From 6cb9fe33300e0f5f8129ab4669dbd65fc10d9289 Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Mon, 21 Sep 2026 10:47:06 +0200 Subject: [PATCH 1/4] feat(sealed-secrets): use Docker Hardened Images We keep the chart as is, just override the image to use our DHI mirror, with the version bumped to the latest (includes helm-docs.sh output) --- charts/gitops-runtime/Chart.yaml | 2 +- charts/gitops-runtime/README.md | 2 +- charts/gitops-runtime/values.yaml | 7 ++++--- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index accdc86d..067e5aa5 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -26,7 +26,7 @@ dependencies: condition: argo-workflows.enabled - name: sealed-secrets repository: https://bitnami.github.io/sealed-secrets - version: 2.18.0 + version: 2.18.6 condition: sealed-secrets.enabled - name: codefresh-tunnel-client repository: oci://quay.io/codefresh/charts diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 70524e50..96a5de71 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -813,7 +813,7 @@ global: | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration | | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration | | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis | -| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"quay.io","repository":"codefresh/sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | +| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.40.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- | | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. | | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false | | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index 1f102cf4..da9f50b0 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -265,9 +265,10 @@ sealed-secrets: fullnameOverride: sealed-secrets-controller keyrenewperiod: "720h" image: - registry: 'quay.io' - repository: 'codefresh/sealed-secrets-controller' - tag: '0.36.0' + registry: 'docker.io' + repository: 'octopusdeploy/dhi-sealed-secrets-controller' + # NB: this overrides version 0.37.0 from bitnami chart version 2.18.6 + tag: '0.40.0' resources: limits: cpu: 500m From 9bd79c5957a715770f61349270e7e205fa85c9b2 Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Fri, 2 Oct 2026 09:49:38 +0200 Subject: [PATCH 2/4] fix(docs): Drop reference to gitops-release.git, unused --- docs/RELEASE_GUIDE.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/docs/RELEASE_GUIDE.md b/docs/RELEASE_GUIDE.md index 28f658f7..9e699228 100644 --- a/docs/RELEASE_GUIDE.md +++ b/docs/RELEASE_GUIDE.md @@ -2,14 +2,6 @@ This guide explains how to perform releases for the GitOps Runtime Helm chart. -> **Tip**: There's a CLI that automates most of these steps: -> ```bash -> npx @codefresh-io/gitops-release --help -> ``` -> See the [CLI repository](https://github.com/codefresh-io/gitops-release) for details. - -The instructions below explain how to do everything manually if you prefer that approach, don't have an Anthropic API key for AI release notes, or need to troubleshoot. - --- ## Table of Contents From cfffb7f58eed75ce848c91c490cca46b2c2ed1b3 Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Fri, 2 Oct 2026 09:52:20 +0200 Subject: [PATCH 3/4] fix(docs): Drop references to Argo Workflows and Events, unused since this was switched to classic CI in May --- docs/RELEASE_GUIDE.md | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/docs/RELEASE_GUIDE.md b/docs/RELEASE_GUIDE.md index 9e699228..a107e895 100644 --- a/docs/RELEASE_GUIDE.md +++ b/docs/RELEASE_GUIDE.md @@ -22,7 +22,7 @@ This guide explains how to perform releases for the GitOps Runtime Helm chart. ## Overview -The GitOps Runtime release process uses **Argo Events and Workflows** to automate most of the work. Your job as release manager is to: +The GitOps Runtime release process uses **Codefresh CI** to automate most of the work. Your job as release manager is to: 1. **Trigger pipelines** by creating branches or merging PRs 2. **Review and approve** the automatically created prepare-release PRs @@ -34,13 +34,13 @@ The GitOps Runtime release process uses **Argo Events and Workflows** to automat ``` You create stable/X.Y branch ↓ -[Argo Workflow: prepare-release] runs automatically +[CF CI: prepare-release] runs automatically ↓ Creates prep/vX.Y.0 branch + PR + draft GitHub release ↓ You review, edit release notes, then merge the PR ↓ -[Argo Workflow: promote] runs automatically +[CF CI: promote] runs automatically ↓ Chart published to quay.io + GitHub release published ``` @@ -349,18 +349,6 @@ Valid `kind` values: `added`, `changed`, `deprecated`, `removed`, `fixed`, `secu ## Troubleshooting -### Pipeline Didn't Run - -**Symptom**: Created stable branch but no prep PR appeared - -**Check**: -1. Verify the branch was created