# QODY CI-CD pipeline fixes 2026-07-08 (MC 105057+105059)

# QODY CI/CD demo pipeline fixevi — 2026-07-08 (MC #105057 + #105059)

Dokazano zelenim pipeline run **#330** (commit 747c100, deployDemo=true). John live-verifikovao timeline + endpointe; Proveo nezavisna tool-verifikacija PASS.

## Kontekst
Run #328 (buildx fail) i raniji Trivy fail (#327) blokirali QODY demo deploy. Oba uzroka su bili **pre-postojeće pipeline rupe**, ne aplikacijski/Monri kod.

## Fix #105059 — idempotent buildx (Build_Images)
- **Simptom:** run #328 Build_Images `ERROR: existing instance for "qody-builder" but no append mode`.
- **Uzrok:** azure-pipelines.yml demo stage (lin 881) radio goli `docker buildx create --use --name qody-builder`; persistent self-hosted agent (qody-forge-1) zadrži builder instancu između runova → kolizija.
- **Fix:** backport idempotentnog patterna s prod stagea (MC #104911): `docker buildx use qody-builder 2>/dev/null || docker buildx create --name qody-builder --use --driver docker-container` (lin 886).

## Fix #105057 — Trivy verify-not-fetch (Security_Image_Scan)
- **Simptom:** Trivy install pao na qody-forge-1: `mkdir /usr/local/bin: Permission denied`.
- **Uzrok:** curl-based installer piše u /usr/local/bin, koji ne postoji na Apple Silicon self-hosted agentu i traži sudo (kojeg agent nema).
- **Fix:** verify-not-fetch — koristi već-instalirani Homebrew Trivy 0.72.0 (`export PATH="/opt/homebrew/bin:$PATH"; which trivy`), isti pattern kao druga dva Trivy stepa (MC #104917). **FORGE agent nije diran.**

## Dokaz (run #330)
| Stage | Rezultat |
|---|---|
| CI Gates | succeeded |
| Build_Images → ACR | succeeded (buildx fix radi) |
| Security: Trivy image scan (4 images) | succeeded (Trivy fix radi) |
| Deploy → QODY demo ACA | succeeded |
| Deploy_Prod | skipped (ispravno — nije main) |

Timeline: 165 succeeded / **0 failed** / 6 skipped (prod).

Live (John curl): `demo.api.qody.ba/health` → 200 (db.connected, RLS PASS); `demo.app.qody.ba` → 200.

Evidence: ~/system/evidence/105048/pipeline-330-timeline.json + verdict-105057.json + verdict-105059.json