feat(m13): webhook HMAC, secrets/config injection, reliability, promote#11
Merged
Merged
Conversation
Add four production-hardening foundations aligned with Milestone 13: 1. GitHub webhook HMAC verification (X-Hub-Signature-256) with env or K8s Secret resolution; unsigned allowed only when no secret is set. 2. Stack secrets/config schema + deploy-full-stack injection and pre-deploy Secret validation; GET /api/apps/<app>/injection-status. 3. Pipeline reliability: timeouts and max-retries on PipelineRuns, retries on compile/containerize, transient failure classifier and per-tool resource profiles in tekton-dag-common. 4. stack-promote pipeline/task, registries.yaml, and POST /api/run mode=promote with optional approval gate. Includes unit tests for new helpers, builders, and routes. Co-authored-by: John Menke <jmjava@gmail.com>
Add DO-THIS-LOCAL.md for cluster/E2E follow-up when agents only ran --local-only. Expand offline coverage: JSON Schema fixture validation, Tekton YAML structure asserts (retries/promote/validate-secrets), Newman promote + injection-status requests, and extra route tests for approval/reliability forwarding. Co-authored-by: John Menke <jmjava@gmail.com>
Iteration fixes from review: - injection-status uses find_app so secrets/config are not dropped - promote splits comma-separated apps; mounts dockerconfig for creds - registries.yaml resolves target_registry/credentials by environment - k8s list Secret/ConfigMap errors propagate (503) instead of false missings - deploy-full-stack validates ConfigMaps; sanitizes volume names - Helm + raw Deployment get PIPELINE_TIMEOUT/MAX_RETRIES/webhook/registries - Management GUI BFF exposes /api/teams/<team>/apps/<app>/injection-status - Clarify max-retries is audit-only (Tekton retries stay fixed at 2) Co-authored-by: John Menke <jmjava@gmail.com>
Polish pass: - Webhook: named Secret missing → 503; unavailable kubeconfig still allows local tests; status API for secret resolution - Promote: resolve-stack-inline emits apps-csv so changed-app-only runs work - Helm: project per-team ConfigMaps into /teams/<name>/team.yaml - Docker: require staged tekton-dag-common; GUI publish script + Dockerfile - Volume names: disambiguate collisions after truncation - Tests: registries promote resolution, real StackResolver injection-status, webhook missing secret, GUI allow-list, sanitize/collision, apps-csv wiring Co-authored-by: John Menke <jmjava@gmail.com>
Add What's new table, mark M13 Partial, document promote pipeline, and list remaining production-hardening work. Co-authored-by: John Menke <jmjava@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Milestone 13 production-hardening foundations with three polish iterations: features, bugfixes, then more tests + rough-edge cleanup.
Latest polish
apps-csvresult sochanged-app-only PipelineRuns promote correctlytekton-dag-teams-<name>→/teams/<name>/team.yamltekton-dag-common(orchestrator + new GUI publish script)StackResolverinjection-status, webhook missing secret, GUI allow-list, sanitize/collision, apps-csv wiringTest counts (local regression exit 0)
Local cluster follow-up
See DO-THIS-LOCAL.md.