fix: CRD CEL reserved-word escape + package-profile release dispatch #2036

Merged

pipeline-bot merged 2 commits from fix/crd-cel-and-zig into trunk 2026-08-13 15:22:56 +00:00

Conversation 0 Commits 2 Files changed 6 +84 -5

sean commented 2026-08-13 15:21:52 +00:00

Owner

Copy link

Two commits, two defects — and this PR is the first fleet train ride: it does not merge by hand, it merges when the release is declared.

1. fix(crd): namespace is a CEL reserved word. The kubernetesImage rule selected self.namespace, which spec-compliant CEL compilers refuse — so envtest 1.30/1.31 could not install the pipelinedeploys/pipelinetargets CRDs and the whole 125-spec controller suite failed at BeforeSuite on every laptop. Escaped to self.__namespace__ (the documented k8s form). Proof: the full controller suite now passes locally (125/125, ~31s), and both regenerated CRDs pass --dry-run=server against the live 1.34 apiserver. Rule behaviour unchanged.

2. fix(release): zdns + zerotea could not release since 2026-08-07. The operator's StagingArgs overrides pipeline-staging's defaults for every profile; the package case forgot to restore buildTemplate/testTemplate, so package releases compiled via pipeline-build-buildkit — whose compile pod deliberately holds NO clone — while the zig build scripts contract on pipeline-build's cloned /src. First zig fmt --check → FileNotFound, release-mode only (the push sensor targets pipeline-build, so CI stayed green). The deb/rpm install matrix had also silently degraded to noop. Reproduced live on zerotea before fixing (zerotea-release-request-8c8hr, failed=compile, "unable to format 'src': FileNotFound").

TestStagingArgsMatchStagingSensor could not catch this — the package sensor passes neither param, and that test compares only explicit ones. New TestPackageProfileReleaseCompilesFromClone pins both args; verified red without the fix, green with it.

Also: pipeline-staging gains the mcbin volume (pkg-install's baked-mc share) — the same templateRef non-inheritance trap the file documents for codeberg/release-lib; its absence failed zelnet's release at the deb step.

zelnet's stranded 0.10.3 claim: no change needed — the holder is terminal with no tag/items/image, so the releaseVersionClaimAbandoned takeover (added for ory's identical wedge 2026-08-10) hands the version over on the next declared release.

Verification: full go test ./... green INCLUDING the controller envtest suite (first time possible on a laptop); 129/129 guards; render tests cover all 21 delivered CRs.

After this deploys: declare releases on zerotea, zdns, zelnet to confirm all three ship again.

Two commits, two defects — and this PR is the **first fleet train ride**: it does not merge by hand, it merges when the release is declared. **1. `fix(crd)`: `namespace` is a CEL reserved word.** The kubernetesImage rule selected `self.namespace`, which spec-compliant CEL compilers refuse — so envtest 1.30/1.31 could not install the pipelinedeploys/pipelinetargets CRDs and the whole 125-spec controller suite failed at BeforeSuite on every laptop. Escaped to `self.__namespace__` (the documented k8s form). Proof: the full controller suite now passes locally (125/125, ~31s), and both regenerated CRDs pass `--dry-run=server` against the live 1.34 apiserver. Rule behaviour unchanged. **2. `fix(release)`: zdns + zerotea could not release since 2026-08-07.** The operator's StagingArgs overrides pipeline-staging's defaults for every profile; the `package` case forgot to restore `buildTemplate`/`testTemplate`, so package releases compiled via **pipeline-build-buildkit** — whose compile pod deliberately holds NO clone — while the zig build scripts contract on pipeline-build's cloned `/src`. First `zig fmt --check` → FileNotFound, release-mode only (the push sensor targets pipeline-build, so CI stayed green). The deb/rpm install matrix had also silently degraded to noop. Reproduced live on zerotea before fixing (`zerotea-release-request-8c8hr`, failed=compile, "unable to format 'src': FileNotFound"). `TestStagingArgsMatchStagingSensor` could not catch this — the package sensor passes neither param, and that test compares only explicit ones. New `TestPackageProfileReleaseCompilesFromClone` pins both args; verified red without the fix, green with it. **Also**: `pipeline-staging` gains the `mcbin` volume (pkg-install's baked-mc share) — the same templateRef non-inheritance trap the file documents for codeberg/release-lib; its absence failed zelnet's release at the deb step. **zelnet's stranded 0.10.3 claim**: no change needed — the holder is terminal with no tag/items/image, so the `releaseVersionClaimAbandoned` takeover (added for ory's identical wedge 2026-08-10) hands the version over on the next declared release. Verification: full `go test ./...` green INCLUDING the controller envtest suite (first time possible on a laptop); 129/129 guards; render tests cover all 21 delivered CRs. After this deploys: declare releases on zerotea, zdns, zelnet to confirm all three ship again.

