You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(email): prepare an unchanged DNS import proposal - #64
Company Email routing must be brought under declarative ownership without changing its current delivery. Existing records and their ownership need to be preserved before that migration.
What
Adds an encrypted, read-only import proposal that requires the existing resources to remain unchanged. Preserves Email record values and metadata while excluding records owned by runtime controllers.
Part of #63. Preserve existing records and metadata in an isolated, read-only native plan; export only encrypted evidence and keep authoritative state adoption separate.
Validation at signed head 1d79c35bcbee96961ee82dd2a13c8ea474acf646:
The complete repository suite passed before the final ownership tightening, including native OpenTofu schema validation and the existing recovery/locking regressions. The Linux/tmpfs lifecycle is explicitly reserved for Ubuntu CI. Both affected proposal suites pass again at this head; workflow syntax and whitespace checks also pass.
RED/GREEN controls reproduce metadata changes from defaults, discarded provider settings, foreign ownership acceptance, and missing proposal behavior. The corrected path preserves values and metadata, rejects ambiguous/controller-owned records, restricts provider/CLI operations, and accepts only the exact complete unchanged plan. Real age transport is decrypted and checked by an independently held fixture identity.
The selector was exercised privately against the authenticated provider inventory and identified six existing Email records with their metadata preserved. This is a point-in-time selection observation, not a native live provider plan.
Self-review covered correctness, simplification and the credential/export boundary. The prior encrypted inventory shares the same bounded collector; credentials remain outside arguments, logs and exported files.
The native main-only provider trial, independent artifact authentication and authoritative-state adoption remain unverified. This delivers a read-only proposal path; #63 remains open until its confirmed trial passes.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 548a7ab3-5c84-4549-92d3-9622af350835
Commits
Reviewing files that changed from the base of the PR and between 1d79c35 and a2f3368.
Files selected for processing: 4
scripts/dns-snapshot-common.sh
scripts/plan-email-dns.sh
scripts/tests/test-email-dns-plan.sh
scripts/tests/test-email-dns-proposal.sh
No actionable comments were generated in the recent review.
Walkthrough
This change adds a manually dispatched workflow for a read-only Email DNS import proposal. It collects and validates a DNS snapshot, selects eligible Email records, imports them into an isolated local Terraform backend, and rejects plans that show changes or drift. The workflow publishes an encrypted proposal and manifest on success, or encrypted diagnostics when available after failure. The changes also extend DNS record inputs to support provider settings and private routing, and reuse the snapshot collector in the existing DNS export script.
Possibly related issues
Issue 63 — The PR implements its reviewed, read-only Email DNS import proposal objective, but does not complete the trial or authoritative-state steps.
Issue 21 — The PR prepares an Email DNS import proposal as one step in the roadmap; it does not complete DNS adoption or the Email migration.
Possibly related PRs
devantler-tech/cloudflare#32: This PR refactors the DNS exporter introduced there to use the shared collector, and uses the encrypted inventory pattern.
devantler-tech/cloudflare#34: This PR uses the repository’s DNS recovery recipient to encrypt proposal and diagnostic artifacts.
devantler-tech/cloudflare#51: This PR validates and imports the existing R2 state bucket as an unchanged resource in the Email DNS proposal.
Merge Risk: Minimal · previous review 1d79c
No actionable merge-blocking issue is established. The proposal remains read-only; the native provider trial and artifact authentication remain separate validation steps.
Important
Pre-merge checks failed
Please resolve all errors before merging. Addressing warnings is optional.
Failed checks: 1 error
Check name
Status
Explanation
Resolution
Docstring Coverage
Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…
Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title clearly and concisely describes the main change: preparing an unchanged Email DNS import proposal.
Description check
The description directly explains the purpose and outcome of the Email DNS import proposal, including preservation of routing and exclusion of runtime-owned records.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 6 files. (6 skipped: 6 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Run CodeRabbit Verify to test the changes in this pull request.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 0ebe47ea-c93a-4c92-8d57-ae6757c97eb3
Commits
Reviewing files that changed from the base of the PR and between 90fc8ed and 1d79c35.
Files selected for processing: 12
.github/workflows/email-dns-proposal.yaml
docs/email-dns-proposal.md
main.tf
scripts/check-email-dns-plan.jq
scripts/dns-snapshot-common.sh
scripts/email-dns-proposal.jq
scripts/export-dns-snapshot.sh
scripts/plan-email-dns.sh
scripts/test.sh
scripts/tests/test-email-dns-plan.sh
scripts/tests/test-email-dns-proposal.sh
variables.tf
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Context from checks skipped due to timeout: 1
GitHub Check: CodeRabbit
Additional context used
Learnings: 1
Common learnings
Learnt from: CR
Repo: devantler-tech/cloudflare PR: 0
File: README.md:0-0
Timestamp: 2026-10-31T14:40:28.966Z
Learning: Applicability reference:
AGENTS.md: # AGENTS.md — devantler-tech/cloudflare
## What this repo is
CI checks links in `README.md` and this file against the repository-owned retired
catalogue list in `.github/retired-repo-links.json`. The required guard verifies
clean documentation, rejected retired links, and missing configuration. Run
`bash scripts/test-retired-repo-links.sh <released-validator-binary>` to repeat
the clean and disposable failure fixtures locally.
