feat(repos): declare software-update-publisher - #79
Merged
Merged
Conversation
Declares the repository that will monitor upstream vendors for new Windows software releases, verify each artifact, publish it to the application repository bucket, and emit a release document naming every file with its version, size and digest. Its first consumer is pdq-deploy-inventory, whose pinned variable map and installer digests are what that document feeds. Created from the Python type-template so it inherits the ratified package anatomy, the shared quality-gate scripts and the sync manifest that keeps them current. The template is declared at creation rather than added later, which keeps it out of every subsequent plan diff. required_checks is intentionally omitted on this first apply: the checks the repository will require do not report until their caller workflows exist in it, and a context that never reports blocks the pull requests that would add them. They follow once a first run has reported each name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Declares a new public repository,
software-update-publisher.What it will do
Monitor upstream vendors for new versions of the Windows software this fleet tracks, acquire and verify each artifact, publish it to the application repository bucket, and emit a release document naming every published file with its product, version, size and SHA-256.
Its day-1 consumer is
pdq-deploy-inventory: the release document is what feeds that repository's pinned variable map and its installer digests, and it closes the recorded gap where several pins name a version the bucket does not carry.Declaration choices
Created from
NWarila/python-template. It inherits the ratified package anatomy, the shared quality-gate script surface, and the pull-based sync manifest that keeps those scripts current. Thetemplateblock is declared at creation rather than added afterwards —rancher-terraform-framework.ymldocuments what an undeclared template costs on every later plan.required_checksis intentionally omitted from this first apply. The checks this repository will require (the template's aggregateci-passed, plus the org hygiene and security reusables) do not report until their caller workflows exist in the created repository. Declaring a context that never reports would block every pull request, including the ones that would add those workflows. They are declared in a follow-up once a first run has reported each name.Public, consistent with the rest of the portfolio. It carries no secret: the AWS account id reaches its workflows as an Actions secret, as it does elsewhere.
Verification
allowed_repo_keys; everytemplatekey is inallowed_template_keys.!/terraform/public/**rule; no.gitignorechange needed.Plan only on this pull request; creation happens on a deliberate dispatch after review.