feat(delivery): deploy dev and prod from one signed bundle #30

Merged

gitchegumi merged 2 commits from kiyi/environment-promotion into main

2026-09-08 17:10:18 -05:00

kiyi commented

2026-09-08 15:00:25 -05:00

Member

The existing OpenBao credential wrapper and download/signature/rescan/gateway/rollout/HTTPS checks remain active. Add stage logging and archive digest output. Extend Actual’s permission contract for its isolated dev namespace, production gateway and dev Zarf metadata; platform RBAC must be applied before adopting this release. Refresh only the two existing location-sensitive mitigation fingerprints; controls and expiry are unchanged.

Validation: 102 library tests pass on Linux, including both environments selecting different packages from identical signed archive bytes, mismatched images/shared PVs/shared namespaces, tampered metadata and existing credential cleanup/negative permissions. This is mocked pipeline validation; native UDS builds and live deployment/promotion acceptance remain pending. Intended release v1.5.0.

Tracks Homelab/workflows#5, Homelab/workflows#19 and Homelab/platform#24.

A selected environment previously had to match a separately built archive. Add opt-in build-once promotion: .pipeline/promotion.json packages reviewed dev and prod manifests into separate Zarf packages inside one signed UDS archive. Deployment verifies the receipt, selects the signed profile and calls uds deploy --packages for that environment without rebuilding archive bytes. Both profiles require identical pinned images and separate namespaces, package names, endpoints and static PVs; direct host/NFS mounts are rejected. Legacy single-environment archives keep their mismatch rejection. The existing OpenBao credential wrapper and download/signature/rescan/gateway/rollout/HTTPS checks remain active. Add stage logging and archive digest output. Extend Actual’s permission contract for its isolated dev namespace, production gateway and dev Zarf metadata; platform RBAC must be applied before adopting this release. Refresh only the two existing location-sensitive mitigation fingerprints; controls and expiry are unchanged. Validation: 102 library tests pass on Linux, including both environments selecting different packages from identical signed archive bytes, mismatched images/shared PVs/shared namespaces, tampered metadata and existing credential cleanup/negative permissions. This is mocked pipeline validation; native UDS builds and live deployment/promotion acceptance remain pending. Intended release v1.5.0. Tracks Homelab/workflows#5, Homelab/workflows#19 and Homelab/platform#24.

kiyi added 1 commit

2026-09-08 15:00:25 -05:00

feat(delivery): deploy dev and prod from one signed bundle

Workflow acceptance / acceptance (pull_request) Successful in 1m9s

Details

Repository security / security-1 (pull_request) Failing after 1m18s

Details

Repository security / security (pull_request) Failing after 0s

Details

Library checks / tests (pull_request) Failing after 1m19s

Details

9907db5767

kiyi added 1 commit

2026-09-08 16:34:56 -05:00

fix(scan): expose safe scanner failure diagnostics

Workflow acceptance / acceptance (pull_request) Successful in 49s

Details

Repository security / security-1 (pull_request) Successful in 1m33s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 2m17s

Details

bfea4efdb4

portegumi approved these changes

2026-09-08 16:50:45 -05:00

portegumi left a comment

Approved: no blocking implementation findings in the reviewed build-once promotion changes.

Validation:

All 105 local library tests pass; scaffold checks pass; git diff --check is clean.
Independently exercised delivery.build with checksum-verified native UDS 0.35.1 and a small pinned BusyBox fixture. It created separate real dev/prod Zarf packages and one UDS bundle containing both, and completed receipt generation. The scanner was explicitly replaced with a controlled fixture for this packaging probe; this is native packaging evidence, not a scan/signature/deployment acceptance claim. No cluster operation was invoked.
The production deploy tests select distinct packages from identical archive bytes, preserve legacy environment mismatch rejection, and reject altered signed metadata. The pinned UDS CLI supports --packages.
Cross-checked the paired platform RBAC against all 20 required and seven forbidden authorization probes: no mismatches.
All four exact-head hosted status contexts pass. Downloaded security artifact 227 from run 403: passed=true, zero blockers and zero scanner errors, five mitigated findings. This self-scan uses released v1.4.3, so it is not runtime evidence for the new scanner-diagnostic code; that code is covered by local tests.
Confirmed adopted security release v1.4.3 exists and is non-draft.

Non-blocking follow-up: retain a build-path regression for multi-package generation; the committed promotion tests currently focus on preparation and mocked deployment rather than delivery.build.

Operational sequencing remains mandatory: approve/merge/apply the platform RBAC before adopting the new library in the app caller. My separate platform review requests wiring its new RBAC test into hosted CI. Real credential issuance, signed application build, dev/prod deployment and promotion acceptance remain separate owner-run work; none was performed here.

Approved: no blocking implementation findings in the reviewed build-once promotion changes. Validation: - All 105 local library tests pass; scaffold checks pass; git diff --check is clean. - Independently exercised delivery.build with checksum-verified native UDS 0.35.1 and a small pinned BusyBox fixture. It created separate real dev/prod Zarf packages and one UDS bundle containing both, and completed receipt generation. The scanner was explicitly replaced with a controlled fixture for this packaging probe; this is native packaging evidence, not a scan/signature/deployment acceptance claim. No cluster operation was invoked. - The production deploy tests select distinct packages from identical archive bytes, preserve legacy environment mismatch rejection, and reject altered signed metadata. The pinned UDS CLI supports --packages. - Cross-checked the paired platform RBAC against all 20 required and seven forbidden authorization probes: no mismatches. - All four exact-head hosted status contexts pass. Downloaded security artifact 227 from run 403: passed=true, zero blockers and zero scanner errors, five mitigated findings. This self-scan uses released v1.4.3, so it is not runtime evidence for the new scanner-diagnostic code; that code is covered by local tests. - Confirmed adopted security release v1.4.3 exists and is non-draft. Non-blocking follow-up: retain a build-path regression for multi-package generation; the committed promotion tests currently focus on preparation and mocked deployment rather than delivery.build. Operational sequencing remains mandatory: approve/merge/apply the platform RBAC before adopting the new library in the app caller. My separate platform review requests wiring its new RBAC test into hosted CI. Real credential issuance, signed application build, dev/prod deployment and promotion acceptance remain separate owner-run work; none was performed here.