(projects) add projects app support - #59
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR adds Projects as a standalone Sails.js application supported by ChangesProjects application
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant st-cli
participant SecretBackend
participant AnsibleRole
participant Podman
Operator->>st-cli: bootstrap projects <env>
st-cli->>SecretBackend: store project secrets
st-cli->>AnsibleRole: write project variables and manifest
AnsibleRole->>Podman: configure and deploy Projects
Podman-->>Operator: run Projects container
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@changelogs/fragments/projects.yml`:
- Line 2: Update the Projects changelog entry to describe uploads as “optional
S3-backed uploads” instead of “S3-backed uploads,” leaving the rest of the entry
unchanged.
In `@roles/projects/REFERENCE.md`:
- Line 2: Update the documentation in REFERENCE.md to satisfy linting: add
required blank lines around all affected headings, label the playbook code fence
as yaml, and replace “Prometheus compatible” with “Prometheus-compatible” while
preserving the surrounding content.
In `@roles/projects/templates/projects/compose.yaml.j2`:
- Around line 10-13: Update the volumes section in the compose template to
derive upload mounts from the configured st_projects_directories list rather
than hardcoded defaults. Add or use each directory’s container-path metadata and
loop over the entries so custom directories are mounted and an empty list
produces no upload mounts, preserving the documented S3-only behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1d4e0201-2bec-4738-8236-8c59b75fcc3d
📒 Files selected for processing (27)
README.mdchangelogs/fragments/projects.ymlcli/st_cli/cmd/bootstrap.pycli/st_cli/core/appmeta.pycli/st_cli/core/envrender.pycli/st_cli/core/resources/apps/drive.ymlcli/st_cli/core/resources/apps/keycloak.ymlcli/st_cli/core/resources/apps/meet.ymlcli/st_cli/core/resources/apps/messages.ymlcli/st_cli/core/resources/apps/projects.ymlcli/st_cli/core/resources/templates/env/projects.env.j2cli/st_cli/core/writer.pycli/tests/test_appmeta.pycli/tests/test_bootstrap.pycli/tests/test_envrender.pycli/tests/test_writer.pydocs/05-projects/01-projects.mdroles/projects/REFERENCE.mdroles/projects/defaults/main.ymlroles/projects/meta/argument_specs.ymlroles/projects/meta/main.ymlroles/projects/tasks/deploy.ymlroles/projects/tasks/deploy/projects.ymlroles/projects/tasks/main.ymlroles/projects/templates/monitoring/compose_cadvisor.yaml.j2roles/projects/templates/projects/compose.yaml.j2roles/projects/templates/projects/env.j2
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
cli/st_cli/cmd/bootstrap.py (1)
875-877: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winThread
backendinto both egressvars_headercalls. Line 1155 now passes the selectedSecretBackendso the header describes the real secret store, but the two egress writers still use the default (None), producing an ansible-vault "stored encrypted in vault.yml" line for units bootstrapped inhashi_vaultmode, where novault.ymlexists.
cli/st_cli/cmd/bootstrap.py#L875-L877: in_bundle_egress, passbackendas the 4th argument towriter.vars_header.cli/st_cli/cmd/bootstrap.py#L928-L930: in_reuse_egress, passbackendas the 4th argument towriter.vars_header.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cli/st_cli/cmd/bootstrap.py` around lines 875 - 877, Update both _bundle_egress (cli/st_cli/cmd/bootstrap.py:875-877) and _reuse_egress (cli/st_cli/cmd/bootstrap.py:928-930) to pass the selected backend as the fourth argument to writer.vars_header, matching the existing call around line 1155 so generated headers reflect the actual secret store.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cli/st_cli/core/writer.py`:
- Around line 211-212: Update both _bundle_egress and _reuse_egress to pass
backend when calling vars_header, so generated egress headers reflect whether
component secrets are written. Make the success message near line 220
conditional on backend.component_secrets(...) being non-empty, and do not report
vault.yml as written when that collection is empty.
In `@cli/tests/test_bootstrap.py`:
- Around line 792-848: Add the scripted-questionnaire consumption assertion to
the projects bootstrap tests, including this test and the cases around the
referenced later scenarios: capture the return value of script_questionary in sq
and assert not sq._scripts after bootstrap completes. Preserve all existing
setup and behavioral assertions.
