Merge branch 'main' into development

Author: Wikid82

.github/workflows/docs-to-issues.yml

@@ -343,7 +343,8 @@ jobs:
           # Removed [skip ci] to allow CI checks to run on PRs
           # Infinite loop protection: path filter excludes docs/issues/created/** AND github.actor guard prevents bot loops
           git diff --staged --quiet || git commit -m "chore: move processed issue files to created/"
-          git push
+          BRANCH="${{ github.event.workflow_run.head_branch || github.ref_name }}"
+          git push origin HEAD:refs/heads/${BRANCH}
 
       - name: Summary
         if: always()

.github/workflows/waf-integration.yml

@@ -40,8 +40,8 @@ jobs:
       - name: Run WAF integration tests
         id: waf-test
         run: |
-          chmod +x scripts/coraza_integration.sh
-          scripts/coraza_integration.sh 2>&1 | tee waf-test-output.txt
+          chmod +x scripts/waf_integration.sh
+          scripts/waf_integration.sh 2>&1 | tee waf-test-output.txt
           exit "${PIPESTATUS[0]}"
 
       - name: Dump Debug Info on Failure
@@ -53,25 +53,25 @@ jobs:
 
             echo "### Container Status"
             echo '```'
-            docker ps -a --filter "name=charon" --filter "name=coraza" 2>&1 || true
+            docker ps -a --filter "name=charon" --filter "name=waf" 2>&1 || true
             echo '```'
             echo ""
 
             echo "### Caddy Admin Config"
             echo '```json'
-            curl -s http://localhost:2019/config 2>/dev/null | head -200 || echo "Could not retrieve Caddy config"
+            curl -s http://localhost:2119/config/ 2>/dev/null | head -200 || echo "Could not retrieve Caddy config"
             echo '```'
             echo ""
 
             echo "### Charon Container Logs (last 100 lines)"
             echo '```'
-            docker logs charon-debug 2>&1 | tail -100 || echo "No container logs available"
+            docker logs charon-waf-test 2>&1 | tail -100 || echo "No container logs available"
             echo '```'
             echo ""
 
             echo "### WAF Ruleset Files"
             echo '```'
-            docker exec charon-debug sh -c 'ls -la /app/data/caddy/coraza/rulesets/ 2>/dev/null && echo "---" && cat /app/data/caddy/coraza/rulesets/*.conf 2>/dev/null' || echo "No ruleset files found"
+            docker exec charon-waf-test sh -c 'ls -la /app/data/caddy/coraza/rulesets/ 2>/dev/null && echo "---" && cat /app/data/caddy/coraza/rulesets/*.conf 2>/dev/null' || echo "No ruleset files found"
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
 
@@ -100,6 +100,6 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
-          docker rm -f charon-debug || true
-          docker rm -f coraza-backend || true
+          docker rm -f charon-waf-test || true
+          docker rm -f waf-backend || true
           docker network rm containers_default || true

.github/workflows/weekly-nightly-promotion.yml

@@ -48,9 +48,11 @@ jobs:
       - name: Check Nightly Workflow Status
         id: check
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          SKIP_WORKFLOW_CHECK: ${{ inputs.skip_workflow_check }}
         with:
           script: |
-            const skipCheck = '${{ inputs.skip_workflow_check }}' === 'true';
+            const skipCheck = process.env.SKIP_WORKFLOW_CHECK === 'true';
 
             if (skipCheck) {
               core.info('Skipping workflow health check as requested');
@@ -298,6 +300,8 @@ jobs:
         id: create-pr
         if: steps.check-diff.outputs.skipped != 'true' && steps.existing-pr.outputs.exists != 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          TRIGGER_REASON: ${{ inputs.reason }}
         with:
           script: |
             const fs = require('fs');
@@ -307,7 +311,7 @@ jobs:
             const filesChanged = '${{ steps.commits.outputs.files_changed }}';
             const commitLog = fs.readFileSync('/tmp/commit_log.md', 'utf8');
 
-            const triggerReason = '${{ inputs.reason }}' || 'Scheduled weekly promotion';
+            const triggerReason = process.env.TRIGGER_REASON || 'Scheduled weekly promotion';
 
             const body = `## 🚀 Weekly Nightly to Main Promotion
 
@@ -484,11 +488,14 @@ jobs:
     steps:
       - name: Create Failure Issue
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        env:
+          FAILURE_REASON: ${{ needs.check-nightly-health.outputs.failure_reason }}
+          LATEST_RUN_URL: ${{ needs.check-nightly-health.outputs.latest_run_url }}
         with:
           script: |
             const isHealthy = '${{ needs.check-nightly-health.outputs.is_healthy }}';
-            const failureReason = '${{ needs.check-nightly-health.outputs.failure_reason }}';
-            const latestRunUrl = '${{ needs.check-nightly-health.outputs.latest_run_url }}';
+            const failureReason = process.env.FAILURE_REASON || '';
+            const latestRunUrl = process.env.LATEST_RUN_URL || 'N/A';
             const prResult = '${{ needs.create-promotion-pr.result }}';
 
