Upgrade EdgeZero to the deploy-actions branch

[aram356]

Summary

Upgrades the six edgezero workspace dependencies from tag = "v0.0.4" to the feature/edgezero-deploy-actions tree and adapts Trusted Server to its API changes.

• Repoint edgezero-adapter-{axum,cloudflare,fastly,spin}, edgezero-cli, and edgezero-core at an immutable rev = "5f3d648c" pin on that branch; the lock is rebuilt from main with a scoped update, so the only non-edgezero lock changes are syn 3.0.3 and toml_edit 0.25.12 (both required by the new edgezero tree).
• Wire the new ts CLI subcommands surfaced by edgezero-cli — active-version, healthcheck, rollback, config gc — plus deploy --staging, config push/diff --staging, and a top-level --version flag, with argument-parsing coverage.
• Document the new lifecycle and config gc surface in docs/guide/cli.md, including the staged-deploy config leg (config push --staging before healthcheck --staging), the destructive config gc --yes semantics, and the deploy -- passthrough boundary.
• Migrate TrustedServerAppConfig to the AppConfigMeta::secret_fields() method that replaces the removed SECRET_FIELDS associated constant.

Verification

All CI gates run locally against the branch and pass:

• cargo fmt --all -- --check — clean
• cargo clippy — fastly, axum, cloudflare native + wasm, spin native + wasm — clean
• Tests — core 1644, fastly 99, axum 32, cloudflare 32, spin 72, cli 29 — all pass
• integration parity — 13 pass
• JS build/test/format — 411 pass, prettier clean
• Review-round follow-ups verified with cargo metadata --locked, cargo check-fastly --locked, host CLI suite (168 tests + clippy -D warnings), and docs prettier

⚠️ Blocked on upstream

stackpop/edgezero#316 is not yet merged. The six deps are pinned to the immutable rev = "5f3d648c" (the commit the lock resolves), so the reference cannot silently move; before this lands, re-pin rev → tag once #316 merges and a tag containing it exists (the v0.0.5 tag cut since then has diverged from the branch and does not contain it). Per the status comment below, move the deployer's deploy-fastly@<ref> in lockstep.

Two residuals the rev pin does not cover (from review):

• Reachability is branch-scoped. 5f3d648c is ahead of edgezero main, so the only ref keeping it fetchable is feature/edgezero-deploy-actions. If that branch is deleted after merge (the GitHub default) or force-pushed, cargo fetch fails for every cold checkout and CI runner. The rev pin is immutable, not unconditionally fetchable — another reason the rev → tag repin must happen before this merges.
• A squash merge of Remove immutable cache headers from integrations #316 breaks the mechanical rev → tag swap. A squash commit is not an ancestor of 5f3d648c, so re-pinning to a tag containing it means different bytes and a full gate re-run, not a lock refresh. A merge commit or fast-forward keeps 5f3d648c an ancestor and the swap mechanical. Confirm the merge method on Remove immutable cache headers from integrations #316 before planning the repin.

Out of scope

• Adopting the new deploy GitHub Actions (deploy-fastly / healthcheck-fastly / rollback-fastly) in this repo's workflows is separate, unstarted work.
• Embedding the resolved edgezero rev in ts --version output (reviewer suggestion) is a follow-up.

Closes #939

[aram356]

Status update — P0/P1 tracking

Head: `96dd1f72` (main merged in twice since the original commit; edgezero dep unchanged, no conflicts).

P0.2 — CI + output-line contract

• Local verification at head is green: fmt, clippy (fastly), core+fastly tests (1648+99), vitest (411). The earlier red checks were a systemic/environmental run on `96dd1f72` (every job failed, incl. JS/fmt that pass locally) — fresh reruns of all four workflows are in progress.
• Machine-readable output lines the deployer parses are verified end-to-end. All three are emitted by edgezero-cli at `log::info!` (Info→stdout), and `ts`'s `main.rs` calls `edgezero_cli::init_cli_logger()`, so they reach stdout rather than being swallowed:

  Line	Source (edgezero @ 145f1699)
  `version=`	`edgezero-cli/src/lib.rs:253`
  `pushed-key=`	`edgezero-cli/src/config.rs:386`
  `rolled-back-to=`	`edgezero-adapter-fastly/src/cli.rs:2807`

• Dispatcher/arg-parse tests for `active-version`, `healthcheck`, `rollback` are in `crates/trusted-server-cli/src/run.rs`.

