ci: verify platform stack during bootstrap by casey-brooks · Pull Request #22 · agynio/bootstrap

casey-brooks · 2026-03-03T10:36:30Z

Summary

add concurrency limits, job timeout, kubeconfig exports, and kubectl/jq setup in bootstrap workflow
apply the platform stack with explicit TF_VAR values, wait for jobs/deployments/statefulsets, and verify platform pods
run optional Argo CD application health checks and ensure PR cleanups destroy platform -> system -> k8s

Testing

terraform fmt -check -recursive
terraform -chdir=stacks/k8s validate
terraform -chdir=stacks/system validate
terraform -chdir=stacks/platform validate
terraform -chdir=stacks/k8s apply -auto-approve -input=false
terraform -chdir=stacks/system apply -auto-approve -input=false
terraform -chdir=stacks/platform apply -auto-approve -input=false
bash /tmp/platform-health.sh
bash /tmp/argocd-health.sh
terraform -chdir=stacks/platform destroy -auto-approve -input=false
terraform -chdir=stacks/system destroy -auto-approve -input=false
terraform -chdir=stacks/k8s destroy -auto-approve -input=false

Fixes #21

casey-brooks · 2026-03-03T10:37:04Z

Test & Lint Summary

terraform fmt -check -recursive
terraform -chdir=stacks/k8s validate
terraform -chdir=stacks/system validate
terraform -chdir=stacks/platform validate
terraform -chdir=stacks/k8s apply -auto-approve -input=false
terraform -chdir=stacks/system apply -auto-approve -input=false
terraform -chdir=stacks/platform apply -auto-approve -input=false
bash /tmp/platform-health.sh
bash /tmp/argocd-health.sh
terraform -chdir=stacks/platform destroy -auto-approve -input=false
terraform -chdir=stacks/system destroy -auto-approve -input=false
terraform -chdir=stacks/k8s destroy -auto-approve -input=false

casey-brooks · 2026-03-03T11:10:28Z

Test & Lint Summary (update)

./actionlint .github/workflows/bootstrap.yml
/usr/local/bin/terraform fmt -check -recursive
/tmp/workflow-steps.sh (runs k3d bring-up, terraform init/apply/destroy for k8s/system/platform, platform & Argo CD health checks)

noa-lucent

Requested changes after full review.

Blocking items:

[major] Concurrency group naming does not match the agreed issue specification (bootstrap-pr-<pr_number> for PRs, bootstrap-main for main). Please align this exactly to avoid unintended overlap behavior and keep workflow policy explicit.

Everything else in this PR looks aligned with the requested scope (platform apply, health checks, optional Argo verification, and PR-only reverse destroy).

noa-lucent

Re-review complete. The previously requested concurrency fix is now implemented correctly with explicit PR/main groups, and the workflow remains aligned with issue #21 scope. Approving.

vitramir · 2026-03-03T11:36:42Z

+      TF_VAR_kubeconfig_path: ${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml
+      TF_VAR_argocd_server_addr: localhost:8080
+      TF_VAR_argocd_admin_username: admin
+      TF_VAR_argocd_admin_password: admin
+      TF_VAR_platform_repo_url: https://github.com/agynio/platform.git
+      TF_VAR_platform_repo_username: ""
+      TF_VAR_platform_repo_password: ""
+      TF_VAR_platform_target_revision: v0.15.2
+      TF_VAR_platform_namespace: platform
+      TF_VAR_destination_server: https://kubernetes.default.svc
+      TF_VAR_platform_server_image_tag: 0.15.2
+      TF_VAR_docker_runner_image_tag: 0.15.2
+      TF_VAR_docker_runner_replica_count: "1"
+      TF_VAR_argocd_automated_sync_enabled: "true"
+      TF_VAR_argocd_prune_enabled: "true"
+      TF_VAR_argocd_self_heal_enabled: "true"
+      TF_VAR_platform_db_password: agents
+      TF_VAR_platform_db_pvc_size: 5Gi
+      TF_VAR_litellm_db_password: change-me
+      TF_VAR_litellm_db_pvc_size: 5Gi
+      TF_VAR_litellm_master_key: sk-dev-master
+      TF_VAR_litellm_salt_key: sk-dev-salt
+      TF_VAR_docker_runner_shared_secret: change-me
+      TF_VAR_vault_pvc_size: 5Gi
+      TF_VAR_registry_mirror_pvc_size: 5Gi


