mirror of
https://github.com/vee1e/krply.git
synced 2026-09-01 09:49:51 +00:00
lakshit verma
9f4b6c2c5a
Audit: correlation event_ids include stage and response code so the multi-stage lines of one request no longer collapse under dedup; match scans are bounded to a time window and a page instead of the object's full history. Web: dry-run results are read from dry_run_result (nested) so the verdict is rendered correctly and conflicts/errors/skipped are shown; the plans view no longer POSTs an unsolicited plan on page load; coverage and streams surface API errors instead of showing a misleading empty state and follow cursor pagination so they are not stuck on the oldest page; the diff path tokenizer handles backslash-escaped dotted keys. Deploy/CI: the chart no longer grants the query server a cluster-wide read ClusterRole, runs as non-root with a read-only root filesystem, adds liveness/readiness probes, wires the ConfigMap as env (STORE_PATH, LISTEN_ADDR), defaults the journal to a PVC instead of an ephemeral emptyDir, and adds imagePullSecrets; the replay ClusterRole drops the unused update verb; a Dockerfile builds a static distroless image; GitHub actions are pinned by commit SHA, jobs set least-privilege permissions, the Vercel deploy skips fork PRs, CI passes the Makefile test timeouts, and make lint runs a real web syntax check. Docs: event-schema/consistency no longer describe an ingest_sequence field, an observed-time-based event_id, or restart-from-checkpoint; the threat model documents the unauthenticated HTTP API surface and the chart's RBAC change; replay-safety matches the enforced dry-run gate.
42 lines
1.5 KiB
YAML
42 lines
1.5 KiB
YAML
name: vercel
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- web/**
|
|
- .github/workflows/**
|
|
pull_request:
|
|
paths:
|
|
- web/**
|
|
- .github/workflows/**
|
|
|
|
concurrency:
|
|
group: vercel-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
deploy:
|
|
name: deploy web ui
|
|
runs-on: ubuntu-latest
|
|
# The vercel-action receives a deploy token, so only runs on pushes where
|
|
# the repository secrets are available and readable content. Fork PRs are
|
|
# skipped because they never receive repository secrets.
|
|
if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
# Requires repository secrets:
|
|
# VERCEL_TOKEN personal access token (vercel.com/account/tokens)
|
|
# VERCEL_ORG_ID org id (vercel.com -> account settings)
|
|
# VERCEL_PROJECT_ID project id (vercel.com -> project settings)
|
|
- name: Deploy to Vercel
|
|
uses: amondnet/vercel-action@2d78157ee070f28ff89dd4da74e0369fc26d3b34 # v20
|
|
with:
|
|
vercel-token: ${{ secrets.VERCEL_TOKEN }}
|
|
vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
|
|
vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
|
|
working-directory: ./web
|
|
vercel-args: ${{ github.ref == 'refs/heads/main' && '--prod' || '--preview' }}
|