Repository navigation
Add secrets - #2
Merged
Merged
Conversation
adskyiproger
force-pushed
the
add-secrets
branch
from
March 24, 2025 15:17
cb856aa to
9c71706
Compare
adskyiproger
pushed a commit
that referenced
this pull request
Apr 10, 2026
🔧 Add configuration for qa
adskyiproger
added a commit
that referenced
this pull request
May 18, 2026
* configure public env variables for MOSIP Collab * add mosip api secrets to deployment * move secrets / variables to appropriate places * bump version * disable not needed mocks * update esignet urls * Update Verifiable Credentials URLs in values.override.yaml use proxy instead of the direct issuer - it adds issuerKey --------- Co-authored-by: Vadym Mudryi <vadym.mudryi@gmail.com>
adskyiproger
added a commit
that referenced
this pull request
Sep 24, 2026
* Added integration environemnt * fix: Added mosip integration * fix: Repo link for helm chart * fix: Disable authentication * fix: Added MOSIP variables * Add verifiable credentials URLs to values.override.yaml * add Pyry to users * Update Verifiable Credentials URLs in values.override.yaml use proxy instead of the direct issuer - it adds issuerKey * chore: remove webhooks from infra * configure public env variables for MOSIP Collab (#2) * configure public env variables for MOSIP Collab * add mosip api secrets to deployment * move secrets / variables to appropriate places * bump version * disable not needed mocks * update esignet urls * Update Verifiable Credentials URLs in values.override.yaml use proxy instead of the direct issuer - it adds issuerKey --------- Co-authored-by: Vadym Mudryi <vadym.mudryi@gmail.com> * bump helm charts to v2.0.0 (#3) * fix: Add portal deployment * fix: Add portal deployment * fix: Add portal deployment * fix: name * add reference data related secrets and mappings * fix: Add performance testing CI/CD * fix: Release name * fix: Added environment * fix: Added environment * fix: Added (tmp) prod environment for perf-testing * fix: Remove file before downloading new version * fix: Added MOSIP integration * fix: Added environment file * fix: checkout before running * fix: hardcode output to elasticsearch * fix: smoke -> load * fix: Switch develop branch to v2.0.0 * fix: Bump version * chore: remove opencrvs/ocrvs-notification from image size comparison script * chore: remove opencrvs/ocrvs-metrics from image size comparison script * initial commit demo environment * fix: Add extra labels to runner * fix: Add self hosted runner additional labels variables * fix: Add depedendencies * fix: Add common demo reset-2fa * add demo env configuration files * fix: use custom path to store data * fix: use custom path to store data * demo staging * fix: Add staging opencrvs environment * fix: Added mosip integration * test * fix: Proper way to create tls secret * fix: Commit not-tested fix; * fix: Add implicit dependency pigz * fix: Added missed variables * fix: Add legacy migration after seeding users * fix: Run legacy migrations as part of cleanup * fix: Add opencrvs environment * fix: name * fix: Upgrade upload/download artifact actions * fix: Add CSP variable * fix: Disable mosip * fix: bypass scale up/down traefik * fix: Hardcoded path to MOSIP configuration file * fix: Added mosip integration * added missed building blocks * fix: Switch to mosip mock integration * fix: Move integration configuration options * fix: Hardcoded path to MOSIP configuration file * fix: Moved MOSIP to dedicated workflow * fix: Moved MOSIP to dedicated workflow * fix: job dependency * fix: job dependency * fix: Bump chart version * fix: Added backup env * fix: Enable restore on staging * fix: Dropped custom mosip variables * fix: add APM server from demo env * fix: MOSIP URLs * fix: Added tool for secret management * fix: Added description * fix: Disable reindex on depoy * disable notifications * feat: Add generic workflow to deploy any release * fix: Drop duplicate redirect * fix: remove duplicated keys * fix: Init beta release * fix: Move postgres to worker node * fix: Use platform.* * Update MOSIP_WEBSUB_CALLBACK_URL for integration * fix: Content security policy * fix: Content security policy * Update CONTENT_SECURITY_POLICY_WILDCARD for client env use wildcard due to needing minio.* for example. * force mosip-api image to v2.0.0-demo.1 * bump mosip-api image to 2.0.0-demo.2 * bump mosip-api image to 2.0.0-demo.3 * Update mosip_api image tag to 2.0.0-demo.4 * Update MOSIP API image tag to 2.0.0-demo.5 * fix: drop mistakenly added wildcard * fix: BGP rules for calico * fix: BGP rules for calico * fix: Use platform.