feat(pipectl)!: remove promote and rollback as delivery operations #2034
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/remove-promote-rollback"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
promoteandrollbackare removed from the pipeline API.spec.operationnow acceptsdeployandretryonly, and both CLI verbs become tombstones namingpipectl deploy.Why these two, and only these two. Neither ever had an execution path — no reconciler branched on either value, so a promote submitted the byte-identical workflow a deploy submits. Across their whole lifetime the cluster recorded one promote and one rollback, and the rollback failed. Applying a Release to a more mature Target is a deploy; returning a Target to earlier bytes is a deploy of the earlier version.
retryandconsumeare deliberately untouched.retryhas 16 live records and is the documented recovery when a kernel-roll canary gate expires at 7200s.consumehas 55 records and is emitted automatically by the flux deploy template, not typed by hand.Decision record. This executes PIPELINE-CONTROL-PLANE-OVERHAUL.md ("remove the deployment operation named with the retired 'promotion' term"). It supersedes the R10 sketch in RELEASE-TRAIN-AND-EVENT-TRIGGERS.md, which proposed keeping both values behind
--as. That doc now records the decision and its cost: the declared label saying a human meant a deploy as a rollback is no longer captured anywhere. Nothing is inferred, so R10's actual objection is not violated.Latent bug fixed along the way.
usage()printed a hardcodedsed -n '2,22p'range. Deleting two help lines without shrinking it would have made everypipectlhelp call printset -euo pipefailand theNS=workflowsblock as if it were help text — affecting all eight call sites, including the surviving verbs.Kept deliberately (same words, unrelated senses): the release-step
promote(build → test → promote) and its four templates, the gitops auto-rollback-on-failure workflow argument,retry.RetryOnConflict, the gpg signing keyset, androlled-backas a deployment outcome.Live objects. The two historical records carrying the removed values stay as history. Both are terminal, so the tightened enum cannot strand an in-flight deployment.
Verification
tests/check.sh: 129/129 guards pass, includinglexicon-retired-verbs,crd-generated-in-sync,check-emittable-templates, andevery-guard-has-a-caller.go build ./...and the non-envtest Go tests pass.retryOfand both retry CEL rules survive.pipectlhelp now ends cleanly attrace; both tombstones exit 1 naming the replacement.pipectl-maturity-intentsextended: the tombstones must refuse, name the replacement, and create no PipelineDeploy record.delivery_api_envtestCEL contract — envtest assets are absent on this laptop. It runs in CI.No CHANGELOG entry: that file is read-only history and release notes come from frozen
PipelineChangeevidence.`promote` and `rollback` are removed from the pipeline API. `spec.operation` now accepts `deploy` and `retry` only, and both CLI verbs are tombstones that name `pipectl deploy`. Neither value ever had an execution path. No reconciler branched on either, so a promote submitted the byte-identical workflow a deploy submits. In their whole lifetime the cluster recorded one promote and one rollback, and the rollback failed. Applying a Release to a more mature Target is a deploy; returning a Target to earlier bytes is a deploy of the earlier version. This executes the decision in PIPELINE-CONTROL-PLANE-OVERHAUL.md ("remove the deployment operation named with the retired 'promotion' term"). It supersedes the R10 sketch in RELEASE-TRAIN-AND-EVENT-TRIGGERS.md, which proposed keeping both values behind `--as`. That doc now records the decision and its cost: the declared label saying a human meant a deploy as a rollback is no longer captured. Nothing is inferred, so R10's actual objection is not violated. `retry` and `consume` are deliberately untouched. `retry` is the recovery path when a kernel-roll canary gate expires, and the flux deploy template emits consumptions by itself. Tombstones follow the existing `ship` and `merge` convention, per the overhaul doc: old commands print a deprecation error naming the replacement rather than aliasing silently. Both verbs took the same three arguments as `deploy`, so a silent deletion would have dropped an old invocation into `usage` with no hint. Also fixes a latent trap: `usage()` printed a hardcoded `sed -n '2,22p'` range. Deleting two help lines without shrinking it would have made every pipectl help call print shell internals as help text. pipectl-maturity-intents now asserts the tombstones refuse, name the replacement, and create no PipelineDeploy record. Kept deliberately, all unrelated senses of the same words: the release-step `promote` (build -> test -> promote) and its templates, the gitops auto-rollback-on-failure workflow argument, `retry.RetryOnConflict`, the gpg signing keyset, and `rolled-back` as a deployment outcome. The two historical records carrying the removed values stay in place as history. Both are terminal, so the tightened enum cannot strand an in-flight deployment.