Repository navigation
refactor(cli): take --ca-bundle on build and up only - #58
Merged
Merged
Conversation
run-user-commands took a bundle path, checked it held PEM, and then used it only as a switch: the variables it set point at the copy up bound into the container, never at the file given. up --ca-bundle already puts those variables in the container's environment, which the lifecycle commands inherit through the user-env probe, so the flag added nothing. The flag has not been released, so nothing depends on it. run-user-commands now rejects --ca-bundle as an unknown flag, and the e2e test checks that its postAttachCommand trusts the proxy's CA with no flag at all. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #57.
run-user-commands --ca-bundletook a bundle path, checked that it held PEM, and then used it only as a switch: the variables it set point at the copyupbound into the container, never at the file passed.up --ca-bundlealready puts those variables in the container's environment, and the lifecycle commands inherit them through the user-env probe, so the flag added nothing.run-user-commandsno longer takes--ca-bundle(it is now an unknown flag);caBundleRemoteEnvandcontainerHasCABundleare gone with it.docs/go-only-features.md,docs/DIVERGENCES.mdanddocs/parity/cli-flags-inventory.yamllist the flag onbuildanduponly.Compatibility: the flag arrived in #57 and no release contains it (latest is v20260921.02), so no user depends on it.
Tests
TestRunUserCommandsTakesNoCABundle: fails onmain(the flag is accepted), passes here.TestE2E_CABundle: afterup --ca-bundle,run-user-commandswith no flag reruns apostAttachCommandthat reaches the TLS server signed by the test CA.Validation (local)
go tool task lint: pass.go test ./internal/cli/ -run 'CABundle|RunUserCommands|Inventory'(e2e included, with Docker): pass.go tool task test:raceandgo tool task parity:contract: the only failures are theTestOpen*tests,TestComputeWorkspaceConfigOutsideARepositoryand tworead-configurationparity cases. The first two groups fail identically onmain; all trace back to a/tmp/.giton the dev machine. CI is the check for those.🤖 Generated with Claude Code