Homelab/infra-core
6
0
Fork 2
Code Issues Pull requests 35 Projects Releases 1 Packages Wiki Activity Actions

IR-20261112-d6 HELD: remove sbx-gits-ld-reviewer (D6 swap, second half) — do not merge yet #957

Open
pi-landing wants to merge 1 commit from plane/f-r2-d6-gits-reviewer-removal into plane/f-r2-d6-sbx-reviewer-out
pull from: plane/f-r2-d6-gits-reviewer-removal
merge into: Homelab:plane/f-r2-d6-sbx-reviewer-out
Conversation 0 Commits 1 Files changed 7 +76 -117
pi-landing commented 2026-11-12 12:07:35 +00:00
Collaborator
Copy link

HELD - do not merge

This is the second half of the D6 sbx-gits swap, split out on purpose. It merges only after the GITS proof rows pass: a GITS seat must have posted a verdict through /run/secrets/ld/identities/gits-reviewer (the identity the first half adds in #956), with the ExternalSecret force-synced and Ready.

Base is the #956 branch (plane/f-r2-d6-sbx-reviewer-out), so this diff is exactly the removal. Retarget to live after #956 merges (or rebase onto live), then merge - nothing else changes.

Sequence (documented in both bodies)

  1. #956 (add-only gits-reviewer; sbx-gits-ld-reviewer untouched) merged and synced.
  2. RUN 3 writes kv/sbx-gits/gits-reviewer (username, token).
  3. Force-sync sbx-gits-gits-reviewer -> Secret sbx-gits-gits-reviewer Ready; a GITS seat posts a verdict through the new path.
  4. This PR merges.
  5. RUN 2.

Why it cannot merge early

ref/seat-clean/bin/seat-post-comment.sh in sbx-gits-0 posts GITS gate verdicts with /run/secrets/ld/identities/ld-reviewer/token. Removing that credential before the GITS lane switches (homelab-33: the change that points the helper at gits-reviewer) stops GITS seats from posting.

What it removes

  • ExternalSecret sbx-gits-ld-reviewer (store openbao-ld-forgejo-reviewer, key ld/forgejo-reviewer) - and, by garbage collection, its target Secret: creationPolicy: Owner puts an ownerRef to the ExternalSecret on the Secret, so Kubernetes removes it when ArgoCD prunes the ES. No Secret is deleted by hand.
  • its volume, its read-only mount at /run/secrets/ld/identities/ld-reviewer, and the LD_REVIEWER_IDENTITY env.
  • scripts/gits-sbx-epic-test.sh: manifest[5]/[5b] invert (reviewer ES and ld-reviewer mount must be ABSENT; gits-reviewer takes their place in the checks; Retain 7 -> 6). Both PASS locally on this commit.
  • the sbx-gits README rows and the three docs/gits-sbx/ headers.

sbx-lab-ld-reviewer is already gone in this PR's base, so with this commit both sandboxes stop carrying the reviewer token and only ld-fleet can read it.

