Tags: max06/atlas
Tags
scrub-baseline: skip already-redacted Secret markers (#70) (#73) Fixes the review-pipeline ghost diff from #70: the baseline scrub re-hashed already-present `REDACTED:sha256:` markers into `sha256("REDACTED:sha256:<hash>")`, flagging every Secret as changed on unrelated PRs (verified exactly on the #69 review diff). Marker-form values are now excluded in both the collection and replacement expressions of the structural pass — replay over an already-redacted (post-#59) baseline is a no-op, while pre-redaction baselines still get the full leak-closing scrub. The map replay pass needed no change (it only rewrites exact map-key matches). Two new tests: marker passthrough (mixed marker/raw Secret) and full run-twice idempotency. Replay suite 11/11. After merge, the standing `deployment47` ghost in self-reviews disappears. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Skip SOPS decryption during state-build passes (#58) Stage-2 fan-out and stage-3 state-build walked the full hierarchy with decryption for every deployment on every render — one sops call per deployment, even unselected ones. Both passes only need hierarchy values for structural templating, so they now merge sops files as plaintext key structure with their ENC[...] values (metadata dropped) instead of decrypting. Secrets resolve exclusively in the release-time values-loader. Measured on a live consumer repo: 26 gpg calls -> 2 per single-app render, wall time -58%. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Update alpine Docker tag to v3.24 (#52) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | alpine | final | minor | `3.23` → `3.24` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/max06/atlas). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjIwOS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update helmfile/helmfile-action action to v2.4.4 (#31) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [helmfile/helmfile-action](https://redirect.github.com/helmfile/helmfile-action) | action | patch | `v2.4.1` → `v2.4.4` | --- ### Release Notes <details> <summary>helmfile/helmfile-action (helmfile/helmfile-action)</summary> ### [`v2.4.4`](https://redirect.github.com/helmfile/helmfile-action/releases/tag/v2.4.4) [Compare Source](https://redirect.github.com/helmfile/helmfile-action/compare/v2.4.3...v2.4.4) ##### What's Changed - build(deps): bump [@​actions/http-client](https://redirect.github.com/actions/http-client) from 4.0.0 to 4.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​684](https://redirect.github.com/helmfile/helmfile-action/pull/684) - build(deps): bump [@​actions/core](https://redirect.github.com/actions/core) from 3.0.0 to 3.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​683](https://redirect.github.com/helmfile/helmfile-action/pull/683) - build(deps-dev): bump [@​typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) from 8.58.2 to 8.59.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​682](https://redirect.github.com/helmfile/helmfile-action/pull/682) - build(deps-dev): bump [@​typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) from 8.58.2 to 8.59.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​681](https://redirect.github.com/helmfile/helmfile-action/pull/681) - build(deps-dev): bump [@​typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) from 8.59.0 to 8.59.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​687](https://redirect.github.com/helmfile/helmfile-action/pull/687) - build(deps-dev): bump [@​swc/core](https://redirect.github.com/swc/core) from 1.15.30 to 1.15.32 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​686](https://redirect.github.com/helmfile/helmfile-action/pull/686) - build(deps-dev): bump [@​typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) from 8.59.0 to 8.59.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​691](https://redirect.github.com/helmfile/helmfile-action/pull/691) - build(deps-dev): bump globals from 17.5.0 to 17.6.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​688](https://redirect.github.com/helmfile/helmfile-action/pull/688) - build(deps-dev): bump [@​swc/core](https://redirect.github.com/swc/core) from 1.15.32 to 1.15.33 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​689](https://redirect.github.com/helmfile/helmfile-action/pull/689) - build(deps-dev): bump [@​typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) from 8.59.1 to 8.59.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​690](https://redirect.github.com/helmfile/helmfile-action/pull/690) **Full Changelog**: <helmfile/helmfile-action@v2.4.3...v2.4.4> ### [`v2.4.3`](https://redirect.github.com/helmfile/helmfile-action/releases/tag/v2.4.3) [Compare Source](https://redirect.github.com/helmfile/helmfile-action/compare/v2.4.2...v2.4.3) ##### What's Changed - build(deps-dev): bump [@​typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) from 8.58.0 to 8.58.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​670](https://redirect.github.com/helmfile/helmfile-action/pull/670) - build(deps-dev): bump eslint-plugin-jest from 29.15.1 to 29.15.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​673](https://redirect.github.com/helmfile/helmfile-action/pull/673) - build(deps-dev): bump prettier from 3.8.1 to 3.8.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​672](https://redirect.github.com/helmfile/helmfile-action/pull/672) - build(deps-dev): bump [@​typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) from 8.58.0 to 8.58.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​669](https://redirect.github.com/helmfile/helmfile-action/pull/669) - build(deps-dev): bump [@​types/node](https://redirect.github.com/types/node) from 25.5.2 to 25.6.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​671](https://redirect.github.com/helmfile/helmfile-action/pull/671) - build(deps-dev): bump globals from 17.4.0 to 17.5.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​674](https://redirect.github.com/helmfile/helmfile-action/pull/674) - build(deps-dev): bump [@​typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) from 8.58.1 to 8.58.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​676](https://redirect.github.com/helmfile/helmfile-action/pull/676) - build(deps-dev): bump typescript from 6.0.2 to 6.0.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​679](https://redirect.github.com/helmfile/helmfile-action/pull/679) - build(deps-dev): bump [@​swc/core](https://redirect.github.com/swc/core) from 1.15.24 to 1.15.30 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​680](https://redirect.github.com/helmfile/helmfile-action/pull/680) - build(deps-dev): bump prettier from 3.8.2 to 3.8.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​677](https://redirect.github.com/helmfile/helmfile-action/pull/677) - build(deps-dev): bump [@​typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) from 8.58.1 to 8.58.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​675](https://redirect.github.com/helmfile/helmfile-action/pull/675) **Full Changelog**: <helmfile/helmfile-action@v2.4.2...v2.4.3> ### [`v2.4.2`](https://redirect.github.com/helmfile/helmfile-action/releases/tag/v2.4.2) [Compare Source](https://redirect.github.com/helmfile/helmfile-action/compare/v2.4.1...v2.4.2) #### What's Changed - build(deps-dev): bump [@​typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) from 8.57.2 to 8.58.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​666](https://redirect.github.com/helmfile/helmfile-action/pull/666) - build(deps-dev): bump [@​typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) from 8.57.2 to 8.58.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​665](https://redirect.github.com/helmfile/helmfile-action/pull/665) - build(deps-dev): bump [@​types/node](https://redirect.github.com/types/node) from 25.5.0 to 25.5.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​668](https://redirect.github.com/helmfile/helmfile-action/pull/668) - build(deps-dev): bump [@​swc/core](https://redirect.github.com/swc/core) from 1.15.21 to 1.15.24 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​667](https://redirect.github.com/helmfile/helmfile-action/pull/667) **Full Changelog**: <helmfile/helmfile-action@v2.4.1...v2.4.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/max06/atlas). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>