ci/k8s: superseded-run cancellation, Stryker env cleanup, CronJobs for scheduled work - #49
Merged
Merged
Conversation
Same rationale as the mutation workflow (b70e515): a newer push always re-validates, so finishing the older ~5-minute run only burns a runner. Today's nine-PR session left a trail of completed runs for superseded pushes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
MONGODB_URI is read by nothing (server tests use mongodb-memory-server), NEXTAUTH_URL was the legacy URL name, and NEXTAUTH_SECRET only mattered as totpCrypto's legacy fallback — give it the dedicated TOTP_ENCRYPTION_KEY name instead. Validated by running the Stryker-scoped suites (totpCrypto, twoFactor actions, auditHashChain — 74 tests) with all three removed vars explicitly unset: green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The audit-outbox drain and pg-boss job drain only ran on Vercel (vercel.json crons) — a k8s deployment had no scheduler at all, so the outbox backlog and job queue would sit undrained. Add the k8s-native mirror: two CronJobs (raw manifests; Helm behind cron.enabled, off by default until CRON_SECRET is set), POSTing with the Bearer secret to the same routes. CRON_SECRET moves from commented-optional to a real key in the raw secret template since cronjob.yaml consumes it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Mutation TestingScore: 70.95% (break threshold 60% — ✅ pass). 320 detected / 451 valid mutants (killed 192, timeout 128, survived 30, no-coverage 101). Full report. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three follow-ups flagged at session close, one commit each.
1.
ci:cancel superseded runs on the same refSame shape and rationale as the mutation workflow's fix (#44): a newer push always re-validates, so finishing the older ~5-minute run only burns a runner. Applies to PR refs and
mainalike — on main the newest run still validates the final state.2.
ci(mutation):drop the pre-v5 env names from the Stryker stepMONGODB_URI— read by nothing (server tests usemongodb-memory-server)NEXTAUTH_URL— legacy URL name, unused in the mutated scopeNEXTAUTH_SECRET→TOTP_ENCRYPTION_KEY— its only real job was totpCrypto's legacy fallback; give it the dedicated nameValidated by running the Stryker-scoped suites (totpCrypto, twoFactor actions, auditHashChain — 74 tests) with all three removed vars explicitly
env -uunset: green. The Stryker run on this PR is the end-to-end confirmation.3.
feat(k8s):CronJobs for the cron endpointsThe audit-outbox drain and pg-boss job drain were scheduled only on Vercel (
vercel.json) — a k8s deployment had no scheduler at all, so the outbox backlog and job queue would sit undrained. Adds the k8s-native mirror:cronjob.yaml, two CronJobs (03:00 audit drain, 03:30 job drain),POSTwithBearer $(CRON_SECRET)againsthrmanager-svc:3000;CRON_SECRETpromoted from commented-optional to a real key in the secret templatecron.enabled(default false — the endpoints 401/500 withoutsecrets.data.CRON_SECRET; set it, then--set cron.enabled=true)k8s/README.md: new "Scheduled work" sectionRoutes verified to accept POST + the constant-time Bearer check (
src/app/api/cron/*/route.tsexport both GET and POST). All YAML parses (multi-doc included);hrmanager.secretName/fullnamehelpers and the-svc:3000service shape confirmed against the existing chart. Full suite green through the pre-push hook (2835).🤖 Generated with Claude Code