You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci: validate rendered talos/ patches pre-merge so bad machine config fails the PR, not the merge groupΒ #2477
Machine-config errors in talos/** patches surface only in the merge_group's π Deploy to Prod (ksail cluster update) β after promotion, atomically, evicting the PR from the queue. Live case: #2462 was evicted because its ${WG_SERVER_PRIVATE_KEY} env-expansion rendered empty in CI (private key is invalid: wrong key "" length: 0); nothing on the PR event renders the Talos patches at all.
Proposed direction
Add a PR-event CI step that renders the Talos machine config with the patches applied (via ksail, with placeholder-but-valid values for env-expanded secrets, e.g. a generated throwaway WireGuard key) and validates it (talosctl validate or ksail's own validation), scoped to run when talos/** changes. It must fail fast on empty/invalid env-expansions.
Acceptance criteria
A PR touching talos/** with an invalid or unexpandable patch goes red on the PR event, before promotion/queueing.
No real secrets are needed on the PR event (placeholder key material suffices for schema validation).
Documented in AGENTS.md's validate guidance.
(Origin: CodeRabbit outside-diff-range finding on #2462.)
#2317 - ci: migrate deploy-prod Flux diagnostics to shared diagnose-flux composite [closed] #2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [closed] #2330 - ci: heal prod when a merge-group deploy fails (restore main) [closed] #2339 - docs(agents): record merge-queue mechanics + root-cause-before-requeue [closed] #2343 - fix(openbao): grant external-secrets role write/read on apps/actual-budget path [closed]
π Issue Planner
Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.
Create Plan
π§ͺ Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your .coderabbit.yaml:
issue_enrichment:
auto_enrich:
enabled: false
π¬ Have feedback or questions? Drop into our discord!
Activity
coderabbitai commentedon Jul 4, 2026
π Related PRs
#2317 - ci: migrate deploy-prod Flux diagnostics to shared diagnose-flux composite [closed]
#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [closed]
#2330 - ci: heal prod when a merge-group deploy fails (restore main) [closed]
#2339 - docs(agents): record merge-queue mechanics + root-cause-before-requeue [closed]
#2343 - fix(openbao): grant external-secrets role write/read on apps/actual-budget path [closed]
π Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.π§ͺ Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:π¬ Have feedback or questions? Drop into our discord!
botantler-1 commentedon Jul 5, 2026
π This issue has been resolved in version 1.101.1 π
The release is available on GitHub release
Your semantic-release bot π¦π