P1.3 — edgezero library ↔ action lockstep (recorded pair)

The `ts` CLI is built from this repo's `Cargo.toml` (edgezero library rev), and the deployer separately pins `stackpop/edgezero/.github/actions/deploy-fastly@` (edgezero action ref). These MUST be the same edgezero commit so library and action can't diverge.

• Current pair: both = `stackpop/edgezero@145f1699` (branch `feature/edgezero-deploy-actions`).
• On merge: when edgezero Remove immutable cache headers from integrations #316 lands and is tagged, move BOTH the six `Cargo.toml` deps and the deployer's `deploy-fastly@` to that same tag/SHA in lockstep.

P0.1 — re-pin off the moving branch (blocker, still open)

edgezero #316 is not yet merged and no new tag exists. Cannot re-pin until it lands; PR stays draft until then.

[prk-Jr]

Summary

Tight, well-tested upgrade: six edgezero deps repointed at the deploy-actions branch, SECRET_FIELDS migrated to secret_fields(), and the new active-version / healthcheck / rollback / config gc subcommands wired through with argument-parsing coverage for each. Dispatch is a clean passthrough and every new command has a doc comment. Two things block: the dependency reference is mutable while upstream #316 is still open, and the operator docs weren't updated for the new (partly destructive) surface.

Blocking

🔧 wrench

• Mutable branch = dep on an unmerged upstream PR (Cargo.toml:57-62): upstream stackpop/edgezero#316 is confirmed open / merged: false, but this PR is isDraft: false and MERGEABLE. See the inline comment for the rev pin suggestion.

• docs/guide/cli.md not updated for the new CLI surface: four subcommands ship undocumented — active-version, healthcheck, rollback, and config gc. config gc is the one that matters most: with --yes and --older-than it destructively sweeps config-store entries, and the only place its semantics are written down right now is a one-line clap doc string and three parse tests. The "Lifecycle commands" block (docs/guide/cli.md:79-90) and "Configuration commands" block (:43-77) both enumerate the available commands, so they read as complete and are now silently wrong.

  The same file also carries a version claim that this PR invalidates (docs/guide/cli.md:67-70):

  EdgeZero v0.0.4 only overrides leaves already present in the TOML; add newly introduced fields to existing configs before relying on their overrides.

  The dependency is no longer v0.0.4. Either confirm the behavior still holds on the new tree and drop the version qualifier, or update it to whatever gets pinned at merge time.

Non-blocking

🤔 thinking

• Unrelated dependency downgrades in the lock refresh (Cargo.lock): windows-sys 0.61.2 → 0.48.0 and itertools 0.13.0 → 0.10.5. Details and a scoped cargo update inline.

🌱 seedling

• ts --version can't identify the embedded edgezero (crates/trusted-server-cli/src/run.rs:16): follow-up, not this PR.

📝 note

• secret_fields() port (crates/trusted-server-core/src/config.rs:115): mechanical and correct; the empty-set caveat above it is unchanged.

👍 praise

• deploy_rejects_renamed_stage_flag_before_separator (crates/trusted-server-cli/src/run.rs:306): catches a silent staging→production routing hazard created by the upstream flag rename plus last = true passthrough.

CI Status

All 19 checks green on fe5767e — reported from GitHub, not re-run locally:

• fmt: PASS
• clippy (fastly / axum / cloudflare native + wasm / spin native + wasm): PASS
• rust tests (core, axum, cloudflare, spin, ts CLI, cross-adapter parity): PASS
• integration + browser integration + Fastly EC lifecycle: PASS
• js tests (vitest) / format-typescript / format-docs: PASS
• CodeQL (actions, javascript-typescript, rust): PASS

[prk-Jr]

Summary

Re-review of the three commits added since the last pass (f90f6384, bf47680d, 40dd9b37). Both prior findings are resolved: the six deps moved from a mutable branch = ref to rev = 5f3d648c…, and the unrelated lock downgrades are gone from the diff. Verified independently — 5f3d648c is an ancestor of the branch tip b3e02111 (behind_by: 0), and the v0.0.5 tag is genuinely diverged from the pin (117 behind / 134 ahead), so the "no tag contains it" reasoning holds.