vitramir · 2026-03-03T11:36:52Z

    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      KUBECONFIG: ${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml


move to the relevant step

casey-brooks · 2026-03-03T12:42:38Z

Local Validation

terraform fmt -check -recursive
./actionlint .github/workflows/bootstrap.yml
terraform -chdir=stacks/k8s init -input=false
terraform -chdir=stacks/k8s apply -auto-approve -input=false
terraform -chdir=stacks/system init -input=false
terraform -chdir=stacks/system apply -auto-approve -input=false
terraform -chdir=stacks/platform init -input=false
terraform -chdir=stacks/platform apply -auto-approve -input=false
./.github/scripts/verify_platform_health.sh
terraform -chdir=stacks/platform destroy -auto-approve -input=false
terraform -chdir=stacks/system destroy -auto-approve -input=false
terraform -chdir=stacks/k8s destroy -auto-approve -input=false

All commands completed successfully with no failures.

noa-lucent

Re-review complete. The workflow now uses the strict single health verification script and remains aligned with issue #21 requirements (trigger scope, stack apply order, explicit vars, health gating, PR-only reverse destroy, and concurrency policy). Approving.

vitramir · 2026-03-03T13:01:24Z

+      TF_VAR_argocd_server_addr: localhost:8080
+      TF_VAR_argocd_admin_username: admin
+      TF_VAR_argocd_admin_password: admin
+      TF_VAR_platform_repo_url: https://github.com/agynio/platform.git
+      TF_VAR_platform_repo_username: ""
+      TF_VAR_platform_repo_password: ""
+      TF_VAR_platform_target_revision: v0.15.2
+      TF_VAR_platform_namespace: platform
+      TF_VAR_destination_server: https://kubernetes.default.svc
+      TF_VAR_platform_server_image_tag: 0.15.2
+      TF_VAR_docker_runner_image_tag: 0.15.2
+      TF_VAR_docker_runner_replica_count: "1"
+      TF_VAR_argocd_automated_sync_enabled: "true"
+      TF_VAR_argocd_prune_enabled: "true"
+      TF_VAR_argocd_self_heal_enabled: "true"
+      TF_VAR_platform_db_password: agents
+      TF_VAR_platform_db_pvc_size: 5Gi
+      TF_VAR_litellm_db_password: change-me
+      TF_VAR_litellm_db_pvc_size: 5Gi
+      TF_VAR_litellm_master_key: sk-dev-master
+      TF_VAR_litellm_salt_key: sk-dev-salt
+      TF_VAR_docker_runner_shared_secret: change-me
+      TF_VAR_vault_pvc_size: 5Gi


delete. apply should work without any additional variables provided

vitramir · 2026-03-03T13:01:58Z

+          echo "KUBECONFIG=${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml" >> "$GITHUB_ENV"
+          echo "TF_VAR_kubeconfig_path=${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml" >> "$GITHUB_ENV"


delete. apply should work without additional variables

noa-lucent

Re-review complete.\n\nRequesting changes due to one blocking regression:\n- [major] Workflow no longer sets the explicit platform TF_VAR values required by issue #21. The issue/spec explicitly asked to pass these in CI even when defaults exist. Please restore them so behavior remains explicit and requirement-compliant.\n\nEverything else reviewed in this update looks fine.

rowan-stein · 2026-03-03T13:55:04Z

Maintainer request incorporated: workflow now relies solely on Terraform defaults and removes TF_VAR overrides. This updates the acceptance criteria in Issue #21 (see linked comment) — apply should work out of the box with no additional variables.

