Repository navigation
release: sync main with develop - #57
Merged
Merged
Conversation
… instance Adds `mctf solve --against-instance <id>`. The challenge is resolved from the instancer store record, and the solver runs with HOST / PORT / URL derived from the instance's host-port mapping (instead of the deploy block) plus INSTANCE_ID / TEAM_ID stamped. The instance's per-team flag is accepted alongside the manifest flags, so dynamic-flag spawns verify correctly. The instance-to-target resolution is split into a pure helper behind a narrow interface so it's unit-testable without docker or a store on disk.
Asset diffing matched local files to CTFd-side files by basename only, so an edited handout kept the same name was never re-uploaded. The diff now also compares content: the local file's SHA1 against the sha1sum CTFd reports for each file. A same-named pair whose hashes differ is re-uploaded (the local copy is added, then the stale remote copy is deleted). SHA1 rather than sha256 because that is the digest CTFd records and exposes; comparing against any other algorithm would never match. When either side's hash is unavailable (older CTFd builds omit sha1sum, or a local read fails) the file falls back to the previous basename-only behavior, so a sync never churns on missing data.
Before this change, deploy hard-required registry.url and always rewrote compose files via TranslateCompose, breaking simple-profile deploys that run raw docker-compose.yml without a registry. Now the translate/tag/orphan-cleanup logic is gated behind hasRegistry (cfg.Registry != nil && cfg.Registry.URL != ""). Simple-profile deploys use the original docker-compose.yml unchanged. Also fixes down command to fallback to docker-compose.yml when the generated docker-compose.mctf.yml does not exist. Refactors loadPlanAndRunner to return *config.Config so down can check registry presence without reloading config.
- Add test coverage for promptString: empty input, trimming, multiline handling - Add test coverage for promptChoice: valid/invalid choices, re-prompting, EOF - Add test coverage for stdinIsTTY detection - Implement lineReader helper to support multiple bufio.NewReader calls in test loops - All tests pass, covers the backlog requirement for cmd/init prompt testing
- Remove 'Test coverage for cmd/init prompts' from backlog (completed) - Add guidance in CONTRIBUTING.md on testing interactive prompts with promptIn - Reference cmd/init_test.go as example pattern for prompt injection testing
Feat/k8s deploy fixed
feat(monitoring): mctf monitoring up/down (prometheus + grafana + cadvisor)
feat(deploy): immutable image-tag pinning (closes #5)
docs: short command reference for the team
feat(instance): CLI reads instances from the remote instancer API
feat(instance): destroy via remote instancer API + deprecate built-in daemon
feat: goreleaser cross-platform releases (binaries, deb/rpm, Homebrew cask)
feat: publish ghcr.io Docker image of mctf
feat: man pages (mctf gen-man) bundled in releases
docs: architecture overview
feat(doctor): D043 — warn on committed MCTF_* secret values
feat(plugin): plugin system foundation + deploy hooks
test: fuzz the compose-port and manifest parsers
…lates; D043 skips _test.go
chore: open-source readiness hygiene
docs: public-facing README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Maintainer-gated — do not auto-merge. Opens the long-standing
develop→maingap for review when the team is ready to makemainthe current/public default.Context
Per team convention all work lands on
develop;mainhas intentionally lagged. For an open-source launch, visitors land onmain, so it should be current (or the branch model documented). This PR bringsmainup to date with everything merged ondevelopthis cycle.What's included (highlights)
K8s + SSH deploy, image-tag pinning + rollback, monitoring stack, remote-instancer control plane + daemon deprecation, GHCR image, man pages, architecture doc, D043 secret scan, fuzz tests, the plugin-system foundation, and the open-source hygiene files (SECURITY, CODE_OF_CONDUCT, templates).
Before merging
developfirst (public README docs: public-facing README #56) so this sync carries them.developas integration + periodicmainsyncs, or switch default todevelop).Merge when ready; squash is not recommended (preserve the PR-merge history).