Skip to content

feat: adopt golden pins and workflows from pdq-deploy-inventory - #1

Merged
NWarila merged 5 commits into
mainfrom
feat/adopt-golden-pins-and-workflows
Aug 27, 2026
Merged

NWarila merged 5 commits into
mainfrom
feat/adopt-golden-pins-and-workflows

Conversation

@NWarila

@NWarila NWarila commented Aug 27, 2026 •

Copy link
Copy Markdown
Contributor

Normalizes this repo onto the Golden Repo (pdq-deploy-inventory) layout, per the fleet templating initiative:

  • Pins: root .framework-pin (ansible-framework @ 363c5b4c) and .github/terraform-framework-pin (aws-terraform-framework @ 546d80b1) at the golden SHAs.
  • aws-deploy.yml: the golden deploy skeleton — OIDC role nwarila-platform_<repo>_runner, pinned framework checkouts, terraform apply, ansible converge, hold, always-destroy, incident report. PDQ-specific proof steps are stripped; app proofs return as this repo's application work.
  • quality.yml: fleet port of the golden quality gate — roles discovered from ansible/applications/ and gated on the tree existing, so it passes before application work starts.
  • powershell.yml: golden thin caller (path-filtered; inert until .ps1 pairs exist).
  • Supports: .editorconfig, .yamllint.yml, quality-tools.env, requirements-quality.{txt,yml}, scripts/compose-and-run.sh (playbook default parameterized), scripts/materialize-role-scripts.sh.
  • .gitignore: default-deny allowlist extended to exactly the files above.

Normalizes this repo onto the Golden Repo layout: root .framework-pin +
.github/terraform-framework-pin at the golden SHAs, the golden aws-deploy
skeleton (converge + hold + teardown; app-specific proofs stripped), the
thin powershell.yml caller, the fleet quality gate with role discovery,
and the quality/compose support files.
@github-actions

github-actions Bot commented Aug 27, 2026 •

Copy link
Copy Markdown

PowerShell pair results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit b4a9048.

♻️ This comment has been updated with latest results.

One-line parameterization of the Golden Repo inventory: the gitlab_servers
group selects Function=gitlab hosts; everything else is carried unchanged.
Mirrors pdq-deploy-inventory#2: ansible_python_interpreter (RHEL ->
platform-python, else python3) and windows_password_source (winrm-direct
legs only) now live in the shared inventory body.
@NWarila
NWarila force-pushed the feat/adopt-golden-pins-and-workflows branch 2 times, most recently from 586052b to 0d661ef Compare August 27, 2026 15:15
AGENTS.md states the org-wide contribution rules (no AI attribution,
golden-repo deference, protected main, default-deny gitignore);
CLAUDE.md imports it.
@NWarila
NWarila force-pushed the feat/adopt-golden-pins-and-workflows branch from 0d661ef to ef28734 Compare August 27, 2026 15:16
MIT license carried from the golden repo; SECURITY.md carried from
windows-wsus with platform-neutral wording (the one fleet copy that
existed), covering supported version and private vulnerability
reporting.
@NWarila
NWarila force-pushed the feat/adopt-golden-pins-and-workflows branch from 7251bf4 to b4a9048 Compare August 27, 2026 16:22
@NWarila
NWarila merged commit 4293c94 into main Aug 27, 2026
4 of 5 checks passed
@NWarila
NWarila deleted the feat/adopt-golden-pins-and-workflows branch August 27, 2026 18:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant