Promote to production #138

Merged

jfraeys merged 4 commits from main into prod

2026-10-13 19:26:54 -04:00

jfraeys commented

2026-10-13 19:21:08 -04:00

Owner

Promotion: staging passed. Run `scripts/plan-prod.sh` locally before merging

Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run scripts/promote-prod.sh (or scripts/deploy-services.sh --tags ... --limit services for an Ansible-only change); both refuse any other commit.

Staging validation: passed on commit a1250c60e5 (this run)
Production drift check: clean

Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values)


PLAY [Deploy the Docker-based services stack] **********************************
skipping: no hosts matched

PLAY RECAP *********************************************************************

### Promotion: staging passed. Run `scripts/plan-prod.sh` locally before merging Merging this PR is the approval record; it deploys nothing. Then check out the validated commit and run `scripts/promote-prod.sh` (or `scripts/deploy-services.sh --tags ... --limit services` for an Ansible-only change); both refuse any other commit. **Staging validation:** passed on commit a1250c60e508fe780533295dc52fa5895204ae75 (this run) **Production drift check:** clean ### Ansible preview (staging clone, synthetic secrets — approximate, not exact prod values) ``` PLAY [Deploy the Docker-based services stack] ********************************** skipping: no hosts matched PLAY RECAP ********************************************************************* ```

jfraeys added 4 commits

2026-10-13 19:21:09 -04:00

fix(hardening): the trivy report dropped exactly the images that failed on CRITICAL findings

Lint / lint (pull_request) Successful in 2m17s

Details

Secret scan / scan (pull_request) Successful in 13s

Details

9b80011507

scan_image returned 1 before appending, so only clean images reached the saved report (2026-10-11: 6 of 15 images, 0 CRITICAL, while
9 images / 119 CRITICAL failed the run) and trivy convert could not read the concatenated file anyway. Keep each image's JSON before
judging it, write one file per image, and print the top CRITICAL CVEs (with fixed versions) into the journal.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'fix(hardening): keep the images that fail on CRITICAL findings in the trivy report' (#136 ) from jfraeys/fix/trivy-report-keeps-failures into main

Staging Validation / validate (push) Failing after 16m8s

Details

Staging Validation / promote (push) Has been skipped

Details

4e70c3be14

fix(staging): retry the TCP connectivity probes that expect an open port

Lint / lint (pull_request) Successful in 1m51s

Details

Secret scan / scan (pull_request) Successful in 14s

Details

299d00f858

Run 604 (UI #413) failed on one sample of tailnet web -> services:25 ('filtered') right after the services deploy, while the HTTPS and
LLDAP probes just below already retry 6 x 10 s. A container still starting leaves its published port silently dropped. Retry the
open-expecting probes the same way; closed-expecting probes are not retried.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'fix(staging): retry the TCP connectivity probes that expect an open port' (#137 ) from jfraeys/fix/connectivity-probe-retries into main

Staging Validation / validate (push) Successful in 13m52s

Details

Staging Validation / promote (push) Successful in 9s

Details

Lint / lint (pull_request) Successful in 1m46s

Details

Secret scan / scan (pull_request) Successful in 13s

Details

a1250c60e5

jfraeys referenced this pull request

2026-10-13 19:21:50 -04:00