* * fix: bypass scale up/down traefik * fix: Add CSP variable * fix: Proper way to create tls secret * fix: Add implicit dependency pigz * fix: Add legacy migration after seeding users * fix: Upgrade upload/download artifact actions * chore: add jamil as an ssh user on demo server * chore: add markus as an ssh user on demo server * feat: Init release * fix: Added changelog * fix: Token reference * fix: Token reference * chore: update version to 1.9.14 * docs: update changelog for 1.9.14 release candidate * fix: Skip configuration files override on environment:init (upgrade) flow (#306) * fix: BGP rules for calico * fix: Don't ask "Do you want to enable disk encryption?" for configured environment (#307) * fix: Adjust message to be shown only for disabled encryption * fix: Don't ask "Do you want to enable disk encryption?" for configured environment (#307) * fix: Adjust message to be shown only for disabled encryption * fix: Added changelog * TODO/FIXME * chore: Kubernetes upgrade from 1.34 to 1.35 (#310) * fix: Added changelog * chore: Kubernetes upgrade from 1.34 to 1.35 * fix: Duplicate key "when" * fix: Hardcoded cert-manager * fix: Upgrade calico according to official doc * fix: Adding missed "quotes" * fix: added Testing outbound HTTPS connectivity instead of ping * fix: Changelog * fix: Runner directory must belong to provision user (#313) * fix: Runner directory must belong to provision user (#313) * Add retry to curl command * Update mosip_api image tag to 2.0.0-demo.6 * Update MOSIP API image tag to 2.0.0-demo.7 * fix: Set string variable type * fix: Set string variable type * remove ocrvs-user-mgnt * chore: update version to 1.9.15 * docs: update changelog for 1.9.15 release candidate * fix: Add handler for not initialised git repository * fix: Enable Typha * fix: Remove mistakenly merged files (#319) * fix: Small amend to properly enable 2FA * fix: Git rid of call to countryconfig from elastalert service (#321) * Remove auth.* public subdomain — auth is now only reachable via gateway proxy (#320) * fix: Refactor Kubernetes & Runtime Questions (#323) * fix: Refactor Kubernetes & Runtime Questions * fix: Consistency in variable names * fix: Added network CIDRs validation * fix: Question clearification * fix: Variable name * fix: Revisited unattended upgrades policy (#324) * fix: Revisited unattended upgrades policy * Remove previously managed file * fix: Added placeholder value to avoid parsing issues * fix: Security adjustments (#326) * fix: Security adjustments * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: Always set ansible_default_ipv4 --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: Amend question * drop man file * drop man file * fix: Version convention fix * fix: Init release script fix * chore: update version to 1.9.16 * docs: update changelog for 1.9.16 release candidate * fix: Release versioning (#337) * fix: Always restart self-hosted runner on k8s * fix: added Testing outbound HTTPS connectivity instead of ping (#338) * fix: Versions * agents.md / settings.json for infra * add copilot + codex config * link to docs * testing (#342) * feat: Backup migration script (#340) * fix: Add ACTIVATE_USERS to data_seed job (like for deploy)" * fix: Downgrade helm to 3.x version (#350) * feat: Added k9s to default userspace configuration * fix: Run differencial backup as non-root user after upgrade pgbackrest to v2.59.0 (#360) * fix: Make pgbackrest package version depending on distribution selection (#364) (#365) * fix: Retry connectivity check on transient failures in bootstrap script * fix: Retry runner archive download on transient failures * bump package version * ci: accept target_branch from core for older-channel releases - default master, so manual runs behave as before - skip the develop merge-back when targeting a release branch Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: update version to 2.0.2 * docs: update changelog for 2.0.2 release candidate * fix: Added hold around pgbackrest to avoid upgrade/downgrade (#375) * ci: merge older-channel releases up instead of targeting master Mirrors opencrvs-core's init-release change, driven by the target_branch core passes down. When the target is a release branch rather than master this repo opens no release PR: it cuts merge-back/release-<version>-into-<target> from the target, merges the release branch into it, and PRs that into the target. Conflicts confined to the CHANGELOG and the chart/image version lines in the deploy workflows resolve to the target channel's copy and are noted in the PR body; anything else aborts. A target branch that does not exist yet is cut from master and given the same chart version bump and CHANGELOG section a normal init-release run would have written. Merge-back branch names now strip dots, matching the other repos. