QODY CI-CD pipeline fixes 2026-07-08 (MC 105057+105059)
QODY CI/CD demo pipeline fixevi — 2026-07-08 (MC #105057 + #105059)
Dokazano zelenim pipeline run #330 (commit 747c100, deployDemo=true). John live-verifikovao timeline + endpointe; Proveo nezavisna tool-verifikacija PASS.
Kontekst
Run #328 (buildx fail) i raniji Trivy fail (#327) blokirali QODY demo deploy. Oba uzroka su bili pre-postojeće pipeline rupe, ne aplikacijski/Monri kod.
Fix #105059 — idempotent buildx (Build_Images)
- Simptom: run #328 Build_Images
ERROR: existing instance for "qody-builder" but no append mode. - Uzrok: azure-pipelines.yml demo stage (lin 881) radio goli
docker buildx create --use --name qody-builder; persistent self-hosted agent (qody-forge-1) zadrži builder instancu između runova → kolizija. - Fix: backport idempotentnog patterna s prod stagea (MC #104911):
docker buildx use qody-builder 2>/dev/null || docker buildx create --name qody-builder --use --driver docker-container(lin 886).
Fix #105057 — Trivy verify-not-fetch (Security_Image_Scan)
- Simptom: Trivy install pao na qody-forge-1:
mkdir /usr/local/bin: Permission denied. - Uzrok: curl-based installer piše u /usr/local/bin, koji ne postoji na Apple Silicon self-hosted agentu i traži sudo (kojeg agent nema).
- Fix: verify-not-fetch — koristi već-instalirani Homebrew Trivy 0.72.0 (
export PATH="/opt/homebrew/bin:$PATH"; which trivy), isti pattern kao druga dva Trivy stepa (MC #104917). FORGE agent nije diran.
Dokaz (run #330)
| Stage | Rezultat |
|---|---|
| CI Gates | succeeded |
| Build_Images → ACR | succeeded (buildx fix radi) |
| Security: Trivy image scan (4 images) | succeeded (Trivy fix radi) |
| Deploy → QODY demo ACA | succeeded |
| Deploy_Prod | skipped (ispravno — nije main) |
Timeline: 165 succeeded / 0 failed / 6 skipped (prod).
Live (John curl): demo.api.qody.ba/health → 200 (db.connected, RLS PASS); demo.app.qody.ba → 200.
Evidence: ~/system/evidence/105048/pipeline-330-timeline.json + verdict-105057.json + verdict-105059.json