Repository navigation
fleet-apply.sh: remove the legacy settings flags that race terraform/ - #301
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Review (haiku, claude-review.yml)Review of PR #301: remove the live-write flags from
|
Contributor
terraform plan (success) |
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cpitzi
changed the title
Contributor
Author
Review triageBoth findings are fixed. 6af99ae only answers these findings, so it needs no fresh review.
The Terraform plan on this PR reports Both findings are triaged, so I'm arming auto-merge. The required checks gate it on 6af99ae. |
cpitzi
enabled auto-merge (squash)
October 31, 2026 18:56
Contributor
terraform plan (success) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #298
Summary
Implements option A from #298, decided 2026-10-31:
fleet-apply.shno longer writes any repo setting.terraform/is now the only writer of merge options, the topic spine, rulesets, required checks and labels. The script keeps three jobs that Terraform cannot express: the read-only drift check, the required-context preflight inside it, and--prune-branches.The removed paths wrote Terraform-owned surfaces live, with no plan. They raced the Terraform state, and the next apply reverted them (and that apply only runs on a merge touching
terraform/orfleet-ops/*.json).--require-checksalso hard-codedstrict_required_status_checks_policy: false, which disagreed withterraform/locals.tf'sstrict_up_to_date_repos.What was removed
--apply(and its per-repo block)gh repo editfor merge-button options and spine topics, plus a POST ofrepo-ruleset.jsonto a repo with no ruleset--require-checks,--allow-check-removal,require_checks_apply()required_status_checksrule--apply-labels,labels_apply()gh label edit/gh label createfleet-ops/repo-ruleset.json--apply.terraform/rulesets.tfdeclares the ruleset itself and never read this fileMODE,REQUIRE,LABELS,ALLOW_REMOVAL,LABELS_MAP,ACTIONS_APP_IDEach removed flag now exits 2 with one line on stderr, before or after
--repo NAME. Passed as the--repovalue itself (--repo --apply), it is rejected by--repo, which exits 2 with--repo needs a name, got flag '--apply'and runs no sweep:--checkis still accepted as a no-op, because it was the default. The only write left in the script is--prune-branches'sgh api -X DELETE …/git/refs/heads/<branch>.What changed alongside
-hheader: rewritten for what the script does now. It names the removed flags and fleet-apply.sh: retire or fence the legacy settings flags that race terraform/ #298, and lists the remaining usage (--repo,--prune-branches).fleet-ops/README.md:fleet-apply.shsection shows only the remaining usage.labels.jsonsection drops the--apply-labelsusage andensuretable.required-checks.jsonsection replaces the--require-checksusage with the read-only preflight command and keeps rule 3's history in the past tense.README.md(thefleet-apply.shbullet; therepo-ruleset.jsonbullet is removed)brand/README.md(labels are applied byterraform/labels.tf)_commentblocks inlabels.jsonandrequired-checks.jsonterraform/labels.tfci/validate.pystrings: the module docstring, the configs docstring, and the empty-required-checks.jsonfailure messageorg-ruleset.json, which is unchanged), and the past-tense comments interraform/rulesets.tfandterraform/README.md.Because this touches
fleet-ops/*.jsonandterraform/labels.tf, the Terraform plan runs on this PR. Only comments changed (_commentis not read by the module, and the.tfchange is a comment), so the plan should report no changes.Filed, not swept
ensurefield fromlabels.json. It encoded the removed--apply-labelssemantics, nothing reads it, andci/validate.pystill requires it. That is a data and validator change, so it was kept out of this removal.Testing
Every run below used a guard
ghfirst onPATHthat fails any PUT, POST, DELETE, PATCH,edit,createormerge.--apply,--require-checks,--allow-check-removaland--apply-labels, alone and after--repo epigaea, each exit 2 with the pointer line before anyghcall.--repo epigaeaand--check --repo epigaeaboth report✓ epigaea settings okwith no guard hits.required-checks.jsonadding a bogusBatzto epigaea, the run shows⧗ req-checks missing=[Batz] ✗ req-checks never-seen-on-a-PR=[Batz].shellcheckis clean,bash -nis ok,python3 ci/validate.pypasses,terraform fmt -checkis clean, and everyfleet-ops/*.jsonparses.--prune-brancheswas not exercised. Its code is unchanged, and running it deletes real branches.🤖 Generated with Claude Code