deploy: hold dinersclub at v0.0.43-wa until DingConnect is live - #147
Open
nandanrao wants to merge 1 commit into
Open
deploy: hold dinersclub at v0.0.43-wa until DingConnect is live#147nandanrao wants to merge 1 commit into
nandanrao wants to merge 1 commit into
Conversation
Both values files were bumped to v0.0.45 in 0fbe0de but never applied, so the version has sat ahead of the cluster since. That made it a silent passenger: the next `helm upgrade` for any other service would have shipped it, because helm upgrades the whole release. DingConnect is not operational yet, and v0.0.45 is the commit that switches its credential resolution to Generic Secrets — deliberately dropping support for the legacy entity='dingconnect' credential (TestDingConnectAuth_IgnoresLegacyEntity pins that). Deploying it before the secrets are seeded would break DingConnect payments rather than merely not help. Pinned back to v0.0.43-wa, which is what both clusters are actually running, so the values files once again describe the live state. The code stays on main and the image stays built; only the deployment waits. A comment at each site records why and what unblocks it, so the next person to see 43-wa next to a published 45 does not read it as drift and "fix" it. Holding costs nothing else: the whole v0.0.43-wa..v0.0.45 range is DingConnect-scoped — dingconnect.go, its tests, a new secrets.go referenced by nothing else, and the go-dingconnect dep. No other provider is touched, and DINERSCLUB_PROVIDERS in both envs is "fake,reloadly,giftcard,http", which does not include dingconnect at all. With this, `helm upgrade` against either values file changes exactly one image: vprod replybot v0.0.213 -> v0.0.215 vstag replybot v0.0.211-wa -> v0.0.215
✅ Deploy Preview for vlab-research canceled.
|
✅ Deploy Preview for virtuallab-videos canceled.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the next
helm upgradeship replybot and nothing else.Why
0fbe0deabumpedversionDinersclubto v0.0.45 in both values files, but it was never applied — so the version has sat ahead of the cluster since. That made it a silent passenger:helm upgradeacts on the whole release, so deploying replybot would have shipped dinersclub too.DingConnect isn't operational yet, and v0.0.45 is exactly the commit that switches its credential resolution to Generic Secrets — deliberately dropping the legacy
entity='dingconnect'credential (TestDingConnectAuth_IgnoresLegacyEntitypins that behaviour). Deploying it before the secrets are seeded would break DingConnect payments rather than merely not help.What this does
Pins both files back to
v0.0.43-wa— what both clusters actually run — so the values files describe live state again. The code stays on main, the image stays built; only the deployment waits.A comment at each site records why and what unblocks it, so the next person to see
43-wanext to a published45doesn't read it as drift and "fix" it.Blast radius of holding: nil
The whole
v0.0.43-wa..v0.0.45range is DingConnect-scoped —dingconnect.go, its tests, a newsecrets.goreferenced by nothing else, and thego-dingconnectdep. No other provider is touched. AndDINERSCLUB_PROVIDERSin both envs is"fake,reloadly,giftcard,http"— dingconnect isn't in the enabled list at all.Verified
helm templateagainst each values file, diffed against the live images:Exactly one image changes per namespace. Nothing else.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XrTQ71XhpBp678wC3TB5CF