Repository navigation
sync: port the platform's chart changes since the seed (build hosts, OCR keys, azure-cli cask, operator README, TolerantYaml) - #4
Merged
Conversation
…ository's own fixes The seed (#1) copied the chart material from Systemorph/MeshWeaver at fdcbc25983. Since then the platform's copy moved on while this one gained its own fixes (#2, #3), and two pipelines baked `hosting-operator:main` from the two copies. The platform's chart is now frozen; this repository is its only home. Ported from the platform (fdcbc25983..16b9902f03): - #7143 the standing build hosts: templates/build-host/, buildHosts values, the networkpolicies write verbs in operator-rbac.yaml, test-build-hosts.sh + testdata, the invariants combination and the chart-gate step. The runner (build-run.py) and deploy/build-host/Dockerfile stay in the platform (main-cd builds that image), so test-build-hosts.sh reads them from the DECLARED platform checkout ($MW_PLATFORM_ROOT, fail-closed) and the chart-invariants job's sparse checkout gains deploy/build-host/Dockerfile. - #7159 the build-host node label (in the build-host templates/values above). - #7184 the OCR ConfigMap keys (Ocr__Engine, Ocr__HttpService__Endpoint). - #7170 memex-local: azure-cli is a cask; the formula no longer depends on it. - #7119 the operator image is published by MeshWeaver.Plugins (hosting-operator README), with this repository's tag shape and wording. - #7180 the ConfigMap guards read helm's render with the platform's TolerantYaml, not YamlDotNet. Also, because the guards build against the platform's main: #7125 moved Memex.Portal.Shared to MeshWeaver.Plugins, so the reference is dropped and SetupProbeEndpointsTest (1 test) leaves with its subject; the guard floor is 87. Not ported: #7189 and the chart half of #7191 (they land here directly). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
Build-host scaling, configuration validation, and drift comparison have unresolved correctness issues.
5 open issues
What changed in this PR
Synchronizes this deployment repository with the platform’s post-seed chart changes while preserving repository-specific fixes as the chart moves to its sole maintained home.
Changes:
- Adds opt-in standing build hosts, supporting permissions, fixtures, and chart checks.
- Adds OCR configuration keys and updates Azure CLI installation guidance.
- Migrates ConfigMap guards to
TolerantYaml, removes the relocated setup-host guard, and updates operator documentation.
| File | Description |
|---|---|
| test/MeshWeaver.Deploy.ChartGuards/SetupProbeEndpointsTest.cs | Removes the guard relocated with its subject. |
| test/MeshWeaver.Deploy.ChartGuards/RecordConfigReachesTheConfigMapGuard.cs | Checks parsed string types. |
| test/MeshWeaver.Deploy.ChartGuards/MeshWeaver.Deploy.ChartGuards.csproj | Updates platform project dependencies. |
| test/MeshWeaver.Deploy.ChartGuards/AutomationSwitchesReachTheConfigMapGuard.cs | Parses rendered YAML with TolerantYaml. |
| deploy/homebrew/README.md | Documents separate Azure CLI installation. |
| deploy/homebrew/Formula/memex-local.rb | Removes the Azure CLI formula dependency. |
| deploy/homebrew/bin/memex-local | Recommends the Azure CLI cask when missing. |
| deploy/helm/values.yaml | Adds disabled-by-default build-host settings. |
| deploy/helm/templates/memex-portal/config.yaml | Emits explicitly configured OCR keys. |
| deploy/helm/templates/build-host/build-host.yaml | Adds build-host workloads, isolation, and scaling. |
| deploy/helm/templates/build-host/_build-hosts.tpl | Validates and normalizes build-host settings. |
| deploy/aks/scripts/testdata/values.build-hosts.yaml | Exercises both build-host channels. |
| deploy/aks/scripts/testdata/values.build-hosts-tag-not-digest.yaml | Covers rejection of mutable image tags. |
| deploy/aks/scripts/testdata/values.build-hosts-run-deadline-zero.yaml | Covers rejection of a zero deadline. |
| deploy/aks/scripts/testdata/values.build-hosts-run-deadline-too-long.yaml | Covers rejection of excessive deadlines. |
| deploy/aks/scripts/testdata/values.build-hosts-registry-credential.yaml | Covers rejection of publication credentials. |
| deploy/aks/scripts/testdata/values.build-hosts-public-http.yaml | Covers rejection of public HTTP endpoints. |
| deploy/aks/scripts/testdata/values.build-hosts-postgres-sidecar.yaml | Covers rejection of shared PostgreSQL sidecars. |
