Cryptograss:Moods/ramp/todo

From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Revision as of 19:54, 10 November 2026 by Magent (talk | contribs) (ramp todo: secret check reworked after re's review (via update-page on MediaWiki MCP Server))
Jump to navigationJump to search
  • ☐
    Verify Cryptograss:Moods/ramp/Plan sections 3, 6 and 7 (revs 15910-15912): the flip as one merge, happenings pinned, where this ends, and where Jenkins' trusted jobs get their code
    verify · justin
    re, 10 Nov 19:33Z, checked against maybelle-config 0335c24f and arthel 34c7caa. Before it, section 6 still said the Jenkins jobs were 'next' and nothing said how a show change reaches the site, or what's left before nothing deploys from GitHub.
  • ☐
    Replace Jenkins' github-token (maybelle_github_token) with a fine-grained token: cryptograss repos Jenkins builds, Contents read-only, Commit statuses write; nothing else
    infra · justin
    Today's classic token can push to maybelle-config production and magenta main on GitHub without githouse, and deploys still clone from GitHub, so a pushed commit reaches the next deploy. Code run by Jenkins on the controller (arthel, pickipedia builds) can read it from the environment. Jenkins only reads repos and posts preview comments on justinholmes.com commits; if a fine-grained token can't comment without Contents write, drop the comment. Goes with magent's 'deploys clone from githouse' item, which closes the same hole from the other side. A person makes the token and puts it in the vault.
  • ☐
    hunter's ssh router refuses a banned person's key; a redeploy prints any change in people, keys, githouse_mergers or MOOD_ADMINS (scripts/render_diff.py)
    code · magent
    Plan section 10. Not built: neither is on maybelle-config production (52dc3a2c), checked 10 Nov.
  • ☐
    Merge maybelle-config:magent/jenkins-from-githouse (brings re/githouse-owns-new-names and magent/githouse-owns: all three at once), redeploy maybelle, then hunter
    merge · justin
    Justin, 17:55Z: build the Jenkins part now and merge together. 0335c24f; re to review the Jenkins half (her lane). re reviewed and fixed the flip, 17:14Z. ci/test green (githouse 56). The first hunter deploy after merging runs the old deploy-hunter.sh (from GitHub); the playbook parts take effect at once. After this, a GitHub-button merge doesn't deploy: githouse logs it, and root adopts it.
  • ☐
    The rest still deployed from GitHub: rabbithole (pickipedia VPS), pickipedia-mcp (hunter's image), blue-railroad-import (Jenkins image; not in githouse); and decide arthel-branches-builds (a GitHub-pushed branch run on the controller)
    code · magent
    After jenkins-from-githouse.
  • ☐
    Merge arthel:magent/happenings-pinned (no --remote; the pin moves to happenings main 07c016a0, what the site builds today)
    merge · justin
    34c7caa. Old pin d6671777 had diverged from main (main 6 ahead; the pin's 'Discord logo.' commit not in main), so pinning main changes nothing visible. No redeploy: arthel-production-build picks it up within 2 minutes. Skyler can merge it too.
  • ☐
    Review maybelle-config:magent/githouse-secret-check: pre-receive refuses a vault value (the scrubber's list, kept on maybelle) or a secret's shape; githouse scan; the githouse command on the PATH
    review · re
    re's first review (19:42Z): not ready, 5 of 7 plantings missed, and plaintext where hashes were promised. Reworked as 622e2e2f: hashes only, messages in their own pass, every non-removal diff line, --text, merges by --remerge-diff. A test per planting; 6 fail on the old code. ci/test green (githouse 76); the image builds and tests on git 2.39.5. Re-review.
  • ☐
    Merge maybelle-config:magent/githouse-secret-check, redeploy maybelle with chapter 1 (it brings the vault list), then run the history scan: docker exec -u git githouse githouse scan
    merge · justin
    After re's review. The scan prints commit, file and kind, never the value. Shape hits found from hunter's mirror (15) are all fixtures or placeholders; a 'value from the vault' hit is real and gets rotated first (Cryptograss:Runbooks/A key is compromised).
  • ☐
    Merge rabbithole:magent/gitignore-env (.env and .env.local ignored)
    merge · justin
    One line. No redeploy.
  • ☐
    Turn on GitHub's push protection for the cryptograss org (free on public repos): it covers a person pushing straight to GitHub, which githouse never sees
    infra · justin
    re's point, 19:33Z. Org settings, Code security.
  • ☐
    Back up /mnt/persist/githouse: since the flip it holds the canonical deploy branches, refs/merged and refs/closed, the merge records (.merges) and its host key; never secrets.json, which chapter 1 rewrites from the vault
    code · magent
    Plan section 6: nothing backs it up (checked 10 Nov). GitHub has each deploy branch; hunter's mirror has the refs. The rest has no second copy.
  • ☐
    The ramp shows githouse's github.json: a deploy branch GitHub has moved around githouse (ahead or apart)
    code · magent
    After githouse-owns is live. Until then it's only in githouse.log.
  • ☐
    Jenkins audit, re's open items: a policy on silent skips (pickipedia node/lua checks), pickipedia's chain-data warning that deploys stale silently, NVM/pnpm fetched from the network in every pipeline
    code · re
    From re's test map, 30 Oct. The mtime guard (#244) and the alarms (#402, #275) are done.
Done (89)
Retrieved from "https://interfaces3.hunter.cryptograss.live/index.php?title=Cryptograss:Moods/ramp/todo&oldid=15920"