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: require the target release branch to exist Replaces the step that cut and initialised a missing target branch with a check that fails before anything is created. That release writes its own version bump and CHANGELOG, and a placeholder branch would make its own init-release run skip them. opencrvs-core resolves the target — now the next unreleased patch of the channel directly above the release's own — and passes it down; this repo only verifies it is there. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: tidy up init-release and trim its comments Quality pass over the release workflow, no behaviour change: - one `Configure the git identity` step instead of the same two git config lines in two places - a `create_pr` helper instead of the "list, then create unless open" block written out twice - drop the `release_pr` output and the `target_slug` variable — both restate the target branch — and use bash parameter expansion for the dot-stripping instead of `echo | tr` subshells - resolve the expected merge conflicts with one `git checkout --ours` over the pathspec, staging just those files rather than `git add -A` - one `git fetch` for both refs the older-channel path needs Comments are about a quarter shorter: the header is a plain list of what the workflow does, and each step comment gives the reason rather than restating the code. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: don't merge in CI when creating the merge-back branch Merging the release branch into the target during CI aborts the release init whenever the two channels disagree — core's 1.9.17 run died on modify/delete conflicts for packages 2.x dropped, before any PR, companion dispatch or draft release happened. The merge-back branch is now a copy of release/<version> whichever channel it targets, the same as the merge-back to develop has always worked: the branch exists so that the commits resolving conflicts with the target stay off the release branch, and whoever merges the PR does that resolution. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * ci: cut the merge-back from the target again, without blocking the release Restores the branch shape core's workflow was designed around: for an older channel the merge-back branch is cut from the target and the release branch merged into it, so the PR diff is only what that channel adds. What broke core's 1.9.17 run is fixed instead of avoided: a conflict outside the version/CHANGELOG class abandons the merge, skips the branch and its PR, and writes the job summary rather than failing the run; and modify/delete conflicts now resolve, keeping the target's deletions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(ocrvs-13460): remove Sentry provisioning Core no longer reads SENTRY_DSN, so drop the Sentry DSN prompt from environment setup and the sentry.io reachability check from bootstrap. * chore: update version to 1.9.17 * docs: update changelog for 1.9.17 release candidate * docs(ocrvs-13460): note the Sentry removal * docs(ocrvs-13460): trim the changelog entry to the actionable part * ci: simplify init-release in step with core Same pass core just had, minus the parts that do not apply here — core still resolves the target branch and passes it in as target_branch. - VERSION and RELEASE_BRANCH as workflow-level env, so the version stops being interpolated into every command - the separate "check if release branch exists" step folded into the branch creation as an early exit - the draft release and its tag deletion are one step, since the second only undid what the first had just done - shorter names (BRANCH, TARGET), CHANGELOG.new + mv instead of the copy dance, and comments cut to why rather than what Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: Make provision user and group ids not rely on hardcoded values (#379) * fix: Make provision user and group ids not rely on hardcoded values * fix: Local provision scripts * chore: update version to 1.9.18 * docs: update changelog for 1.9.18 release candidate --------- Co-authored-by: Vadym Mudryi <vadym.mudryi@gmail.com> Co-authored-by: Pyry Rouvila <pyry.rouvila@gmail.com> Co-authored-by: jamil314 <jamil31415926@gmail.com> Co-authored-by: Pankaj Pant <44195004+pankaj-pant@users.noreply.github.com> Co-authored-by: Nil20 <alamnileem11@gmail.com> Co-authored-by: Md. Ashikul Alam <32668488+Nil20@users.noreply.github.com> Co-authored-by: Pyry Rouvila <pyry@opencrvs.org> Co-authored-by: Markus Laurila <makelicious@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: cibelius <cihan.m.bebek@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Oni <ocq1003@gmail.com> Co-authored-by: Riku Rouvila <riku.rouvila@gmail.com> Co-authored-by: tahmidrahman-dsi <tahmidrahman.dsi@gmail.com> Co-authored-by: Tahmid Rahman <42269993+tahmidrahman-dsi@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.