In `@docs/05-projects/01-projects.md`:
- Around line 145-147: Update the Containers troubleshooting command to replace
the hardcoded /opt/projects/projects path with the configured st_projects_dir
placeholder, using <st_projects_dir>/compose.yaml, and instruct operators to
substitute the actual configured directory.
- Around line 87-89: Update the Projects manifest’s requires declaration to
remove s3, so bootstrap does not list optional S3 configuration under required
preparation while preserving the questionnaire’s local-storage and S3 paths.
In `@roles/projects/defaults/main.yml`:
- Around line 36-37: The cAdvisor descriptions incorrectly claim direct
Prometheus and Loki integrations. Update the comment for
st_projects_cadvisor_enabled in roles/projects/defaults/main.yml (lines 36-37)
and its argument description in roles/projects/meta/argument_specs.yml (lines
69-72) to state that cAdvisor exposes metrics for Prometheus scraping, without
adding integrations.
---
Outside diff comments:
In `@cli/st_cli/cmd/bootstrap.py`:
- Around line 875-877: Update both _bundle_egress
(cli/st_cli/cmd/bootstrap.py:875-877) and _reuse_egress
(cli/st_cli/cmd/bootstrap.py:928-930) to pass the selected backend as the fourth
argument to writer.vars_header, matching the existing call around line 1155 so
generated headers reflect the actual secret store.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1649ad80-a140-4d74-9bec-d84fce4a2b3c
📒 Files selected for processing (27)
README.mdchangelogs/fragments/projects.ymlcli/st_cli/cmd/bootstrap.pycli/st_cli/core/appmeta.pycli/st_cli/core/envrender.pycli/st_cli/core/resources/apps/drive.ymlcli/st_cli/core/resources/apps/keycloak.ymlcli/st_cli/core/resources/apps/meet.ymlcli/st_cli/core/resources/apps/messages.ymlcli/st_cli/core/resources/apps/projects.ymlcli/st_cli/core/resources/templates/env/projects.env.j2cli/st_cli/core/writer.pycli/tests/test_appmeta.pycli/tests/test_bootstrap.pycli/tests/test_envrender.pycli/tests/test_writer.pydocs/05-projects/01-projects.mdroles/projects/REFERENCE.mdroles/projects/defaults/main.ymlroles/projects/meta/argument_specs.ymlroles/projects/meta/main.ymlroles/projects/tasks/deploy.ymlroles/projects/tasks/deploy/projects.ymlroles/projects/tasks/main.ymlroles/projects/templates/monitoring/compose_cadvisor.yaml.j2roles/projects/templates/projects/compose.yaml.j2roles/projects/templates/projects/env.j2
| expand_var_markers(data, backend) | ||
| data.yaml_set_start_comment(vars_header(app, meta, core)) | ||
| data.yaml_set_start_comment(vars_header(app, meta, core, backend)) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Propagate backend-aware messaging to all generated units.
Egress creation paths still call vars_header() without backend, so Hashi Vault/OpenBao egress configs claim secrets are encrypted in vault.yml even though none is written. Also make the Line 220 success message conditional for the same reason.
Proposed fix
- writer.vars_header(meta.app, meta, meta.component("egress"))
+ writer.vars_header(meta.app, meta, meta.component("egress"), backend)Apply this to both _bundle_egress and _reuse_egress, and avoid reporting vault.yml as written when backend.component_secrets(...) is empty.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cli/st_cli/core/writer.py` around lines 211 - 212, Update both _bundle_egress
and _reuse_egress to pass backend when calling vars_header, so generated egress
headers reflect whether component secrets are written. Make the success message
near line 220 conditional on backend.component_secrets(...) being non-empty, and
do not report vault.yml as written when that collection is empty.
| # Containers | ||
| podman-compose -f /opt/projects/projects/compose.yaml ps | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use the configured Projects directory in the troubleshooting command.
The command hardcodes /opt/projects/projects, so it fails when st_projects_dir is overridden. Use a placeholder such as <st_projects_dir>/compose.yaml and instruct operators to substitute the configured value.
Based on roles/projects/defaults/main.yml Line 10.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/05-projects/01-projects.md` around lines 145 - 147, Update the
Containers troubleshooting command to replace the hardcoded
/opt/projects/projects path with the configured st_projects_dir placeholder,
using <st_projects_dir>/compose.yaml, and instruct operators to substitute the
actual configured directory.
| # Triggers the installation of the cadvisor container, used to send metrics to a Prometheus compatible server and logs to a Loki server. | ||
| st_projects_cadvisor_enabled: false |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the cAdvisor capability description.
