Version-consistency CI gate, SECRET_KEY production guard, and small cleanups#15
Merged
Merged
Conversation
Add tests/test_version_consistency.py: eight tests that parse pyproject.toml, versions.toml, helm/Chart.yaml, helm/values.yaml and docker/docker-compose.yaml and assert all component version pins agree. Two frontend image-comparison tests are skipped pending reconciliation of the helm (v0.3.0) vs docker (v0.2.3) frontend version drift. Also: - Add [frontend] table to versions.toml to start tracking the climate-ref-frontend image version (set to 0.3.0, matching Helm). - Wire the new test into the CI lint job so version drift becomes a hard build failure. - Add changelog fragment.
Align the docker-compose ref-app image tag up to v0.3.0 to match the Helm chart (api.image.tag) and versions.toml [frontend]. With the drift resolved, enable the two previously-skipped frontend image-comparison tests and drop the now-unused pytest import.
Add a ref.validateApiSecret helper that calls fail when api.env.ENVIRONMENT=production and api.env.SECRET_KEY is empty or the 'changethis' placeholder. The helper is invoked at the top of templates/api/secret.yaml so the guard fires whenever the API Secret would be rendered. Default api.env.SECRET_KEY in values.yaml is changed from 'changethis' to '' (empty string), which the guard also rejects in production. The helm-lint CI step is updated to pass --set api.env.SECRET_KEY=lint-not-a-real-secret so the workflow remains green.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (13)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThis PR adds a CI-enforced test suite verifying version consistency across pyproject.toml, versions.toml, Helm chart files, and docker-compose.yaml; introduces a Helm helper that blocks production rendering when SECRET_KEY is unset or placeholder; pins the frontend version; and applies minor documentation, CI, and test-marker updates. ChangesVersion Consistency Test Suite
Helm Production Secret Guard
Housekeeping and Changelog
Sequence Diagram(s)sequenceDiagram
participant CI as CI Lint Job
participant TestSuite as test_version_consistency.py
participant Files as Config Files (pyproject.toml, versions.toml, Chart.yaml, values.yaml, docker-compose.yaml)
participant Helm as Helm Render
CI->>TestSuite: run pytest test_version_consistency.py
TestSuite->>Files: read pinned versions
Files-->>TestSuite: version values
TestSuite-->>CI: pass/fail assertion
CI->>Helm: helm lint --set api.env.SECRET_KEY=lint-not-a-real-secret
Helm->>Helm: ref.validateApiSecret check (ENVIRONMENT, SECRET_KEY)
Helm-->>CI: render success or fail
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
Rename the +slug.type.md fragments to the repo's <PR>.<type>.md convention so towncrier links them to #15, and split the combined trivial fragment so the README fix renders under Improved Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three small, independent hardening changes for the AFT deployment repo, one per commit.
pyproject.toml,versions.toml,helm/Chart.yaml,helm/values.yaml,docker/docker-compose.yaml) and were synced by hand. A newtests/test_version_consistency.pyasserts they agree and runs in the fastlintjob, so drift fails the build. Also reconciles a pre-existing mismatch: theref-appfrontend image (v0.3.0in Helm,v0.2.3in Docker, untracked in the manifest) is now tracked under[frontend]and set tov0.3.0everywhere.ENVIRONMENT: productionwithSECRET_KEY: changethis. A newref.validateApiSecrethelper aborts the render when production has an empty or placeholder key; the default is hardened to empty. Production-only; real overrides,api.enabled: false, and non-prod are untouched.test_provider_discoveryas slow so it runs by default; fix the stale README Helm install version (0.1.0→0.2.2).Verification (combined branch): ruff check/format pass;
pytest -m "not slow"green (11 passed); 10 consistency assertions pass;helm lintpasses and the render fails on defaults. Each change adds a changelog fragment.Note: the Docker frontend bump to
v0.3.0wasn't exercised againstclimate-ref:v0.14.3on the full docker stack — worth a localbash scripts/smoke-test.shfirst.Summary by CodeRabbit
New Features
Bug Fixes
Documentation