Skip to content

ci: validate rendered talos/ patches pre-merge so bad machine config fails the PR, not the merge groupΒ #2477

Closed

Description

@devantler

πŸ€– Generated by the Daily AI Assistant

Problem

Machine-config errors in talos/** patches surface only in the merge_group's πŸš€ Deploy to Prod (ksail cluster update) β€” after promotion, atomically, evicting the PR from the queue. Live case: #2462 was evicted because its ${WG_SERVER_PRIVATE_KEY} env-expansion rendered empty in CI (private key is invalid: wrong key "" length: 0); nothing on the PR event renders the Talos patches at all.

Proposed direction

Add a PR-event CI step that renders the Talos machine config with the patches applied (via ksail, with placeholder-but-valid values for env-expanded secrets, e.g. a generated throwaway WireGuard key) and validates it (talosctl validate or ksail's own validation), scoped to run when talos/** changes. It must fail fast on empty/invalid env-expansions.

Acceptance criteria

  • A PR touching talos/** with an invalid or unexpandable patch goes red on the PR event, before promotion/queueing.
  • No real secrets are needed on the PR event (placeholder key material suffices for schema validation).
  • Documented in AGENTS.md's validate guidance.

(Origin: CodeRabbit outside-diff-range finding on #2462.)

Activity

  1. coderabbitai commented on Jul 4, 2026

    @coderabbitai
    Contributor
    πŸ”— Related PRs

    #2317 - ci: migrate deploy-prod Flux diagnostics to shared diagnose-flux composite [closed]
    #2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [closed]
    #2330 - ci: heal prod when a merge-group deploy fails (restore main) [closed]
    #2339 - docs(agents): record merge-queue mechanics + root-cause-before-requeue [closed]
    #2343 - fix(openbao): grant external-secrets role write/read on apps/actual-budget path [closed]


    πŸ“ Issue Planner

    Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.

    • Create Plan

    πŸ§ͺ Issue enrichment is currently in open beta.

    You can configure auto-planning by selecting labels in the issue_enrichment configuration.

    To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

    issue_enrichment:
      auto_enrich:
        enabled: false

    πŸ’¬ Have feedback or questions? Drop into our discord!

  2. moved this from πŸ‘€ In Review to βœ… Done in 🌊 Project Boardon Jul 5, 2026
  3. botantler-1 commented on Jul 5, 2026

    @botantler-1
    Contributor

    πŸŽ‰ This issue has been resolved in version 1.101.1 πŸŽ‰

    The release is available on GitHub release

    Your semantic-release bot πŸ“¦πŸš€

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Fields

    Priority

    None yet

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions