gitops 1.9.0__tar.gz → 1.10.1__tar.gz

{gitops-1.9.0 → gitops-1.10.1}/.github/workflows/release-please.yaml

@@ -14,6 +14,10 @@ permissions:
 env:
   MISE_PYTHON_COMPILE: false
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  ECR_REGISTRY: 610829907584.dkr.ecr.ap-southeast-2.amazonaws.com
+  ECR_HELM_PREFIX: helm
+  AWS_REGION: ap-southeast-2
+  AWS_ROLE_ARN: arn:aws:iam::610829907584:role/default-github-actions-ci-role
 
 jobs:
   release-please:
@@ -36,10 +40,31 @@ jobs:
     if: ${{ needs.release-please.outputs.helm-version }}
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
-      - name: Publish Helm charts
-        uses: stefanprodan/helm-gh-pages@89c6698c192e70ed0e495bee7d3d1ca5b477fe82 # ratchet:stefanprodan/helm-gh-pages@master
+
+      - name: Install Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # ratchet:azure/setup-helm@v4
+
+      - name: Lint chart
+        run: helm lint charts/gitops
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # ratchet:aws-actions/configure-aws-credentials@v5.1.1
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          role-to-assume: ${{ env.AWS_ROLE_ARN }}
+          role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to ECR (Helm OCI)
+        run: |
+          aws ecr get-login-password --region "$AWS_REGION" \
+            | helm registry login --username AWS --password-stdin "$ECR_REGISTRY"
+
+      - name: Package and push chart
+        run: |
+          set -euo pipefail
+          chart_version=$(helm show chart charts/gitops | awk '/^version:/ {print $2}')
+          helm package charts/gitops --destination "$RUNNER_TEMP"
+          helm push "${RUNNER_TEMP}/gitops-${chart_version}.tgz" "oci://${ECR_REGISTRY}/${ECR_HELM_PREFIX}"
 
   publish_to_pypi:
     name: Publishes tag to pypi

{gitops-1.9.0 → gitops-1.10.1}/.github/workflows/test.yml

@@ -14,6 +14,9 @@ permissions:
 
 env:
   PYTHONUNBUFFERED: 1
+  ECR_REGISTRY: 610829907584.dkr.ecr.ap-southeast-2.amazonaws.com
+  ECR_HELM_PREFIX: helm
+  AWS_REGION: ap-southeast-2
 
 jobs:
   ci:
@@ -99,23 +102,43 @@ jobs:
           tags: |
             610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}
 
-      - name: Prepare Docker image comment
+      - name: Install Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # ratchet:azure/setup-helm@v4
+
+      - name: Lint and render chart
+        run: |
+          helm lint charts/gitops
+          helm template gitops charts/gitops > /dev/null
+
+      # The SHA identifies the build; a fixed 0.0.0 base can't be mistaken for a release.
+      - name: Package and push test chart
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          aws ecr get-login-password --region "$AWS_REGION" \
+            | helm registry login --username AWS --password-stdin "$ECR_REGISTRY"
+          chart_version="0.0.0-test-${GIT_SHORT_HASH}"
+          helm package charts/gitops --version "$chart_version" --destination "$RUNNER_TEMP"
+          helm push "${RUNNER_TEMP}/gitops-${chart_version}.tgz" "oci://${ECR_REGISTRY}/${ECR_HELM_PREFIX}"
+
+      - name: Prepare test build comment
         id: docker_comment
         if: github.event_name == 'pull_request'
         run: |
           {
             echo "comment<<EOF"
-            echo "## Docker Images"
+            echo "## Test builds"
             echo ""
             echo "**Commit:** \`${{ github.event.pull_request.head.sha }}\`"
             echo ""
-            echo "| Tag |"
-            echo "| --- |"
-            echo "| \`610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}\` |"
+            echo "| | Reference |"
+            echo "| --- | --- |"
+            echo "| Image | \`610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}\` |"
+            echo "| Chart | \`oci://610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/helm/gitops\` version \`0.0.0-test-${{ env.GIT_SHORT_HASH }}\` |"
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Comment Docker images on PR
+      - name: Comment test builds on PR
         if: github.event_name == 'pull_request'
         uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # ratchet:marocchino/sticky-pull-request-comment@v2.9.2
         with:

gitops-1.10.1/.release-please-manifest.json

@@ -0,0 +1,5 @@
+{
+    ".": "1.10.1",
+    "gitops_server": "0.15.1",
+    "charts/gitops": "1.4.1"
+}