| deploy/aks/scripts/testdata/values.build-hosts-localhost-no-profile.yaml | Covers rejection of unnamed local profiles. |
| deploy/aks/scripts/test-build-hosts.sh | Checks build-host rendering and configuration refusals. |
| deploy/aks/scripts/check-chart-invariants.sh | Adds the build-host render combination. |
| deploy/aks/manifests/hosting-operator/README.md | Documents operator ownership and image tagging. |
| deploy/aks/manifests/hosting-operator/operator-rbac.yaml | Grants NetworkPolicy write permissions. |
| .github/workflows/homebrew.yml | Corrects a comment about the Linux job. |
| .github/workflows/chart-guards.yml | Adjusts the test floor for the relocated guard. |
| .github/workflows/chart-gate.yml | Adds platform runner inputs and build-host checks. |
Review effort: Balanced
| {{- end -}} | ||
| {{- $as := ($b.artifactStore | default dict) -}} | ||
| {{- $asClaim := ($as.claimName | default "") -}} | ||
| {{- $asSpec := ($as.spec | default (ternary "file:/ci-artifacts" "" (ne $asClaim ""))) -}} |
| {{- end -}} | ||
| {{- end -}} | ||
| {{- $pv := required (printf "buildHosts.%s.platformVersion is required when that channel is enabled — the set the host stamps on every run it claims" $name) $c.platformVersion -}} | ||
| {{- $max := int ($c.maxReplicas | default 1) -}} |
Comment on lines
+283
to
+286
| apiVersion: "keda.sh/v1alpha1" | ||
| kind: "ScaledObject" | ||
| metadata: | ||
| name: "build-host-{{ $c.name }}-scaler" |
| - type: metrics-api | ||
| metricType: AverageValue | ||
| metadata: | ||
| url: "{{ $b.apiUrl }}/queue?channel={{ $c.name }}" |
| orasImage: "ghcr.io/oras-project/oras:v1.3.4@sha256:f7bc056d54d97baa399414ed5048ecc67c3371b750d4bbce1d871827a5758179" | ||
| # The tainted build pool (Build service §1.4): one build = one node. | ||
| nodeSelector: | ||
| workload: ci-build # the CI node pools (cibuildv6, cidind) carry workload=ci-build — the same label the ARC runners select |
rbuergi
added a commit
that referenced
this pull request
Oct 25, 2026
…tform #7179) (#7) Port of the platform's last change to its frozen copy of deploy/homebrew, made after #4 was cut: core carries no GUI technology, so `memex-local e2e test` resolves a MeshWeaver.Plugins checkout (MEMEX_PLUGINS_REPO, default beside the platform checkout) and runs its src/MeshWeaver.Portal.E2E.Test from the platform checkout (whose global.json selects the Microsoft.Testing.Platform runner), with -p:MeshWeaverRoot naming that checkout. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The platform's chart is frozen (owner decision): this repository is the chart's only home, and the platform's copy is deleted by Systemorph/MeshWeaver#7127. Until now both copies were live. #1 seeded this repository from the platform at
fdcbc25983. The platform's copy then moved on, and this one gained its own fixes (#2, #3). Two pipelines bakedhosting-operator:main, one from each copy, so:mainflapped between them. This PR brings this repository level with the platform at16b9902f03(itsorigin/mainwhen this was cut) and keeps every fix that is only here.Ported from the platform (
fdcbc25983..16b9902f03, every commit that touched the seeded paths)templates/build-host/, thebuildHostsvalues block, thenetworkpolicieswrite verbs inoperator-rbac.yaml,test-build-hosts.shwith its testdata, the invariants combination and the chart-gate step.workload=ci-build, the label the CI node pools carry.Ocr__EngineandOcr__HttpService__Endpoint.deploy/ocritself is a service image, not chart material, and stays in the platform.azure-cliis a cask now, so the formula no longer depends on it. This fixes the macOS brew job, which #1 listed as red before the move.<plugins7>-<core7>-<deploy7>, and the old:<core sha7>tags belong to the platform repository. The platform'shomebrew.ymlcomment now points at its newmemex-local.yml; here it points at the Linux job in the same file.TolerantYaml(aMeshWeaver.Yamlproject reference) instead of YamlDotNet.The guard-test changes from Systemorph/MeshWeaver#7111 and its siblings (
RepoPaths) are the platform's own plumbing. They are not ported, because the guards here resolve paths throughChartRoots.Deliberately not ported (agreed with the owner of the build-host work): Systemorph/MeshWeaver#7189 (the build-cache claim) and the chart half of Systemorph/MeshWeaver#7191 (versioned build hosts). Both land here directly, on top of this PR.
