Repository navigation
github-backup: rename to developing-today-backup + just/nix deploy standard - #3280
Conversation
…ia just -> nix run (wrangler versions flow)
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 47 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 307a2501ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| bws | ||
| git | ||
| nodejs | ||
| sops | ||
| wrangler |
There was a problem hiding this comment.
On a machine without a globally installed jq, the new flake deployment entrypoint exits before reaching Wrangler. worker/deploy.sh sources lib/bitwarden-env.sh, which explicitly checks for jq and returns 1 when it is unavailable, but this runtime dependency list does not provide it. This was reproduced with the helper's other prerequisites available and jq absent from PATH. Add jq to the application arguments and runtimeInputs, as the existing id-mail-deploy package does, so both normal deployments and dry runs work outside the development shell.
Useful? React with 👍 / 👎.
| setWorkerSecrets(); | ||
| reportLive(); | ||
| console.log(`live: ${WORKER_URL} at version ${version.id} (${tag})`); |
There was a problem hiding this comment.
On a fresh Worker, the tagged version is uploaded before either required secret exists. This subsequent call changes the deployed version: Cloudflare documents that wrangler secret put “creates a new version of the Worker and deploys it immediately.” Consequently, the version ID printed as live below is not the final secret-bearing version. The --deploy-version path deploys that advertised ID without provisioning secrets, so it does not restore the working configuration: the tagged bootstrap version lacks the bearer required by /queue and the HMAC secret required by /github. Include the secrets before selecting the tagged deployment version, or retain and advertise the final configured version for rollback.
Useful? React with 👍 / 👎.
| if (deployVersion !== null) { | ||
| createDeployment(deployVersion); |
There was a problem hiding this comment.
When an operator combines --dry-run with --deploy-version <id> to preview a rollback, this branch runs before the dry-run check and immediately changes the production deployment. Running the actual script with mocked executables confirmed that it invokes wrangler versions deploy <id>@100% --name developing-today-backup --yes, without forwarding --dry-run. Wrangler documents the deployment command's --dry-run option as “Don't actually deploy,” but the wrapper silently discards that protection and bypasses confirmation. Forward the dry-run flag for existing-version deployments, or reject the combination before making any changes.
Useful? React with 👍 / 👎.
|
Deployment evidence (laptop, 2026-10-31 evening CDT):
Merged as |
Implements Drew's 2026-10-31 directives for the github-backup system (umbrella issue #3215).
1. Naming —
developing-today-backupThe public name is now developing-today-backup everywhere repo-side:
infra/github-backup/config.json:app.nameandworker.name(app_setup.py reads the App name from config, so the future App creation uses the new name automatically)infra/github-backup/worker/wrangler.toml: Worker nameworker/src/index.jsheader,bin/app_setup.pydocstring,README.md,docs/RUNBOOK.md(incl. the settings/apps install URLs and the Worker URL examples)State of the world this lands on (verified 2026-10-31): the GitHub App was never created —
GET /apps/hatch-repo-backupandGET /apps/developing-today-backupboth 404 and no app-credential secrets exist in Bitwarden — so nothing needs renaming on GitHub;developing-today-backupis simply the name the App will be created under (slug checked available; thedeveloping-today-repo-backupfallback is not needed). The Worker, however, WAS live under the old namehatch-repo-backup-webhook; this PR renames it and the renamed Worker is deployed from this branch (evidence in a follow-up comment). The old Worker is deleted after the rename verifies live and the laptop drainer is repointed (Bitwardengithub-app.backup-worker-url).2. Deploy method — just → nix run, versions upload/deploy
Before this PR, the Worker deployed by bare wrangler commands typed from RUNBOOK §5. Now it follows the shape of the repo's Cloudflare Worker deployment standard (
doc/2026-10-31T23-00-00Z_design_cloudflare_worker_deployment_standard.md):just deploy-developing-today-backup(root.just, groupgithub-backup) →nix run .#developing-today-backup-deploy(new flake app inlib/default.nix,writeShellApplicationininfra/github-backup/deploy.nix, mirroringpkgs/pkarr-worker/deploy.nixand the wrangler-basednixos/services/id-mail/worker/deploy.nix)worker/deploy.sh(sourceslib/bitwarden-env.sh, SOPS-extracts the Cloudflare account id) →worker/deploy.mjs: API token from Bitwarden by name (cloudflare.api-token-day-to-day), version uploaded first taggedgit-<sha12>, then a separate deployment at 100%;--deploy-version <id>is the rollback path;--dry-runvalidates without uploadingDRAIN_BEARERandGITHUB_WEBHOOK_SECRETare (re)set from Bitwarden by name — values pass via wrangler stdin only, never printed or written to diskTool gap (per the standard's fallback rule): the script drives wrangler's versions commands rather than the
cfCLI. cf's flow is built around a TypeScriptcf/configproject with npm dependencies; this Worker is a dependency-free plain-JS worker configured bywrangler.toml. Drew's 2026-10-31 directive for this system also specified wrangler via the flake app. Converting this Worker to the cf config format is a possible follow-up; the upload/deploy separation, SHA tagging, and secret handling are identical either way.Also in root.just (group
github-backup), per the same directive:github-backup-units(install/refresh the laptop systemd units),github-backup-fetchandgithub-backup-reconcile(run the daily fetch / weekly sweep on demand via the installed units).just-recipes.jsonregenerated (just just-recipes) so the new recipes also exist asnix run .#<recipe>apps; note the generated file'ssourcepaths now point at the worktree this was generated in, the same churn the file already carried (previously a pkarr worktree).Verification (laptop)
just --list: all four recipes parse and list under[github-backup]nix eval .#apps.x86_64-linux.developing-today-backup-deploy.programandnix build .#developingTodayBackupDeploy: OK; recipe appgithub-backup-fetchalso evaluates--dry-runend to end: Bitwarden token resolved, SOPS account id decrypted, wrangler validated the renamed config (upload 2.92 KiB, KV bindingGHB_EVENTS46b1fe46…), nothing uploadedRelated: #3215 (umbrella), #3219 and #3229 (known defects, untouched by this PR).
Need help on this PR? Tag
@codesmith-botwith what you need.