ci(lint): run amtool check-config in CI (checksum-pinned amtool)

jfraeys commented

2026-10-13 16:57:31 -04:00

Owner

The Alertmanager config test (#128) validated routing everywhere but only ran amtool check-config where Docker exists; the ephemeral lint runners have none, so CI printed SKIP and never asked Alertmanager itself whether the rendered file is valid.

lint.yml installs amtool v0.34.1 from the prometheus/alertmanager release, SHA-256 verified (265b9d1e... matches the published sha256sums.txt and my own download), same pattern as sops in staging-validate. 0.34.1 is what production runs.
scripts/tests/test-alertmanager-config.sh: uses a local amtool when on PATH (url_file pointed at a real file in the work dir), else Docker, else SKIP.
docs/tool-versions.yml: new alertmanager_amtool entry (tier C, checksum) so the upstream survey tracks the pin and its regex must keep matching.
Verified by running the workflow's own install step (extracted from lint.yml) inside a plain python:3.11 container with no Docker: checksum OK, amtool 0.34.1, and the test passes 10/10 on the local-amtool path. Also still passes with the Docker path locally.

🤖 Generated with Claude Code

The Alertmanager config test (#128) validated routing everywhere but only ran amtool check-config where Docker exists; the ephemeral lint runners have none, so CI printed SKIP and never asked Alertmanager itself whether the rendered file is valid. - lint.yml installs amtool v0.34.1 from the prometheus/alertmanager release, SHA-256 verified (265b9d1e... matches the published sha256sums.txt and my own download), same pattern as sops in staging-validate. 0.34.1 is what production runs. - scripts/tests/test-alertmanager-config.sh: uses a local amtool when on PATH (url_file pointed at a real file in the work dir), else Docker, else SKIP. - docs/tool-versions.yml: new alertmanager_amtool entry (tier C, checksum) so the upstream survey tracks the pin and its regex must keep matching. - Verified by running the workflow's own install step (extracted from lint.yml) inside a plain python:3.11 container with no Docker: checksum OK, amtool 0.34.1, and the test passes 10/10 on the local-amtool path. Also still passes with the Docker path locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-13 16:57:32 -04:00

ci(lint): run amtool check-config in CI with a checksum-pinned amtool

Lint / lint (pull_request) Successful in 1m30s

Details

Secret scan / scan (pull_request) Successful in 12s

Details

59ce6cc4b5

The lint runners have no Docker, so the Alertmanager config test skipped its amtool step there. The job now installs a pinned
amtool (v0.34.1, SHA-256 checked, registered in docs/tool-versions.yml); the test uses a local amtool, else Docker, else skips.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys referenced this pull request

2026-10-13 17:01:41 -04:00

Infra backlog: capacity, CI verification, alerts, older loose ends #121

~~jfraeys referenced this pull request 2026-10-13 17:08:37 -04:00~~

Roadmap: remaining infra and secrets work (tracker) #122

jfraeys referenced this pull request

2026-10-13 17:12:13 -04:00

Next: immediate steps (merge, deploy, verify) after the 2026-10-13 session #116

jfraeys referenced this pull request

2026-10-13 17:18:01 -04:00

ci(lint): pinned promtool, sops and age so the alert-rule and key-isolation tests run in CI (stacked on #131) #132

jfraeys merged commit bc1ec7ac4b into main