Both descriptions claim that cAdvisor sends metrics to Prometheus and logs to Loki, but the supplied compose template only exposes cAdvisor’s metrics endpoint; no Loki forwarding or Prometheus destination is configured. Describe it as exposing metrics for Prometheus scraping, or add the missing integrations.
roles/projects/defaults/main.yml#L36-L37: update the default-variable comment.roles/projects/meta/argument_specs.yml#L69-L72: update the argument description so generated documentation matches.
Based on roles/projects/templates/monitoring/compose_cadvisor.yaml.j2.
📍 Affects 2 files
roles/projects/defaults/main.yml#L36-L37(this comment)roles/projects/meta/argument_specs.yml#L69-L72
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@roles/projects/defaults/main.yml` around lines 36 - 37, The cAdvisor
descriptions incorrectly claim direct Prometheus and Loki integrations. Update
the comment for st_projects_cadvisor_enabled in roles/projects/defaults/main.yml
(lines 36-37) and its argument description in
roles/projects/meta/argument_specs.yml (lines 69-72) to state that cAdvisor
exposes metrics for Prometheus scraping, without adding integrations.
| default: | ||
| - name: user-avatars | ||
| container_uid: 1000 | ||
| container_path: /app/public/user-avatars | ||
| - name: project-background-images | ||
| container_uid: 1000 | ||
| container_path: /app/public/project-background-images | ||
| - name: attachments | ||
| container_uid: 1000 | ||
| container_path: /app/private/attachments |
There was a problem hiding this comment.
container_path should never be a var, these are fixed paths inside the container, we shouldn't put them there.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
roles/projects/REFERENCE.md (1)
49-56: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winQuote the task name in the playbook example.
The unquoted
namevalue contains:, which makes this YAML invalid.Proposed fix
- - name: Importing role: suitenumerique.st.projects + - name: "Importing role: suitenumerique.st.projects"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@roles/projects/REFERENCE.md` around lines 49 - 56, Quote the task name value in the playbook example under the task list, specifically the name beginning with “Importing role:”, so the colon-space sequence is parsed as part of the string and the YAML remains valid.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@roles/projects/REFERENCE.md`:
- Around line 49-56: Quote the task name value in the playbook example under the
task list, specifically the name beginning with “Importing role:”, so the
colon-space sequence is parsed as part of the string and the YAML remains valid.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b5308242-8dcc-4467-a89d-7549a24bd7c6
📒 Files selected for processing (7)
cli/st_cli/cmd/bootstrap.pycli/st_cli/core/resources/templates/env/projects.env.j2cli/tests/test_bootstrap.pyroles/projects/REFERENCE.mdroles/projects/defaults/main.ymlroles/projects/meta/argument_specs.ymlroles/projects/templates/projects/compose.yaml.j2
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
cli/st_cli/cmd/bootstrap.py (1)
319-328: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winCollect the DATABASE_URL password using a masked prompt.
_ask()renders asquestionary.text, so the password inDATABASE_URLis echoed while entered;_password()already exists and is used for other credential fields. Prompt the password with_password()and assemble the URL, or otherwise make the database URL entry explicitly non-echoing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cli/st_cli/cmd/bootstrap.py` around lines 319 - 328, Update the DATABASE_URL collection in the bootstrap flow to avoid echoing the embedded password: replace the plain-text _ask() entry with a masked _password()-based prompt, assembling the complete URL as needed before passing it to backend.env_secret. Preserve the existing prompts_values() conditional and DATABASE_URL storage behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@cli/st_cli/cmd/bootstrap.py`:
- Around line 319-328: Update the DATABASE_URL collection in the bootstrap flow
to avoid echoing the embedded password: replace the plain-text _ask() entry with
a masked _password()-based prompt, assembling the complete URL as needed before
passing it to backend.env_secret. Preserve the existing prompts_values()
conditional and DATABASE_URL storage behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fb3d051f-7ff9-4851-8387-3498f8a53061
📒 Files selected for processing (6)
cli/st_cli/cmd/bootstrap.pycli/st_cli/core/resources/apps/projects.ymlcli/st_cli/core/writer.pycli/tests/test_appmeta.pycli/tests/test_bootstrap.pycli/tests/test_writer.py
2 participants
Summary by CodeRabbit
vault.ymlis not produced).