Repository navigation
Release: 10 change(s) since 2026-10-27 - #150
Merged
Merged
Conversation
Ory joins staging (#81) and the e2e suite runs against it, its result required for a release (auth#16, #121). - apps/staging/auth: the Secret `auth` (staging databases, own keys, mail to mailpit) and Flux objects in auth-staging that build bulbashenko-com/auth's root base with its staging component, at the same commit and images (auth-ui, auth-e2e) as production. The nested Kustomization impersonates a ServiceAccount of its own namespace. - promote.sh pins an app in several files in one commit: auth moves production's and staging's pins together. - apps/staging-platform/notify.yaml: Flux reports the staging auth Kustomization (whose health includes the e2e Job) to infra as a repository_dispatch, as the deploy App; staging-gate.yml turns it into the commit status staging/e2e on dev (pending on a new auth pin, carried over otherwise; hotfix PRs into main are marked as such). - `staging` checks the site's Deployment instead of `wait`, which would also wait for the nested Kustomization and its e2e run; `staging-platform` checks the certificate, not the export Jobs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A private key of the deploy GitHub App generated for the cluster (just flux-github-app, owner), so notify.yaml can dispatch to infra. It lives in flux-system, from main; staging never reads it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bulbashenko-com/auth#24: the staging component and the e2e suite as an image. Both pins move together, as promote.sh does from now on; the image build that follows finds them in place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run Ory in staging and gate releases on its e2e run
apps/staging-platform/github-app.sops.yaml (#149) is a SOPS Secret, but staging-platform has no decryption: with the release it would fail to apply, take notify.yaml with it and block staging (dependsOn). Cluster-level: applies only with the release.
Let staging-platform decrypt the deploy App's key
bulbashenko-com-deploy
Bot
changed the title
…nko-com/auth#25) 2 commit(s), 1 file(s) since c92cc28: - 84fd837 Merge pull request #25 from bulbashenko-com/mailpit-tmp - b500b82 Give staging's mailpit a writable /tmp Source: bulbashenko-com/auth@c92cc28...84fd837
bulbashenko-com-deploy
Bot
changed the title
…uth#26) 2 commit(s), 2 file(s) since 84fd837: - 5283a6b Merge pull request #26 from bulbashenko-com/e2e-prs-only - faabae0 Run e2e on pull requests only Source: bulbashenko-com/auth@84fd837...5283a6b
bulbashenko-com-deploy
Bot
changed the title
…lbashenko-com/auth#27) 2 commit(s), 5 file(s) since 5283a6b: - 0dc4b76 Merge pull request #27 from bulbashenko-com/claude/busy-wozniak-yasqr3 - 8258466 Keep the Ory admin APIs inside the namespace Source: bulbashenko-com/auth@5283a6b...0dc4b76
bulbashenko-com-deploy
Bot
changed the title
…ilures in staging (bulbashenko-com/auth#28) 2 commit(s), 3 file(s) since 0dc4b76: - ce22f42 Merge pull request #28 from bulbashenko-com/e2e-timeouts - a472568 Give TOTP tests time for their waits, and log failures in staging Source: bulbashenko-com/auth@0dc4b76...ce22f42
bulbashenko-com-deploy
Bot
changed the title
…and give e2e a CPU (bulbashenko-com/auth#29) 2 commit(s), 2 file(s) since ce22f42: - 153f053 Merge pull request #29 from bulbashenko-com/e2e-authorize-wait - 2bfb73a Let the OIDC redirect wait as long as the test, and give e2e a CPU Source: bulbashenko-com/auth@ce22f42...153f053
bulbashenko-com-deploy
Bot
changed the title
…bursts (bulbashenko-com/auth#30) 2 commit(s), 3 file(s) since 153f053: - d9d24d4 Merge pull request #30 from bulbashenko-com/kratos-memory - 9f682ac Keep Kratos inside its memory limit under login bursts Source: bulbashenko-com/auth@153f053...d9d24d4
bulbashenko-com-deploy
Bot
changed the title
…he version it was built for (bulbashenko-com/auth#31) 2 commit(s), 6 file(s) since d9d24d4: - d6004ef Merge pull request #31 from bulbashenko-com/e2e-own-kustomization - ab0881c Run staging's e2e as its own Kustomization, on the version it was built for Source: bulbashenko-com/auth@d9d24d4...d6004ef
bulbashenko-com-deploy
Bot
changed the title
The e2e Job sat in the stack's Kustomization: changing pins changed its spec images, Flux reconciled at once with the previous source artifact and the new image tags, so the run tested a new suite against old manifests, and its 30-minute health wait kept the new revision out. auth-staging/auth now deploys the stack only (10-minute timeout); auth-e2e runs bulbashenko-com/auth deploy/staging-e2e after it (Flux dependsOn: ready on the same source revision; the Job also waits for its own commit). The notification and the gate follow auth-e2e. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run staging's e2e in its own Kustomization after the stack
bulbashenko-com-deploy
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Всё, что накопилось в
dev(staging) с прошлого релиза. Merge = релиз в prod: Flux раскатитmain.Приложения
Изменения
Warning
В staging не проверялось, впервые применится в prod этим релизом:
apps/staging-platform/clusters/hel1/Метод мержа — только merge commit (история нужна, чтобы следующий релиз видел, что уже выкачено).
Откат: revert merge-коммита релиза в
main. Обновляетсяscripts/release-pr.sh.