The live checkout sat on feat/bcda-v3, so everything merged to main
today (UI fixes, Traefik theme change) only reached the running
services by hand-copied files. It now tracks main; this brings the
branch's 18 commits (BCDA v3 client, crosswalk-driven flatteners,
vendored upstream, institutional provider universe, sandbox notebook)
along with it.
Conflicts:
- .gitea/workflows/{harden,rebuild-all}.yml: regenerated with
gen_config.py from the merged stack.toml + backends/gitea.py — bcda
joins the per-image build → scan → push Harden job, pinned trivy/crane.
- tests/dev/test_gen_config_deploy.py: both sides fixed the GIT_* env
leak; kept main's shared _clean_env() (also used by the detector run).
- uv.lock auto-merged; `uv lock --locked` passes, a relock changes no
version, and trivy finds 0 vulnerabilities in the merged lock.
Two bcda tests needed fixing on the merged tree:
- test_completed_jobs used dated fixtures against completed_jobs()'s
default 24 h window, so it failed a day after it was written; it
now asks for max_age_hours=None (it tests ordering + version filter).
- test_ui_metrics matched whole Prometheus lines; the OTel exporter
(0.66, from the CVE bump) adds otel_scope_* labels to every series,
so it now matches on the labels the stack owns.
Full suite on the merged tree: 15,856 passed before those two fixes;
tests/bcda 426/426 after.
ee3e3a5cfc