Repository navigation
Tags
Tags
chore(deps): update golang:1.27.3 docker digest to 9048d5e (kimdre#2115) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `f20d83a` → `9048d5e` | --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At 10:00 PM through 11:59 PM and 12:00 AM through 07:59 AM (`* 22-23,0-7 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kimdre/doco-cd). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update module github.com/infisical/go-sdk to v0.9.0 (kimdr… …e#2093) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/infisical/go-sdk](https://redirect.github.com/infisical/go-sdk) | `v0.8.0` → `v0.9.0` |  |  | --- ### Release Notes <details> <summary>infisical/go-sdk (github.com/infisical/go-sdk)</summary> ### [`v0.9.0`](https://redirect.github.com/Infisical/go-sdk/releases/tag/v0.9.0) [Compare Source](https://redirect.github.com/infisical/go-sdk/compare/v0.8.0...v0.9.0) #### What's Changed - fix: require Go 1.26.10 to reject compromised eMudhra intermediates by [@​varonix0](https://redirect.github.com/varonix0) in [Infisical#78](https://redirect.github.com/Infisical/go-sdk/pull/78) **Full Changelog**: <Infisical/go-sdk@v0.8.0...v0.9.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At 10:00 PM through 11:59 PM and 12:00 AM through 07:59 AM (`* 22-23,0-7 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kimdre/doco-cd). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(commitstatus): retain targets in run-level reports (kimdre#2074) ## Summary Early source/configuration failures and skipped webhook runs now report under `doco-cd/<target>/deploy` when a configuration target is set. This keeps reports for different targets separate on the same commit. Existing stack-specific names and untargeted run labels remain unchanged. Updates the related documentation and regression coverage for legacy statuses, native GitHub Checks, and webhook/poll reporting. Fixes kimdre#2069.
fix(commitstatus): preserve full errors in GitHub check summaries (ki… …mdre#2067) ## Summary Failure messages were truncated to 140 characters before reporting, then reused as both the GitHub check title and summary. This discarded the full error even though check summaries support longer messages. - Keep short check titles and preserve full, multiline errors as literal text in check summaries. - Use shared failure-status construction for deployment, admission, early source/configuration, timeout, and self-update failures. - Preserve legacy commit-status payloads, timeout classification, reporting targets, and the existing check-summary size limit.
refactor(config): remove deprecated destroy.remove_dir (kimdre#2037) ## Summary - Remove `destroy.remove_dir` from the deployment config and generated schema. - Remove its ignored-warning path and update docs and shared-source coverage. ## Validation - `make fmt` - `go test -tags nobitwarden ./cmd/deploy-schema ./internal/config/deploy ./internal/stages` - `go test -tags e2e -run '^$' ./test/e2e/...` (compile only)
test(e2e): consolidate redundant scenarios and CI coverage (kimdre#2012) Merge related deployment, OCI, appended-document, scheduled-job, and self-update lifecycle checks into fewer harnesses. Add fast config, artifact decryption, and changelog regressions. Select standalone and Swarm CI coverage explicitly to avoid duplicate Compose-only runs while preserving recovery, crash-window, migration, and mixed-context coverage. Reduce scenario harness starts across the CI matrix from 57 to 38 and document the coverage boundaries.
fix(git): recover from reference namespace collisions (kimdre#2007) ## Summary - Repair confirmed stale Git refs and blocking empty directories after a typed reference namespace collision, then retry the same fetch once under the repository lock. - Prevent failed recovery from falling through to tag/broad-fetch fallback or bare-mirror re-cloning. - Add regression, safety, locking, and GitStore coverage, including relative-path repositories. Closes kimdre#2006 ## Validation - `make fmt` - Focused race tests for `internal/git` and `internal/source/store` - Namespace collision tests repeated five times with the race detector - `go build -tags nobitwarden ./...` - `go vet -tags nobitwarden ./internal/git ./internal/source/store` - `git diff --check`
feat(encryption): reuse plaintext of unchanged sops files across arti… …facts (kimdre#1933) ## Summary - Publish records sops format + sha256 of ciphertext + sha256 of plaintext per decrypted file in `artifacts/<revision>.decrypted.json`, sibling of the artifact alike `<revision>.lock`. Written atomically, only by the publish winner. - Next publish copies plaintext from an earlier artifact when format and ciphertext are identical, candidates newest first. Key service is called only for changed files. - Plaintext is reused only if its content still hashes to the record, otherwise decrypted again. No trusted copy = normal decryption. - GC removes the record together with the artifact. - No new config. Works for git and OCI stores, independent of filesystem. - Wiki: `Advanced/Encryption.md`, layout in `Reference/Artifact-Storage.md`. ## Why With a cloud key service (AWS KMS for us) every encrypted file is a billed request on every new revision, on every host, even when no secret changed. Most commits are image bumps, so nearly all of it is waste. This makes cost proportional to changed secrets instead of revisions. First version of this PR was `ARTIFACT_DECRYPT_PATHS` to scope decryption per host. Dropped it, hand managed scope per host is bad UX and wrong pattern is silent. ## Notes - Record is keyed by ciphertext hash, so works the same for git and OCI, no need for blob hashes or reflinks. - Does not reduce which files a host holds in plaintext, only how often they are decrypted. That part stays for option 3 / sparse export. - Revoking a key does not stop reuse of unchanged files, documented in the wiki. Re-encrypt to force the key again. ## Validation - `make fmt` - `golangci-lint run ./internal/encryption/... ./internal/source/...` - `go test -race ./internal/source/... ./internal/encryption/ ./internal/gc/ ./internal/migration/` - `zensical build --strict` - e2e not run --------- Co-authored-by: Kim Oliver Drechsel <kim@drechsel.xyz>
fix: migrate legacy Git stacks on recreate (kimdre#1993) - Migrate legacy Git deployments to an artifact of their exact deployed commit during recreate. - Serialize lifecycle actions with deployments and improve 409 diagnostics. - Add regression coverage and document the legacy migration behavior. Fixes kimdre#1971 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PreviousNext