correctly: - ```bash - gh api repos/codefresh-io/gitops-runtime-helm/branches/stable/0.27 - ``` -2. Check Argo Events sensor logs (requires cluster access) -3. Try creating a small commit to the branch to re-trigger - ### PR Doesn't Have `prepare-release` Label **Symptom**: PR exists but missing the label From 1d1f07f31a35380d691a0f9dee100139d618682d Mon Sep 17 00:00:00 2001 From: Josip Rodin Date: Fri, 2 Oct 2026 10:06:34 +0200 Subject: [PATCH 4/4] fix(docs): Drop references to prepare-release labels etc, and stable/release branches The prepare-release stuff has been unused since this was switched to classic CI in May The stable/release branch stuff is being obsoleted now by request from Zhenya, it's not useful any more --- docs/RELEASE_GUIDE.md | 196 ++++-------------------------------------- 1 file changed, 19 insertions(+), 177 deletions(-) diff --git a/docs/RELEASE_GUIDE.md b/docs/RELEASE_GUIDE.md index a107e895..0fec0378 100644 --- a/docs/RELEASE_GUIDE.md +++ b/docs/RELEASE_GUIDE.md @@ -22,23 +22,18 @@ This guide explains how to perform releases for the GitOps Runtime Helm chart. ## Overview -The GitOps Runtime release process uses **Codefresh CI** to automate most of the work. Your job as release manager is to: +The GitOps Runtime release process uses **Codefresh CI** to automate most of the work. +The developers: -1. **Trigger pipelines** by creating branches or merging PRs -2. **Review and approve** the automatically created prepare-release PRs +1. **Trigger pipelines** by creating branches +2. **Review and approve** the PRs 3. **Write/edit release notes** (the AI can help, but human review is essential) -4. **Publish releases** by merging the prepare-release PR +4. **Publish releases** by merging the PR ### How It Works ``` -You create stable/X.Y branch - ↓ -[CF CI: prepare-release] runs automatically - ↓ -Creates prep/vX.Y.0 branch + PR + draft GitHub release - ↓ -You review, edit release notes, then merge the PR +You complete work on a PR for main, edit release notes, then merge the PR ↓ [CF CI: promote] runs automatically ↓ @@ -73,56 +68,18 @@ gh auth login ## Release Types -| Type | When | Branch Created | Example | -|------|------|----------------|---------| -| **Minor Release** | New features, starting a release line | `stable/0.27` | 0.27.0 | -| **Patch Release** | Bug fixes to existing release | Already exists | 0.26.6 | +| Type | When | Example | +|------|------|---------| +| **Minor Release** | New features, starting a release line | 0.27.0 | +| **Patch Release** | Bug fixes to existing release | 0.26.6 | --- -## Creating a New Minor Release - -Use this when starting a new release line (e.g., 0.27.x). - -### Step 1: Create the Stable Branch - -**Option A: GitHub UI (easiest)** -1. Go to https://github.com/codefresh-io/gitops-runtime-helm -2. Click the branch dropdown -3. Type `stable/0.27` (replace with your version) -4. Click "Create branch: stable/0.27 from main" - -**Option B: Git command line** -```bash -git fetch origin -git checkout main -git pull -git checkout -b stable/0.27 -git push -u origin stable/0.27 -``` +## Basic release sanity checks -**From a specific commit:** -```bash -git checkout -b stable/0.27 abc1234 -git push -u origin stable/0.27 -``` - -### Step 2: Wait for the Pipeline - -The **prepare-release** pipeline will automatically: -- Create `prep/v0.27.0` branch -- Bump version in `Chart.yaml` -- Open a PR with the `prepare-release` label -- Create a draft GitHub release - -This usually takes 2-5 minutes. - -### Step 3: Verify - -Check that everything was created: ```bash # Check for the PR -gh pr list --repo codefresh-io/gitops-runtime-helm --head prep/v0.27.0 +gh pr list --repo codefresh-io/gitops-runtime-helm --head your-branch-name # Check for draft release gh release list --repo codefresh-io/gitops-runtime-helm | head -5 @@ -136,7 +93,7 @@ Or visit: ## Release Validation -After the prepare-release PR is automatically created and before publishing the release, the release should be validated to ensure stability. +After the PR is reviewed and approved, the release should be validated to ensure stability. ### Current Approach @@ -149,7 +106,7 @@ The CI pipeline runs e2e tests on every PR. If these tests pass, the release is Before publishing, ensure: - [ ] All CI checks pass (unit tests, linting, e2e tests) -- [ ] The prepare-release PR has been reviewed +- [ ] The PR has been reviewed by the right reviewers - [ ] Release notes accurately reflect the changes - [ ] No known critical issues exist in the changes being released @@ -166,11 +123,6 @@ Before publishing, verify: gh pr checks --repo codefresh-io/gitops-runtime-helm ``` -2. **PR has the `prepare-release` label** (CRITICAL - this triggers the promote pipeline) - ```bash - gh pr view --repo