merge crreg/gate-flips (`7101d53977`) #1072

Open

pipeline-bot wants to merge 2 commits from crreg/gate-flips into trunk

pipeline-bot commented

2026-07-21 10:48:26 +00:00

Collaborator

No description provided.

pipeline-bot added 2 commits

2026-07-21 10:48:26 +00:00

feat(cr-registry): flip live gate CR reads/writes workflows-alice->workflows (steps 3-5) 1f9be4309c

The build+release CR history is mirrored into `workflows` (full parity) and the
release-path SAs are authorized there; flip every live gate to read/write it:
- I1 assert-ready reads pipelinebuild in workflows (SA pipeline-gate, granted)
- I2 deploy reads pipelinerelease in workflows (SA pipeline-deploy, granted)
- promote-images writes+patches the release row in workflows (pipeline-build-images)
- deploy-operator-pin declares the autodeploy release in workflows (build-pipeline;
  set -euo pipefail, grant present) — was actually broken in alice (0 projects there)
- shipd.js creates the Ship-button release in workflows (needs the step-1 grant LIVE first)
- cosmetic: dashboard.html Argo deep-links + buildkit target_url (runs are in workflows)

Removes NO workflows-alice RBAC/grants (retire-at-B4). Both read gates fail open,
so the cutover is a no-op window, never a block. Verified SOUND by adversarial review.

test(dashboard): update Argo-link assertion for the workflows ns flip 7101d53977

dashboard.html's failed-step 'red pill' Argo deep-link now points at
/workflows/workflows/ (runs execute in the bare workflows ns); update the
dashboard-release-render assertion in lockstep.

This pull request has changes conflicting with the target branch.

CHANGELOG.md
dashboard/dashboard.html

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'merge crreg/gate-flips (7101d53977e0)' (#1072) from crreg/gate-flips into trunk

Merge commit body

Reviewed-on: https://code.sean.farm/sean/pipelines/pulls/1072

Merge pull request 'merge crreg/gate-flips (7101d53977e0)' (#1072) from crreg/gate-flips into trunk

Reviewed-on: https://code.sean.farm/sean/pipelines/pulls/1072

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin crreg/gate-flips:crreg/gate-flips

git switch crreg/gate-flips

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!1072

No description provided.

Rows
Columns

merge crreg/gate-flips (7101d53977) #1072

Manual merge helper

Checkout

merge crreg/gate-flips (`7101d53977`) #1072