merge feat/le-prod-approval-guard (42008b2373) #247

Open

pipeline-bot wants to merge 1 commit from feat/le-prod-approval-guard into trunk

pull from: feat/le-prod-approval-guard

merge into: sean:trunk

sean:main

sean:trunk

sean:chore/b8-listener-narrow

sean:retire/apis-workflows

sean:deploy/openbao-0.12.28-r1

sean:chore/oidc-prune-retired-ns-refs

sean:fix/tenantbucket-css-bare-forgejo

sean:fix/openbao-v0.12.27-rollout

sean:fix/openbao-v0.12.26-rollout

sean:fix/openbao-v0.12.24-image-r2

sean:fix/openbao-v0.12.24-image

sean:cnpg/p05-wave4-gcp

sean:feat/cosign-platform-bound-ns

sean:feat/olly-teardown

sean:feat/repo-guards

Conversation 0 Commits 1 Files changed 7 +79 -9

pipeline-bot commented 2026-07-17 08:57:53 +00:00

Collaborator

Copy link

No description provided.

pipeline-bot added 1 commit 2026-07-17 08:57:53 +00:00

feat(guard): LE-prod approval marker + staging-safe XRD default ... 42008b2373

The LE-staging hard rule was prose-only and had drifted: the Stack
XRD's acmeServer DEFAULT was silently LE-prod, and bob's instance
carried a 'staging is the default' banner directly above an LE-prod
value (stale since the approved 09ce76d flip). Now: (1) XRD default +
composition placeholder = LE-STAGING (no live effect — every Stack sets
acmeServer; unpatched renders fail safe); (2) every LE-prod value line
requires a 'le-prod-approved: <who> <when>' marker within 5 preceding
lines, enforced by tests/check-acme-approval.sh through the
validate-flux repo-guard hook. alice/bob carry markers for the recorded
2026-06-13/19 approvals. Teeth-tested red (marker stripped) and green.

This pull request has changes conflicting with the target branch.

• CHANGELOG.md
• apis/stack/composition.yaml
• tests/check.sh

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Merge pull request 'merge feat/le-prod-approval-guard (42008b237344)' (#247) from feat/le-prod-approval-guard into trunk

Merge commit body Reviewed-on: https://code.sean.farm/sean/platform-seanfarm/pulls/247

Merge pull request 'merge feat/le-prod-approval-guard (42008b237344)' (#247) from feat/le-prod-approval-guard into trunk Reviewed-on: https://code.sean.farm/sean/platform-seanfarm/pulls/247 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/le-prod-approval-guard:feat/le-prod-approval-guard

git switch feat/le-prod-approval-guard

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/platform-seanfarm!247

No description provided.