fix(manifest): correct hardening.deployOnPush to true; wire auto-merge guard - #201
Draft
github-actions[bot] wants to merge 2 commits into
Draft
fix(manifest): correct hardening.deployOnPush to true; wire auto-merge guard#201github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
release.yml triggers on push to main (paths: services/orchestrator/**, services/ui-react/**, mcp-servers/fuzeagent-server/**, deploy/helm/**, etc.), builds+pushes GHCR images, and commits the tag bump to values-prod.yaml directly. Argo syncs from there. That is a production deploy triggered by a push to the default branch, so hardening.deployOnPush was misdeclared false.
Wires the auto-merge path to hardening.deployOnPush in .fuze/manifest.json: a merge on this repo pushes images and bumps values-prod.yaml directly (release.yml), so a bot-merged PR here would be an unattended production deploy. Mirrors the pattern already live on FuzeX's auto-merge.yml and the canonical template in izzywdev/FuzeSDLC (workflow-templates/auto-merge.yml).
izzywdev
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
hardening.deployOnPushmeans a merge to the default branch IS a production deploy (see FuzeFront's CLAUDE.md and FuzeSDLC'sgovernance/repo-manifest.schema.json). This repo's manifest declareddeployOnPush: false, which was wrong.Evidence:
.github/workflows/release.yml—on: push: branches: [main](paths underservices/orchestrator/**,services/ui-react/**,mcp-servers/fuzeagent-server/**,deploy/helm/**, etc.) — builds and pushes the four service images to GHCR, then commits the tag bump tovalues-prod.yamldirectly. Argo syncs from there. That is a deploy triggered by a push tomain.Changes:
.fuze/manifest.json:hardening.deployOnPushfalse→true..github/workflows/auto-merge.yml: reads the flag and withholds bot-merge whendeployOnPush: true(mirrors the pattern already live onizzywdev/FuzeX'sauto-merge.ymland the canonical template inizzywdev/FuzeSDLC'sworkflow-templates/auto-merge.yml). This repo has no existing deploy-preserving auto-merge mechanism (unlike FuzeFront/FuzePicker), so blocking is the safe default — merge this PR by hand in a deploy window.No deploy workflow behavior changes; this only declares a fact and gates the merge path on it.
Note: this PR was auto-opened as a draft by this repo's stranded-branch detector; marking ready for review here.