fix(operator): freeze only the environment identity, not its gates (#52) #2055

Merged

pipeline-bot merged 2 commits from fix/env-gates-mutable into trunk 2026-08-15 22:09:20 +00:00

Conversation 0 Commits 2 Files changed 4 +83 -15

sean commented 2026-08-15 22:05:05 +00:00

Owner

Copy link

Narrows the PipelineEnvironment spec CEL rule from self == oldSelf to self.maturity == oldSelf.maturity. Maturity is the identity and stays frozen; the gates (approvalMode, requiredChecks) become mutable in place. Proven red-green with a new envtest against a real apiserver: gate edits accepted, maturity edit still rejected. Unwedges the released kernel-production automatic flip and removes the standing ArgoCD false green on workflows-infra-bare (op.rev pinned at 74e40399). Closes #52.

Narrows the PipelineEnvironment spec CEL rule from `self == oldSelf` to `self.maturity == oldSelf.maturity`. Maturity is the identity and stays frozen; the gates (approvalMode, requiredChecks) become mutable in place. Proven red-green with a new envtest against a real apiserver: gate edits accepted, maturity edit still rejected. Unwedges the released kernel-production `automatic` flip and removes the standing ArgoCD false green on workflows-infra-bare (op.rev pinned at 74e40399). Closes #52.

sean added 2 commits 2026-08-15 22:05:05 +00:00

fix(operator): freeze only the environment's identity, not its gates ... 30454df4cf

The spec-level rule on PipelineEnvironment was `self == oldSelf`: the
whole spec frozen. That made every gate flip impossible without
delete + recreate of a live environment. The 2026-08-15
kernel-production incident made the cost concrete: a released
`automatic` flip could never apply, and the ArgoCD app that carried
it reported Synced while its server-side apply was rejected — a
standing false green.

The narrowed rule is `self.maturity == oldSelf.maturity`. Maturity
orders environments, so it is the identity and stays frozen. The
gates (approvalMode, requiredChecks) are operator policy and are now
mutable in place. maturity is required on both sides, so the rule
never dereferences an absent field.

Proven red-green with a new envtest against a real apiserver: the
gate edits are accepted, the maturity edit is still rejected. A fake
client enforces no CEL, so only envtest can hold this line.

chore(query): gofmt realignment of the DeployLeg struct tags ... 1beac14629

make test runs go fmt; this drift re-appears on every run until
committed.

pipeline-bot merged commit 1beac14629 into trunk 2026-08-15 22:09:20 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2055

No description provided.