Repository navigation
fix(ci): one stack-asset check, and derive what it needs from the compose file - #28
Open
allanice001 wants to merge 1 commit into
Open
allanice001 wants to merge 1 commit into
allanice001 wants to merge 1 commit into
Conversation
…pose file ci.yml and release.yml each carried their own copy of the compose validation, including a hand-written list of the credentials to supply. Adding keycloak, openbao and dex gave the compose file three new `:?` requirements; ci.yml was updated and release.yml was not, so the release job failed on a tag that had already been pushed -- the one moment this repo is least able to absorb a mistake, since a tag is only undone by deleting a release. Both now call .github/scripts/check-stack-assets.sh, and the script reads the required variables out of the compose file rather than repeating them. A service added with a new credential is picked up with nothing to remember, which is the only version of this that survives the next service. Together with TestWriteEnvCoversEveryRequiredComposeVariable, both ends are held: the generator must emit every required variable, and the check must supply every one, and neither list is written down twice. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013uGZy72FJV4SV2xh3nTvU9 Signed-off-by: allanice001 <allanice001@gmail.com>
✅ DragonGuard: PASSPosture 93/100 (+0 from 93) · 5 findings No blocking conditions. Top findings
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ci.ymlandrelease.ymleach carried their own copy of the compose validation, including a hand-written list of the credentials to supply. #27 gave the compose file three new:?requirements;ci.ymlwas updated andrelease.ymlwas not, so the release job forv0.4.0failed on a tag that had already been pushed — the one moment this repo is least able to absorb a mistake, since a tag is only undone by deleting a release.Both jobs now call
.github/scripts/check-stack-assets.sh, and the script reads the required variables out of the compose file rather than repeating them:required=$(grep -oE '\$\{[A-Z_][A-Z0-9_]*:\?' "$compose" | sed 's/^\${//; s/:?$//' | sort -u)A service added with a new credential is picked up with nothing to remember, which is the only version of this that survives the next service. Verified by temporarily adding a
${BRAND_NEW_CREDENTIAL:?}to the compose file — the script picked it up and still passed, with no edit to the script.Together with
TestWriteEnvCoversEveryRequiredComposeVariablefrom #27, both ends are held: the generator must emit every required variable, and the check must supply every one, and neither list is written down twice.Nothing was published for
v0.4.0—verifygatedgoreleaser, so there is no release to undo. The tag will need re-cutting once this lands.🤖 Generated with Claude Code
https://claude.ai/code/session_013uGZy72FJV4SV2xh3nTvU9