fix(ci): staging parity: plain prod image, explicit role skip, documented differences #74

Merged

jfraeys merged 1 commit from jfraeys/fix/staging-skip-ci-provisioner into main

2026-10-12 20:24:50 -04:00

jfraeys commented

2026-10-12 19:03:36 -04:00

Owner

Run 499 (338 tasks, CrowdSec now passes after #73) stopped at ci_ephemeral_provisioner : Fail if required secrets are missing: that role reads CI_EPHEMERAL_TAILSCALE_AUTHKEY from the environment, and it can't work on an isolated staging node anyway (it clones jfraeys/infra from the node's own empty Forgejo and runs tofu against the production state bucket).

Changes, with parity as the goal:

Explicit, visible skip of ci_ephemeral_provisioner,ci_ephemeral_wakeup for the services check (SERVICES_CHECK_SKIP_TAGS), logged as [PARITY]. This is a deviation from production and is listed as such.
Plain production image for staging validation. The compute module booted staging from a custom prebaked-staging image whenever one existed (and silently ignored the workflow's image input), unlike production which boots plain linode/debian12. New use_prebaked_image variable (default true, so other staging users are unchanged); the validation env sets it false. Production plan is unchanged (verified: only the two pre-existing vpn records).
docs/staging-parity.md: what is the same, and every known difference with its reason, including a known gap: 7 validate-hardening checks are skipped as 'production only' because they run before the deploy.

Expect staging runs to be slower (full install path instead of a prebaked image). tofu validate/fmt pass. 🤖 Generated with Claude Code

Run 499 (338 tasks, CrowdSec now passes after #73) stopped at `ci_ephemeral_provisioner : Fail if required secrets are missing`: that role reads CI_EPHEMERAL_TAILSCALE_AUTHKEY from the environment, and it can't work on an isolated staging node anyway (it clones jfraeys/infra from the node's own empty Forgejo and runs tofu against the production state bucket). Changes, with parity as the goal: - **Explicit, visible skip** of `ci_ephemeral_provisioner,ci_ephemeral_wakeup` for the services check (`SERVICES_CHECK_SKIP_TAGS`), logged as `[PARITY]`. This is a deviation from production and is listed as such. - **Plain production image for staging validation.** The compute module booted staging from a custom `prebaked-staging` image whenever one existed (and silently ignored the workflow's `image` input), unlike production which boots plain `linode/debian12`. New `use_prebaked_image` variable (default true, so other staging users are unchanged); the validation env sets it false. Production plan is unchanged (verified: only the two pre-existing vpn records). - **docs/staging-parity.md**: what is the same, and every known difference with its reason, including a known gap: 7 `validate-hardening` checks are skipped as 'production only' because they run before the deploy. Expect staging runs to be slower (full install path instead of a prebaked image). tofu validate/fmt pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-12 19:03:36 -04:00

fix(ci): staging parity: plain prod image, explicit role skip, documented differences

Lint / lint (pull_request) Successful in 1m41s

Details

Secret scan / scan (pull_request) Successful in 14s

Details

b148fa0634

Skip the CI-provisioner roles explicitly (they cannot run on an isolated node), boot staging from the same
plain image as production (use_prebaked_image=false in the validation env), and document every known
difference in docs/staging-parity.md.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit c16bfaa480 into main

2026-10-12 20:24:50 -04:00

jfraeys referenced this pull request from a commit

2026-10-12 20:24:51 -04:00

Merge pull request 'fix(ci): staging parity: plain prod image, explicit role skip, documented differences' (#74) from jfraeys/fix/staging-skip-ci-provisioner into main

jfraeys referenced this pull request

2026-10-12 20:40:41 -04:00

fix(ansible): load vault vars under always so --skip-tags cannot drop them #75