Bump framework pin to d4ab1e9 - #48
Merged
Merged
Conversation
Picks up the two fixes made while working on the-hero-wars-guys:
#94 the assembly guard used compgen -G, which skips dotfiles, so a
definitions directory containing only dotfiles read as empty and its
repositories silently stopped being declared.
#95 a destroy guard: refuses a genuine deletion (archive_on_destroy=false)
and refuses to archive a repository that was not deliberately archived
first, while still allowing a deliberate retirement to complete.
This runner was not hit by #94 because terraform/public/ holds 19 non-dotfile
YAMLs. It was closer than that sounds, though: terraform/private/ contains only
.gitkeep, so it reads as empty under the old guard, and it is only safe because
the S3 fetch populates that directory before assembly runs. A change to that
ordering, or a move of the last public definition, would have exposed it.
More to the point, this runner had no destroy guard at all - and it is the one
holding org-admin credentials for 21 repositories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Picks up the two fixes made while working on the-hero-wars-guys. This runner is currently two commits behind and has no destroy guard — while holding org-admin credentials for 21 repositories.
compgen -G, which skips dotfiles — a definitions directory containing only dotfiles read as empty and its repositories silently stopped being declaredarchive_on_destroy=false) and refuses archiving a repository that was not deliberately archived first, while still allowing a deliberate retirement to completeWas this runner exposed to #94?
Not in practice —
terraform/public/holds 19 non-dotfile YAMLs, so the guard passed.It was closer than that sounds.
terraform/private/contains only.gitkeep, so it reads as empty under the old guard, and it is safe only because the S3 fetch populates that directory before assembly runs. A change to that step ordering, or moving the last public definition, would have exposed it.Acceptance
No changes, since this is CI-only