Provision application storage from reviewed per-stack declarations #89
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!89
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/reusable-terraform-contracts"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The delivery engine currently embeds Gitchistry dev resource names and permissions, which prevents another application or production stack from using it. This change loads a reviewed per-stack catalog from the owning repository: bucket name, IAM policy, runtime fields, credential ownership, state key, scoped OpenBao paths and acceptance checks are explicit inputs. Existing v1 callers remain compatible.
Managed credentials generate and preserve their secret in OpenBao; existing credentials preserve the complete runtime record without taking ownership of its IAM key. Plans still reject unapproved resources, deletion/replacement, persisted secret payloads and policy changes outside the declaration. Protected plan approval, encrypted remote state, locking, short-lived credentials and recovery evidence remain in place.
Companion implementation: terraform-modules branch, tracked by terraform-modules#1. After this merges, publish the next library release and advance all five Terraform caller pins together. They remain on published v1.33.0 during review; the new roots fail closed until the v2 engine supplies their required contract version.
Validation: 64 targeted delivery, catalog, credential-boundary and workflow tests passed; both actual dev/prod declarations load successfully; 26 workflow YAML files parse across the two repositories. Existing workflow/check names and job IDs are unchanged. No live infrastructure was provisioned.
Commit:
c47773029a.Companion PR is now terraform-modules#3. It includes the reusable composition, explicit bucket/access-policy declarations, dev/prod roots and a generic application caller. It remains WIP until this library change is merged/published and all five caller pins are updated together.
Addressed run 553. Gitleaks generic-api-key matched the synthetic public object name
published/acceptance/fixturein the read-only catalog test, rather than an authentication credential. All-ref history also carried that match into PRs #87 and #90.9ba2c62425 adds an exact source-literal review for that rule/path/value, expiring 2026-12-01, with immutable fixture provenance. The normalizer verifies the original redacted scanner span privately; changed values, paths, rules, malformed/decoded spans and genuine secrets remain blocking. Both complete history and working-tree scans remain enabled. 36ad6e5412 makes the object-path construction explicit in the test; the historical finding is still reviewed.
Validation: 76 affected local tests passed, including native pinned Gitleaks 8.30.1 history/tree fixtures, line movement, adjacent changed values and sanitized reporting. The six catalog tests also passed after the fixture edit. No workflow files, job IDs or status-check names changed. The same shared fix is published on #87 and #90 so each can rerun independently. Fresh hosted checks were triggered by the push; their results are pending.
Reviewed the storage-contract changes and the paired Terraform proposal as source preparation at
36ad6e5. The focused catalog/delivery suite passed 27/27 locally in an isolated venv; the policy rejects cross-bucket wildcard/Principal grants and binds explicit state, role and credential paths. The exact public read-only S3 fixture is reviewed under a narrow generic-api-key false-positive selector in this branch, not a blanket secret bypass. Sequencing note: workflows #92 currently fails its all-ref source-security run on that fixture because #92 still uses main's mitigation policy. Land/verify the reviewed #89 policy first, then rerun #92 checks before merging hooks. Terraform-modules #3 still pins v1.33.0, is WIP/non-mergeable, and must advance its five caller/library refs to an actual published v2-capable release before applying. No live storage or Harbor acceptance was exercised.Correction to my review above: #87 also carries the same narrow public-object fixture review and currently has green exact-head security checks. The dependency for #92 is that an approved version of this exact mitigation reach
mainand #92 security rerun; it does not specifically require #89 to merge first. Neither change should bypass the all-ref history scan.Reviewed exact head
81923c3after current main/v1.34.0 merged. The five PR-owned files are unchanged since my earlier review at36ad6e5; the head-only change is reconciliation with main. Independently ran 39 catalog/Terraform/Forgejo-contract tests under Python 3.13, loaded both actual dev/prod v2 catalogs from terraform-modules #3, and checked the reusable Terraform invocation supplies the required environment. All seven hosted contexts are success at this SHA. Repository-security artifact 5304 passes with zero blocking/scanner errors (source scope, no selected images); acceptance artifact 5314 passes 12 cases at this SHA; compatibility startup artifacts show successful legacy and image modes. APPROVED for the reviewed library source only. Do not publish a new library tag until the separately requested workflow #90 is reviewed/green and included in main; Terraform-modules #3 remains draft and must advance caller pins to the resulting immutable release before using v2. No live provisioning or cluster acceptance was performed.