@marcusrbrown/infra 0.12.2 → 0.12.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcusrbrown/infra",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "Infrastructure management CLI — deploy automation, health checks, and MCP bridge",
   "keywords": [
     "infra",

package/src/commands/gateway/deploy.ts

@@ -68,6 +68,8 @@ export function getGatewayDeployEnv(): Record<string, string> {
     GATEWAY_OPERATOR_OAUTH_ALLOWED_RETURN_PATHS: process.env.GATEWAY_OPERATOR_OAUTH_ALLOWED_RETURN_PATHS ?? '',
     GATEWAY_OPERATOR_OAUTH_STATE_TTL_MS: process.env.GATEWAY_OPERATOR_OAUTH_STATE_TTL_MS ?? '',
     GATEWAY_OPERATOR_OAUTH_MAX_OUTSTANDING_ATTEMPTS: process.env.GATEWAY_OPERATOR_OAUTH_MAX_OUTSTANDING_ATTEMPTS ?? '',
+    GATEWAY_VPC_IP: process.env.GATEWAY_VPC_IP ?? '',
+    DASHBOARD_VPC_IP: process.env.DASHBOARD_VPC_IP ?? '',
     GATEWAY_IMAGE_DIGEST: process.env.GATEWAY_IMAGE_DIGEST ?? '',
     WORKSPACE_IMAGE_DIGEST: process.env.WORKSPACE_IMAGE_DIGEST ?? '',
   }

package/src/conventions.test.ts

@@ -440,6 +440,35 @@ describe('per-app invariants', () => {
     // SHA verification is wired in and was not accidentally stripped.
     expect(buildTs).toMatch(/const\s+EXPECTED_SHA256\s*=/)
   })
+
+  it('deploy-gateway.yaml does NOT install doctl (firewall is provisioning-only, not deploy-time)', async () => {
+    const text = await Bun.file(resolve(REPO_ROOT, '.github/workflows/deploy-gateway.yaml')).text()
+    // The DO Cloud Firewall is created in provisioning (provision-droplet.ts), not in the deploy hot path.
+    // The deploy job must NOT install doctl — it no longer needs it.
+    expect(text).not.toMatch(/uses:\s+digitalocean\/action-doctl@[a-f0-9]{40}/)
+    expect(text).not.toContain('digitalocean/action-doctl')
+  })
+
+  it('deploy-gateway.yaml does NOT forward DIGITALOCEAN_ACCESS_TOKEN to the deploy step', async () => {
+    const text = await Bun.file(resolve(REPO_ROOT, '.github/workflows/deploy-gateway.yaml')).text()
+    // DIGITALOCEAN_ACCESS_TOKEN is only needed for provisioning, not for the deploy hot path.
+    // Verify it is not forwarded to the deploy step env block.
+    const deployStepIndex = text.indexOf('name: Deploy gateway')
+    expect(deployStepIndex).toBeGreaterThan(-1)
+    const afterDeployStep = text.slice(deployStepIndex)
+    expect(afterDeployStep).not.toContain('DIGITALOCEAN_ACCESS_TOKEN')
+  })
+
+  it('deploy-gateway.yaml still forwards GATEWAY_VPC_IP and DASHBOARD_VPC_IP to the deploy step', async () => {
+    const text = await Bun.file(resolve(REPO_ROOT, '.github/workflows/deploy-gateway.yaml')).text()
+    // GATEWAY_VPC_IP and DASHBOARD_VPC_IP are still needed by deploy.ts for the compose VPC-IP
+    // publish and the DOCKER-USER iptables rule.
+    const deployStepIndex = text.indexOf('name: Deploy gateway')
+    expect(deployStepIndex).toBeGreaterThan(-1)
+    const afterDeployStep = text.slice(deployStepIndex)
+    expect(afterDeployStep).toContain('GATEWAY_VPC_IP')
+    expect(afterDeployStep).toContain('DASHBOARD_VPC_IP')
+  })
 })
 
 describe('findCrossOrgSecretsInherit', () => {
@@ -645,10 +674,9 @@ describe('dorny/paths-filter quantifier guard', () => {
   })
 })
 
-// ─── Unit 5: operator auth/config secrets and tuning vars ────────────────────
+// ─── operator auth/config secrets and tuning vars ────────────────────────────
 //
-// RED tests for Unit 5 of 2026-06-18-002-feat-gateway-operator-auth-config-plan.md
-// These assert the four new auth/config secrets and three optional tuning vars are
+// These assert the four operator auth/config secrets and three optional tuning vars are
 // wired through deploy-gateway.yaml (workflow_call.secrets + inputs + deploy step env),
 // deploy.yaml (fan-out secrets + with inputs), and the CLI passthrough.
 
