fix: sign GitOps bumps, run tests in CI, scope feature snapshots #29

2026-10-12T10:52:31Z

KofTwentyTwo commented

2026-10-12 10:52:31 +00:00

(Migrated from github.com)

Summary

Signed GitOps commits. update_cd_repo now creates the CD-repository commit with the GraphQL createCommitOnBranch mutation instead of git commit + git push. GitHub signs API-created commits, so the GitOps repository (cluster-gitops) can require signed commits on main with no bypass actor. expectedHeadOid replaces the rebase loop: a concurrent bump fails cleanly and is retried (up to 3 times) against the refreshed head with the edits re-applied. The commit is authored by the GITHUB_TOKEN identity; the source repo and SHA stay in the body. ci_git_email / ci_git_name are kept for compatibility but are documented as ignored.
CI runs the tests. New test job (cimg/node:22.12, yq v4.44.6, bats 1.11.1): make test-scripts test-templates and bats tests.
orb-tools pinned to the exact circleci/orb-tools@12.5.0 (was the floating @12.1).
#26. Only develop publishes dev:snapshot; feature/* publishes the immutable dev:<sha> tag only.
#27 (item 1). org is added to the generator's KNOWN_KEYS, so the documented org: block no longer warns. Packed script regenerated.
.editorconfig added (K22-REPO-03). The scripts stay at 2-space indentation under a standards exception; no reformatting.

Verification

shellcheck --severity=warning and bash -n clean on update_cd_repo.sh.
End-to-end probe: I ran the new script against a temporary gaps/signing-probe branch in this repo using a kustomize fixture. It produced commit b5da7ea, which GitHub reports as verified: true, reason: valid (committer GitHub). For comparison, a REST git/commits commit made with the same token was unsigned. The probe branch is deleted.
I could not run the BATS and script suites locally because this Windows host has no bats or circleci CLI. The new CI test job is their first run.

Refs #26, #27.

🤖 Generated with Claude Code

## Summary - **Signed GitOps commits.** `update_cd_repo` now creates the CD-repository commit with the GraphQL `createCommitOnBranch` mutation instead of `git commit` + `git push`. GitHub signs API-created commits, so the GitOps repository (cluster-gitops) can require signed commits on `main` with no bypass actor. `expectedHeadOid` replaces the rebase loop: a concurrent bump fails cleanly and is retried (up to 3 times) against the refreshed head with the edits re-applied. The commit is authored by the `GITHUB_TOKEN` identity; the source repo and SHA stay in the body. `ci_git_email` / `ci_git_name` are kept for compatibility but are documented as ignored. - **CI runs the tests.** New `test` job (cimg/node:22.12, yq v4.44.6, bats 1.11.1): `make test-scripts test-templates` and `bats tests`. - **orb-tools pinned** to the exact `circleci/orb-tools@12.5.0` (was the floating `@12.1`). - **#26.** Only `develop` publishes `dev:snapshot`; `feature/*` publishes the immutable `dev:<sha>` tag only. - **#27 (item 1).** `org` is added to the generator's `KNOWN_KEYS`, so the documented `org:` block no longer warns. Packed script regenerated. - `.editorconfig` added (K22-REPO-03). The scripts stay at 2-space indentation under a standards exception; no reformatting. ## Verification - `shellcheck --severity=warning` and `bash -n` clean on `update_cd_repo.sh`. - End-to-end probe: I ran the new script against a temporary `gaps/signing-probe` branch in this repo using a kustomize fixture. It produced commit b5da7ea, which GitHub reports as `verified: true, reason: valid` (committer GitHub). For comparison, a REST `git/commits` commit made with the same token was `unsigned`. The probe branch is deleted. - I could not run the BATS and script suites locally because this Windows host has no bats or circleci CLI. The new CI `test` job is their first run. Refs #26, #27. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Munitor#29