Vendoo 1.43.0 – Production Update

Manifestbasierter Production-Updater 3.3, Modulnavigation, optionales Produktbild Studio, Listing-Studio-Aktionsleiste sowie plattformübergreifende Windows-/Linux-Release-Gates.

.github/workflows/ci.yml

@@ -48,6 +48,10 @@ jobs:
       - name: Syntaxprüfung
         run: npm run check
 
+
+      - name: PowerShell-Regressionen statisch prüfen
+        run: npm run verify:powershell-static
+
       - name: Produktiven Source-Root und Archivgrenzen prüfen
         run: npm run verify:source-boundaries
 
@@ -114,3 +118,31 @@ jobs:
 
       - name: Docker-Image testweise bauen
         run: docker build --pull --tag vendoo:ci .
+
+  windows-release-contract:
+    name: Windows – vollständiger Releasevertrag
+    runs-on: windows-latest
+    timeout-minutes: 35
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Node.js 22 aktivieren
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          cache: npm
+
+      - name: Abhängigkeiten reproduzierbar installieren
+        run: npm ci
+
+      - name: Alle PowerShell-Dateien mit Windows PowerShell 5.1 parsen
+        shell: powershell
+        run: .\tools\verify-powershell-parser.ps1
+
+      - name: Vollständigen Vendoo-Releasevertrag unter Windows ausführen
+        shell: pwsh
+        run: npm run verify:all
+

.github/workflows/release.yml

@@ -16,7 +16,20 @@ env:
   IMAGE_NAME: masterluke77/vendoo
 
 jobs:
+  powershell-parser:
+    name: Windows PowerShell 5.1 Parser
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v6
+
+      - name: Alle PowerShell-Dateien mit Windows PowerShell 5.1 parsen
+        shell: powershell
+        run: .\tools\verify-powershell-parser.ps1
+
   release-assets:
+    needs: powershell-parser
     name: Release-Paket und Prüfsummen
     permissions:
       contents: write
@@ -42,31 +55,21 @@ jobs:
           EXPECTED="v$(node -p "require('./package.json').version")"
           test "$RELEASE_TAG" = "$EXPECTED" || { echo "Release-Tag $RELEASE_TAG passt nicht zu $EXPECTED." >&2; exit 1; }
 
-      - name: Vollständige Prüfung
-        run: |
-          npm run verify:git
-          npm run verify:git-regression
-          npm run verify:git-staging
-          npm run verify:ignore-boundaries
-          npm run check
-          npm run verify:source-boundaries
-          npm run verify:esm-exports
-          npm run verify:flux-loop
-          npm run verify:capabilities
-          npm run verify:coolify
-          npm run verify:initial-modules
-          npm run verify:architecture
-          npm run verify:themes
-          npm run verify:security
-          npm run verify:identity
-          npm run verify:catalog
-          npm run verify:modules
-          npm run verify:deployment
-          npm run verify:config
-          npm run verify:installer-shell
-          npm run verify:db
+      - name: ESM-Exportverträge explizit prüfen
+        run: npm run verify:esm-exports
 
-      - name: Release-Staging erzeugen
+      - name: FLUX-Loop-Hotfix explizit prüfen
+        run: npm run verify:flux-loop
+
+      - name: Vollständige Prüfung
+        run: npm run verify:all
+
+      - name: Release-Manifest reproduzierbar prüfen
+        run: |
+          node tools/generate-release-manifest.mjs .
+          git diff --exit-code -- release-manifest.json
+
+      - name: Manifestbasiertes Release-Staging erzeugen
         run: node tools/build-release.mjs
 
       - name: ZIP und SHA-256 erzeugen

.github/workflows/sync-release-manifest.yml

@@ -0,0 +1,47 @@
+name: Vendoo Release Manifest Sync
+
+on:
+  push:
+    branches:
+      - release/1.43.0-production-update-v3
+
+permissions:
+  contents: write
+
+concurrency:
+  group: vendoo-release-manifest-sync-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    name: Release-Manifest reproduzierbar synchronisieren
+    if: ${{ !contains(github.event.head_commit.message, '[manifest-sync]') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Release-Branch auschecken
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Node.js 22 aktivieren
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+
+      - name: Release-Manifest erzeugen
+        run: node tools/generate-release-manifest.mjs .
+
+      - name: Geändertes Manifest committen
+        shell: bash
+        run: |
+          if git diff --quiet -- release-manifest.json; then
+            echo "Release-Manifest ist bereits aktuell."
+            exit 0
+          fi
+          git config user.name "vendoo-release-bot"
+          git config user.email "vendoo-release-bot@users.noreply.github.com"
+          git add release-manifest.json
+          git commit -m "chore: Release-Manifest synchronisieren [manifest-sync]"
+          git push origin HEAD:${GITHUB_REF_NAME}

