fix(deploy-preview): fail loud on render failures and anchor the raw-secret match#62
Merged
jorisjonkers-dev-agents[bot] merged 2 commits intoJul 10, 2026
Conversation
…secret match Review follow-ups to #60: - Fragment render failures previously only warned once the misattributed no_raw_secrets override was removed, so a preview with broken renders could pass the gate. The action now fails with E_RENDER_FAILED naming the failed env/fragment pairs, and the gate summary reason carries render-failed:<list>. - The raw-secret scan matched any line containing 'kind: Secret', so SecretStore and ClusterSecretStore resources produced false failures. The match is now anchored to the exact kind value.
jorisjonkers-dev-agents
Bot
added
the
type: bug
Review follow-ups: when both fragment renders and emit-contract fail, the E_EMIT_CONTRACT_FAILED message now also names the failed fragments so neither cause is hidden. Add an executable end-to-end test that runs main() with stubbed tooling (oras, npm, deploy-config-schema) forcing render failures, asserting the E_RENDER_FAILED exit path is reachable, names the env/fragment pairs, and the gate summary reason carries render-failed:<list>.
This was referenced Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #60 (issue #59): cross-review of the merged change surfaced two remaining defects.
Problem
no_raw_secrets, but that block was the only failure signal for broken renders. A preview whose fragment renders all failed could exit 0 with a green scorecard as long asemit-contractsucceeded.kind: Secret, sokind: SecretStoreandkind: ClusterSecretStoreresources (and comments containing the text) produced falseno_raw_secretsfailures.Fix
E_RENDER_FAILED: fragment renders failed: <env/fragment,...>, naming each concrete failed fragment. The gate summary carries the same list in its reason (render-failed:<list>); per-fragment diagnostics remain as::warningannotations. Scorecard checks are never overridden.^kind:[[:space:]]*Secret[[:space:]]*$).Tests
test_no_raw_secrets_pass_for_secretstore_kinds:SecretStore/ClusterSecretStoremanifests do not trip the checktest_render_failures_fail_action_with_named_fragments: the script fails viaE_RENDER_FAILEDwith arender-failed:gate reason and never setsno_raw_secretsfrom render state