Kept from this repository (conflicts resolved by intent)
registry.validationUrl, plus its refusal; example values only in the public example overlay; the job-runner admission policy and its offline test; the passthrough case-collision and bundle-root refusals.MW_PLATFORM_ROOT), the series-0.3 Homebrew version, and thelinuxjob.build-run.pyanddeploy/build-host/Dockerfile, because main-cd builds the runner image there. The test now reads both from the declared platform checkout and fails closed whenMW_PLATFORM_ROOTis unset. The chart-invariants job's sparse checkout gainsdeploy/build-host/Dockerfile.A red this PR also clears
Systemorph/MeshWeaver#7125 moved
Memex.Portal.Sharedto MeshWeaver.Plugins. It merged after this repository's last green guards run. Against the platform's currentmain, the guards project failed to build:MSB9008 … Memex.Portal.Shared.csproj does not existandCS0234. The reference is dropped here.SetupProbeEndpointsTest(1 test) leaves this repository, because its subject is now in MeshWeaver.Plugins, which has its own copy (src/Memex.Portal.Shared.Test/SetupProbeEndpointsTest.cs). The guard floor goes from 88 to 87.Follow-up outside this PR: that MeshWeaver.Plugins copy still reads the PLATFORM's
deploy/helm. It must read this repository's chart before #7127 deletes the platform copy.Verified locally
check-chart-invariants.shvalue combinations was rendered with the platform's chart (origin/main) and with this branch's chart, using each repository's own values files. 25 of 26 renders are byte-identical. The one difference is thevalues.registry.example.yamlcombination. That difference is fix: the job-runner cannot start the operator; no default registry validator; examples in public files #2's deliberate change: the public example overlay namesregistry.example.com,exampleregistrystore,example-vaultandportal.example.cominstead of real fleet values. It also moves the dependentchecksum/confighashes. Nothing else differs.MW_PLATFORM_ROOTset to a platform export at16b9902f03:check-chart-invariants.sh: all 26 combinations render self-consistently, and all 15 refusal controls hold.check-values-are-read.sh: 128 of 128 keys are read.test-chart-drift-compare.sh,test-chart-drift-render.sh,test-crash-dump-retention.sh(11 cases) andtest-artifact-store-jobs.sh(23 cases) pass.test-build-hosts.sh: both channels render, all 7 refusals hold, andbuild-run.py --self-testpasses.test-observability-storage.pyandtest-observability-values.pypass.test-build-hosts.shwithoutMW_PLATFORM_ROOTexits 1 and names the variable.-warnaserroragainst the platform at16b9902f03with 0 warnings and 0 errors. The test exe reportsTotal: 87, Errors: 0, Failed: 0. Before this change, the same build failed with the two errors above.deploy/homebrew/test/run-tests.sh: 94 passed, 0 failed.shellcheckontest-build-hosts.shis clean.test-jobrunner-admission.py(needs cel-python). This PR changes neither.Refs
rbuergi/Feedback/20261025-operator-main-flaps-between-core-and-deploy-charts.🤖 Generated with Claude Code