ci: repo-declared CI scaffold (lab/automation#9) #62

Merged

ginjiruu merged 1 commit from ci/repo-declared-scaffold into master

2026-09-23 19:39:50 +00:00

ginjiruu commented

2026-09-23 19:22:43 +00:00

Owner

Repo-declared CI scaffold per lab/automation#9 — the reference shape the onboarding generators (lab/automation#10) will copy.

What's in it

.ci/kustomization.yaml — namespace ci, common label ci/repo: lab-authz-bridge
.ci/tag-build-sensor.yaml — repo-prefixed sensor (authz-bridge-tag-build): filters the shared webhook EventSource events to tag pushes of lab/authz-bridge and submits the ci-namespace go-build-push workflow template with repo + ref params from the event

Notes / deviations from the issue text

Label value sanitized: the issue says common label ci/repo: lab/authz-bridge, but Kubernetes label values cannot contain / — using lab-authz-bridge (full_name with / → -).
k8s/ starter dropped (agreed in issue discussion): authz-bridge is a system service deployed by Flux from deployments/kustomization/ (see lab/clusters) — it has no app Application and needs no k8s/ directory. The app-manifest-location mechanism (per-repo ApplicationSet + repo-declared .ci/apps.yaml) is scoped into lab/automation#10.
Sensor SA is ci-argocd — the ci-namespace destination SA, the only SA in ci with create on workflows; the argo CLI in the sensor pod authenticates as it, so the submitted workflow lands in ci and resolves the ci-namespace template.

Validation

kustomize build .ci/ clean
kubectl apply -k .ci/ --dry-run=server against mini: validates against the live argo-events v1.9.10 Sensor CRD
Cross-namespace event flow verified against argo-events v1.9.10 source: JetStream subject is default.<eventSource>.<event> (no namespace), both EventBuses (automation, ci) are named default on the shared NATS server, and the sensor reconciler never fetches the EventSource object — so the webhook source in automation is consumable from ci.

Remaining steps (lab/automation#9)

Factory PR into lab/dev-apps-source (CI Application + AppProject) + lab/clusters wiring (projects/ → argocd)
Remove lab/authz-bridge from the central tag-build sensor allowlist (lab/automation) so only the repo sensor fires
E2E: tag push → repo sensor → go-build-push → Harbor image

Repo-declared CI scaffold per lab/automation#9 — the reference shape the onboarding generators (lab/automation#10) will copy. ## What's in it - `.ci/kustomization.yaml` — namespace `ci`, common label `ci/repo: lab-authz-bridge` - `.ci/tag-build-sensor.yaml` — repo-prefixed sensor (`authz-bridge-tag-build`): filters the shared webhook EventSource events to tag pushes of `lab/authz-bridge` and submits the `ci`-namespace `go-build-push` workflow template with `repo` + `ref` params from the event ## Notes / deviations from the issue text 1. **Label value sanitized**: the issue says common label `ci/repo: lab/authz-bridge`, but Kubernetes label values cannot contain `/` — using `lab-authz-bridge` (full_name with `/` → `-`). 2. **`k8s/` starter dropped** (agreed in issue discussion): authz-bridge is a system service deployed by Flux from `deployments/kustomization/` (see lab/clusters) — it has no app Application and needs no `k8s/` directory. The app-manifest-location mechanism (per-repo ApplicationSet + repo-declared `.ci/apps.yaml`) is scoped into lab/automation#10. 3. **Sensor SA is `ci-argocd`** — the ci-namespace destination SA, the only SA in `ci` with `create` on workflows; the argo CLI in the sensor pod authenticates as it, so the submitted workflow lands in `ci` and resolves the ci-namespace template. ## Validation - `kustomize build .ci/` clean - `kubectl apply -k .ci/ --dry-run=server` against mini: validates against the live argo-events v1.9.10 Sensor CRD - Cross-namespace event flow verified against argo-events v1.9.10 source: JetStream subject is `default.<eventSource>.<event>` (no namespace), both EventBuses (`automation`, `ci`) are named `default` on the shared NATS server, and the sensor reconciler never fetches the EventSource object — so the `webhook` source in `automation` is consumable from `ci`. ## Remaining steps (lab/automation#9) - Factory PR into lab/dev-apps-source (CI Application + AppProject) + lab/clusters wiring (`projects/` → `argocd`) - Remove `lab/authz-bridge` from the central tag-build sensor allowlist (lab/automation) so only the repo sensor fires - E2E: tag push → repo sensor → go-build-push → Harbor image

ginjiruu added 1 commit

2026-09-23 19:22:44 +00:00

ci: add repo-declared CI scaffold (.ci/ kustomization + tag-build sensor)

Lint / Run on Ubuntu (push) Waiting to run

Details

E2E Tests / Run on Ubuntu (push) Waiting to run

Details

Tests / Run on Ubuntu (push) Waiting to run

Details

Lint / Run on Ubuntu (pull_request) Waiting to run

Details

E2E Tests / Run on Ubuntu (pull_request) Waiting to run

Details

Tests / Run on Ubuntu (pull_request) Waiting to run

Details

adbf201908

Repo-declared CI per lab/automation#9: the .ci/ directory is synced by
the CI Application (factory: lab/dev-apps-source) into the shared ci
namespace on mini. The repo-prefixed sensor filters the shared webhook
events to tag pushes of this repo and submits the ci-namespace
go-build-push workflow template.

Validated: kustomize build + server-side dry-run against the live
argo-events v1.9.10 Sensor CRD on mini.

ginjiruu referenced this pull request from lab/automation

2026-09-23 19:22:51 +00:00

authz-bridge: first end-to-end (hand-written scaffold + factory entry) #9

ginjiruu merged commit 1abae0a475 into master

2026-09-23 19:39:50 +00:00

ginjiruu referenced this pull request from a commit

2026-09-23 19:39:51 +00:00

Merge pull request 'ci: repo-declared CI scaffold (lab/automation#9)' (#62) from ci/repo-declared-scaffold into master

ginjiruu referenced this pull request from lab/dev-apps-source

2026-09-23 19:50:40 +00:00

issue-9: lab/authz-bridge factory entry (CI Application + AppProject) #8

ginjiruu referenced this pull request from lab/automation