feat(#645): manage the full axiom resource set in the pulumi workspace - #666
Merged
Conversation
Import the vers datasets, the ingest and query API tokens, and the baseline dashboard into the vers-infra Pulumi program, alongside the monitors and notifier already managed there. Imports were state-only adoptions verified against a zero-change refresh preview — no token rotated, no resource recreated. - datasets carry protect: true; kind is declared to match live state since a kind change forces a data-destroying replacement - token scopes mirror the live capabilities exactly; secret values stay in 1Password, and the provider regenerates a token's secret on any arg change - the dashboard document serializes through a Go-compatible JSON encoder (sorted keys, HTML escaping) so state stays byte-identical to code - infra/tsconfig.json extends tsconfig.base.json so the type-aware linter resolves ES2024 lib types - deployment and observability docs point at the program instead of the retired curl provisioning steps
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe Pulumi workspace now manages Axiom datasets, tokens, and a baseline dashboard. Infrastructure exports and TypeScript configuration were updated, while deployment and observability documentation now describe Pulumi provisioning, vault-managed secrets, token permissions, and drift reconciliation. ChangesAxiom observability infrastructure
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
🍹
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/architecture/observability.md`:
- Around line 69-72: Update the Axiom resource-management documentation to
clarify that token secret values are kept in 1Password as the source of truth
but may be stored in encrypted Pulumi stack state; remove the inaccurate claim
that they never reach state while preserving the surrounding drift-management
guidance.
In `@infra/axiom.ts`:
- Around line 10-16: Convert the declaration-level rationale comments near the
affected configurations in infra/axiom.ts to multiline JSDoc, attaching each
block directly to its enclosing declaration or configured property. Apply this
consistently to the referenced comment ranges, and retain // comments only for
statement-level commentary.
- Around line 70-83: Update the datasetCapabilities objects for both Axiom
tokens to explicitly include vers-traces, vers-logs, and vers-metrics as dataset
keys, preserving the existing ingests/create scope for the ingest token and
queries/read scope for mcpToken; remove the '*' entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6ca4e18b-aa16-487b-acf7-211908182c2a
📒 Files selected for processing (6)
docs/architecture/deployment.mddocs/architecture/observability.mdinfra/README.mdinfra/axiom.tsinfra/index.tsinfra/tsconfig.json
Token secrets reach Pulumi stack state encrypted after a regeneration, so the docs say that instead of claiming they never touch state. Declaration comments in the Axiom program convert from // blocks to multiline JSDoc per the comment conventions.
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes #645
Brings the remaining Axiom resources — the three
vers-*datasets, thevers-productioningest andvers-mcpquery tokens, and the baseline dashboard — under thevers-infraPulumi program, so the whole observability backend is reviewable and drift-checked.--refresh --expect-no-changespreview passes, so no token rotated and nothing was recreated.protect: true;vers-traceskeeps its liveaxiom:events:v1kind because a kind change forces a data-destroying replacement.infra/README.md.infra/tsconfig.jsonnow extendstsconfig.base.json— its standalone ES2022 config broke type-aware linting oftoSorted.iac-token) stays console-managed: a token cannot rotate itself.Testing
bun run typecheckpassesbun run testpassesbun run lintpasses