sean added 2 commits 2026-08-13 15:21:52 +00:00

fix(crd): escape the CEL reserved word namespace in the kubernetesImage rule ... 5b85f82e89

`namespace` is a CEL reserved word. The KubernetesImageTargetSpec validation
rule selected it as `self.namespace`, which a spec-compliant CEL compiler
refuses with "undefined field 'namespace'". The Kubernetes escape form is
`self.__namespace__`.

The blast radius was invisible in CI and total on a laptop: the envtest
apiservers (1.30, 1.31) refuse to install the pipelinedeploys and
pipelinetargets CRDs at all, so the whole 125-spec controller suite failed
at BeforeSuite on any local machine. The CI image's older assets tolerate
the bare form, and the live k3s 1.34 accepted it on apply, so the defect
never surfaced where the tests run.

With the escape, the full controller suite runs and passes on a laptop
(125/125, ~32s), and both regenerated CRDs pass a server-side dry-run
against the live 1.34 apiserver.

The rule's behaviour is unchanged: deployments XOR the legacy
namespace/deployment/container triple.

fix(release): package releases compile from a clone and run the pkg-install matrix again ... 02c7a5c3ca

Two divergences broke every zdns and zerotea release since 2026-08-07, and
one missing volume broke zelnet's.

The operator's StagingArgs passes buildTemplate and testTemplate explicitly
for every paramProfile, overriding pipeline-staging's own parameter defaults.
The package case set its keys and images but never restored those two, so a
package release inherited the base pair: pipeline-build-buildkit and
pipeline-test-noop. The buildkit compile pod deliberately holds NO clone —
buildkitd clones the build — while the zig build scripts contract on
pipeline-build's cloned /src for their style, test, and coverage gates. The
first `zig fmt --check` died with FileNotFound, and only in release mode:
the push sensor (packageCI) targets pipeline-build directly, so per-commit
CI stayed green while every release failed. The deb/rpm install matrix
silently degraded to a noop the same way.

TestStagingArgsMatchStagingSensor could not see this: the package staging
sensor passes NEITHER param — it relies on the CWT defaults — and that test
compares only params the sensor passes explicitly. The new
TestPackageProfileReleaseCompilesFromClone pins both args directly and
fails red without the render.go change.

pipeline-staging also gains the mcbin volume. pipeline-pkg-install shares
the baked mc binary through it, declared in its own workflow spec — which is
not the effective spec when staging templateRefs the test template. Same
non-inheritance trap the file already documents for codeberg and
release-lib; its absence failed zelnet's release at the deb step with
"volume 'mcbin' not found in workflow spec".

zelnet's stranded 0.10.3 version claim needs no change here: the holder
failed at the deb step with no tag, no items, and no image, so the
releaseVersionClaimAbandoned takeover (added for ory's identical wedge on
2026-08-10) hands the version to the next intent.

pipeline-bot merged commit 02c7a5c3ca into trunk 2026-08-13 15:22:56 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2036

No description provided.