Write down the pull request convention - #129
Closed
evansibok wants to merge 2 commits into
Closed
Conversation
Bundles all shared ~/.nanny/certs. A second app's generate refused to
run, and --force would have replaced the first app's certificate
authority, invalidating every certificate already deployed from it with
no indication that had happened. They now live at
~/.nanny/servers/<app_id>/certs/{sandbox,live}/, beside the governor
state of the app they belong to, so every certs command has to run inside
the project.
--live selects the authority, on the certs commands and on --serve, which
has to look where they wrote. Two environments means two authorities, and
that is the whole point: a CA is what a governor trusts, so one authority
spanning both means a client certificate issued for sandbox is admitted
to production, and the production governor cannot tell, because the
signature really is valid. Sandbox is the default and production is typed
every time, because rotate takes no confirmation and reissuing a live
bundle stops every joiner still holding the old client certificate.
Reuses the words the nny_sdbx_/nny_live_ prefixes already put in front of
users rather than adding a second vocabulary for the same idea. They stay
independent axes: this picks the trust anchor, the key prefix picks the
cloud, neither reads the other.
Removes --out-dir, which existed only on generate while rotate, show,
import and remove hardcoded the default, so a bundle written with it
could not afterwards be rotated or inspected.
Removes --config. A project has one nanny.toml at its root, which the
runtime already enforces. The flag was global, so it appeared under every
subcommand, and exactly one path read it: plain nanny run. --serve
accepted and ignored it, reading ./nanny.toml regardless. Both paths now
resolve from the working directory. The tests that used it to target a
temporary project set the child's working directory instead, which is
per-process and safe under a parallel run where the flag's replacement
would not have been.
Fixes a documented instruction to keep ca.key on the server machine. It
signs certificates, so whoever holds it can mint a client that any
governor trusting that CA will admit. It never leaves the machine that
generated it.
Every PR here already follows one shape: sections named after the problem rather than the change, numbered when there are several, and a Verification section last saying what ran and what was added. Nothing recorded it, so following it meant reading the last six PRs first, and anyone who did not read them wrote something else. The template is mostly comments, because the parts worth enforcing are the two rules in CONTRIBUTING.md and not a form to fill in.
Contributor
Author
|
Folded into #128, which now carries both commits. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Asked why the PRs here look improvised. They are not: #122 through #128 all use the same shape. But nothing records it, so following it means reading the last six PRs first, and anyone who does not read them writes something else.
The convention existed only in the PRs themselves
Extracted from the merged history:
##sections named after the problem, not the change.## The tokenand## The session token could only be an environment value, never## Summaryor## What changed.## 1.) when a PR carries several distinct defects, as docs: correct v0.6.0's docs, drop the declared token cost, and surface the Rust pack gap聽#124 and feat: secrets from files, a rotatable session token, and a fleet that survives a governor restart聽#125 do.## Verificationlast, in every one of them..github/pull_request_template.mdnow carries that, andCONTRIBUTING.mdgains a short section for the two parts that actually matter: name sections after the problem, and always verify in the open.The template is mostly HTML comments. A form with fields to fill in produces filled-in fields; the useful part is the two rules, which live in
CONTRIBUTING.mdwhere they are read once rather than skimmed every time.Verification
No code.
.github/pull_request_template.mdis picked up by GitHub for PRs opened through the web UI;gh pr create --bodyoverrides it, which is why the convention is also written inCONTRIBUTING.mdrather than only in the template.Rendered the template on this PR before replacing it with this body.