- Upgrade ActuatorSecurityConfig to @Order(Ordered.HIGHEST_PRECEDENCE) at class level
to ensure filter chain is evaluated before auto-configured management security
- Replace string-based securityMatcher with EndpointRequest.toAnyEndpoint() for
proper Spring Boot actuator endpoint matching
- Add belt-and-suspenders permitAll() for /actuator/health and /actuator/info in
SecuirtyConfig so health endpoints are accessible even if filter chain ordering fails
- Root cause: SecuirtyConfig catch-all (no securityMatcher) was intercepting actuator
requests on the separate management port (management.server.port=8081) and
redirecting to OIDC login before ActuatorSecurityConfig filter chain could apply
- Add spring-boot-starter-actuator dependency
- Configure management port (8081) separate from application port (8080)
- Expose /actuator/health and /actuator/info endpoints publicly
- Block other actuator endpoints without authentication
- Add ActuatorSecurityConfig for actuator-specific security rules
- Update Docker Compose to expose management port (5003:8081)
- Update Dockerfile to expose ports 8080 and 8081
- Add actuator configuration to all profile-specific properties files
Extract trust-all SSL logic into buildTrustAllRestTemplate() helper.
Add @Profile("prod") bean that also trusts self-signed certs.
Change @Profile("!local") to @Profile("!local & !prod") so standard
strict SSL is only used for CI/test profiles.
Rename portainerRestTemplate() to portainerRestTemplateDefault().
Remove 'type: choice' and 'options:' from workflow_dispatch inputs,
replacing with 'type: string'. The Gitea Actions runner may not support
the 'choice' type with 'options' subfield, causing the entire workflow
to fail registration silently. The workflow already has runtime
validation (lines 40-44) that rejects invalid environment values, so
the 'choice' type was redundant.
The Portainer redeploy endpoint POST /api/deploy/{stackId} requires
POST requests. wget defaults to GET, so --method=POST is needed.
Applied to both Dev (test_image_build_push.yml) and Prod
(prod_image_tag_promote.yaml) workflow files.
- Replace single-branch push trigger with test + main + workflow_dispatch
- Add environment determination (test → PATCH bump, main/prod → MINOR bump)
- Add semver calculation with conditional patch/minor logic
- Add env validation (fails early on invalid env)
- Remove pa- prefix from git tags (use plain semver)
- Test builds fresh image; main/prod promotes test image to prod
- Match final architecture spec from Archie
- Add Dockerfile for portainer-automation (multi-stage build)
- Add standalone docker-compose.yaml for PA service
- Add application-prod.properties (prod Portainer :9443)
- Add application-ci.properties (CI test endpoints)
- Add .env.example with documented env vars for PA
- Add PORTAINER_STACK.md with deployment guide, env var tables, architecture diagram
- Add CI workflow (portainer_automation_build_push.yml) for image build/push
- Update root docker-compose.yaml to include PA service
