From 4a749bd1b616478d0bd4e4bfc6ffb668ac95d73c Mon Sep 17 00:00:00 2001 From: Bruno Domingues Date: Mon, 19 Oct 2026 21:16:27 -0300 Subject: [PATCH 1/4] chore(ci): drop feature/** from push trigger to avoid duplicate quality-gate runs [skip ci] --- .github/workflows/quality-gate.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml index fa5f41d..bfe3582 100644 --- a/.github/workflows/quality-gate.yml +++ b/.github/workflows/quality-gate.yml @@ -5,7 +5,6 @@ on: branches: - main - 'release/**' - - 'feature/**' pull_request: branches: - main From 7b3da582be65b45a69212146e7c5d5e7437b5ff5 Mon Sep 17 00:00:00 2001 From: Bruno Domingues Date: Tue, 20 Oct 2026 18:02:02 -0300 Subject: [PATCH 2/4] chore(ci): switch deploy.yml to manual workflow_dispatch with required chart_ref MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removes auto-deploy-on-PR-merge trigger and the old PR-merge gate. Deploy now triggers only via workflow_dispatch, with chart_ref required (no default) as the literal sientia-helm-chart branch bumped and deployed — hard error if it doesn't exist, no silent fallback to development/main. - .github/workflows/deploy.yml: drop pull_request trigger, add chart_ref input, branch_name now github.ref_name, drop pull-requests:read permission - Delete .github/workflows/require-chart-ref-label.yml [skip ci] --- .github/workflows/deploy.yml | 16 ++++++++++------ .github/workflows/require-chart-ref-label.yml | 16 ---------------- 2 files changed, 10 insertions(+), 22 deletions(-) delete mode 100644 .github/workflows/require-chart-ref-label.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 998130d..b5a9404 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,23 +1,27 @@ name: Deploy DataOps Worker on: - pull_request: - types: [closed] - branches: [main, 'release/**', 'feature/**'] workflow_dispatch: + inputs: + chart_ref: + description: > + sientia-helm-chart branch to bump GITHUB_BRANCH on AND deploy — the literal + deploy target. Validated via git ls-remote; a branch that does not exist in + sientia-helm-chart is a hard error, not a silent fallback to main. + required: true + type: string permissions: contents: write id-token: write - pull-requests: read jobs: deploy: name: Deploy - if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true uses: Aignosi/github_workflow_templates/.github/workflows/reusable-deploy-dataops.yml@main with: - branch_name: ${{ github.event.pull_request.head.ref }} + branch_name: ${{ github.ref_name }} + chart_ref: ${{ inputs.chart_ref }} project_name: 'ingestor' chart_name: 'opc-ingestor' env_list_path: '[".env"]' diff --git a/.github/workflows/require-chart-ref-label.yml b/.github/workflows/require-chart-ref-label.yml deleted file mode 100644 index 20f8be3..0000000 --- a/.github/workflows/require-chart-ref-label.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: Require chart-ref label - -on: - pull_request: - types: [opened, synchronize, reopened, labeled, unlabeled] - branches: - - main - - 'release/**' - - 'feature/**' - -permissions: - pull-requests: write - -jobs: - require-chart-ref-label: - uses: Aignosi/github_workflow_templates/.github/workflows/require-chart-ref-label.yml@main From f8d5a1f5a7954816941689ce9c3827ef0c667433 Mon Sep 17 00:00:00 2001 From: Bruno Domingues Date: Wed, 21 Oct 2026 00:30:05 -0300 Subject: [PATCH 3/4] chore(ci): add version-bump.yml, decoupled from deploy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New workflow bumps pyproject.toml's version on PR merge, calling the shared reusable-version-bump.yml (SIENTIAPDE-2217 version-bump reform) — zero build/image/chart/deploy side effects. deploy.yml (workflow_dispatch- only) will read this committed value instead of calculating one. [skip ci] --- .github/workflows/version-bump.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/version-bump.yml diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml new file mode 100644 index 0000000..29abd1c --- /dev/null +++ b/.github/workflows/version-bump.yml @@ -0,0 +1,14 @@ +name: Version Bump + +on: + pull_request: + types: [closed] + branches: [main, 'release/**', 'feature/**'] + +jobs: + bump: + if: github.event.pull_request.merged == true + uses: Aignosi/github_workflow_templates/.github/workflows/reusable-version-bump.yml@main + with: + update_version_in: '["pyproject"]' + secrets: inherit From 01bce628593bcfd752ca58e59b6c04e997fdcab7 Mon Sep 17 00:00:00 2001 From: Bruno Domingues Date: Wed, 21 Oct 2026 11:44:57 -0300 Subject: [PATCH 4/4] fix(ci): grant contents:write permission to version-bump workflow Caller workflow had no permissions block, so GitHub's permission- intersection rule capped the nested reusable-version-bump.yml call to read-only, breaking dispatch ("requesting 'contents: write', but is only allowed 'contents: read'"). [skip ci] --- .github/workflows/version-bump.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml index 29abd1c..11dec02 100644 --- a/.github/workflows/version-bump.yml +++ b/.github/workflows/version-bump.yml @@ -1,5 +1,8 @@ name: Version Bump +permissions: + contents: write + on: pull_request: types: [closed]