             let title, body;

docs/issues/issue-1022-manual-test-plan.md

@@ -0,0 +1,73 @@
+---
+title: "Manual Test Plan - Issue #1022: Apostrophe in Workflow Dispatch Reason Crashes Weekly Promotion"
+status: Open
+priority: Medium
+labels: testing, ci
+---
+
+# Test Objective
+
+Confirm that the `weekly-nightly-promotion` workflow completes successfully when the manual trigger `reason` field contains an apostrophe (e.g., `it's`), and that the PR body reflects the reason correctly.
+
+# What Was Fixed
+
+The `Create Promotion PR` step previously injected `${{ inputs.reason }}` directly into a bash heredoc. An apostrophe in the reason value (e.g., `it's an ad-hoc run`) broke the shell quoting and caused the step to fail with a syntax error.
+
+The fix moves `inputs.reason` into a dedicated `TRIGGER_REASON` environment variable, which is then read inside the `actions/github-script` step via `process.env.TRIGGER_REASON`. This isolates the user-supplied string from the shell entirely.
+
+Manual testing is required because this workflow runs against the live GitHub Actions environment and cannot be fully covered by unit or integration tests.
+
+# Prerequisites
+
+- Write access to the repository (to trigger `workflow_dispatch`).
+- The `nightly` branch must exist and have at least one commit ahead of `main`, **or** `skip_workflow_check` must be set to `true` to bypass the health gate.
+- A GitHub account with permission to view Actions run logs.
+
+# Manual Scenarios
+
+## 1) Apostrophe in reason — primary regression check
+
+- [ ] Navigate to **Actions → Weekly Nightly to Main Promotion → Run workflow**.
+- [ ] Set **Why are you running this manually?** to: `it's a manual test run`
+- [ ] Set **Skip nightly workflow status check?** to `true` (avoids a failing nightly blocking the test).
+- [ ] Click **Run workflow**.
+- [ ] Wait for the run to complete.
+- [ ] **Expected**: The run completes without a syntax error. All jobs show green (or the run skips the PR-creation job with "No changes to promote" if `nightly` is already up-to-date with `main` — both are acceptable outcomes).
+- [ ] Open the run logs for the **Create Promotion PR** step.
+- [ ] **Expected**: No `syntax error` or `unexpected token` entries in the log.
+- [ ] If a PR was created, open it and confirm the **Trigger** line in the PR body reads: `it's a manual test run`.
+
+## 2) Double apostrophe / multiple special characters
+
+- [ ] Trigger the workflow again with reason: `can't stop, won't stop`
+- [ ] Set **Skip nightly workflow status check?** to `true`.
+- [ ] **Expected**: Run completes. PR body (if created) or log output contains the reason verbatim.
+
+## 3) Plain-text reason — regression check
+
+- [ ] Trigger the workflow with reason: `Ad-hoc promotion request` (the default value, no special characters).
+- [ ] **Expected**: Run behaves identically to before the fix. No regressions introduced.
+
+## 4) Scheduled trigger (no `inputs.reason`)
+
+- [ ] Review a recent scheduled Monday run in the Actions history (or re-run one).
+- [ ] **Expected**: The `TRIGGER_REASON` env var falls back to `'Scheduled weekly promotion'` and the PR body reflects that. No errors introduced by the env-var change.
+
+# Expected Results
+
+| Scenario | Expected outcome |
+|---|---|
+| Reason with apostrophe | Workflow completes; no shell syntax error |
+| Reason with multiple special chars | Workflow completes; reason appears verbatim in PR body |
+| Plain-text reason | No regression; workflow behaves as before |
+| Scheduled run | Fallback reason used; no errors |
+
+# Pass / Fail Criteria
+
+**PASS** — All four scenarios complete without a `syntax error` or `unexpected token` in the logs, and user-supplied reason text appears correctly in the PR body or step output.
+
+**FAIL** — Any scenario produces a shell syntax error, an unexpected token error, or the reason field is garbled/missing in the PR body.
+
+# Related
+
+- Issue #1022 — Apostrophe in `workflow_dispatch` reason causes syntax error in weekly promotion workflow

docs/plans/current_spec.md

@@ -545,7 +545,8 @@ watchHeartbeat: sess.IsAlive() == false
 | `backend/internal/api/handlers/docker_handler_test.go` | Modify | Add orthrus resolver tests |
 | `backend/internal/orthrus/proxy_integration_test.go` | Create | Integration test stub (`//go:build integration`) |
 
----
+This is a 5-line change to one file. No scaffolding, no test setup, no
+multi-phase implementation. The entire work is one atomic commit.
 
 ## 7. Implementation Plan