Skip to content

fix(website): unblock prod deploy; build website in merge queue - #3287

Merged
Andriy Knysh (aknysh) merged 1 commit into
mainfrom
osterman/b8fp7
Oct 6, 2026
Merged

Andriy Knysh (aknysh) merged 1 commit into
mainfrom
osterman/b8fp7

Conversation

@osterman

@osterman Erik Osterman (Cloud Posse) (osterman) commented Oct 6, 2026 •

Copy link
Copy Markdown
Member

what

  • Add related_docs front matter to examples/scaffolding-yaml-functions/README.md (links to scaffold generate, scaffold validate, and the !include function).
  • Add a merge_group trigger to Website Preview Build so the website prebuild tests and the Docusaurus build also run against the synthetic merge-queue commit. The preview deploy still ignores these runs because they have no associated PR number.

why

references

Summary by CodeRabbit

  • Chores
    • Website preview builds now also run for merge-queue checks.
  • Documentation
    • Added links to documentation for scaffold generation, template configuration, scaffold validation, and the !include YAML function.

Add related_docs front matter to the scaffolding-yaml-functions example,
which the new example-docs prebuild test requires, and run the website
build and prebuild tests on merge_group so PRs that pass alone cannot
break the production deploy once combined in the queue.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@atmos-pro

atmos-pro Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

@osterman Erik Osterman (Cloud Posse) (osterman) added the no-release Do not create a new release (wait for additional code changes) label Oct 6, 2026
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

@github-actions github-actions Bot added the size/s Small size PR label Oct 6, 2026
@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown

Warning

SHA Pin Verification Passed — with documented exceptions

All 239 third-party action reference(s) are covered, but 2 rely on a documented allowlist entry in allowlist.json and could not be automatically drift-checked. This does not fail CI, but should be reviewed.

Action Location Status Details
aquasecurity/trivy-action@v0.36.0 build.yml:162 ⚠️ Allowlisted (documented) The aquasecurity GitHub organization has enabled an IP allow list that blocks API access (git ref/tag lookups) from GitHub-hosted Actions runner IPs, for any caller, on any of their repos, including public ones — this is not specific to our token or workflow. Verified independently: the exact same 403 is reported against the sibling aquasecurity/tfsec-action, and trivy-cache-action's issue tracker explicitly confirms 'aquasecurity GitHub org now has IP allow list enabled, blocking API access'. Manually confirmed our pinned SHA is correct (dereferenced the v0.36.0 annotated tag directly against the GitHub API from a non-Actions IP; it matches) — this entry only silences the automated drift check, which the API access restriction makes impossible to run in CI, not the underlying security property.
aquasecurity/trivy-action@v0.36.0 test.yml:1294 ⚠️ Allowlisted (documented) The aquasecurity GitHub organization has enabled an IP allow list that blocks API access (git ref/tag lookups) from GitHub-hosted Actions runner IPs, for any caller, on any of their repos, including public ones — this is not specific to our token or workflow. Verified independently: the exact same 403 is reported against the sibling aquasecurity/tfsec-action, and trivy-cache-action's issue tracker explicitly confirms 'aquasecurity GitHub org now has IP allow list enabled, blocking API access'. Manually confirmed our pinned SHA is correct (dereferenced the v0.36.0 annotated tag directly against the GitHub API from a non-Actions IP; it matches) — this entry only silences the automated drift check, which the API access restriction makes impossible to run in CI, not the underlying security property.

See the action run for full details.

@mergify

mergify Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

@mergify mergify Bot added the needs-cloudposse Needs Cloud Posse assistance label Oct 6, 2026
@coderabbitai

coderabbitai Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: cloudposse/atmos/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: cc80879d-9e93-47b6-8666-2a6f162208ce
📥 Commits

Reviewing files that changed from the base of the PR and between bd75d3b and efedc5e.

📒 Files selected for processing (2)
  • .github/workflows/website-preview-build.yml
  • examples/scaffolding-yaml-functions/README.md

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The website preview build workflow now runs for merge-queue checks. The scaffolding YAML functions example README adds links to related documentation.

