chore(github-app): sync chart to v1.17.0 #67
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -292,6 +292,8 @@ secrets: | |
| # --- 8. Daemon / Orchestrator WebSocket (auto-generated, persisted across upgrades) --- | ||
| daemonAuthToken: "" # Leave empty to auto-generate and persist. | ||
| daemonAuthTokenPrevious: "" # Optional rotation-window predecessor of daemonAuthToken. When set, the orchestrator accepts daemons whose Bearer header matches EITHER the primary or this previous value (constant-time). Set to the old token during a rolling rotation, then unset once every daemon has restarted on the new primary. Daemon-side ignored — daemons always send the primary daemonAuthToken. | ||
| workflowRunnerCapabilitySecret: "" # Controller-only HMAC root for deadline-bound, per-attempt isolated-workflow-runner capabilities. Min 32 chars. Setting it enables the isolated workflow runner feature (see config.workflowRunner). Must differ from daemonAuthToken and daemonAuthTokenPrevious. Rejected at boot if set on a daemon/worker. | ||
| workflowRunnerCapabilitySecretPrevious: "" # Optional controller-only rotation predecessor of workflowRunnerCapabilitySecret. Accepted only for capabilities whose signed expiry has not elapsed. Must also differ from both daemon-auth slots. | ||
|
|
||
| # ─────────────────────────── APPLICATION CONFIG ─────────────────────── | ||
| # `config:` is a 1:1 mirror of the non-secret fields of the Zod schema in | ||
|
|
@@ -325,6 +327,7 @@ config: | |
| agentMaxTurns: "" # Leave empty for no turn cap (recommended). Set to a positive int only when ops needs a hard ceiling; overrides defaultMaxTurns when both are set. | ||
| claudeCodePath: "" # Required only when claude-code is installed globally (e.g. Docker). | ||
| allowedOwners: "" # Comma-separated. Required when secrets.claudeCodeOauthToken is set. | ||
| autoReviewUsers: "" # Comma-separated GitHub logins whose pushes to an open PR (pull_request.synchronize) auto-trigger the review workflow, matched case-insensitively. Empty disables the feature. Requires config.allowedOwners set and workflows.review.auto=true on the repo. Under a PAT, do NOT list the PAT owner (self-pushes are skipped). | ||
|
|
||
| # --- 6. Orchestrator --- | ||
| wsPort: 3002 # Must differ from config.port. | ||
|
|
@@ -336,6 +339,7 @@ config: | |
| staleExecutionThresholdMs: 3660000 # Must exceed agentTimeoutMs (3600000); 60s margin. | ||
| daemonDrainTimeoutMs: 3600000 # Set >= agentTimeoutMs to avoid mid-run kills on SIGTERM. Inflates daemon Pod terminationGracePeriodSeconds (drain/1000 + 30s) — confirm cluster tolerates ~60min graceful shutdown. | ||
| jobMaxRetries: 3 | ||
| workflowDispatchTimeoutMs: 4200000 # Maximum age of an unclaimed structured-workflow dispatch. On retry-budget or age expiry the workflow fails, releases its in-flight lock, fails its execution receipt, and queues a public failure projection. | ||
| offerTimeoutMs: 5000 | ||
| queueWorkerBackoffMaxMs: 5000 # Caps doubling backoff when a leased job has no locally-capable daemon and is re-pushed for another instance to claim. | ||
| livenessReaperIntervalMs: 30000 # Cadence of the heartbeat-based liveness reaper. Min 20000 (orchestrator heartbeat refresh interval) to avoid false reaps. | ||
|
|
@@ -354,9 +358,23 @@ config: | |
| spawnCooldownMs: 30000 # Minimum interval between spawns. Prevents burst storms. | ||
| spawnQueueThreshold: 3 # Queue depth that triggers overflow spawn when persistent pool is saturated. | ||
| namespace: "" # Leave empty to use the release namespace. Sets EPHEMERAL_DAEMON_NAMESPACE. | ||
| secretName: "" # Existing Secret in the ephemeral-daemon namespace that spawned Pods mount via envFrom. Leave empty to use the app default (daemon-secrets). Every key in it becomes an env var on Pods that run agent-authored code. Sets EPHEMERAL_DAEMON_SECRET_NAME. | ||
| image: "" # Leave empty to use the daemon image helper. Sets DAEMON_IMAGE. | ||
| orchestratorPublicUrl: "" # Optional ws:// or wss:// URL ephemeral daemons dial back. Unset OK when spawned Pods can reach the in-cluster orchestrator Service. | ||
|
|
||
| # --- 8a. Isolated workflow runners (K8s-spawned per-attempt Pods) --- | ||
| # Structured `workflow-run` jobs each run in one bare Pod per attempt, in a | ||
| # dedicated namespace, gated by secrets.workflowRunnerCapabilitySecret (unset | ||
| # → feature off). Requires rbac.create=true so the orchestrator can manage | ||
| # runner Pods. Every knob has an app default; leave empty to inherit it. The | ||
| # internal WORKFLOW_RUNNER flag is spawner-injected and never set here. See | ||
| # upstream src/k8s/workflow-runner-spawner.ts. | ||
| workflowRunner: | ||
| namespace: "" # Dedicated namespace for runner Pods, per-attempt Secrets, PSA, and the runner ValidatingAdmissionPolicy. Must differ from ephemeralDaemon.namespace. Empty → app default (github-app-runners). Sets WORKFLOW_RUNNER_NAMESPACE. | ||
| nodeLabel: "" # Node label key the runner Pod's nodeSelector and NoSchedule toleration are both built from. Empty → app default (github-app.node-restriction.kubernetes.io/workflow-runner). Sets WORKFLOW_RUNNER_NODE_LABEL. | ||
| nodeValue: "" # Value paired with nodeLabel. Empty → app default (true). Sets WORKFLOW_RUNNER_NODE_VALUE. | ||
| imagePullSecret: "" # Name of an existing kubernetes.io/dockerconfigjson Secret in the runner namespace that runner Pods may reference. Empty emits no imagePullSecrets (anonymous-pull registries only). Sets WORKFLOW_RUNNER_IMAGE_PULL_SECRET. | ||
|
|
||
| # --- 9. Triage (binary heavy classifier) --- | ||
| triageEnabled: true # Kill-switch for the triage LLM call. | ||
| triageToolsEnabled: true # Kill-switch for tool-driven triage (upstream #117). When false, falls back to snapshot-only triage classifier. | ||
|
|
@@ -426,7 +444,8 @@ config: | |
| schedulerEnabled: true # Chart default ON (upstream defaults OFF). Master kill-switch for the scheduler. When false the scheduler never starts. | ||
| schedulerScanIntervalMs: 300000 # Tick cadence (5m). Zod range [60000, 3600000]. Below 60s the per-tick GitHub API cost is not worth it; above 1h cron precision degrades. | ||
| schedulerAllowAutoMerge: false # Privilege gate for the `merge_readiness` MCP tool. When true (and an action sets `auto_merge: true`), the tool can merge PRs. Does NOT sandbox the agent from merging by other means: `allowed_tools` is owner-trusted config. Default OFF — opt-in per deployment. | ||
| repoConfigFile: ".github-app.yaml" # Filename read from each installed repo's default-branch root, carrying the repo-wide per-repo policy (workflow toggles, agent knobs, scheduled actions, review-learnings). Trimmed at load — a stray space 404s on every repo and silently disables the surface. Sets REPO_CONFIG_FILE. | ||
| schedulerConfigFile: ".github-app.yaml" # DEPRECATED former name for repoConfigFile; still honoured as a fallback (logs a one-shot boot warning) so upgrades don't silently change which file is read. Sets SCHEDULER_CONFIG_FILE. | ||
|
Comment on lines
+447
to
+448
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -euo pipefail
fd -t f -e ts -e yaml -e yml . -x rg -n -C 8 \
'REPO_CONFIG_FILE|SCHEDULER_CONFIG_FILE|repoConfigFile|schedulerConfigFile'
helm template github-app charts/github-app \
--set config.schedulerConfigFile=legacy.yaml |
