Repository navigation
ci: merge pull requests directly into main and retire dev - #21
Merged
Merged
Conversation
Brings chore(release): start versioning at 0.1.0 (#12) back to dev.
## Summary Operator secrets are now managed in OpenBao's web UI instead of gitignored env files pushed by a script. - `moon run deploy:openbao` forwards OpenBao to `localhost:18200`, logs in through Kubernetes auth as a new `snapflow-operator` role and prints a one-hour token to sign in with. OpenBao stays cluster-internal; the UI is never routed through Traefik. - The `snapflow-operator` policy (written by the configure job) can create, edit, roll back and delete only the operator secrets: `snapflow/api`, `alerts`, `backups`, `cloudflare-dns` and `edges/*`. It cannot read the keyrings and platform credentials the job generates, write any other path, or change OpenBao itself. The old shell used the far broader `snapflow-configure` role. - Closing the session (Ctrl-C) annotates every ExternalSecret with `force-sync`, so edits reach the cluster at once instead of at the hourly refresh, as the push did. - `ui = true` in the OpenBao server config. - Removed: `deploy:secrets`, `push-secrets.sh`, `openbao-shell.sh` and `lib/openbao-session.sh`. `docs/deployment.md` describes the UI workflow. The `/deploy/secrets/production/` gitignore entry stays until the operator has moved its existing local values into OpenBao and deleted the folder, so those files can never be committed by accident. ## Testing - Against a throwaway OpenBao 2.7.1 (the pinned image) with the policy generated exactly as `configure.sh` writes it, an operator token could create, update, read, roll back and delete `snapflow/api` and `snapflow/edges/home`, and list `snapflow/` and `snapflow/edges/`; it was denied reading or writing `snapflow/api/encryption-keyring` and `snapflow/platform/redis`, writing other paths, writing policies and listing mounts. - `deploy/scripts/validate.sh` passes for every stage; shellcheck is clean on the new and changed scripts.
… access (#15) Dynamic DNS: favonia/cloudflare-ddns keeps the public site, registry and storage records on the home connection's current IPv4 address, in the infrastructure-configs stage so it runs before the platform and apps. It reuses the cert-manager DNS token and reports failures to the alerts channel; that stage now takes the shared cluster settings. Host firewall: deploy/bootstrap/host-firewall.sh applies the server's whole UFW configuration declaratively: public edge and Traefik ports, SSH and the k3s API from the administrative network only, and the k3s pod and service networks. It lists every port Docker or Kubernetes exposes past UFW. Database access: CloudNativePG manages a snapflow_readonly role in pg_read_all_data, with a password generated in OpenBao that the operator can read in the UI.
The api's env-docs command becomes env-file and only lays out the local apps/api/.env; its CI check is gone. Runbook content now lives in the files it describes: cluster-settings.env, bootstrap-flux.sh, install-k3s.sh, the backup manifests, notifications.yaml, postgres.yaml, the deploy:openbao output, the TUF trust root README and the README.
Removes unused configuration, the tsx dependency, pnpm entries for packages no longer installed, unused API helpers and environment registry fields, and dead microVM runtime code: the never-applied WithVolumeBlockStore and WithGPUManager options, the unwired fork-from-snapshot-record path, and four uncalled methods. GPU passthrough, volumes and standby pause, restore and fork behave as before.
The api image runs scripts/download-geoip-database.sh directly; it lost its executable mode in #16, so the image build failed with permission denied.
The api Dockerfile copies scripts/download-geoip-database.sh, but the image path filter did not list it, so a change to it never rebuilt the image.
|
Important Review skippedToo many files! This PR contains 108 files, which is 8 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.
 |
github-actions
Bot
added
documentation
Every pull request is now squash-merged into main, so each commit on main is one described change instead of a promotion or sync merge. Pushes to main run CI, publish the changed images and run release-please; Flux image automation pins the new digests on main (its pin commits skip CI). The dev workflow, sync-dev and the dev ruleset are removed, the main ruleset allows squash merges only with the automation App allowed to push pins, and CI no longer restricts which branches may target main. Renovate, the PR template, image.sh and CONTRIBUTING follow the new flow.
BryanLawless
force-pushed
the
ci/merge-directly-into-main
branch
from
November 5, 2026 07:01
d655c74 to
b12a4eb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the repository to trunk-based development: every pull request is squash-merged directly into
main, and thedevbranch is retired. Each commit onmainbecomes one described change (Conventional Commits title from the PR, body from the PR description) instead of apromote dev to mainormerge main into devmerge.main.ymlnow does whatdev.ymldid: on push tomainit runs CI, then publishes images for the changed apps and runs release-please (and the release when one is cut). Pushes that only changedeploy/apps/production/**(Flux's digest pins) are ignored so they neither rerun CI nor rebuild images.main; its pin commits still list every changed image.image.shpublishes only commits onorigin/main..github/rulesets/main.jsonallows squash merges only and lets thesnapflowio-automationApp push the pin commits;dev.json,dev.ymlandsync-dev.ymlare deleted.CI passedno longer restricts which branches may open a pull request intomain; CI, CodeQL, the security audit and the isolation suite targetmainonly.After this reaches
main(with the final promotion, #18), the GitHub side is: import the new main ruleset, delete the dev ruleset, allow only squash merging with the PR title and description as the commit message, and delete thedevbranch.Testing
--persona regular --min-severity medium, as in CI) reports no findings.deploy/scripts/validate.shpasses helm lint and kubeconform for every stage includingdeploy/images.devbranch remains.