |
 | **Project structure** — directory tree + build targets | [doc/architecture/project-structure.md](doc/architecture/project-structure.md) |
-| **CI / CD** — two-forge topology, runners, trigger keywords, mirror | [doc/architecture/ci-cd.md](doc/architecture/ci-cd.md) |
 | **Discrete conformal theory** — mathematical background for collaborators | [doc/math/discrete-conformal-theory.md](doc/math/discrete-conformal-theory.md) |
 | **Validation** — known analytic results + how to verify them | [doc/math/validation.md](doc/math/validation.md) |
 | **Validation protocol** — concrete commands with expected outputs | [doc/math/validation-protocol.md](doc/math/validation-protocol.md) |

doc/architecture/ci-cd.md

@@ -1,110 +0,0 @@
-# CI / CD
-
-Single source of truth for **how continuous integration is wired** across the
-two forges this project lives on. If you add, move or rename a workflow, update
-this page.
-
-## TL;DR
-
-| Forge | Remote | Role | CI system | Config | Runner |
-|---|---|---|---|---|---|
-| **eulernest Gitea** | `origin` | Authoritative gate (full test + quality suite) | Gitea Actions | `.gitea/workflows/` | self-hosted Raspberry Pi (ARM64), label `eulernest` |
-| **Codeberg** | `codeberg` | Public mirror + public build badge | Woodpecker **and** Forgejo Actions | `.woodpecker.yml`, `.forgejo/workflows/` | Codeberg shared runners, label `docker` |
-
-The two forges are connected by a one-way mirror: every push to `main` on
-eulernest is force-mirrored to Codeberg (see
-[Mirror](#mirror-eulernest--codeberg) below). Codeberg never pushes back.
-
-Why two CI systems on Codeberg? They are independent and either may be enabled
-per-repo; providing both means the public build status is green regardless of
-which one the repo has switched on. They run the **same** `test-fast` build.
-
----
-
-## eulernest Gitea (`origin`) — the real gate
-
-Self-hosted Gitea with a single self-hosted runner: a Raspberry Pi (ARM64,
-3–4 GB RAM). Because the runner is RAM-constrained, the heavy jobs are
-**keyword-gated** (opt-in per commit) rather than run on every push.
-
-All C++ jobs use the private image `git.eulernest.eu/conformallab/ci-cpp:latest`
-(built from `.gitea/docker/Dockerfile.ci-cpp` — Ubuntu 22.04 + Node 20 + cmake +
-build-essential + libboost-dev + doxygen).
-
-### `.gitea/workflows/cpp-tests.yml`
-
-| Job | Trigger | Memory cap | What it does |
-|---|---|---|---|
-| `test-fast` | every push to `main` / `claude/**` / `feature/**` / `review/**` + every PR | 800 MB | Pure-math suite (Clausen, ImLi₂, hyper-ideal). Serial build (`-j1`) to avoid OOM. Eigen vendored, GTest via FetchContent. |
-| `test-cgal` | commit message contains **`/test-cgal`** | 2000 MB | Full CGAL suite via `LOW_MEMORY_BUILD` (`-O0`, no PCH, unity batch 1, `--no-keep-memory`). Then `check-test-counts.sh` + `try_it.sh` smoke test. |
-| `quality-gates` | commit message contains **`/quality-gates`** | 600 MB | License headers, CGAL conventions, codespell, shellcheck, coverage (gate currently in report-only mode, `SKIP_COVERAGE_GATE=1`). |
-
-> One keyword per commit — the Pi cannot sustain multiple Docker containers at
-> once (`/ci-all` was removed for this reason). Example:
-> `git commit -m "fix: correct angle formula /test-cgal"`.
-
-### Other eulernest workflows
-
-| File | Trigger | Purpose | Blocks merge? |
-|---|---|---|---|
-| `doc-build.yaml` | push to main branches + manual | Doxygen HTML + warning stats | No (`continue-on-error`) |
-| `markdown-links.yml` | push + weekly cron (Mon 05:00 UTC) + manual | Link-rot check across docs | Yes on push |
-| `doxygen-pages.yml` | manual only | Publish Doxygen HTML to Codeberg Pages (`tmoussa.codeberg.page/ConformalLabpp/`) | n/a |
-| `perf-compile-time.yml` | manual only | Compile-time benchmark | n/a |
-| `mirror-to-codeberg.yml` | push to `main` | Mirror all branches to Codeberg (see below) | n/a |
-
----
-
-## Codeberg (`codeberg`) — public mirror CI
-
-Codeberg's shared runners **cannot** pull the private `ci-cpp` image and are not
-the `eulernest` Pi, so the Codeberg configs differ from Gitea in exactly two
-ways:
-
-1. **Runner label** `docker` (Codeberg shared runners), not `eulernest`.
-2. **Public base image**, with build tools `apt`-installed at run time:
-   - Woodpecker: `debian:bookworm`
-   - Forgejo Actions: `node:20-bookworm` (Node is needed by
-     `actions/checkout@v4`; cmake/g++/make are installed in the first step).
-
-Both run **only** `test-fast` — the pure-math suite. No CGAL/Boost/Wayland, so
-they are fast (< 2 min) and headless. Eigen is vendored, GoogleTest is fetched
-at configure time (Codeberg runners have network). A failing build or any
-failing `ctest` turns the public CI badge red.
-
-| File | CI system | Enable via |
-|---|---|---|
-| `.woodpecker.yml` | Woodpecker | https://ci.codeberg.org → enable repo |
-| `.forgejo/workflows/cpp-tests.yml` | Forgejo Actions | repo *Settings → Actions* (shared runner label `docker`) |
-
-> These configs are committed in the repo and reach Codeberg through the mirror
-> — they are not maintained separately on Codeberg.
-
----
-
-## Mirror (eulernest → Codeberg)
-
-`.gitea/workflows/mirror-to-codeberg.yml` runs on every push to `main` and does
-a `git push --mirror` from eulernest to
-`codeberg.org/TMoussa/ConformalLabpp.git`. It uses two secrets:
-
-- `MIRROR_TOKEN` — read access to the eulernest source repo.
-- `CODEBERG_TOKEN` — push access to the Codeberg mirror.
-
-The mirror is **one-way and authoritative-from-eulernest**: do not commit
-directly on Codeberg, it will be overwritten on the next mirror run.
-
----
-
-## The one rule
-
-> **eulernest is the gate, Codeberg is the shop window.**
-> Merge decisions are made on eulernest CI (full suite). Codeberg CI exists so
-> the public repo also shows a green/red build status to outside readers.
-
-## See also
-
-- [dependencies.md](dependencies.md) — what each build mode requires.
-- [project-structure.md](project-structure.md) — where the test targets live.
-- [../api/tests.md](../api/tests.md) — per-suite test counts CI checks against.
-- [../contributing.md](../contributing.md) — the git workflow that feeds CI.

