Allow the reviewed Terraform runner correction in stable-v1 #104

Merged

gitchegumi merged 1 commit from kiyi/channel-terraform-runner-compatibility into main

2026-10-15 14:02:36 -05:00

kiyi commented

2026-10-15 13:49:42 -05:00

Member

Run 787 stopped promotion of v1.40.0 because Terraform’s provision job moved from the retired deploy-k8s label to the owner-accepted deploy pool. Compatibility failed before any snapshot/channel write; stable-v1 still selects v1.38.0.

Allow only that forward transition for terraform.yml/provision. Keep workflow/job names, caller contracts and all other runner changes protected; reject a return to the retired label. No workflow/status names or authorization settings change. The runbook includes the recovery procedure.

Validation: 32 local channel/Git/Forgejo/Terraform contract tests passed, including both new regression tests and nine rejection cases. The actual v1.38.0 → v1.40.0 interface comparison passes and all 27 released reusable workflows compile. Two existing shell-execution tests failed locally because Windows Bash did not receive their fixture environment; the unchanged Linux CI suite remains required. Staged Gitleaks 8.30.1 and diff checks passed. No hosted promotion/deployment was performed.

After merge and successful protected-main checks, start a fresh Promote workflow channel dispatch from main, version v1.40.0, rollback reason empty. The verifier runs from current main, so the existing immutable release can be promoted without publishing another release. Review canary, promotion evidence and stable smoke before fresh consumer runs.

Related to #93.

Run [787](https://git.gitchegumi.com/Homelab/workflows/actions/runs/787/jobs/0/attempt/1) stopped promotion of v1.40.0 because Terraform’s `provision` job moved from the retired `deploy-k8s` label to the owner-accepted `deploy` pool. Compatibility failed before any snapshot/channel write; stable-v1 still selects v1.38.0. Allow only that forward transition for `terraform.yml/provision`. Keep workflow/job names, caller contracts and all other runner changes protected; reject a return to the retired label. No workflow/status names or authorization settings change. The runbook includes the recovery procedure. Validation: 32 local channel/Git/Forgejo/Terraform contract tests passed, including both new regression tests and nine rejection cases. The actual v1.38.0 → v1.40.0 interface comparison passes and all 27 released reusable workflows compile. Two existing shell-execution tests failed locally because Windows Bash did not receive their fixture environment; the unchanged Linux CI suite remains required. Staged Gitleaks 8.30.1 and diff checks passed. No hosted promotion/deployment was performed. After merge and successful protected-main checks, start a **fresh Promote workflow channel** dispatch from `main`, version **v1.40.0**, rollback reason empty. The verifier runs from current main, so the existing immutable release can be promoted without publishing another release. Review canary, promotion evidence and stable smoke before fresh consumer runs. Related to #93.

kiyi added 1 commit

2026-10-15 13:49:42 -05:00

Allow the reviewed Terraform runner correction in stable-v1

Workflow acceptance / acceptance (pull_request) Successful in 1m37s

Details

Repository security / security-1 (pull_request) Successful in 7m21s

Details

Library checks / tests (pull_request) Successful in 10m35s

Details

3b7006213b

portegumi approved these changes

2026-10-15 13:51:16 -05:00

portegumi left a comment

Reviewed exact head 3b7006213b. The compatibility exception is narrowly scoped to terraform.yml/provision changing runs-on from deploy-k8s to deploy; the existing workflow/job-name, caller-input/output and other runner-role checks remain in force. The new tests exercise the accepted transition, reverse transition and nine rejected contract variations; the runbook documents fresh-dispatch recovery. This changes promotion compatibility verification, not Terraform execution manifests, UDS resources, routing or deployment policy. Source review approved; this does not validate a promotion or authorize merge. Workflow acceptance, Repository security and Library checks are still pending at this head; the unchanged Linux suite and protected-main checks remain separate gates. No deployment or tag promotion was performed by this review.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head 3b7006213ba3e77f5103f6dfa0d70cb1fccbcded. The compatibility exception is narrowly scoped to terraform.yml/provision changing runs-on from deploy-k8s to deploy; the existing workflow/job-name, caller-input/output and other runner-role checks remain in force. The new tests exercise the accepted transition, reverse transition and nine rejected contract variations; the runbook documents fresh-dispatch recovery. This changes promotion compatibility verification, not Terraform execution manifests, UDS resources, routing or deployment policy. Source review approved; this does not validate a promotion or authorize merge. Workflow acceptance, Repository security and Library checks are still pending at this head; the unchanged Linux suite and protected-main checks remain separate gates. No deployment or tag promotion was performed by this review. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.