codefresh-io/gitops-runtime-helm --json labels - ``` - 3. **Release notes are complete** (see [Writing Release Notes](#writing-release-notes)) ### Step 2: Review the PR @@ -182,7 +134,6 @@ Before publishing, verify: ### Step 3: Merge the PR ```bash -# Merge the prepare-release PR gh pr merge --repo codefresh-io/gitops-runtime-helm --squash ``` @@ -210,63 +161,6 @@ No manual action required. If notifications don't appear, see [Troubleshooting: --- -## Creating a Patch Release - -Patch releases (e.g., 0.26.6) happen when fixes are merged to an existing stable branch. - -### Step 1: Merge Fixes to Stable Branch - -Either: -- Merge PRs directly to `stable/0.26` -- Cherry-pick commits (see [Cherry-Picking Fixes](#cherry-picking-fixes)) - -### Step 2: Pipeline Creates New Prep PR - -When commits are merged to `stable/X.Y`, the prepare-release pipeline automatically: -- Creates `prep/v0.26.6` (incremented patch version) -- Opens a new prepare-release PR -- Creates a new draft release - -### Step 3: Publish - -Follow the same [Publishing a Release](#publishing-a-release) steps. - ---- - -## Cherry-Picking Fixes - -To backport a fix from `main` to a stable branch: - -```bash -# Make sure you have the latest -git fetch origin - -# Checkout stable branch -git checkout stable/0.26 -git pull - -# Create backport branch -git checkout -b backport/fix-memory-leak - -# Cherry-pick the commit(s) from main -git cherry-pick abc1234 - -# If there are conflicts, resolve them, then: -git add . -git cherry-pick --continue - -# Push and create PR -git push -u origin backport/fix-memory-leak -gh pr create --base stable/0.26 --title "Backport: Fix memory leak" --body "Cherry-picked from main" -``` - -**Multiple commits:** -```bash -git cherry-pick abc1234 def5678 ghi9012 -``` - ---- - ## Writing Release Notes > **Important**: AI-generated release notes are only as good as the commit messages. If commits are not descriptive or miss important context (like breaking changes), you MUST manually edit the notes. @@ -349,15 +243,6 @@ Valid `kind` values: `added`, `changed`, `deprecated`, `removed`, `fixed`, `secu ## Troubleshooting -### PR Doesn't Have `prepare-release` Label - -**Symptom**: PR exists but missing the label - -**Fix**: -```bash -gh pr edit --repo codefresh-io/gitops-runtime-helm --add-label prepare-release -``` - ### CI Checks Failing **Symptom**: PR checks are red @@ -367,37 +252,6 @@ gh pr edit --repo codefresh-io/gitops-runtime-helm --add-label prepa 2. Fix issues on the `prep/vX.Y.Z` branch 3. Push fixes - checks will re-run -### Merge Conflicts - -**Symptom**: PR shows merge conflicts - -**Fix**: -```bash -# Checkout the prep branch -git fetch origin -git checkout prep/v0.27.0 - -# Rebase or merge from stable -git rebase origin/stable/0.27 -# OR -git merge origin/stable/0.27 - -# Resolve conflicts, then force push -git push --force-with-lease -``` - -### Release Not Publishing After Merge - -**Symptom**: Merged the PR but release is still draft - -**Check**: -1. Verify the PR had the `prepare-release` label when merged -2. Check promote pipeline logs (requires cluster access) -3. Manual fallback - publish the release: - ```bash - gh release edit 0.27.0 --repo codefresh-io/gitops-runtime-helm --draft=false - ``` - ### Slack Notifications Not Sent **Symptom**: Release published but no Slack notifications appeared @@ -434,15 +288,8 @@ git push --force-with-lease | Pattern | Purpose | Example | |---------|---------|---------| -| `main` | Development branch | - | -| `stable/X.Y` | Release branch | `stable/0.27` | -| `prep/vX.Y.Z` | Prepare-release branch | `prep/v0.27.0` | - -### Important Labels - -| Label | Purpose | -|-------|---------| -| `prepare-release` | **CRITICAL**: Triggers promote pipeline when PR is merged | +| `main` | Release branch | - | +| `(feat|fix|...)/XX-YYYY-desc` | Development branches | `feat/CF-1234-fancy-stuff` | ### Version Formats @@ -570,8 +417,8 @@ Updates alpine base image to 3.19.1 which patches CVE-2024-12345 # List recent releases gh release list --repo codefresh-io/gitops-runtime-helm -# View open prepare-release PRs -gh pr list --repo codefresh-io/gitops-runtime-helm --label prepare-release +# View open PRs +gh pr list --repo codefresh-io/gitops-runtime-helm # Check PR status gh pr view --repo codefresh-io/gitops-runtime-helm @@ -579,14 +426,9 @@ gh pr view --repo codefresh-io/gitops-runtime-helm # Check PR CI status gh pr checks --repo codefresh-io/gitops-runtime-helm -# Merge prepare-release PR +# Merge a PR gh pr merge --repo codefresh-io/gitops-runtime-helm --squash # View a release gh release view --repo codefresh-io/gitops-runtime-helm - -# Create stable branch from main -git fetch origin && git checkout main && git pull -git checkout -b stable/0.27 -git push -u origin stable/0.27 ```