From c0ff0de8f70ad4ddad7de4c1d09d06fc64399beb Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Wed, 16 Sep 2026 19:57:39 +0200
Subject: [PATCH] fix: consume protected platform values

---
 .../templates/delivery-pipeline.yaml.tmpl     | 37 +++++++------------
 internal/bootstrap/bootstrap.go               |  8 ++--
 internal/bootstrap/bootstrap_test.go          | 12 +++---
 3 files changed, 24 insertions(+), 33 deletions(-)

diff --git a/internal/assets/templates/delivery-pipeline.yaml.tmpl b/internal/assets/templates/delivery-pipeline.yaml.tmpl
index 97d9137..3c2a86d 100644
--- a/internal/assets/templates/delivery-pipeline.yaml.tmpl
+++ b/internal/assets/templates/delivery-pipeline.yaml.tmpl
@@ -27,10 +27,6 @@ spec:
     - name: environment
     - name: pr-number
       default: ""
-    - name: platform-url
-      default: ""
-    - name: platform-revision
-      default: ""
     - name: forgejo-base-url
       default: ""
     - name: forgejo-owner
@@ -57,10 +53,6 @@ spec:
           value: $(params.environment)
         - name: PR_NUMBER
           value: $(params.pr-number)
-        - name: PLATFORM_URL
-          value: $(params.platform-url)
-        - name: PLATFORM_REVISION
-          value: $(params.platform-revision)
         - name: FORGEJO_BASE_URL
           value: $(params.forgejo-base-url)
         - name: FORGEJO_OWNER
@@ -102,8 +94,6 @@ spec:
         cd /tmp/manifests
         if [ "$ENVIRONMENT" = preview ]; then
           valid_pr_number "$PR_NUMBER"
-          valid_url "$PLATFORM_URL"
-          valid_revision "$PLATFORM_REVISION"
           app_dir="apps/previews/$APP_NAME-pr-$PR_NUMBER"
           marker="$app_dir/ownership.yaml"
           if [ -e "$app_dir" ]; then
@@ -129,12 +119,7 @@ spec:
         EOF
             cmp -s "$expected_marker" "$marker" || fail
           fi
-          git clone "$PLATFORM_URL" /tmp/platform
-          git -C /tmp/platform checkout "$PLATFORM_REVISION"
-          [ -f /tmp/platform/preview/values.yaml ] || fail
           mkdir -p "$app_dir"
-          cp /tmp/platform/preview/values.yaml "$app_dir/values.yaml"
-          sed -i "s/PLACEHOLDER_PR/$PR_NUMBER/g" "$app_dir/values.yaml"
           cat > "$marker" <<EOF
         apiVersion: v1
         kind: ConfigMap
@@ -169,14 +154,20 @@ spec:
           chart:
             spec:
               chart: ./charts/$APP_NAME
+              reconcileStrategy: Revision
               sourceRef:
                 kind: GitRepository
                 name: $APP_NAME
                 namespace: flux-system
+              valuesFiles:
+                - ./charts/$APP_NAME/values.yaml
+                - ./preview/values.yaml
           values:
             image:
               repository: $IMAGE
               tag: $TAG
+            gateway:
+              hostname: $APP_NAME-pr-$PR_NUMBER.{{ .ClusterDomain }}
         EOF
           cat > "$app_dir/kustomization.yaml" <<EOF
         apiVersion: kustomize.config.k8s.io/v1beta1
@@ -212,10 +203,14 @@ spec:
           chart:
             spec:
               chart: ./charts/$APP_NAME
+              reconcileStrategy: Revision
               sourceRef:
                 kind: GitRepository
                 name: $APP_NAME
                 namespace: flux-system
+              valuesFiles:
+                - ./charts/$APP_NAME/values.yaml
+                - ./staging/values.yaml
           values:
             image:
               repository: $IMAGE
@@ -259,10 +254,14 @@ spec:
           chart:
             spec:
               chart: ./charts/$APP_NAME
+              reconcileStrategy: Revision
               sourceRef:
                 kind: GitRepository
                 name: $APP_NAME
                 namespace: flux-system
+              valuesFiles:
+                - ./charts/$APP_NAME/values.yaml
+                - ./production/values.yaml
           values:
             image:
               repository: $IMAGE
@@ -628,10 +627,6 @@ spec:
       default: {{ quote .ForgejoOwner }}
     - name: manifests-repo
       default: {{ quote .ManifestsRepo }}
-    - name: platform-url
-      default: {{ quote .AppRepoURL }}
-    - name: platform-revision
-      default: {{ quote .PlatformBranch }}
   tasks:
     - name: build-layer
       when:
@@ -681,10 +676,6 @@ spec:
           value: preview
         - name: pr-number
           value: $(params.pr-number)
-        - name: platform-url
-          value: $(params.platform-url)
-        - name: platform-revision
-          value: $(params.platform-revision)
     - name: update-staging
       runAfter: [build-layer]
       when:
diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go
index 2b45822..db2b52c 100644
--- a/internal/bootstrap/bootstrap.go
+++ b/internal/bootstrap/bootstrap.go
@@ -622,7 +622,6 @@ type appDeliveryTemplateConfig struct {
 	AppRepository        string
 	AppRepoURL           string
 	AppRepoRef           string
-	PlatformBranch       string
 	ProductionBranch     string
 	ImageRepository      string
 	BuildStrategy        string
@@ -633,6 +632,7 @@ type appDeliveryTemplateConfig struct {
 	ManifestsURL         string
 	ManifestsRepo        string
 	ManifestsBranch      string
+	ClusterDomain        string
 }
 
 var deliveryAppName = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,45}[a-z0-9])?$`)
@@ -654,11 +654,11 @@ func renderAppDelivery(cfg config.Config) ([]byte, error) {
 	}
 	values := appDeliveryTemplateConfig{
 		AppName: cfg.Delivery.AppName, AppRepository: appRepository, AppRepoURL: cfg.Delivery.AppRepoURL,
-		AppRepoRef: cfg.Delivery.AppRepoRef, PlatformBranch: "maidn/platform-" + cfg.Delivery.AppName, ProductionBranch: cfg.Delivery.ProductionBranch, ImageRepository: cfg.Delivery.ImageRepository,
+		AppRepoRef: cfg.Delivery.AppRepoRef, ProductionBranch: cfg.Delivery.ProductionBranch, ImageRepository: cfg.Delivery.ImageRepository,
 		BuildStrategy: cfg.Delivery.BuildStrategy, BuildOutputDirectory: cfg.Delivery.BuildOutputDirectory, BuildConfiguration: cfg.Delivery.BuildConfiguration,
-		ForgejoBaseURL: origin, ForgejoOwner: cfg.Git.Owner, ManifestsURL: forgejo.CloneURL(origin, cfg.Git.Owner, cfg.Flux.ManifestsRepo), ManifestsRepo: cfg.Flux.ManifestsRepo, ManifestsBranch: cfg.Flux.Branch,
+		ForgejoBaseURL: origin, ForgejoOwner: cfg.Git.Owner, ManifestsURL: forgejo.CloneURL(origin, cfg.Git.Owner, cfg.Flux.ManifestsRepo), ManifestsRepo: cfg.Flux.ManifestsRepo, ManifestsBranch: cfg.Flux.Branch, ClusterDomain: cfg.Flux.ClusterDomain,
 	}
-	for name, value := range map[string]string{"appRepository": values.AppRepository, "appRepoUrl": values.AppRepoURL, "appRepoRef": values.AppRepoRef, "platformBranch": values.PlatformBranch, "productionBranch": values.ProductionBranch, "imageRepository": values.ImageRepository, "buildOutputDirectory": values.BuildOutputDirectory, "buildConfiguration": values.BuildConfiguration, "forgejoBaseUrl": values.ForgejoBaseURL, "forgejoOwner": values.ForgejoOwner, "manifestsUrl": values.ManifestsURL, "manifestsRepo": values.ManifestsRepo, "manifestsBranch": values.ManifestsBranch} {
+	for name, value := range map[string]string{"appRepository": values.AppRepository, "appRepoUrl": values.AppRepoURL, "appRepoRef": values.AppRepoRef, "productionBranch": values.ProductionBranch, "imageRepository": values.ImageRepository, "buildOutputDirectory": values.BuildOutputDirectory, "buildConfiguration": values.BuildConfiguration, "forgejoBaseUrl": values.ForgejoBaseURL, "forgejoOwner": values.ForgejoOwner, "manifestsUrl": values.ManifestsURL, "manifestsRepo": values.ManifestsRepo, "manifestsBranch": values.ManifestsBranch, "clusterDomain": values.ClusterDomain} {
 		if value == "" || strings.ContainsAny(value, "\r\n") || config.RedactURL(value) != value {
 			return nil, fmt.Errorf("delivery %s cannot be empty or contain credentials", name)
 		}
diff --git a/internal/bootstrap/bootstrap_test.go b/internal/bootstrap/bootstrap_test.go
index 53de2e5..3ccfa19 100644
--- a/internal/bootstrap/bootstrap_test.go
+++ b/internal/bootstrap/bootstrap_test.go
@@ -111,7 +111,7 @@ func TestRemoveDuplicateAppDeliverySource(t *testing.T) {
 func TestGeneratedDeliveryUsesCombinedStaticBuildArtifactContract(t *testing.T) {
 	cfg := config.Config{
 		Git:      config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
-		Flux:     config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"},
+		Flux:     config.FluxConfig{Branch: "main", ClusterDomain: "example.test", ManifestsRepo: "manifests"},
 		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildStrategy: "static", BuildOutputDirectory: "dist/web-ui", BuildConfiguration: "production"},
 	}
 	content, err := renderAppDelivery(cfg)
@@ -123,12 +123,12 @@ func TestGeneratedDeliveryUsesCombinedStaticBuildArtifactContract(t *testing.T)
 			t.Fatalf("generated delivery does not contain %q", expected)
 		}
 	}
-	for _, expected := range []string{"name: platform-url\n      default: \"https://git.example.test/apps/web-ui.git\"", "name: platform-revision\n      default: \"maidn/platform-web-ui\"", "git clone \"$PLATFORM_URL\" /tmp/platform", "/tmp/platform/preview/values.yaml"} {
+	for _, expected := range []string{"reconcileStrategy: Revision", "valuesFiles:\n                - ./charts/$APP_NAME/values.yaml\n                - ./preview/values.yaml", "valuesFiles:\n                - ./charts/$APP_NAME/values.yaml\n                - ./staging/values.yaml", "valuesFiles:\n                - ./charts/$APP_NAME/values.yaml\n                - ./production/values.yaml", "hostname: $APP_NAME-pr-$PR_NUMBER.example.test"} {
 		if !strings.Contains(string(content), expected) {
-			t.Fatalf("generated delivery does not contain protected platform input %q", expected)
+			t.Fatalf("generated delivery does not contain protected platform values %q", expected)
 		}
 	}
-	for _, unexpected := range []string{"maidn-git-clone", "maidn-node-static-build", "maidn-node-static-push", "runAfter: [clone]", "name: source", "workspace: source", "workspace: artifact", "easycsr", "test-org", "git rm -r", "$APP_URL", "$APP_REVISION", "/tmp/app/preview/values.yaml"} {
+	for _, unexpected := range []string{"maidn-git-clone", "maidn-node-static-build", "maidn-node-static-push", "runAfter: [clone]", "name: source", "workspace: source", "workspace: artifact", "easycsr", "test-org", "git rm -r", "$APP_URL", "$APP_REVISION", "platform-url", "platform-revision", "/tmp/platform", "/tmp/app/preview/values.yaml"} {
 		if strings.Contains(string(content), unexpected) {
 			t.Fatalf("generated delivery contains unexpected %q", unexpected)
 		}
@@ -138,7 +138,7 @@ func TestGeneratedDeliveryUsesCombinedStaticBuildArtifactContract(t *testing.T)
 func TestGeneratedDeliveryUsesRuntimeImageWithoutStaticParameters(t *testing.T) {
 	cfg := config.Config{
 		Git:      config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
-		Flux:     config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"},
+		Flux:     config.FluxConfig{Branch: "main", ClusterDomain: "example.test", ManifestsRepo: "manifests"},
 		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildStrategy: "runtime", BuildOutputDirectory: "dist/web-ui", BuildConfiguration: "production"},
 	}
 	content, err := renderAppDelivery(cfg)
@@ -160,7 +160,7 @@ func TestGeneratedDeliveryUsesRuntimeImageWithoutStaticParameters(t *testing.T)
 func TestGeneratedDeliveryInitializesStagingAndPromotesByPullRequest(t *testing.T) {
 	cfg := config.Config{
 		Git:      config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
-		Flux:     config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"},
+		Flux:     config.FluxConfig{Branch: "main", ClusterDomain: "example.test", ManifestsRepo: "manifests"},
 		Delivery: config.DeliveryConfig{AppName: "web-ui", AppRepoURL: "https://git.example.test/apps/web-ui.git", AppRepoRef: "main", ProductionBranch: "production", ImageRepository: "registry.example.test/apps/web-ui", BuildStrategy: "static", BuildOutputDirectory: "dist", BuildConfiguration: "production"},
 	}
 	content, err := renderAppDelivery(cfg)