Changes

Website preview workflow

Layer / File(s) Summary
Merge-queue workflow trigger
.github/workflows/website-preview-build.yml
The workflow adds a merge_group trigger for checks_requested. Comments describe merge-queue runs and note that path filters do not apply to them.

Scaffolding example documentation

Layer / File(s) Summary
Related documentation links
examples/scaffolding-yaml-functions/README.md
The README front matter links to documentation for scaffold generation and template configuration, scaffold validation, and the !include YAML function.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested labels: patch, no-release

Suggested reviewers: goruha

Merge Risk: ⚪ Minimal · up to efedc

The merge-queue event runs the website build without requiring PR context; it simply does not deploy a preview. No demonstrated merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: running the website build in the merge queue to help unblock production deploys.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Oct 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.67%. Comparing base (bd75d3b) to head (efedc5e).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #3287      +/-   ##
==========================================
- Coverage   84.68%   84.67%   -0.01%     
==========================================
  Files        2105     2105              
  Lines      206758   206758              
==========================================
- Hits       175083   175075       -8     
- Misses      23407    23410       +3     
- Partials     8268     8273       +5     
Flag Coverage Δ
unittests 84.67% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 8 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown

CI timing summary

Latest completed GitHub Actions runs for efedc5e377ec.

  • PR wall-clock time: 28m 38s
  • Aggregate runner time: 9h 08m 42s
  • Included: 16 workflows, 120 jobs (including matrix jobs)

Wall-clock time spans the earliest included workflow creation through the latest completion. Aggregate runner time adds each job's execution time, so concurrent jobs are counted separately.

Workflow Elapsed Runner time Jobs
✅ Tests 28m 38s 8h 33m 13s 98
✅ CodeQL 9m 26s 16m 59s 6
✅ atmos.ci 6m 12s 6m 08s 1
✅ Dependency Review 3m 55s 3m 51s 1
✅ vhs 3m 04s 2m 46s 3
✅ Pre-commit 2m 16s 2m 12s 1
✅ TruffleHog secret scan 42s 39s 1
✅ Link Check 39s 35s 1
✅ Verify SHA Pinning 33s 30s 1
✅ Release Documentation Check 31s 27s 1
✅ Validate Codeowners 30s 26s 1
✅ PR Size Labeler 28s 24s 1
✅ Verify Repository Symlinks 23s 20s 1
✅ autofix.ci 15s 12s 1
⏭️ landing-demos 1s 0s 1
⏭️ Feature release 1s 0s 1
Longest jobs (top 10)
Job Workflow Duration Conclusion
[race] non-acceptance test suite (shard 4/4) Tests 19m 53s ✅ success
Acceptance Tests (windows, shard 3/10) Tests 15m 11s ✅ success
Acceptance Tests (macos, shard 1/10) Tests 14m 42s ✅ success
[race] non-acceptance test suite (shard 1/4) Tests 13m 53s ✅ success
[k3s-macos] demo-helmfile Tests 13m 21s ✅ success
[floci] go e2e Tests 13m 11s ✅ success
Acceptance Tests (macos, shard 2/10) Tests 12m 59s ✅ success
Acceptance Tests (windows, shard 1/10) Tests 12m 58s ✅ success
[race] non-acceptance test suite (shard 3/4) Tests 12m 38s ✅ success
[k3s-macos] helm Tests 12m 27s ✅ success

Updated automatically when a PR workflow finishes.

@aknysh
Andriy Knysh (aknysh) added this pull request to the merge queue Oct 6, 2026
@atmos-pro

atmos-pro Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

Merged via the queue into main with commit 3f672ff Oct 6, 2026
154 checks passed
@aknysh
Andriy Knysh (aknysh) deleted the osterman/b8fp7 branch October 6, 2026 23:58
@atmos-pro

atmos-pro Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Tip

Atmos Pro  

No affected stacks workflow was detected for this pull request.
If this is expected, no action is needed.
Learn More. Ask AI.

@mergify mergify Bot removed the needs-cloudposse Needs Cloud Posse assistance label Oct 6, 2026
@github-actions

github-actions Bot commented Oct 8, 2026

Copy link
Copy Markdown

These changes were released in v1.231.0-rc.4.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

no-release Do not create a new release (wait for additional code changes) size/s Small size PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants