jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(ci): staging secrets keep valid formats for config-like keys #66

Merged
jfraeys merged 1 commit from jfraeys/fix/staging-secrets-formats into main 2026-10-11 15:09:38 -04:00
Conversation 0 Commits 1 Files changed 3 +144 -132
jfraeys commented 2026-10-11 15:06:49 -04:00
Owner
Copy link

Run 463 reached the backups role and failed: RESTIC_REPOSITORY must be an absolute path or a backend URL ... Got: staging-unused. The generator gave every non-secret-sounding key a placeholder, which breaks roles that validate formats (restic repo, ports, schedules, retention counts, SMTP hosts).

Now the manifest's 18 config: keys keep their production values, with overrides for the dangerous ones: RESTIC_REPOSITORY is a local path (staging never writes to the production bucket), the secondary repo stays off, ALERTMANAGER_EMAIL_TO is example.invalid. Empty strings stay empty (SOPS leaves them plain; hygiene check now accepts them). Re-verified: the staging key decrypts the file, is refused on the production vault, and every value equal to production is non-secret config. 🤖 Generated with Claude Code

Run 463 reached the backups role and failed: `RESTIC_REPOSITORY must be an absolute path or a backend URL ... Got: staging-unused`. The generator gave every non-secret-sounding key a placeholder, which breaks roles that validate formats (restic repo, ports, schedules, retention counts, SMTP hosts). Now the manifest's 18 `config:` keys keep their production values, with overrides for the dangerous ones: RESTIC_REPOSITORY is a local path (staging never writes to the production bucket), the secondary repo stays off, ALERTMANAGER_EMAIL_TO is example.invalid. Empty strings stay empty (SOPS leaves them plain; hygiene check now accepts them). Re-verified: the staging key decrypts the file, is refused on the production vault, and every value equal to production is non-secret config. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(ci): staging secrets keep valid formats for config-like keys
All checks were successful
Lint / lint (pull_request) Successful in 1m40s
Details
Secret scan / scan (pull_request) Successful in 13s
Details
c9b31724ff
 
Run 463 failed at backups: RESTIC_REPOSITORY had to be an absolute path or URL, got "staging-unused".
Config keys from the manifest keep production values; RESTIC_REPOSITORY is a local path, the secondary
repository stays off and the alert recipient is example.invalid. Empty strings stay empty.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!66
No description provided.