ci(bayn): add post-deploy production gate - #13392
Conversation
|
Reopening to retrigger repository pull-request checks; the initial opened event produced no Actions runs. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e35aa21372
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| jobs: | ||
| verify: | ||
| runs-on: arc-amd64 |
There was a problem hiding this comment.
The arc-amd64 scale set runs as arc-amd64-gha-rs-no-permission, but the bindings inspected in argocd/applications/agents-ci/runner-rbac-cluster.yaml grant that identity reads for Argo applications and deployments only; they do not grant the pod list or services/proxy get permissions required by validateReadOnlyPermissions. Consequently every triggered deployment gate exits with RBAC_DENIED before taking a snapshot, so add the Bayn-scoped read bindings or select an appropriately authorized runner identity.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Confirmed as a real deployment blocker. The selected arc-amd64-gha-rs-no-permission identity has read-only Argo/Deployment access but lacks Bayn Pod reads and services/proxy; the existing arc-arm64-gha-rs-kube-mode identity can read Pods/proxy but also has Argo mutation authority, so it does not satisfy the required minimum read-only contract. No existing runner identity satisfies all requirements. Adding the missing Bayn-scoped Role/RoleBinding or changing runner permissions is explicitly outside this task’s ownership (do not touch manifests ... branch/environment permissions). The verifier therefore correctly remains fail-closed with RBAC_DENIED; I am not marking this thread resolved or merging a gate that cannot run.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd2b024700
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d598033019
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db755a128a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1ac93d8063
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c9444f1f54
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c85bdc702e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
f786279 to
bd2602a
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bd2602ad6b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
9d48196 to
ef6a1fd
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ef6a1fdc85
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ef6a1fd to
cde25f0
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cde25f048b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
cde25f0 to
6831df1
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6831df170f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cffa4e5044
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
contents: readpermission/readyz,/v1/status, dependencies, autonomous loop, OBSERVE/read-only authority, zero mutations, and required reconciliationRelated Issues
None
Testing
bun test scripts/bayn-post-deploy-verify.test.ts— 77 passed, including core-versus-non-core wildcard RBAC parsing, wildcard/combined Secret cells, named Secret disclosure, skipped-intermediate Argo descendants, selective sync omission, bounded freshness, and deadline cancellationbun node_modules/typescript/bin/tsc --ignoreConfig --noEmit --module esnext --moduleResolution bundler --target esnext --lib esnext,dom --types bun-types --skipLibCheck scripts/bayn-post-deploy-verify.ts scripts/bayn-post-deploy-verify.test.tsbun node_modules/oxlint/bin/oxlint --config .oxlintrc.json scripts/bayn-post-deploy-verify.ts scripts/bayn-post-deploy-verify.test.ts— 0 warnings/errorsbun node_modules/oxfmt/bin/oxfmt --check .github/workflows/bayn-post-deploy-verify.yml scripts/bayn-post-deploy-verify.ts scripts/bayn-post-deploy-verify.test.ts5e7af567a75841866e92f982095d51ac8abaa151, promoted sourcec7794ce4892ae7d9d6a7b38480a02fe1b39399b0, and digestsha256:13579bcffc30f6f2eaa4ba2054347b96888117236b286e27ac63374d9ea1db53arc-amd64no-permission runner is read-only but currently lacks Bayn Pod reads andservices/proxy, which is intentionally not changed in this PR because branch/environment/RBAC permissions are outside ownershipcontrollerskeys incharts/agents/values-ci-ha.yamlBreaking Changes
None. A future Bayn promotion will remain blocked with
RBAC_DENIEDuntil the existing read-only runner identity is separately granted onlyget/listaccess required for Bayn Pods andget services/proxy; this PR does not alter permissions.Checklist