Repository navigation
Tags
Tags
fix(compose): honor force_recreate for the whole project (#2157) `force_recreate: true` bypasses the pre-deploy skip check, but the Compose executor still selects `RecreateDiverged` when there are no detected file changes. Deployments can report success while unchanged containers retain their IDs and old ownership metadata. Give the explicit flag precedence over service-scoped changes and select forced recreation with an empty service list, so the whole project is recreated. Ordinary deployments retain their existing recreation behavior. Closes #2156. ### Validation - Added a Docker integration test through `DeployStack` that compares real container IDs for four cases: unchanged/scoped deployments, each with and without explicit force. - Before the fix, both force cases failed: unchanged containers stayed in place, and scoped changes limited recreation despite explicit force. The two default-behavior cases passed. - After the fix, all four cases passed: `CGO_ENABLED=0 go test -tags nobitwarden ./internal/docker -run '^TestDeployStackComposeForceRecreate$' -count=1 -timeout 5m`. - `golangci-lint run --build-tags nobitwarden --timeout 5m ./internal/docker/...` passed with zero issues; `git diff --check` passed. - Broader local run: 62 packages passed, one had no tests, and the Docker package had four existing failures listed below. All four were reproduced after reverting the implementation to upstream main. The run used `nobitwarden`; `internal/git`, `internal/git/ssh`, and SSH/KnownHosts-named tests were excluded to honor local restrictions against SSH operations. Existing local failures (macOS/OrbStack): - `TestRecreateProjectManagedLegacyCheckout`: cannot locate migrated artifact. - `TestVerifyDockerHostConnectionContextCancellation/Unix`: Unix socket path fails to bind (`invalid argument`). - `TestLoadComposeScheduledDeployConfigDiscoversDeploymentReference`: scheduled deployment not found. - `TestLoadComposeScheduledDeployConfigUsesRecordedSnapshots`: missing `stacks` directory / scheduled deployment not found. The checkout is nested beneath another repository with its own root deploy config, which may explain the discovery failures. No changes to these unrelated tests are included. Linux/Swarm and Bitwarden-enabled CI have not been run locally. --------- Co-authored-by: Kim Oliver Drechsel <kim@drechsel.xyz>
fix(encryption): reduce warnings for unavailable SOPS keys (#2155) ## Summary - Log unavailable SOPS keys at debug level during speculative artifact decryption, avoiding warnings for secrets belonging to other environments. - Keep warnings for integrity and other decryption failures. Required encrypted files still fail deployment with an error naming the file. - Include skipped and failed file counts in the debug summary and document the logging behavior. - Add regression coverage for wrong age keys, integrity failures, default log-level filtering, summary counts, and ciphertext preservation. Isolate missing-key tests from ambient age key sources. ## Validation - `make fmt` completed with 0 issues. - `WEBHOOK_SECRET=test_Secret1 API_SECRET=test_apiSecret1 CGO_ENABLED=0 go test -count=1 -tags nobitwarden ./internal/encryption ./internal/source/store` passed. Fixes #2154
chore(deps): update docker:29-dind docker digest to 08a9801 (#2153) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [docker](https://hub.docker.com/_/docker) ([source](https://redirect.github.com/docker-library/docker)) | digest | `d035bd3` → `08a9801` | --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At 10:00 PM through 11:59 PM and 12:00 AM through 07:59 AM (`* 22-23,0-7 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kimdre/doco-cd). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(secrets): issue pki-role certificates only when a deployment runs (… …#2130) Pre-deploy resolves all external secrets before checking for changes, so every poll issues a new certificate for every `pki-role:` reference, even when nothing deploys. The skip checks never use those values (`pkiRoleNormMap` swaps them for the reference), and rotation has its own watcher, so they're just thrown away. With 44 `pki-role:` refs and a 5-minute poll, I see ~528 `pki/issue` requests an hour in OpenBao's audit log while nothing deploys. This puts the reference in as a placeholder during pre-deploy (same value `pkiRoleNormMap` already uses, so hashes don't change) and issues the real certificates once the deployment passes mutation admission, then reloads the project. Skipped, paused, out-of-window, and suppressed-retry runs issue nothing, and the deploy stage refuses to run if any placeholders are left. Deferral is skipped with `INTERPOLATE_RESOLVED_SECRETS`, or when a ref already uses a `_KEY`/`_FULL` name, so those behave as before. One side effect: a `pki-role:` ref that can't be issued now fails on the next deploy instead of on every poll. --------- Co-authored-by: Kim Oliver Drechsel <kim@drechsel.xyz>
v0.131.0
chore(deps): update golang:1.27.3 docker digest to 9048d5e (#2115) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [golang](https://hub.docker.com/_/golang) ([source](https://redirect.github.com/docker-library/golang)) | stage | digest | `f20d83a` → `9048d5e` | --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At 10:00 PM through 11:59 PM and 12:00 AM through 07:59 AM (`* 22-23,0-7 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kimdre/doco-cd). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE4NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(deps): update module github.com/infisical/go-sdk to v0.9.0 (#2093) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/infisical/go-sdk](https://redirect.github.com/infisical/go-sdk) | `v0.8.0` → `v0.9.0` |  |  | --- ### Release Notes <details> <summary>infisical/go-sdk (github.com/infisical/go-sdk)</summary> ### [`v0.9.0`](https://redirect.github.com/Infisical/go-sdk/releases/tag/v0.9.0) [Compar 8000 e Source](https://redirect.github.com/infisical/go-sdk/compare/v0.8.0...v0.9.0) #### What's Changed - fix: require Go 1.26.10 to reject compromised eMudhra intermediates by [@​varonix0](https://redirect.github.com/varonix0) in [Infisical#78](https://redirect.github.com/Infisical/go-sdk/pull/78) **Full Changelog**: <Infisical/go-sdk@v0.8.0...v0.9.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At 10:00 PM through 11:59 PM and 12:00 AM through 07:59 AM (`* 22-23,0-7 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kimdre/doco-cd). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzEuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(commitstatus): retain targets in run-level reports (#2074) ## Summary Early source/configuration failures and skipped webhook runs now report under `doco-cd/<target>/deploy` when a configuration target is set. This keeps reports for different targets separate on the same commit. Existing stack-specific names and untargeted run labels remain unchanged. Updates the related documentation and regression coverage for legacy statuses, native GitHub Checks, and webhook/poll reporting. Fixes #2069.
fix(commitstatus): preserve full errors in GitHub check summaries (#2067 ) ## Summary Failure messages were truncated to 140 characters before reporting, then reused as both the GitHub check title and summary. This discarded the full error even though check summaries support longer messages. - Keep short check titles and preserve full, multiline errors as literal text in check summaries. - Use shared failure-status construction for deployment, admission, early source/configuration, timeout, and self-update failures. - Preserve legacy commit-status payloads, timeout classification, reporting targets, and the existing check-summary size limit.
refactor(config): remove deprecated destroy.remove_dir (#2037) ## Summary - Remove `destroy.remove_dir` from the deployment config and generated schema. - Remove its ignored-warning path and update docs and shared-source coverage. ## Validation - `make fmt` - `go test -tags nobitwarden ./cmd/deploy-schema ./internal/config/deploy ./internal/stages` - `go test -tags e2e -run '^$' ./test/e2e/...` (compile only)
PreviousNext