Batch 4 up (PR #306) — sonar-scan + wasm, the last two backend workflows on plaintext Actions secrets. Bao paths populated on the swarm via infra provision-batch4-secrets.sh (infra PR…
Resolved and merged — closing.
Verified on current origin/master (be41048):
- Fix commit
7977b57+ merge PR #298 (3fc5233) are in the tree. Both Serilog builders are corrected:…
Resolved in spikersoft-backend PR #305 (merged to master, be410487). Gated cancel-in-progress to ${{ github.ref != 'refs/heads/master' }} on the 14 remaining workflows; api/blog-media/sched…
Fleet fix up as spikersoft-backend PR #305. Gates cancel-in-progress to ${{ github.ref != 'refs/heads/master' }} on the 14 remaining workflows that still cancelled master deploys (the batch-1…
Batch 3b merged — spikersoft-backend PR #304 to master (merge d152c626). api/blog-media-processor/scheduler now fetch every secret (registry, deploy, discord, and their *_S3_SECRET_KEY)…
Progress (not a close): the CI blocker is cleared. The scheduler workflow + stack file exist, but until now every deploy was rejected by its own non-empty guard because SCHEDULER_S3_SECRET_KEY…
Phase 1 rollout progress (spikersoft-backend)
Resolved in spikersoft-backend PR #303 (batch 3a, merged to master — commit 13d6ffb3). spikersoft-lesson-video-processor.yml now fetches VIDEOS_S3_SECRET_KEY from OpenBao (`secret/ci/backe…
a67d0cf3f3
fix(bao-secrets): retry login+fetch with backoff on 429/504/non-JSON (#545/#590-adjacent)
Progress update (2026-07-15) — Phase 1 underway; first service fully cut over.
bao-secretscomposite action (AppRole login → export KV v2 secrets into the job env, masked).- **New…
Progress update (2026-07-15) — Phase 0 is deployed and OIDC is live.
- Stack deployed: 3-node Raft HA (
openbao-1/2/3on dreamstream1/3/4) behind an nginx router (only the router on…
PR up: spikersoft-backend #298 (not yet merged — leaving this open until it lands).
Confirmed the ticket's diagnosis and found it was understated in two ways:
- Root mechanism. The…
QA verification — code complete, leaving OPEN pending runtime verification.
The S3 self-provisioning code is fully implemented on current master (HEAD bc55a9ff):
- Reader: `GeoIpService.Resol…
QA verification — code complete, leaving OPEN pending deploy verification.
The literal defect ("built nowhere, deployed nowhere") is resolved in code across both repos on current master: -…