{gitops-1.9.0 → gitops-1.10.1}/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [1.10.1](https://github.com/uptick/gitops/compare/gitops-v1.10.0...gitops-v1.10.1) (2026-10-21)
+
+
+### Bug Fixes
+
+* **deps:** upgrade certifi to 2026.10.19 ([680d2ec](https://github.com/uptick/gitops/commit/680d2ec257595763a204e332ce603ade7affc5b6))
+* **deps:** upgrade certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2) ([6f5b494](https://github.com/uptick/gitops/commit/6f5b494bcfa7d6bd9393c45470ccf8f749758b78))
+
+## [1.10.0](https://github.com/uptick/gitops/compare/gitops-v1.9.0...gitops-v1.10.0) (2026-09-22)
+
+
+### Features
+
+* **deploy:** setting to skip helm's client-side OpenAPI validation ([3671513](https://github.com/uptick/gitops/commit/36715132c8e04efeb3b7f389595f6dc49c80c3f6))
+* helm 3.22.0, and a setting to skip its OpenAPI validation ([d66fe4a](https://github.com/uptick/gitops/commit/d66fe4a6362498ec7d85e19b57dbae5f6d8ddd6c))
+* **image:** helm 3.22.0, with helm-secrets 4.7.7 to match ([2d871bf](https://github.com/uptick/gitops/commit/2d871bfefe85d1f25e2748519cea0155e7f499bd))
+
+
+### Bug Fixes
+
+* upgrade urllib3 to 2.8.0 and anyio to the patched release ([dcd9699](https://github.com/uptick/gitops/commit/dcd96990444176abdddb0e70b8db8e5c0c8d55b1))
+* upgrade urllib3 to 2.8.0 and anyio to the patched release ([14bad7c](https://github.com/uptick/gitops/commit/14bad7c39c6743ff20054c3101ae5802eac8fc9c))
+
 ## [1.9.0](https://github.com/uptick/gitops/compare/gitops-v1.8.0...gitops-v1.9.0) (2026-09-09)
 
 

{gitops-1.9.0 → gitops-1.10.1}/Dockerfile

@@ -14,7 +14,7 @@ ARG TARGETARCH
 ## Install kubectl and dependencies.
 ##
 ENV KUBE_LATEST_VERSION="v1.21.3"
-ENV HELM_VERSION="v3.6.2" \
+ENV HELM_VERSION="v3.22.0" \
     VIRTUAL_ENV="/app/.venv" \
     PATH="/app/.venv/bin:$PATH"
 
@@ -30,7 +30,7 @@ RUN apt-get update \
     && chmod +x /usr/local/bin/helm \
     \
     # Install helm-secrets plugin
-    && helm plugin install https://github.com/jkroepke/helm-secrets --version v4.2.2 \
+    && helm plugin install https://github.com/jkroepke/helm-secrets --version v4.7.7 \
     \
     # Download sops
     && wget -q https://github.com/mozilla/sops/releases/download/v3.7.3/sops-v3.7.3.linux.${TARGETARCH} -O /usr/local/bin/sops \

{gitops-1.9.0 → gitops-1.10.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gitops
-Version: 1.9.0
+Version: 1.10.1
 Summary: Manage multiple apps across one or more k8s clusters.
 Author-email: Jarek Głowacki <jarekwg@gmail.com>
 License-File: LICENSE

{gitops-1.9.0 → gitops-1.10.1}/charts/gitops/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [1.4.1](https://github.com/uptick/gitops/compare/helm-v1.4.0...helm-v1.4.1) (2026-10-21)
+
+
+### Documentation
+
+* **chart:** describe ECR publishing ([3b4374a](https://github.com/uptick/gitops/commit/3b4374a6b6f303d1ad445ea988141ab3ca166169))
+
+## [1.4.0](https://github.com/uptick/gitops/compare/helm-v1.3.0...helm-v1.4.0) (2026-09-24)
+
+
+### Features
+
+* **chart:** take resources from values ([7bc1791](https://github.com/uptick/gitops/commit/7bc17919a3fd0405a593ebd55584a5cc31f7bdc7))
+* **chart:** take resources from values ([3f05fab](https://github.com/uptick/gitops/commit/3f05fab5f24009f127177c055a7bdf4c1159bd0e))
+
 ## [1.3.0](https://github.com/uptick/gitops/compare/helm-v1.2.2...helm-v1.3.0) (2026-09-09)
 
 

{gitops-1.9.0 → gitops-1.10.1}/charts/gitops/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: GitOps Server Helm chart.
 name: gitops
-version: 1.3.0
+version: 1.4.1

gitops-1.10.1/charts/gitops/README.md

@@ -0,0 +1,11 @@
+# GitOps Server Helm Chart
+
+Published to `oci://610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/helm/gitops`.
+
+## Releases
+
+Release-please bumps `version` in `Chart.yaml`. Merging its release PR pushes that version to ECR.
+
+## Test versions
+
+Each PR build pushes `0.0.0-test-<short sha>` and lists it in the "Test builds" PR comment.

{gitops-1.9.0 → gitops-1.10.1}/charts/gitops/templates/deployment.yml

@@ -38,8 +38,7 @@ spec:
         ports:
         - containerPort: 8000
         resources:
-          requests:
-            memory: "750Mi"
+          {{- toYaml .Values.resources | nindent 10 }}
 
         envFrom:
         - configMapRef:

{gitops-1.9.0 → gitops-1.10.1}/charts/gitops/values.yaml

@@ -42,12 +42,8 @@ podDisruptionBudget: {}
 #   maxUnavailable: 1
 
 resources:
-  limits:
-    cpu: 500m
-    memory: 512Mi
   requests:
-    cpu: 100m
-    memory: 128Mi
+    memory: 750Mi
 serviceAccount:
   # Specifies whether a service account should be created
   create: true

{gitops-1.9.0 → gitops-1.10.1}/gitops/__init__.py

@@ -6,7 +6,7 @@ from gitops.utils.apps import App, get_app_details, get_apps  # type: ignore[att
 
 from .utils.cli import success, warning
 
-__version__ = "1.9.0"
+__version__ = "1.10.1"
 
 
 # Checking gitops version matches cluster repo version.

{gitops-1.9.0 → gitops-1.10.1}/gitops_server/settings.py

@@ -21,3 +21,13 @@ GITOPS_MAX_PARALLEL_DEPLOYS = os.environ.get("GITOPS_MAX_PARALLEL_DEPLOYS", "5")
 # two commits before it reaches GITOPS_MAX_PARALLEL_DEPLOYS, so without a bound
 # here a burst of pushes is only limited by how fast they arrive.
 GITOPS_MAX_CONCURRENT_DEPLOYMENTS = os.environ.get("GITOPS_MAX_CONCURRENT_DEPLOYMENTS", "20")
+
+# Pass --disable-openapi-validation to helm. Off by default: helm keeps checking
+# manifests against the cluster schema before applying them, which costs each
+# helm process a download and parse of that schema. The API server still
+# rejects wrong types and missing fields either way.
+GITOPS_DISABLE_OPENAPI_VALIDATION = os.environ.get("GITOPS_DISABLE_OPENAPI_VALIDATION", "").lower() in (
+    "1",
+    "true",
+    "yes",
+)

gitops-1.10.1/gitops_server/version.py

@@ -0,0 +1 @@
+__version__ = "1.10.1"

{gitops-1.9.0 → gitops-1.10.1}/gitops_server/workers/deployer/deploy.py

@@ -280,6 +280,7 @@ class Deployer:
                                     f" --history-max {MAX_HELM_HISTORY}"
                                     " --install"
                                     " --timeout=600s"
+                                    f"{' --disable-openapi-validation' if settings.GITOPS_DISABLE_OPENAPI_VALIDATION else ''}"
                                     f"{' --set skip_migrations=true' if self.skip_migrations else ''}"
                                     f" -f {cfg.name}"
                                     f" --namespace={app.namespace}"
@@ -312,6 +313,7 @@ class Deployer:
                                 f" --history-max {MAX_HELM_HISTORY}"
                                 " --install"
                                 " --timeout=600s"
+                                f"{' --disable-openapi-validation' if settings.GITOPS_DISABLE_OPENAPI_VALIDATION else ''}"
                                 f"{' --set skip_migrations=true' if self.skip_migrations else ''}"
                                 f" -f {cfg.name}"
                                 f" --namespace={app.namespace}"

{gitops-1.9.0 → gitops-1.10.1}/pyproject.toml

@@ -1,7 +1,7 @@
 
 [project]
 name = "gitops"
-version = "1.9.0"
+version = "1.10.1"
 description = "Manage multiple apps across one or more k8s clusters."
 requires-python = ">=3.12"
 readme = "README.md"

{gitops-1.9.0 → gitops-1.10.1}/tests/test_deploy.py

@@ -145,6 +145,27 @@ class TestDeploy:
         )
         assert post_mock.call_count == 2
 
+    @patch("gitops_server.workers.deployer.deploy.settings.GITOPS_DISABLE_OPENAPI_VALIDATION", True)
+    @patch("gitops_server.workers.deployer.deploy.run")
+    @patch("gitops_server.utils.slack.post")
+    @patch("gitops_server.workers.deployer.deploy.load_app_definitions", mock_load_app_definitions)
+    @patch("gitops_server.workers.deployer.deploy.temp_repo")
+    async def test_deployer_disable_openapi_validation_setting_adds_the_helm_flag(
+        self, temp_repo_mock, post_mock, run_mock
+    ):
+        run_mock.return_value = {"exit_code": 0, "output": ""}
+        temp_repo_mock.return_value.__aenter__.return_value = "mock-repo"
+        semaphore_manager = AppSemaphoreManager()
+        deployer = await Deployer.from_push_event(SAMPLE_GITHUB_PAYLOAD, semaphore_manager)
+        await deployer.deploy()
+        assert run_mock.call_count == 4
+        for call in (run_mock.call_args_list[1], run_mock.call_args_list[3]):
+            assert re.match(
+                r"helm secrets upgrade --create-namespace --history-max 3 --install --timeout=600s"
+                r" --disable-openapi-validation -f .+\.yml --namespace=mynamespace sample-app-\d mock-repo",
+                call[0][0],
+            )
+
     @patch("gitops_server.workers.deployer.deploy.run")
     @patch("gitops_server.utils.slack.post")
     @patch("gitops_server.workers.deployer.deploy.Deployer.post_result")