Skip to content

feat(ci): issue srql-fixture TLS with cert-manager and a live CA #3761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mfreeman451 merged 3 commits into from
Aug 17, 2026
Merged

feat(ci): issue srql-fixture TLS with cert-manager and a live CA #3761

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d80d02c
feat(ci): issue srql-fixture TLS with cert-manager and a live CA
mfreeman451 Aug 17, 2026
b4a9a4f
fix(ci): target ARC by scale set name only
mfreeman451 Aug 17, 2026
aeb7870
fix(ci): publish fixture CA on the shared gateway
mfreeman451 Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .agents/skills/srql-fixtures-db-tests/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ ADMIN_PASS_ENC=$(printf '%s' "$ADMIN_PASS" | jq -sRr @uri)
TLS_SERVER_NAME=srql-fixture-rw.srql-fixtures.svc.cluster.local
CA_FILE="${TMPDIR:-/tmp}/srql-fixture-ca-$$.crt"
umask 077
kubectl get secret srql-fixture-ca -n srql-fixtures -o jsonpath='{.data.ca\.crt}' | \
kubectl get secret srql-fixture-server-ca -n srql-fixtures -o jsonpath='{.data.ca\.crt}' | \
base64 -d > "$CA_FILE"
```

Expand Down
14 changes: 9 additions & 5 deletions .forgejo/workflows/armis-dire-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
ImageOS: ubuntu24
SRQL_TEST_DATABASE_URL: ${{ secrets.SRQL_TEST_DATABASE_URL }}
SRQL_TEST_ADMIN_URL: ${{ secrets.SRQL_TEST_ADMIN_URL }}
SRQL_TEST_DATABASE_CA_CERT: ${{ secrets.SRQL_TEST_DATABASE_CA_CERT }}
SRQL_FIXTURE_CA_URL: https://srql-fixture-ca.serviceradar.cloud/ca.crt
SRQL_TEST_DATABASE_CERT: ${{ secrets.SRQL_TEST_DATABASE_CERT }}
SRQL_TEST_DATABASE_KEY: ${{ secrets.SRQL_TEST_DATABASE_KEY }}

Expand Down Expand Up @@ -43,14 +43,18 @@ jobs:
set -euo pipefail

if [ -z "${SRQL_TEST_DATABASE_URL}" ] ||
[ -z "${SRQL_TEST_ADMIN_URL}" ] ||
[ -z "${SRQL_TEST_DATABASE_CA_CERT}" ]; then
echo "SRQL fixture DSNs and CA certificate are required for the scale Armis/DIRE gate." >&2
[ -z "${SRQL_TEST_ADMIN_URL}" ]; then
echo "SRQL fixture DSNs are required for the scale Armis/DIRE gate." >&2
exit 1
fi

ca_file="${RUNNER_TEMP}/armis-dire-e2e-ca.crt"
printf "%s" "${SRQL_TEST_DATABASE_CA_CERT}" >"${ca_file}"
curl -fsS --max-time 20 "${SRQL_FIXTURE_CA_URL}" >"${ca_file}"
if ! grep -q "BEGIN CERTIFICATE" "${ca_file}"; then
echo "Live fixture CA at ${SRQL_FIXTURE_CA_URL} was not a PEM certificate." >&2
exit 1
fi
export SRQL_TEST_DATABASE_CA_CERT="$(cat "${ca_file}")"

cert_env=()
if [ -n "${SRQL_TEST_DATABASE_CERT:-}" ] || [ -n "${SRQL_TEST_DATABASE_KEY:-}" ]; then
Expand Down
4 changes: 1 addition & 3 deletions .forgejo/workflows/elixir-integration-sr-core.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,6 @@ jobs:
# non-uploaded database TestRunner actions. Generic remote test sweeps never load them.
SRQL_TEST_DATABASE_URL: ${{ secrets.SRQL_TEST_DATABASE_URL }}
SRQL_TEST_ADMIN_URL: ${{ secrets.SRQL_TEST_ADMIN_URL }}
SRQL_TEST_DATABASE_CA_CERT: ${{ secrets.SRQL_TEST_DATABASE_CA_CERT }}
SRQL_TEST_DATABASE_CERT: ${{ secrets.SRQL_TEST_DATABASE_CERT }}
SRQL_TEST_DATABASE_KEY: ${{ secrets.SRQL_TEST_DATABASE_KEY }}
SRQL_TEST_DATABASE_SERVER_NAME: srql-fixture-rw.srql-fixtures.svc.cluster.local
Expand Down Expand Up @@ -190,8 +189,7 @@ jobs:
missing=0
for name in \
SRQL_TEST_DATABASE_URL \
SRQL_TEST_ADMIN_URL \
SRQL_TEST_DATABASE_CA_CERT; do
SRQL_TEST_ADMIN_URL; do
if [ -z "${!name:-}" ]; then
echo "${name} is unavailable; database integration cannot run safely." >&2
missing=1
Expand Down
17 changes: 11 additions & 6 deletions .forgejo/workflows/elixir-quality.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,17 +194,22 @@ jobs:
# that cluster, loads the committed baseline into one and replays the
# migrations into the other, then diffs them.
BASELINE_ADMIN_URL: ${{ secrets.SRQL_TEST_ADMIN_URL }}
SRQL_TEST_DATABASE_CA_CERT: ${{ secrets.SRQL_TEST_DATABASE_CA_CERT }}
SRQL_FIXTURE_CA_URL: https://srql-fixture-ca.serviceradar.cloud/ca.crt
run: |
set -euo pipefail
# Fail closed: never silently skip. A missing secret is a
# misconfiguration, not a reason to let baseline drift through.
if [ -z "${BASELINE_ADMIN_URL:-}" ] || [ -z "${SRQL_TEST_DATABASE_CA_CERT:-}" ]; then
echo "::error::Baseline gate cannot run: repository secrets SRQL_TEST_ADMIN_URL and SRQL_TEST_DATABASE_CA_CERT are required. They already back the srql-fixtures integration DB (a Timescale+AGE CNPG cluster). Configure them in Forgejo repo settings." >&2
# Fail closed: never silently skip. The admin DSN stays a repository
# secret; the CA is fetched live so a 90-day snapshot cannot stall this
# gate.
if [ -z "${BASELINE_ADMIN_URL:-}" ]; then
echo "::error::Baseline gate cannot run: repository secret SRQL_TEST_ADMIN_URL is required. It already backs the srql-fixtures integration DB (a Timescale+AGE CNPG cluster). Configure it in Forgejo repo settings." >&2
exit 1
fi
ca_file="${RUNNER_TEMP:-/tmp}/baseline-ca.crt"
printf '%s' "${SRQL_TEST_DATABASE_CA_CERT}" > "${ca_file}"
curl -fsS --max-time 20 "${SRQL_FIXTURE_CA_URL}" > "${ca_file}"
if ! grep -q "BEGIN CERTIFICATE" "${ca_file}"; then
echo "::error::Live fixture CA at ${SRQL_FIXTURE_CA_URL} was not a PEM certificate." >&2
exit 1
fi
export PGSSLROOTCERT="${ca_file}"
export CNPG_CA_FILE="${ca_file}"
export SERVICERADAR_TEST_DATABASE_CA_CERT_FILE="${ca_file}"
Expand Down
Loading
Loading