@@ -843,6 +871,24 @@ describe('CLI getGatewayDeployEnv: operator auth/config passthrough', () => {
       Object.assign(process.env, origEnv)
     }
   })
+
+  it('getGatewayDeployEnv includes GATEWAY_VPC_IP and DASHBOARD_VPC_IP (but NOT DIGITALOCEAN_ACCESS_TOKEN)', async () => {
+    const {getGatewayDeployEnv} = await import('./commands/gateway/deploy')
+    const origEnv = {...process.env}
+    process.env.PATH = '/usr/bin'
+    process.env.HOME = '/home/test'
+    process.env.SSH_AUTH_SOCK = '/tmp/ssh.sock'
+    try {
+      const env = getGatewayDeployEnv()
+      // VPC IPs are still needed by deploy.ts for compose publish + DOCKER-USER rule
+      expect(env).toHaveProperty('GATEWAY_VPC_IP')
+      expect(env).toHaveProperty('DASHBOARD_VPC_IP')
+      // DIGITALOCEAN_ACCESS_TOKEN is provisioning-only — must NOT be in the deploy env
+      expect(env).not.toHaveProperty('DIGITALOCEAN_ACCESS_TOKEN')
+    } finally {
+      Object.assign(process.env, origEnv)
+    }
+  })
 })
 
 // ─── deploy.yaml: aggregate router passes operator secrets to deploy-gateway ──
@@ -988,3 +1034,147 @@ describe('deploy-gateway.yaml: optional operator secret declarations (issue 1)',
     expect(validateStep?.env ?? {}).not.toHaveProperty('GATEWAY_OPERATOR_PUBLIC_ORIGIN')
   })
 })
+
+// ─── VPC bridge secrets: CI-vs-local parity ──────────────────────────────────
+//
+// GATEWAY_VPC_IP and DASHBOARD_VPC_IP are optional (all-or-none via getOperatorVpcState)
+// but must be forwarded through CI so the operator VPC bridge is not silently disabled
+// when the secrets are set. DIGITALOCEAN_ACCESS_TOKEN is provisioning-only and must NOT
+// be forwarded to the deploy step.
+// These tests assert the end-to-end wiring without adding them to the required
+// validation preflight (they are opt-in, like the operator listener vars).
+
+const VPC_GATEWAY_SECRETS = ['GATEWAY_VPC_IP', 'DASHBOARD_VPC_IP'] as const
+const VPC_DASHBOARD_SECRETS = ['GATEWAY_VPC_IP'] as const
+
+describe('deploy-gateway.yaml: VPC bridge secrets wired end-to-end', () => {
+  const DEPLOY_GATEWAY_WORKFLOW = resolve(REPO_ROOT, '.github/workflows/deploy-gateway.yaml')
+
+  for (const secret of VPC_GATEWAY_SECRETS) {
+    it(`workflow_call.secrets declares ${secret} as optional (required: false)`, async () => {
+      const text = await Bun.file(DEPLOY_GATEWAY_WORKFLOW).text()
+      const parsed = parseYaml(text) as {on?: {workflow_call?: {secrets?: Record<string, {required?: boolean}>}}}
+      const secrets = parsed?.on?.workflow_call?.secrets ?? {}
+      expect(secrets).toHaveProperty(secret)
+      expect(secrets[secret]?.required).toBe(false)
+    })
+
+    it(`Deploy gateway step env forwards ${secret} from secrets context`, async () => {
+      const text = await Bun.file(DEPLOY_GATEWAY_WORKFLOW).text()
+      const parsed = parseYaml(text) as {
+        jobs?: {'deploy-gateway'?: {steps?: {name?: string; env?: Record<string, string>}[]}}
+      }
+      const steps = parsed?.jobs?.['deploy-gateway']?.steps ?? []
+      const deployStep = steps.find(s => s.name === 'Deploy gateway')
+      expect(deployStep).toBeDefined()
+      expect(deployStep?.env).toHaveProperty(secret)
+      expect(deployStep?.env?.[secret]).toMatch(/\$\{\{\s*secrets\./)
+    })
+  }
+
+  it('VPC bridge secrets are NOT in the required-secret validation step env', async () => {
+    const text = await Bun.file(DEPLOY_GATEWAY_WORKFLOW).text()
+    const parsed = parseYaml(text) as {
+      jobs?: {'deploy-gateway'?: {steps?: {name?: string; env?: Record<string, string>; run?: string}[]}}
+    }
+    const steps = parsed?.jobs?.['deploy-gateway']?.steps ?? []
+    const validateStep = steps.find(s => s.name === 'Validate required secrets')
+    expect(validateStep).toBeDefined()
+    for (const secret of VPC_GATEWAY_SECRETS) {
+      expect(validateStep?.env ?? {}).not.toHaveProperty(secret)
+    }
+  })
+})
+
+describe('deploy-dashboard.yaml: VPC bridge secret wired end-to-end', () => {
+  const DEPLOY_DASHBOARD_WORKFLOW = resolve(REPO_ROOT, '.github/workflows/deploy-dashboard.yaml')
+
+  for (const secret of VPC_DASHBOARD_SECRETS) {
+    it(`workflow_call.secrets declares ${secret} as optional (required: false)`, async () => {
+      const text = await Bun.file(DEPLOY_DASHBOARD_WORKFLOW).text()
+      const parsed = parseYaml(text) as {on?: {workflow_call?: {secrets?: Record<string, {required?: boolean}>}}}
+      const secrets = parsed?.on?.workflow_call?.secrets ?? {}
+      expect(secrets).toHaveProperty(secret)
+      expect(secrets[secret]?.required).toBe(false)
+    })
+
+    it(`Deploy step env forwards ${secret} from secrets context`, async () => {
+      const text = await Bun.file(DEPLOY_DASHBOARD_WORKFLOW).text()
+      const parsed = parseYaml(text) as {
+        jobs?: {'deploy-dashboard'?: {steps?: {name?: string; env?: Record<string, string>}[]}}
+      }
+      const steps = parsed?.jobs?.['deploy-dashboard']?.steps ?? []
+      const deployStep = steps.find(s => s.name === 'Deploy')
+      expect(deployStep).toBeDefined()
+      expect(deployStep?.env).toHaveProperty(secret)
+      expect(deployStep?.env?.[secret]).toMatch(/\$\{\{\s*secrets\./)
+    })
+  }
+
+  it('GATEWAY_VPC_IP is NOT in the required-secret validation step env', async () => {
+    const text = await Bun.file(DEPLOY_DASHBOARD_WORKFLOW).text()
+    const parsed = parseYaml(text) as {
+      jobs?: {'deploy-dashboard'?: {steps?: {name?: string; env?: Record<string, string>; run?: string}[]}}
+    }
+    const steps = parsed?.jobs?.['deploy-dashboard']?.steps ?? []
+    const validateStep = steps.find(s => s.name === 'Validate required secrets')
+    expect(validateStep).toBeDefined()
+    expect(validateStep?.env ?? {}).not.toHaveProperty('GATEWAY_VPC_IP')
+  })
+})
+
+describe('deploy.yaml: aggregate router forwards VPC bridge secrets', () => {
+  const DEPLOY_WORKFLOW = resolve(REPO_ROOT, '.github/workflows/deploy.yaml')
+
+  for (const secret of VPC_GATEWAY_SECRETS) {
+    it(`deploy-gateway job secrets block passes ${secret}`, async () => {
+      const text = await Bun.file(DEPLOY_WORKFLOW).text()
+      const parsed = parseYaml(text) as {
+        jobs?: {'deploy-gateway'?: {secrets?: Record<string, string>}}
+      }
+      const secrets = parsed?.jobs?.['deploy-gateway']?.secrets ?? {}
+      expect(secrets).toHaveProperty(secret)
+      expect(secrets[secret]).toContain(secret)
+    })
+  }
+
+  for (const secret of VPC_DASHBOARD_SECRETS) {
+    it(`deploy-dashboard job secrets block passes ${secret}`, async () => {
+      const text = await Bun.file(DEPLOY_WORKFLOW).text()
+      const parsed = parseYaml(text) as {
+        jobs?: {'deploy-dashboard'?: {secrets?: Record<string, string>}}
+      }
+      const secrets = parsed?.jobs?.['deploy-dashboard']?.secrets ?? {}
+      expect(secrets).toHaveProperty(secret)
+      expect(secrets[secret]).toContain(secret)
+    })
+  }
+})
+
+// ─── deploy.yaml: deploy-dashboard is decoupled from deploy-gateway ──────────
+//
+// The dashboard is a standalone deployment. A gateway failure or slowness must
+// not block dashboard deploys. deploy-dashboard must NOT declare needs: deploy-gateway,
+// and its if: must NOT reference needs.deploy-gateway — locking in the decoupling
+// so it cannot silently regress.
+
+describe('deploy.yaml: deploy-dashboard is decoupled from deploy-gateway', () => {
+  const DEPLOY_WORKFLOW = resolve(REPO_ROOT, '.github/workflows/deploy.yaml')
+
+  it('deploy-dashboard needs: does NOT include deploy-gateway (standalone job)', async () => {
+    const text = await Bun.file(DEPLOY_WORKFLOW).text()
+    const parsed = parseYaml(text) as {
+      jobs?: {'deploy-dashboard'?: {needs?: string | string[]}}
+    }
+    const needs = parsed?.jobs?.['deploy-dashboard']?.needs ?? []
+    const needsArr = Array.isArray(needs) ? needs : [needs]
+    expect(needsArr).not.toContain('deploy-gateway')
+  })
+
+  it('deploy-dashboard if: does NOT reference needs.deploy-gateway (no gateway coupling)', async () => {
+    const text = await Bun.file(DEPLOY_WORKFLOW).text()
+    // The if: expression must not reference needs.deploy-gateway in any form —
+    // gateway state must not gate the dashboard deploy.
+    expect(text).not.toMatch(/needs\.deploy-gateway/)
+  })
+})