doc/contributing.md

@@ -13,12 +13,11 @@ with English.
 ## Git workflow
 
 - `main` is protected on `origin` (Gitea). Push to `dev`, then open a pull request.
-- `codeberg/main` is the public mirror. It now also runs CI of its own
-  (Woodpecker + Forgejo Actions) — see [architecture/ci-cd.md](architecture/ci-cd.md).
+- `codeberg/main` can be pushed to directly (public mirror, no CI).
 - Both remotes must stay in sync after every significant change:
   ```bash
-  git push origin HEAD:dev   # triggers eulernest CI (full suite, keyword-gated CGAL)
-  git push codeberg main     # updates public mirror → triggers Codeberg CI (test-fast)
+  git push origin HEAD:dev   # triggers CI
+  git push codeberg main     # updates public mirror
   ```
 - Branch naming: `feature/<topic>`, `fix/<topic>`, `phase<N>-<topic>`
 
@@ -26,30 +25,17 @@ with English.
 
 ## CI
 
-The project runs CI on **two forges**. Full topology, runners, images and
-trigger keywords are documented in [architecture/ci-cd.md](architecture/ci-cd.md).
-
-**eulernest Gitea** (`origin`, self-hosted Raspberry Pi / ARM64) — the
-authoritative gate. On push to `dev`/`main` or a pull request:
+Two jobs run on push to `dev`/`main` or on pull requests:
 
 | Job | What it tests | Trigger |
 |---|---|---|
 | `test-fast` | pure-math tests, no Boost | all branches |
-| `test-cgal` | full CGAL test suite | commit message contains `/test-cgal` |
-| `quality-gates` | license / codespell / shellcheck / CGAL conventions | commit message contains `/quality-gates` |
+| `test-cgal` | full CGAL test suite | `main`, `dev`, PRs only |
 
-A PR is ready to merge when `test-fast` (and, for CGAL-touching work,
-`test-cgal`) pass. See `.gitea/workflows/cpp-tests.yml` and
-`.gitea/docker/Dockerfile.ci-cpp`.
+A PR is ready to merge when both jobs pass.
 
-**Codeberg** (`codeberg`, public mirror, shared runners) — a lightweight
-`test-fast` mirror so the public repo also shows a build status. Defined twice,
-once per CI system Codeberg offers:
-
-| File | CI system |
-|---|---|
-| `.woodpecker.yml` | Woodpecker CI (ci.codeberg.org) |
-| `.forgejo/workflows/cpp-tests.yml` | Forgejo Actions |
+The runner is a self-hosted Raspberry Pi (ARM64). See `.gitea/workflows/cpp-tests.yml`
+and `.gitea/docker/Dockerfile.ci-cpp`.
 
 ---