Source excerpt:
# cloudflare
## Dependency updates
The OpenTofu runtime stays on the reviewed 1.12.x line; no updater changes it.
Every provider proposal must pass `scripts/test.sh`, including the
destructive-plan guard. Dependency automation has no production credentials or
apply path.
Learnt from: CR
Repo: devantler-tech/cloudflare PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-11-02T09:14:08.491Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare
## Maintenance
- Pass credentials only through environment variables or the approved private
CI secret store. Never commit plaintext credentials, private keys, state or
plans. The maintainer-approved exception is authenticated ciphertext for
essential bootstrap recovery in `recovery/`, bound by its registered package
validator and an independently recoverable key. Ordinary service credentials
stay in OpenBao. Paired state packages bind encrypted state and desired
configuration to their reviewed source and run; authenticate recovery with
the independently held identity before using either file.
Learnt from: CR
Repo: devantler-tech/cloudflare PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-10-14T09:35:35.012Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare
## Maintenance
- Keep the state backend and execution path independent of Kubernetes, Flux,
Crossplane, OpenBao, and cluster-hosted runners. GitHub-hosted runners are the
automation boundary.
Learnt from: CR
Repo: devantler-tech/cloudflare PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-10-31T14:40:15.878Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/cloudflare
## Maintenance
- Use OpenTofu 1.12.x and the official Cloudflare provider version pinned in
`versions.tf`.
ast-grep (0.51.1)
scripts/tests/test-email-dns-plan.sh
[warning] 80-80: A credential-bearing variable (e.g. PASSWORD, PASSWD, SECRET, TOKEN, API_KEY) is assigned a hardcoded string literal. Secrets committed to a script are exposed in source control, process listings, and shell history, and cannot be rotated without a code change. Read the value from a secrets manager or an injected environment variable at runtime instead (e.g. PASSWORD="${DB_PASSWORD:?must be set}"), and never commit the literal.
Context: token=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Note: [CWE-798] Use of Hard-coded Credentials.
(hardcoded-password-assignment-bash)
Additional comments: 12
main.tf: 1
16-26: LGTM!
scripts/dns-snapshot-common.sh: 1
1-61: LGTM!
scripts/export-dns-snapshot.sh: 1
28-34: LGTM!
scripts/email-dns-proposal.jq: 1
1-79: LGTM!
scripts/tests/test-email-dns-proposal.sh: 1
1-103: LGTM!
scripts/check-email-dns-plan.jq: 1
1-33: LGTM!
scripts/plan-email-dns.sh: 1
1-117: LGTM!
scripts/tests/test-email-dns-plan.sh: 1
1-166: LGTM!
docs/email-dns-proposal.md: 1
1-32: LGTM!
.github/workflows/email-dns-proposal.yaml: 1
1-84: LGTM!
scripts/test.sh: 1
16-17: LGTM!
variables.tf: 1
20-21: Data Integrity & Integration
The concern is not supported by the repository. The default change is real, and an omitted comment or tags now resolves to null or an empty set. Every repository-owned dns_records input sets both fields explicitly, so no in-repo plan drops the managed-by comment or the owner tag. The proposal filter also refuses selected records that carry owner or managed-by tags, so the claimed owner-tag removal is not reachable through the proposal path. The only remaining input is external tfvars, which the repository does not bind to. That input does not establish a finding.
Addressed the selected review’s documentation finding at a2f33684d4d32832d4555d1e64cea37412e72d96. The touched shell functions now describe their read scope, cleanup ownership, credential boundary and controlled test behavior. This commit changes comments only; shell lint and whitespace checks pass. Fresh hosted checks and review remain required at this head; no refreshed coverage percentage is claimed.
The analysis warning about the all-A test credential is a synthetic value accepted only by the controlled local API/CLI fixtures. It is not a production credential and is never sent to Cloudflare by these tests.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
CodeRabbit declined this exact head because of its included review limit (#issuecomment-6594714257). The complete no-gate census returns ADMIT at this head. The prior documentation finding is addressed by the comment-only change and its resolution record. Continuing the ordered review loop with Codex.
Ready at signed head a2f33684d4d32832d4555d1e64cea37412e72d96: CI run 41572518023 passed; all 16 checks are settled (12 successes, 3 intentional skips and CodeRabbit’s neutral quota result). Codex completed a clean review of this exact head (#issuecomment-6594767480). The complete thread/review/comment census has no outstanding finding; the prior documentation finding has its explicit resolution record. GitHub reports CLEAN.
User evaluation exercised the real OpenTofu variable conversion, complete snapshot selection, refusal cases, and real age encryption/decryption around the controlled provider/CLI boundary. The authenticated inventory also passed the selector privately. The native live provider trial and independent capture authentication remain main-only gates. Proceeding through the maintainer-approved protected handoff; after merge, run that fixed read-only trial once. This performs no provider apply or authoritative-state adoption, and #63 remains open until its trial is verified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Company Email routing must be brought under declarative ownership without changing its current delivery. Existing records and their ownership need to be preserved before that migration.
What
Adds an encrypted, read-only import proposal that requires the existing resources to remain unchanged. Preserves Email record values and metadata while excluding records owned by runtime controllers.
Part of #63