rg -n 'REPO_CONFIG_FILE|SCHEDULER_CONFIG_FILE'Repository: chrisleekr/helm-charts Length of output: 7103 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- repository conventions ---'
head -5 /tmp/coderabbit-repo-knowledge/chrisleekr-helm-charts-da203bd2/*/*.md 2>/dev/null || true
printf '%s\n' '--- direct bindings and precedence ---'
rg -n -C 12 'REPO_CONFIG_FILE|SCHEDULER_CONFIG_FILE|repoConfigFile|schedulerConfigFile' \
charts/github-app templates . 2>/dev/null | head -240Repository: chrisleekr/helm-charts Length of output: 24536 🌐 Web query:
💡 Result: Based on the available documentation and related project resources, there is no evidence that REPO_CONFIG_FILE or SCHEDULER_CONFIG_FILE are standard environment variables with defined precedence rules within the chrisleekr/github-app repository or its associated helm-charts [1][2][3]. The chrisleekr/github-app and its playground chart typically use standard Kubernetes configuration patterns, such as a values.yaml file for Helm and ConfigMaps or Secrets for runtime environment variables [3][4][5]. Configurations for these deployments are generally managed through the Helm chart values, which follow standard Helm merging precedence (e.g., default values.yaml < user-provided values files < --set flags) [3][6]. If you are observing references to REPO_CONFIG_FILE or SCHEDULER_CONFIG_FILE, they are likely specific to custom integrations, third-party tooling, or application-specific logic not documented as a core feature of the chrisleekr/github-app project [1][7][8]. Users should verify if these variables are being injected by custom CI/CD pipelines or specific deployment wrappers, as the official documentation emphasizes configuration via the Helm values structure [1][3][5]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
tmp="$(mktemp)"
curl -fsSL 'https://api.github.com/repos/chrisleekr/github-app/git/trees/v1.17.0?recursive=1' > "$tmp"
jq -r '.tree[] | select(.path | test("config|env|repo|scheduler"; "i")) | .path' "$tmp" | head -120
printf '%s\n' '--- matching source files ---'
jq -r '.tree[] | select(.type == "blob" and (.path | test("\\.(ts|js|json)$"))) | .path' "$tmp" |
while IFS= read -r path; do
content="$(curl -fsSL "https://raw.githubusercontent.com/chrisleekr/github-app/v1.17.0/$path")"
if printf '%s' "$content" | rg -n 'REPO_CONFIG_FILE|SCHEDULER_CONFIG_FILE|repoConfigFile|schedulerConfigFile'; then
printf 'FILE: %s\n' "$path"
fi
doneRepository: chrisleekr/helm-charts Length of output: 4745 Preserve legacy repository-config overrides. The chart renders both variables. In 🤖 Prompt for AI Agents |
||
| reviewLearningsEnabled: true # Master kill-switch for review-learnings. When false the orchestrator never loads learnings into job:payload, the prompt block stays empty, and save/delete MCP calls are dropped. Additive feature — safe to leave ON. | ||
| reviewLearningsRagEnabled: true # Chart default ON (upstream defaults OFF). Stage 2 pgvector RAG path: orchestrator embeds each directive at save time + each PR's changed-file paths at handleAccept, then runs pgvector top-K against `review_learnings.embedding`. REQUIRES Postgres migration 015 (pgvector extension); if missing or migration not applied, falls back to legacy file-glob filter. | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: chrisleekr/helm-charts
Length of output: 7924
🏁 Script executed:
Repository: chrisleekr/helm-charts
Length of output: 25405
Sensitive Data Exposure (CWE-668)
Reachability: Internal
Separate controller-only capability secrets from the daemon Secret.
The daemon Deployment imports the shared Secret with
envFrom, so both capability keys become daemon environment variables. Use a controller-only Secret or allow-list daemon Secret keys.🤖 Prompt for AI Agents