jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

docs: every approval step says ./infra approve; every vault change includes it #166

Merged
jfraeys merged 1 commit from jfraeys/docs/approve-everywhere into main 2026-10-14 19:03:47 -04:00
Conversation 0 Commits 1 Files changed 12 +26 -24
jfraeys commented 2026-10-14 18:37:28 -04:00
Owner
Copy link

Audit of instructions after today's changes (#151 vault PRs, #154/#164 ./infra approve, #156 layout, #157 bare Bitwarden token, #163 forgejo/headscale tags). Checked repo-wide: no stale script paths, no doc that runs rotate-secret.sh directly, no reference to the retired rotate playbook. Fixed what still described the old flow:

  • Approval step said "merge the promotion PR": the promotion PR body CI writes (now: approve with ./infra approve, then git pull and ./infra deploy), the workflow comment, the gate's and promote-prod.sh's refusal messages, and deployment.md's troubleshooting row.
  • Rotation next steps without the approval (the deploy would be refused): regenerate-ci-ephemeral-ssh-key.sh, rotate-ovh-s3-credentials.sh, vault-pr.py (messages and PR body).
  • Hand-made vault changes with no PR or approval: mail-pipeline-failure.md (relay password) and roles/alertmanager/CLAUDE.md (ntfy topic) now use vault-pr.py, ./infra approve, git pull, deploy.
  • README rotation pointers now ./infra rotate with the full sequence; the manifest's comments now ./infra rotate instead of manage secret rotate; verify-vaultwarden-token.sh now names the Bitwarden item vaultwarden-admin-token-plain (bare token) and the rotate command.

Touches .forgejo/workflows/staging-validate.yml (the PR body text), so merging starts a staging run; the passed on commit ${{ github.sha }} line the gate reads is unchanged. Checked: yamllint, bash -n, py_compile, test-promotion, test-vault-pr, test-approve-promotion, test-infra-cli, test-rotation-lock.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

Audit of instructions after today's changes (#151 vault PRs, #154/#164 `./infra approve`, #156 layout, #157 bare Bitwarden token, #163 forgejo/headscale tags). Checked repo-wide: no stale script paths, no doc that runs `rotate-secret.sh` directly, no reference to the retired rotate playbook. Fixed what still described the old flow: - **Approval step** said "merge the promotion PR": the promotion PR body CI writes (now: approve with `./infra approve`, then `git pull` and `./infra deploy`), the workflow comment, the gate's and `promote-prod.sh`'s refusal messages, and `deployment.md`'s troubleshooting row. - **Rotation next steps without the approval** (the deploy would be refused): `regenerate-ci-ephemeral-ssh-key.sh`, `rotate-ovh-s3-credentials.sh`, `vault-pr.py` (messages and PR body). - **Hand-made vault changes** with no PR or approval: `mail-pipeline-failure.md` (relay password) and `roles/alertmanager/CLAUDE.md` (ntfy topic) now use `vault-pr.py`, `./infra approve`, `git pull`, deploy. - **README** rotation pointers now `./infra rotate` with the full sequence; the manifest's comments now `./infra rotate` instead of `manage secret rotate`; `verify-vaultwarden-token.sh` now names the Bitwarden item `vaultwarden-admin-token-plain` (bare token) and the rotate command. Touches `.forgejo/workflows/staging-validate.yml` (the PR body text), so merging starts a staging run; the `passed on commit ${{ github.sha }}` line the gate reads is unchanged. Checked: yamllint, `bash -n`, py_compile, test-promotion, test-vault-pr, test-approve-promotion, test-infra-cli, test-rotation-lock. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
docs: every approval step says ./infra approve; every vault change includes it
All checks were successful
Lint / lint (pull_request) Successful in 1m50s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
da3af87352
 
After #154 and #164, approval is `./infra approve` (it also opens the promotion
PR for a vault/docs-only change), but several places still described the old
flow:
- the promotion PR body written by CI and the workflow comment: "run plan-prod,
  then merge"; the gate's and promote-prod's refusals: "merge the promotion PR";
  deployment.md's troubleshooting row.
- regenerate-ci-ephemeral-ssh-key.sh, rotate-ovh-s3-credentials.sh and
  vault-pr.py printed "merge, git pull, deploy" without the approval, so that
  deploy would be refused.
- mail-pipeline-failure.md (relay password) and the alertmanager CLAUDE.md (ntfy
  topic) changed the vault by hand without opening its PR or approving.
- README pointed rotation at scripts/secrets/rotate-secret.sh; the manifest's
  comments at `manage secret rotate`; verify-vaultwarden-token.sh at a
  VAULTWARDEN_ADMIN_TOKEN_PLAIN entry (the Bitwarden note is now the bare token).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!166
No description provided.