Cryptograss:Moods/ramp/todo: Difference between revisions

From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
← Older editNewer edit →
VisualWikitext
Magent (talk | contribs)
Bots, emergent
3,862 edits
ramp todo: magenta's dead production branch is gone (via update-page on MediaWiki MCP Server)
Magent (talk | contribs)
Bots, emergent
3,862 edits
ramp todo: Jenkins token checked; follow-up to narrow it (via update-page on MediaWiki MCP Server)
Line 123: Line 123:
   who: justin
   who: justin
   kind: infra
   kind: infra
   note: "If it can administer the org, a merge there can change the org and its deploy keys (Plan, section 10, open). Nothing in the record says it's been checked, as of 10 Nov."
   note: "If it can administer the org, a merge there can change the org and its deploy keys (Plan, section 10, open)."
  done: "Checked by Justin 10 Nov 16:47Z: classic token of cryptograss-maybelle (org member, not owner; write on all seven repos, checked by magent with gh). Scopes gist, public_repo, read:project, read:user, repo:status, user:email, write:discussion. No admin:org, no admin rights: it can't touch the org or deploy keys. But public_repo plus write means it can push to every repo's deploy branch on GitHub, around githouse. Follow-up below."
- task: "Replace Jenkins' github-token (maybelle_github_token) with a fine-grained token: cryptograss repos Jenkins builds, Contents read-only, Commit statuses write; nothing else"
  who: justin
  kind: infra
  note: "Today's classic token can push to maybelle-config production and magenta main on GitHub without githouse, and deploys still clone from GitHub, so a pushed commit reaches the next deploy. Code run by Jenkins on the controller (arthel, pickipedia builds) can read it from the environment. Jenkins only reads repos and posts preview comments on justinholmes.com commits; if a fine-grained token can't comment without Contents write, drop the comment. Goes with magent's 'deploys clone from githouse' item, which closes the same hole from the other side. A person makes the token and puts it in the vault."
- task: "hunter's disk (82%, warning at 85%): decide whether hunter prunes unused images, which the playbook leaves alone on purpose"
- task: "hunter's disk (82%, warning at 85%): decide whether hunter prunes unused images, which the playbook leaves alone on purpose"
   who: justin
   who: justin

Revision as of 16:50, 10 November 2026

  • ☐
    Replace Jenkins' github-token (maybelle_github_token) with a fine-grained token: cryptograss repos Jenkins builds, Contents read-only, Commit statuses write; nothing else
    infra · justin
    Today's classic token can push to maybelle-config production and magenta main on GitHub without githouse, and deploys still clone from GitHub, so a pushed commit reaches the next deploy. Code run by Jenkins on the controller (arthel, pickipedia builds) can read it from the environment. Jenkins only reads repos and posts preview comments on justinholmes.com commits; if a fine-grained token can't comment without Contents write, drop the comment. Goes with magent's 'deploys clone from githouse' item, which closes the same hole from the other side. A person makes the token and puts it in the vault.
  • ☐
    hunter's ssh router refuses a banned person's key; a redeploy prints any change in people, keys, githouse_mergers or MOOD_ADMINS (scripts/render_diff.py)
    code · magent
    Plan section 10. Not built: neither is on maybelle-config production (52dc3a2c), checked 10 Nov.
  • ☐
    Deploys clone from githouse's copy on maybelle instead of GitHub (Jenkinsfiles, deploy scripts)
    code · magent
    re's point 9: its own PR, after githouse has run a few days.
  • ☐
    Jenkins audit, re's open items: a policy on silent skips (pickipedia node/lua checks), pickipedia's chain-data warning that deploys stale silently, NVM/pnpm fetched from the network in every pipeline
    code · re
    From re's test map, 30 Oct. The mtime guard (#244) and the alarms (#402, #275) are done.
Done (85)
Retrieved from "https://interfaces3.hunter.cryptograss.live/index.php?title=Cryptograss:Moods/ramp/todo&oldid=15880"