jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

docs+chore: describe the real deploy flow and remove the staging marker mechanism (stacked on #96) #97

Merged
jfraeys merged 1 commit from jfraeys/chore/gitops-docs-cleanup into main 2026-10-13 11:18:43 -04:00
Conversation 0 Commits 1 Files changed 12 +53 -261
jfraeys commented 2026-10-13 10:58:38 -04:00
Owner
Copy link

Merge #96 first (this branch is stacked on it; until #96 merges the diff below also shows its two commits).

CI validates; the operator deploys. The README, the deployment runbook and the text the promote job writes into the promotion PR still described a different system, and the staging marker files could never be created by a CI run.

Docs and text

  • README Workflow, docs/runbooks/deployment.md (steps, 'Staging markers' section, troubleshooting rows), ROLLBACK.md (also fixes the bypass word: the code asks for 'deploy', the doc said 'linode'), docs/provider-portability.md.
  • The promote job now writes the truth into the promotion PR: merging it is the approval record and deploys nothing; check out the validated commit and run scripts/promote-prod.sh (or deploy-services.sh for an Ansible-only change). It no longer claims Terraform applies automatically on merge to prod followed by an on-host reconciler (neither exists; the apply workflows were removed 2026-10-10).

Removed (clear-dead only)

  • The staging marker mechanism: SERVICES_MARKER/WEB_MARKER, create/check/clear_staging_markers, the rm lines in the staging traps, setup's clean step and its clear call, the .gitignore entries. The promotion gate from #96 replaces it.
  • scripts/find-secret-change-dates.sh: a one-off that decrypted the Ansible-Vault-era secrets/backup snapshots; its only reference was a doc list.
  • Stale references to the retired terraform-plan/terraform-apply/drift-check jobs in docs/secrets-inventory.md and the manifest's CI-token description; "Production rebuild authorized" wording that implied the markers.

Not removed (live or borderline, listed for a decision): scripts/verify-vaultwarden-token.sh, init-vaultwarden.sh, age-recovery-keygen.sh and the BW_SESSION paths in rotate-secret.sh/common-vault.sh (Vaultwarden/Bitwarden era; the recovery key still lives in Bitwarden), export-cloudflare-zone.sh and cloudflare-migration-setup-wizard.sh (DNS migration tooling), backup-terraform.sh and molecule-test.sh (referenced by runbooks/CHANGELOG), the secrets/backup/ and Ansible Vault branches (retired at the very end, as agreed), setup's .staging-lock cleanup (nothing else mentions it).

Verified: bash -n on setup and staging.sh, shellcheck -S error on staging.sh (docker), the promotion tests, yaml/yamllint on the workflow and manifest, git grep finds no remaining marker references outside incidents.md/CHANGELOG.md.

🤖 Generated with Claude Code

**Merge #96 first** (this branch is stacked on it; until #96 merges the diff below also shows its two commits). CI validates; the operator deploys. The README, the deployment runbook and the text the promote job writes into the promotion PR still described a different system, and the staging marker files could never be created by a CI run. Docs and text - README Workflow, docs/runbooks/deployment.md (steps, 'Staging markers' section, troubleshooting rows), ROLLBACK.md (also fixes the bypass word: the code asks for 'deploy', the doc said 'linode'), docs/provider-portability.md. - The promote job now writes the truth into the promotion PR: merging it is the approval record and deploys nothing; check out the validated commit and run scripts/promote-prod.sh (or deploy-services.sh for an Ansible-only change). It no longer claims Terraform applies automatically on merge to prod followed by an on-host reconciler (neither exists; the apply workflows were removed 2026-10-10). Removed (clear-dead only) - The staging marker mechanism: SERVICES_MARKER/WEB_MARKER, create/check/clear_staging_markers, the rm lines in the staging traps, setup's clean step and its clear call, the .gitignore entries. The promotion gate from #96 replaces it. - scripts/find-secret-change-dates.sh: a one-off that decrypted the Ansible-Vault-era secrets/backup snapshots; its only reference was a doc list. - Stale references to the retired terraform-plan/terraform-apply/drift-check jobs in docs/secrets-inventory.md and the manifest's CI-token description; "Production rebuild authorized" wording that implied the markers. Not removed (live or borderline, listed for a decision): scripts/verify-vaultwarden-token.sh, init-vaultwarden.sh, age-recovery-keygen.sh and the BW_SESSION paths in rotate-secret.sh/common-vault.sh (Vaultwarden/Bitwarden era; the recovery key still lives in Bitwarden), export-cloudflare-zone.sh and cloudflare-migration-setup-wizard.sh (DNS migration tooling), backup-terraform.sh and molecule-test.sh (referenced by runbooks/CHANGELOG), the secrets/backup/ and Ansible Vault branches (retired at the very end, as agreed), setup's .staging-lock cleanup (nothing else mentions it). Verified: bash -n on setup and staging.sh, shellcheck -S error on staging.sh (docker), the promotion tests, yaml/yamllint on the workflow and manifest, git grep finds no remaining marker references outside incidents.md/CHANGELOG.md. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ci(lint): run the promotion gate tests
Some checks failed
Lint / lint (pull_request) Has been cancelled
Details
Secret scan / scan (pull_request) Has been cancelled
Details
5ceb5d56ef
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
docs+chore: describe the real deploy flow (CI validates, you deploy) and remove the staging marker mechanism
All checks were successful
Lint / lint (pull_request) Successful in 1m51s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
a401c26bc1
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!97
No description provided.