## HELD - do not merge This is the **second half of the D6 sbx-gits swap**, split out on purpose. It merges **only after** the GITS proof rows pass: a GITS seat must have posted a verdict through `/run/secrets/ld/identities/gits-reviewer` (the identity the first half adds in #956), with the ExternalSecret force-synced and Ready. Base is the #956 branch (`plane/f-r2-d6-sbx-reviewer-out`), so this diff is exactly the removal. **Retarget to `live` after #956 merges** (or rebase onto `live`), then merge - nothing else changes. ### Sequence (documented in both bodies) 1. #956 (add-only `gits-reviewer`; `sbx-gits-ld-reviewer` untouched) merged and synced. 2. **RUN 3** writes `kv/sbx-gits/gits-reviewer` (`username`, `token`). 3. Force-sync `sbx-gits-gits-reviewer` -> Secret `sbx-gits-gits-reviewer` Ready; a GITS seat posts a verdict through the new path. 4. **This PR** merges. 5. **RUN 2.** ### Why it cannot merge early `ref/seat-clean/bin/seat-post-comment.sh` in `sbx-gits-0` posts GITS gate verdicts with `/run/secrets/ld/identities/ld-reviewer/token`. Removing that credential before the GITS lane switches (homelab-33: the change that points the helper at `gits-reviewer`) stops GITS seats from posting. ### What it removes - ExternalSecret `sbx-gits-ld-reviewer` (store `openbao-ld-forgejo-reviewer`, key `ld/forgejo-reviewer`) - and, by garbage collection, its target Secret: `creationPolicy: Owner` puts an ownerRef to the ExternalSecret on the Secret, so Kubernetes removes it when ArgoCD prunes the ES. No Secret is deleted by hand. - its volume, its read-only mount at `/run/secrets/ld/identities/ld-reviewer`, and the `LD_REVIEWER_IDENTITY` env. - `scripts/gits-sbx-epic-test.sh`: manifest[5]/[5b] invert (reviewer ES and ld-reviewer mount must be ABSENT; `gits-reviewer` takes their place in the checks; Retain 7 -> 6). Both PASS locally on this commit. - the sbx-gits README rows and the three `docs/gits-sbx/` headers. `sbx-lab-ld-reviewer` is already gone in this PR's base, so with this commit **both** sandboxes stop carrying the reviewer token and only `ld-fleet` can read it. 
DO NOT MERGE until the GITS proof rows pass: a GITS seat must have posted a
verdict through `/run/secrets/ld/identities/gits-reviewer` (the identity the
first half adds) and the force-sync must show the new Secret Ready. Sequence:
(i) this PR's base merged and synced -> RUN 3 writes `kv/sbx-gits/gits-reviewer`
-> force-sync -> a GITS seat posts through the new path -> (ii) THIS PR -> RUN 2.

WHY IT IS SEPARATE AND HELD. `ref/seat-clean/bin/seat-post-comment.sh` in
sbx-gits-0 posts GITS gate verdicts with
/run/secrets/ld/identities/ld-reviewer/token today. Removing the credential
before the GITS lane switches (homelab-33) stops GITS seats from posting.

WHAT IT REMOVES (and nothing else):

- ExternalSecret `sbx-gits-ld-reviewer` (store `openbao-ld-forgejo-reviewer`,
  key `ld/forgejo-reviewer`) and therefore its target Secret: `creationPolicy:
  Owner` gives the Secret an ownerRef to the ExternalSecret, so Kubernetes GC
  removes it when ArgoCD prunes the ES. No hand deletion of any Secret.
- its volume and its read-only mount at
  /run/secrets/ld/identities/ld-reviewer, and the `LD_REVIEWER_IDENTITY` env.
- scripts/gits-sbx-epic-test.sh: manifest[5]/[5b] invert — the reviewer ES and
  the ld-reviewer mount must be ABSENT, `gits-reviewer` takes their place in the
  checks, Retain 7 -> 6. Both PASS locally on this commit.
- the sbx-gits README row, the identities table and the three docs/gits-sbx
  headers.

`sbx-lab-ld-reviewer` is already gone in this PR's base: with this commit both
sandboxes stop carrying the reviewer token, and only `ld-fleet` can read it.

Lab-Run: IR-20261112-d6
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin plane/f-r2-d6-gits-reviewer-removal:plane/f-r2-d6-gits-reviewer-removal
git switch plane/f-r2-d6-gits-reviewer-removal

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch plane/f-r2-d6-sbx-reviewer-out
git merge --no-ff plane/f-r2-d6-gits-reviewer-removal
git switch plane/f-r2-d6-gits-reviewer-removal
git rebase plane/f-r2-d6-sbx-reviewer-out
git switch plane/f-r2-d6-sbx-reviewer-out
git merge --ff-only plane/f-r2-d6-gits-reviewer-removal
git switch plane/f-r2-d6-gits-reviewer-removal
git rebase plane/f-r2-d6-sbx-reviewer-out
git switch plane/f-r2-d6-sbx-reviewer-out
git merge --no-ff plane/f-r2-d6-gits-reviewer-removal
git switch plane/f-r2-d6-sbx-reviewer-out
git merge --squash plane/f-r2-d6-gits-reviewer-removal
git switch plane/f-r2-d6-sbx-reviewer-out
git merge --ff-only plane/f-r2-d6-gits-reviewer-removal
git switch plane/f-r2-d6-sbx-reviewer-out
git merge plane/f-r2-d6-gits-reviewer-removal
git push origin plane/f-r2-d6-sbx-reviewer-out
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels
operator-review
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Homelab/infra-core!957
No description provided.