Requesting re-review based on updated criteria.

noa-lucent

Re-review complete against the revised issue #21 criteria (documented in the maintainer comment). The workflow now correctly relies on Terraform defaults without TF_VAR overrides, while still meeting the required trigger scope, tool setup, apply order, health verification, PR cleanup, timeout, and concurrency behavior. Approving.

vitramir · 2026-03-03T14:29:57Z

+      - name: Export kubeconfig for kubectl
+        run: |
+          echo "KUBECONFIG=${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml" >> "$GITHUB_ENV"
+


This can be used only inside health check. The rest of the flow should work without any extra env variables!

casey-brooks · 2026-03-03T15:01:30Z

CI run https://github.com/agynio/bootstrap_v2/actions/runs/22628550932 finished green after removing all workflow env exports. @rowan-stein this is ready for re-review.

* ci: expand bootstrap pipeline * ci: fix concurrency format * ci: simplify concurrency group * ci: align concurrency naming * ci: fix platform rollout loop * ci: enforce issue-21 concurrency * feat(ci): harden bootstrap health checks * fix(ci): rely on terraform defaults * fix(ci): drop workflow env exports

Gateway: fix(ziti) managed identity resolution (#123) Agents: feat(authz) agent org membership tuples (#30) LLM-Proxy: fix(identity) managed identity parsing (#22)

#203) Gateway: fix(ziti) managed identity resolution (#123) Agents: feat(authz) agent org membership tuples (#30) LLM-Proxy: fix(identity) managed identity parsing (#22)

ci: expand bootstrap pipeline

d66398f

casey-brooks requested a review from a team as a code owner March 3, 2026 10:36

casey-brooks added 4 commits March 3, 2026 10:42

ci: fix concurrency format

65ae365

ci: simplify concurrency group

82996d3

ci: align concurrency naming

86be9e8

ci: fix platform rollout loop

a507157

noa-lucent requested changes Mar 3, 2026

View reviewed changes

Comment thread .github/workflows/bootstrap.yml Outdated

ci: enforce issue-21 concurrency

0a8c627

noa-lucent previously approved these changes Mar 3, 2026

View reviewed changes

vitramir requested changes Mar 3, 2026

View reviewed changes

feat(ci): harden bootstrap health checks

7482107

casey-brooks dismissed noa-lucent’s stale review via 7482107 March 3, 2026 12:41

noa-lucent previously approved these changes Mar 3, 2026

View reviewed changes

vitramir requested changes Mar 3, 2026

View reviewed changes

fix(ci): rely on terraform defaults

fae15df

casey-brooks dismissed noa-lucent’s stale review via fae15df March 3, 2026 13:43

noa-lucent requested changes Mar 3, 2026

View reviewed changes

Comment thread .github/workflows/bootstrap.yml

rowan-stein mentioned this pull request Mar 3, 2026

Add CI to apply k8s, system, and platform stacks; verify platform services health on PR and main #21

Closed

noa-lucent previously approved these changes Mar 3, 2026

View reviewed changes

vitramir requested changes Mar 3, 2026

View reviewed changes

fix(ci): drop workflow env exports

bb280e3

casey-brooks dismissed noa-lucent’s stale review via bb280e3 March 3, 2026 14:53

vitramir approved these changes Mar 3, 2026

View reviewed changes

vitramir merged commit f6ba5cc into main Mar 3, 2026
1 check passed

		echo "KUBECONFIG=${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml" >> "$GITHUB_ENV"
		echo "TF_VAR_kubeconfig_path=${{ github.workspace }}/stacks/k8s/.kube/agyn-local-kubeconfig.yaml" >> "$GITHUB_ENV"

Conversation

casey-brooks commented Mar 3, 2026

Summary

Testing

Uh oh!

casey-brooks commented Mar 3, 2026

Test & Lint Summary

Uh oh!

casey-brooks commented Mar 3, 2026

Test & Lint Summary (update)

Uh oh!

noa-lucent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

noa-lucent left a comment

Choose a reason for hiding this comment

Uh oh!

vitramir Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

vitramir Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

casey-brooks commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Local Validation

Uh oh!

noa-lucent left a comment

Choose a reason for hiding this comment

Uh oh!

vitramir Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

vitramir Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

noa-lucent left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rowan-stein commented Mar 3, 2026

Uh oh!

noa-lucent left a comment

Choose a reason for hiding this comment

Uh oh!

vitramir Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

casey-brooks commented Mar 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

casey-brooks commented Mar 3, 2026 •

edited

Loading