feat: manage app OpenBao secrets #43

Merged
eding merged 2 commits from feat/app-secret-cli into fix/local-static-build-workspace 2026-09-12 23:40:58 +02:00
3 changed files with 17 additions and 41 deletions
Showing only changes of commit 788f30fe11 - Show all commits

View file

@ -357,57 +357,31 @@ spec:
- name: manifests-repo - name: manifests-repo
default: {{ quote .ManifestsRepo }} default: {{ quote .ManifestsRepo }}
workspaces: workspaces:
- name: source - name: artifact
tasks: tasks:
- name: clone - name: build-layer
when: when:
- input: $(params.event-action) - input: $(params.event-action)
operator: notin operator: notin
values: [closed] values: [closed]
taskRef: taskRef:
name: maidn-git-clone name: maidn-node-static-image
params: params:
- name: url - name: url
value: {{ quote .AppRepoURL }} value: {{ quote .AppRepoURL }}
- name: revision - name: revision
value: $(params.git-revision) value: $(params.git-revision)
workspaces: - name: image
- name: source value: $(params.image)
workspace: source
- name: build-layer
runAfter: [clone]
when:
- input: $(params.event-action)
operator: notin
values: [closed]
taskRef:
name: maidn-node-static-build
params:
- name: output-directory - name: output-directory
value: {{ quote .BuildOutputDirectory }} value: {{ quote .BuildOutputDirectory }}
- name: build-configuration - name: build-configuration
value: {{ quote .BuildConfiguration }} value: {{ quote .BuildConfiguration }}
workspaces: workspaces:
- name: source - name: artifact
workspace: source workspace: artifact
- name: push
runAfter: [build-layer]
when:
- input: $(params.event-action)
operator: notin
values: [closed]
taskRef:
name: maidn-node-static-push
params:
- name: image
value: $(params.image)
- name: revision
value: $(params.git-revision)
workspaces:
- name: source
workspace: source
- name: update-preview - name: update-preview
runAfter: [push] runAfter: [build-layer]
when: when:
- input: $(params.event-type) - input: $(params.event-type)
operator: in operator: in
@ -439,7 +413,7 @@ spec:
- name: app-revision - name: app-revision
value: $(params.git-revision) value: $(params.git-revision)
- name: update-staging - name: update-staging
runAfter: [push] runAfter: [build-layer]
when: when:
- input: $(params.event-type) - input: $(params.event-type)
operator: in operator: in
@ -465,7 +439,7 @@ spec:
- name: environment - name: environment
value: staging value: staging
- name: promote-production - name: promote-production
runAfter: [push] runAfter: [build-layer]
when: when:
- input: $(params.event-type) - input: $(params.event-type)
operator: in operator: in

View file

@ -668,7 +668,7 @@ func renderAppDelivery(cfg config.Config) ([]byte, error) {
if err := tmpl.Execute(&rendered, values); err != nil { if err := tmpl.Execute(&rendered, values); err != nil {
return nil, err return nil, err
} }
return rendered.Bytes(), nil return bytes.ReplaceAll(rendered.Bytes(), []byte("\r\n"), []byte("\n")), nil
} }
func deliveryRepository(baseURL, repositoryURL string) (string, error) { func deliveryRepository(baseURL, repositoryURL string) (string, error) {

View file

@ -108,7 +108,7 @@ func TestRemoveDuplicateAppDeliverySource(t *testing.T) {
} }
} }
func TestGeneratedDeliveryIsGenericAndUsesSafePreviewCleanupContract(t *testing.T) { func TestGeneratedDeliveryUsesCombinedStaticBuildArtifactContract(t *testing.T) {
cfg := config.Config{ cfg := config.Config{
Git: config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"}, Git: config.GitConfig{BaseURL: "https://git.example.test", Owner: "platform"},
Flux: config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"}, Flux: config.FluxConfig{Branch: "main", ManifestsRepo: "manifests"},
@ -118,13 +118,15 @@ func TestGeneratedDeliveryIsGenericAndUsesSafePreviewCleanupContract(t *testing.
if err != nil { if err != nil {
t.Fatal(err) t.Fatal(err)
} }
for _, expected := range []string{"maidn-git-clone", "maidn-node-static-build", "maidn-node-static-push", "runAfter: [clone]", "runAfter: [build-layer]", "maidn-preview-orphan-reconciler", "valid_pr_number()", "valid_commit()", "values: [promotion]", "values: [\"production\"]", "cmp -s \"$expected_marker\" \"$marker\"", "values: [closed]"} { for _, expected := range []string{"name: build-layer", "maidn-node-static-image", "name: url\n value: \"https://git.example.test/apps/web-ui.git\"", "name: revision\n value: $(params.git-revision)", "name: image\n value: $(params.image)", "name: artifact\n workspace: artifact", "runAfter: [build-layer]", "maidn-preview-orphan-reconciler", "valid_pr_number()", "valid_commit()", "values: [promotion]", "values: [\"production\"]", "cmp -s \"$expected_marker\" \"$marker\"", "values: [closed]"} {
if !strings.Contains(string(content), expected) { if !strings.Contains(string(content), expected) {
t.Fatalf("generated delivery does not contain %q", expected) t.Fatalf("generated delivery does not contain %q", expected)
} }
} }
if strings.Contains(string(content), "easycsr") || strings.Contains(string(content), "test-org") || strings.Contains(string(content), "git rm -r") { for _, unexpected := range []string{"maidn-git-clone", "maidn-node-static-build", "maidn-node-static-push", "runAfter: [clone]", "name: source", "workspace: source", "easycsr", "test-org", "git rm -r"} {
t.Fatal("generated delivery contains a non-generic or unsafe literal") if strings.Contains(string(content), unexpected) {
t.Fatalf("generated delivery contains unexpected %q", unexpected)
}
} }
} }