@cyc-seattle/platform 1.19.1 → 1.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +19 -12
  2. package/package.json +5 -5
package/README.md CHANGED
@@ -6,12 +6,12 @@ app owns. The apps that run on it live in their own repos, such as
6
6
 
7
7
  ## Stacks
8
8
 
9
- | Stack | Holds | Applied by |
10
- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
11
- | [`bootstrap`](stacks/bootstrap) | Service accounts and project IAM, the Pulumi state buckets and KMS keys, and the org's GitHub repos and settings | A human with project Owner and `gh` `admin:org`. Never CI. |
12
- | [`infra`](stacks/infra) | The VPC, the cluster subnet and its Cloud NAT on a static address, the private services peering, the prod and dev Cloud SQL instances, the DNS zones, Artifact Registry and its cleanup policy, the GKE Autopilot cluster, the shared Gateway, its address, certificates, and dev's DNS records, the `dev` and `prod` namespaces with their quotas and network policies, dev's RBAC, the prod Job alerts, the log exclusions, and each environment's `platform/outputs.json` | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass. |
13
- | [`smoke`](stacks/smoke) | One `WebService` in dev, at `smoke.dev.cycsail.team`, for the integration tests | `deploy-dev`, from Actions on every PR. A deployer, with `PULUMI_STACK=dev mise run deploy`, when breaking glass. |
14
- | [`backend`](stacks/backend) | Directus, with the schema apply from `schemas/`, its roles, policies, and permission rules, the sync machine users, its OIDC client, and MCP, and the clubspot-sync and gsuite-sync CronJobs, with dev's Clubspot and Workspace fakes | `deploy-dev`, from Actions on every PR, and `deploy-runner` on a push to `main`, after `infra`. |
9
+ | Stack | Holds | Applied by |
10
+ | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
11
+ | [`bootstrap`](stacks/bootstrap) | Service accounts and project IAM, the Pulumi state buckets and KMS keys, and the org's GitHub repos and settings | A human with project Owner and `gh` `admin:org`. Never CI. |
12
+ | [`infra`](stacks/infra) | The VPC, the cluster subnet and its Cloud NAT on a static address, the private services peering, the prod and dev Cloud SQL instances, the DNS zones, Artifact Registry and its cleanup policy, the GKE Autopilot cluster, the shared Gateway, its address, certificates, and dev's DNS records, the `dev` and `prod` namespaces with their quotas and network policies, dev's RBAC, the prod Job alerts, the log exclusions, and each environment's `platform/outputs.json` | `deploy-runner`, from Actions after approval. A deployer, with `mise run deploy`, when breaking glass. |
13
+ | [`smoke`](stacks/smoke) | One `WebService` in dev, at `smoke.dev.cycsail.team`, for the integration tests | `deploy-dev`, from Actions for each queued PR. A deployer, with `PULUMI_STACK=dev mise run deploy`, when breaking glass. |
14
+ | [`backend`](stacks/backend) | Directus, with the schema apply from `schemas/`, its roles, policies, and permission rules, the sync machine users, its OIDC client, and MCP, and the clubspot-sync and gsuite-sync CronJobs, with dev's Clubspot and Workspace fakes | `deploy-dev`, from Actions for each queued PR, and `deploy-runner` on a push to `main`, after `infra`. |
15
15
 
16
16
  ## @cyc-seattle/platform
17
17
 
@@ -96,17 +96,24 @@ deployer needs first.
96
96
  authenticates with Workload Identity Federation and stores no credentials. Each job runs in a
97
97
  GitHub environment that holds its identity and state bucket:
98
98
 
99
- | Event | Jobs, in order |
100
- | -------------- | ----------------------------------------------------------------------------------------- |
101
- | Pull request | `ci`, then `dev`: `mise run deploy` as `deploy-dev`, then `mise run integration` |
102
- | Push to `main` | `ci`, `dev`, then `prod-preview`, then `prod`, which waits for the `maintainers` approval |
99
+ | Event | Jobs, in order |
100
+ | -------------------------- | ---------------------------------------------------------------------------------------------- |
101
+ | Pull request | `ci` |
102
+ | Merge queue | `ci`, then `dev`: `mise run deploy` as `deploy-dev`, then `mise run integration`; `dev-passed` |
103
+ | Push to `main` | `prod-preview`, then `prod`, which waits for the `maintainers` approval |
104
+ | Run by hand, from a branch | `ci`, then `dev` |
105
+ | Run by hand, from `main` | `prod-preview`, then `prod` |
106
+
107
+ Dev is shared, so only the merge queue deploys to it, one PR at a time (#69, #80). The queue
108
+ requires `dev-passed`, so a PR merges only once its dev deploy and the integration tests pass, and
109
+ `main` gets the exact commit the queue tested. A queued PR of only docs or CI skips `dev`. To try a
110
+ branch on dev before queueing it, run `gh workflow run pull-request.yml --ref <branch>`.
103
111
 
104
112
  `prod-preview` runs `mise run preview` as `deploy-runner` and writes the diff to the job summary.
105
113
  `prod` runs `mise run deploy` on the same commit once approved. It runs only when the preview shows
106
114
  changes, so a merge that changes nothing in prod asks for no approval. Dev builds the sync images
107
115
  for every commit, and prod's CronJobs run the one built for theirs, so until cyc-seattle/isthmia#258
108
- every merge previews `backend`'s CronJobs as changed. A PR from a fork gets no OIDC token, so its
109
- `dev` job is skipped.
116
+ every merge previews `backend`'s CronJobs as changed.
110
117
 
111
118
  `PULUMI_STACK` picks what the tasks run (`scripts/each-stack`): `dev` is `smoke`, then `backend`, and
112
119
  `prod` is `infra`, then `backend`. `integration` is dev only.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cyc-seattle/platform",
3
- "version": "1.19.1",
3
+ "version": "1.20.0",
4
4
  "description": "Pulumi components for CYC's shared Google Cloud platform: WebService, the platform outputs reader, and the stacks that build the platform",
5
5
  "author": "CYC Community Sailing Center",
6
6
  "license": "Apache-2.0",
@@ -69,13 +69,13 @@
69
69
  "@cyc-seattle/commodore": "^0.1.0",
70
70
  "@cyc-seattle/gsuite-sdk": "^0.3.0",
71
71
  "@cyc-seattle/ts-config": "^0.1.2",
72
- "@electric-sql/pglite": "0.5.13",
73
- "@pulumi/command": "1.2.1",
74
- "@pulumi/docker-build": "0.0.22",
72
+ "@electric-sql/pglite": "0.5.14",
73
+ "@pulumi/command": "1.3.0",
74
+ "@pulumi/docker-build": "0.0.23",
75
75
  "@pulumi/gcp": "10.2.0",
76
76
  "@pulumi/github": "6.15.0",
77
77
  "@pulumi/kubernetes": "4.34.2",
78
- "@pulumi/pulumi": "3.272.0",
78
+ "@pulumi/pulumi": "3.273.0",
79
79
  "@pulumi/random": "4.21.4",
80
80
  "@types/js-yaml": "4.0.9",
81
81
  "@types/node": "^22.19.1",