refactor(platform): call the shared deploy-check instead of a vendored copy - #33
Merged
Merged
Conversation
…d copy platform/render-local.sh was a ~400-line copy of logic that also lived in actions/deploy-preview/run.sh, duplicated into every service repository. The copies drifted, and this one could not run at all: it passed a directory where --output names a file, and called artifact leak-scan and artifact validate-raw-manifests, neither of which the toolkit publishes. The logic now lives in @jorisjonkers-dev/deploy-check, which the deploy-preview action runs as well, so a local result and a CI result cannot disagree. What is left here is a wrapper that pulls the cluster context and invokes the pinned checker. The schema version and context ref are read out of this repository's own workflows rather than restated in the script. The previous copy hardcoded both and both went stale: the schema version by four minor releases, the context digest by two republications. There is now one place to change either.
ExtraToast
added
the
type: refactor
Deploy Preview — agent-runtimeEnvironments: production Image refs
SC-11 Readiness Scorecard
Updated by deploy-check on push to this PR. |
The wrapper hardcoded deploy-check 0.15.0, which is the same mistake the 400-line copy made with its schema version and context digest -- and 0.15.0 turned out to carry a context-resolution bug fixed in 0.15.1. deploy-check is released from the same repository as the reusable workflows, so the version comment on the deploy-validate (or deploy-artifact) pin is the version to run. The wrapper reads it from there, leaving nothing about the checker restated in this repository. The github-workflows pins move to v0.15.1 accordingly. Both reusable workflow interfaces are unchanged across the versions involved -- same inputs, same required flags -- so no caller change is needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
platform/render-local.shwas a ~400-line copy of logic that also lived inactions/deploy-preview/run.sh, vendored into all seven service repositories. It is replaced by a wrapper around@jorisjonkers-dev/deploy-check(JorisJonkers-dev/github-workflows#94), which thedeploy-previewaction runs too — so a local result and a CI result cannot disagree.Why the copy had to go
The copies drifted. The CI version parsed
deployment.ymlwithyqand read the artifact contract; this one re-derived the same answers by grepping raw text. And this one could not run at all:--outputwas passed the per-environment directory, but the toolkit opens it as a file →EISDIRon all five fragmentsartifact leak-scanandartifact validate-raw-manifestsare not published subcommands →E_USAGEartifact emit-contractwas called with--schema-version(not a flag) and without the required--deploymentand--contextkubeconformandkustomize buildwere pointed at fragment documents, which both tools reject by designPinned values now have one home
The script no longer restates the schema version or the context digest. It reads them from this repository's own workflows, so the local check and CI are pinned by construction. That closes the drift that had already happened: the hardcoded schema version was four minor releases behind, and the context digest two republications behind, what CI used.
Prerequisites
node, plus eitherorasor--context-dirpointing at an already-pulled context package. The toolkit install readsnpm.pkg.github.com, which needs a token even for public packages, soexport GITHUB_TOKEN="$(gh auth token)"first — the wrapper picks it up, falling back togh auth tokenwhen available.Verification
Run in all seven repos against the current public context, via
npxfrom the published 0.15.0 package: five fragments render, the apply bundle builds, and the contract is emitted. Six pass;knowledgeexits 1 on its one real gap, now reported asno health.path on knowledge-ingest-workerrather than a barefail.