sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 11 Projects Releases 279 Packages Wiki Activity

merge chore/audit-wave3 (ff41184c52) #797

Open
pipeline-bot wants to merge 2 commits from chore/audit-wave3 into trunk
pull from: chore/audit-wave3
merge into: sean:trunk
Conversation 0 Commits 2 Files changed 8 +127 -176
pipeline-bot commented 2026-07-13 13:13:52 +00:00
Collaborator
Copy link
No description provided. 
Add tests/check-emittable-templates.sh: assert every ClusterWorkflowTemplate
referenced BY NAME exists in templates/base/, across three reference classes:
- operator emissions (pipelines-operator sensors.go TemplateRef/*Template params +
  taxonomies.go PromoteTemplate) — renamed here = orphaned per-project sensor at
  runtime, no other test catches it (the motivation);
- intra-repo default template params (pipeline-staging build/test/promoteTemplate) —
  the class the Wave-2 "delete pipeline-promote" audit claim was a near-miss in;
- project-crs test.template overrides.

Wired into tests/check.sh (pre-push) and pipeline-validate (in-cluster, before
smoke=pass -> blocks merge on exit 1; exit 2 SKIPs if operator source unreachable).
Zero behavior change. Passes today: 21 referenced subset of 29 defined. Proven to
FAIL when pipeline-promote.yaml is hidden. This makes the later Wave-3 lib/ff_main
extractions safe to iterate.
pipeline-devbump (already pipeline-staging's last release step on every release
path) becomes the SOLE devbump. Two ordered changes (upgrade BEFORE delete, or the
untested Do:merge would be the sole devbump and detonate on a requireSignedCommits
trunk):

1. Upgrade pipeline-devbump's merge-style from the oldest Do:merge to ff-only +
   reactive instance-signed Do:squash fallback (proactive branch_protections
   dial-read + reactive 'unverified commit' catch), grafted from pipeline-promote-tag
   and harmonized with pipeline-merge. ff-only can't carry delete_branch_after_merge,
   so reap the _devbump/* head via an explicit branch DELETE.
2. Delete the ~171 lines of drifted inline "open next dev cycle" epilogue from
   pipeline-promote (55), pipeline-promote-tag (64), pipeline-promote-image (52) —
   dead-weight since pipeline-staging already runs pipeline-devbump after promote.
   Kept promote-image's redact() helper (used by earlier steps) + its resources block.

Blast radius: runs AFTER promote with continueOn:{failed,error} — cannot corrupt a
published release; worst case is a silent stale-trunk (WARN). Verified: all 4 templates
YAML-valid + bash -n clean; check.sh green incl. the Inc-0 tripwire (no orphan);
promote-* invoked ONLY via pipeline-staging (grep-confirmed no standalone entrypoint).
This pull request has changes conflicting with the target branch.
  • CHANGELOG.md
  • templates/base/pipeline-validate.yaml
  • tests/check-emittable-templates.sh
  • tests/check.sh
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/audit-wave3:chore/audit-wave3
git switch chore/audit-wave3
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/pipelines!797
No description provided.