sync-env workflow + auto-roll for self-serve secrets (#2) #1

Merged

plat merged 6 commits from feat/self-serve-secrets-sync into main 2026-06-29 21:08:28 +00:00

Conversation 0 Commits 6 Files changed 5 +120 -2

plat commented 2026-06-29 14:09:11 +00:00

Owner

Copy link

The downstream half of self-serve secrets (#2) — companion to plat/mcp feat/self-serve-secrets.

• .forgejo/workflows/sync-env.yml: reads the app's APP_ENV Forgejo secret and runs the mcp secrets-cli to seal it into the app's runtime env. Derives the platform's current mcp version from gitops at runtime (so it never drifts), and sets DOCKER_HOST for the dind registry pull.
• charts/app: a userEnvRev pod-template annotation (web + worker) so the pod auto-rolls when secrets change; userEnvRev added to values.yaml.

The app contract is otherwise unchanged (the secret rides the existing extraEnvFrom). Validated end-to-end on a germinated platform + a grandchild (see the mcp PR).

Two bugs were caught and fixed during live validation: a stale MCP_IMAGE pin (now derived from gitops) and a missing DOCKER_HOST — exactly the "trivial issues" this validation was meant to surface.

The downstream half of **self-serve secrets (#2)** — companion to `plat/mcp` `feat/self-serve-secrets`. - `.forgejo/workflows/sync-env.yml`: reads the app's `APP_ENV` Forgejo secret and runs the mcp `secrets-cli` to seal it into the app's runtime env. **Derives the platform's current mcp version from gitops at runtime** (so it never drifts), and sets `DOCKER_HOST` for the dind registry pull. - `charts/app`: a `userEnvRev` pod-template annotation (web + worker) so the pod **auto-rolls** when secrets change; `userEnvRev` added to `values.yaml`. The app contract is otherwise unchanged (the secret rides the existing `extraEnvFrom`). Validated end-to-end on a germinated platform + a grandchild (see the mcp PR). > Two bugs were caught and fixed during live validation: a stale `MCP_IMAGE` pin (now derived from gitops) and a missing `DOCKER_HOST` — exactly the "trivial issues" this validation was meant to surface.

plat added 2 commits 2026-06-29 14:09:11 +00:00

chart: roll pod on user-env change (userEnvRev pod annotation) 6c79037614

sync-env: derive mcp version from gitops + set DOCKER_HOST (robust, no pin drift) 8d45473cc4

plat added 1 commit 2026-06-29 14:22:39 +00:00

sync-env: hint when secrets are mis-named instead of in APP_ENV 3c1a802f95

plat added 1 commit 2026-06-29 14:46:15 +00:00

preview: derive mcp version from gitops (fix cold-start preview on fresh germinations) 6bdf3a3484

plat added 1 commit 2026-06-29 15:41:26 +00:00

sync-env: enumerate secrets via toJSON(secrets) — individually-named secrets just work ddc11c0260

plat added 1 commit 2026-06-29 20:03:24 +00:00

_app-template: pass PLAT_DEV variable through sync-env to secrets-cli ... 80923bd803

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat merged commit 10010fda30 into main 2026-06-29 21:08:28 +00:00

plat deleted branch feat/self-serve-secrets-sync 2026-06-29 21:08:28 +00:00

plat referenced this pull request from a commit 2026-06-29 21:08:28 +00:00

Merge pull request 'sync-env workflow + auto-roll for self-serve secrets (#2)' (#1) from feat/self-serve-secrets-sync into main

plat referenced this pull request from open-platform/mitosis 2026-07-02 02:35:23 +00:00

self-serve secrets #2

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent-work

Queue this for an agent: it will build it and open a PR

  

agent-working

An agent is actively working on this

  

ultracode

Operators: run a Fable ultracode orchestrator on this issue

No labels

agent-work

agent-working

ultracode

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

open-platform/app-template!1

No description provided.