.github/workflows/vendoo-production-deploy.yml

@@ -0,0 +1,83 @@
+name: Vendoo Production Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_version:
+        description: Expected Vendoo version
+        required: true
+        type: string
+      public_base_url:
+        description: Public Vendoo URL
+        required: true
+        default: https://vendoo.flatlined.de
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: vendoo-production-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Validate inputs
+        shell: bash
+        env:
+          TARGET_VERSION: ${{ inputs.target_version }}
+          PUBLIC_BASE_URL: ${{ inputs.public_base_url }}
+        run: |
+          set -euo pipefail
+          [[ "$TARGET_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          [[ "$PUBLIC_BASE_URL" =~ ^https://[^/]+/?$ ]]
+
+      - name: Trigger Coolify
+        shell: bash
+        env:
+          COOLIFY_DEPLOY_WEBHOOK_URL: ${{ secrets.COOLIFY_DEPLOY_WEBHOOK_URL }}
+        run: |
+          set -euo pipefail
+          test -n "$COOLIFY_DEPLOY_WEBHOOK_URL"
+          curl --fail --silent --show-error --location --request GET \
+            --connect-timeout 20 --max-time 90 \
+            "$COOLIFY_DEPLOY_WEBHOOK_URL" >/tmp/coolify-response.txt
+          echo "Coolify accepted the deployment trigger."
+
+      - name: Wait for exact production version
+        shell: bash
+        env:
+          TARGET_VERSION: ${{ inputs.target_version }}
+          PUBLIC_BASE_URL: ${{ inputs.public_base_url }}
+        run: |
+          set -euo pipefail
+          BASE_URL="${PUBLIC_BASE_URL%/}"
+          deadline=$((SECONDS + 1500))
+          last_version="unknown"
+          while (( SECONDS < deadline )); do
+            if body=$(curl --fail --silent --show-error --connect-timeout 10 --max-time 30 \
+              -H 'Accept: application/json' -H 'Cache-Control: no-cache' \
+              "$BASE_URL/readyz?github_run=${GITHUB_RUN_ID}&attempt=${GITHUB_RUN_ATTEMPT}"); then
+              ready=$(jq -r '.ok // false' <<<"$body")
+              version=$(jq -r '.version // empty' <<<"$body")
+              if [[ -n "$version" ]]; then last_version="$version"; fi
+              echo "ready=$ready version=${version:-unknown} expected=$TARGET_VERSION"
+              if [[ "$ready" == "true" && "$version" == "$TARGET_VERSION" ]]; then exit 0; fi
+            fi
+            sleep 15
+          done
+          echo "Timeout waiting for Vendoo $TARGET_VERSION. Last version: $last_version" >&2
+          exit 1
+
+      - name: Final health response
+        shell: bash
+        env:
+          PUBLIC_BASE_URL: ${{ inputs.public_base_url }}
+        run: |
+          set -euo pipefail
+          BASE_URL="${PUBLIC_BASE_URL%/}"
+          curl --fail --silent --show-error -H 'Accept: application/json' \
+            "$BASE_URL/healthz?github_run=${GITHUB_RUN_ID}" | jq .

.github/workflows/windows-release-diagnostics.yml

@@ -0,0 +1,125 @@
+name: Vendoo Windows Release Diagnostics
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: vendoo-windows-diagnostics-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  windows-release-diagnostics:
+    name: Windows – Release-Gates einzeln
+    runs-on: windows-latest
+    timeout-minutes: 35
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Node.js 22 aktivieren
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          cache: npm
+
+      - name: Abhängigkeiten reproduzierbar installieren
+        run: npm ci
+
+      - name: Alle PowerShell-Dateien mit Windows PowerShell 5.1 parsen
+        shell: powershell
+        run: .\tools\verify-powershell-parser.ps1
+
+      - name: Git-Sicherheitsgate
+        run: npm run verify:git
+
+      - name: Git-Sicherheitsgate Regressionstest
+        run: npm run verify:git-regression
+
+      - name: Git-Staging-Filter Regressionstest
+        run: npm run verify:git-staging
+
+      - name: Release-Manifest prüfen
+        run: npm run verify:release-manifest
+
+      - name: Git-Ignore-Grenzen prüfen
+        run: npm run verify:ignore-boundaries
+
+      - name: Syntax und Identity-Datenbank prüfen
+        run: npm run check
+
+      - name: PowerShell-Regressionen statisch prüfen
+        run: npm run verify:powershell-static
+
+      - name: Source-Root-Grenzen prüfen
+        run: npm run verify:source-boundaries
+
+      - name: ESM-Exportverträge prüfen
+        run: npm run verify:esm-exports
+
+      - name: FLUX-Loop-Hotfix prüfen
+        run: npm run verify:flux-loop
+
+      - name: Capability-Graph prüfen
+        run: npm run verify:capabilities
+
+      - name: Coolify- und Produktionsoperationen prüfen
+        run: npm run verify:coolify
+
+      - name: Initial deaktivierte Module prüfen
+        run: npm run verify:initial-modules
+
+      - name: Plattformarchitektur prüfen
+        run: npm run verify:architecture
+
+      - name: Theme Manager prüfen
+        run: npm run verify:themes
+
+      - name: Security Foundation prüfen
+        run: npm run verify:security
+
+      - name: Identity und Settings prüfen
+        run: npm run verify:identity
+
+      - name: Einladungen prüfen
+        run: npm run verify:invitations
+
+      - name: SQLite-Cleanup unter Windows prüfen
+        run: npm run verify:sqlite-cleanup
+
+      - name: Katalog und Medien prüfen
+        run: npm run verify:catalog
+
+      - name: Modulmanager prüfen
+        run: npm run verify:modules
+
+      - name: Produktionsoperationen prüfen
+        run: npm run verify:production-operations
+
+      - name: One-Click-Updater prüfen
+        run: npm run verify:one-click-update
+
+      - name: Modulnavigation prüfen
+        run: npm run verify:module-navigation
+
+      - name: Updater-UI prüfen
+        run: npm run verify:updater-ui
+
+      - name: Updater-Hotfix-Vertrag prüfen
+        run: npm run verify:updater-hotfix
+
+      - name: Deployment prüfen
+        run: npm run verify:deployment
+
+      - name: Konfigurationsspeicher prüfen
+        run: npm run verify:config
+
+      - name: Installer-Shell-Portabilität prüfen
+        run: npm run verify:installer-shell
+
+      - name: Datenbankmigrationen prüfen
+        run: npm run verify:db