What remains blocking is the upstream merge gate plus one gap in the new staging docs: the documented deploy --staging → healthcheck --staging sequence never mentions the config leg, so following it literally stages a version pointed at a config key nothing wrote.

4 of the inline comments below carry a one-click GitHub suggestion — use Commit suggestion (or Add suggestion to batch) to apply them as commits on the PR branch. The remaining comments describe the fix in prose because the change is "wait for upstream", needs a new test function, or touches files outside this diff.

Blocking

🔧 wrench

• Upstream #316 still open; branch-only reachability and squash-merge consequences — see inline at Cargo.toml:57
• Staged-deploy docs omit the config leg — see inline at docs/guide/cli.md:120-123

Non-blocking

♻️ refactor

• --retry 3 is 3 total attempts, not 3 retries — see inline at docs/guide/cli.md:140-141 and crates/trusted-server-cli/src/run.rs:182
• config_gc_previews_by_default never asserts yes — see inline at crates/trusted-server-cli/src/run.rs:489

🤔 thinking

• secret_fields() comment names a blocker this upgrade removes — see inline at crates/trusted-server-core/src/config.rs:115

⛏ nitpick

• No test for the new top-level --version — see inline at crates/trusted-server-cli/src/run.rs:16

Cross-cutting / body-level findings

• ♻️ 40dd9b37 missed two live v0.0.4 qualifiers. The commit dropped the stale version qualifier across docs/guide/*.md, but two non-archival sites still restate exactly the same claim:

  • trusted-server.example.toml:124 — the operator-facing template: "Keep this leaf present when using the EdgeZero v0.0.4 environment override."
  • crates/trusted-server-cli/tests/config_env_overlay.rs:47 — "EdgeZero v0.0.4 environment overlays cannot create missing TOML leaves, …"

  Neither file is in this diff, so neither can carry a suggestion — apply manually, dropping v0.0.4 the same way the docs did. (docs/superpowers/plans/2026-07-15-gam-ts-cohort-attribution.md:835 also mentions it, but that is a dated archived plan describing a past experiment; leaving it is defensible.)

  Separately, the genericization itself checks out: at the pinned rev apply_env_overlay still only overrides keys already present in the parsed tree, and env_overlay_only_overrides_existing_keys asserts an env var for an absent key is silently ignored. So this is a by-design property, not a v0.0.4 bug, and dropping the version qualifier is the right call.

• 📝 Two syn majors and two toml_edit majors now compile. The lock carries syn 2.0.118 alongside the new syn 3.0.3 (pulled by edgezero-macros), and toml_edit 0.23.10+spec-1.0.0 alongside 0.25.12+spec-1.1.0. Both duplicates are host-build-only — proc-macro expansion and CLI-side TOML editing — with no wasm32-wasip1 runtime exposure, so this is compile-time cost rather than shipped weight. Nothing to change in this PR; it collapses when the rest of the tree catches up.

• 👍 Two things worth keeping. First, the rev pin was done as a scoped lock rebuild — restore main's lock, run the narrow update, then restore the five edges the resolver had needlessly walked back — and verified with cargo metadata --locked rather than asserted. That is exactly the right way to answer "is this lock diff minimal?". Second, the config gc documentation catches a real footgun rather than paraphrasing --help: it spells out that --older-than is a safety assertion about the whole physical store, and that gc's --no-env means something different from every other config subcommand's --no-env (it reselects the target store instead of skipping the app-config overlay). On a destructive command, that distinction is the one an operator would otherwise learn the hard way.

CI Status

All 19 reported checks PASS at 40dd9b37:

• cargo fmt: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• format-typescript: PASS (required)
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• vitest: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• prepare integration artifacts: PASS
• CodeQL: PASS
• Analyze (rust): PASS
• Analyze (javascript-typescript): PASS
• Analyze (actions): PASS

Verification performed for this review

Every suggestion below was applied in an isolated worktree at 40dd9b37, verified alone and then batched, with a byte-exact pre/post patch snapshot each time:

	cargo fmt --all -- --check	prettier 3.8.1 (docs/node_modules)	clippy -D warnings	tests
each suggestion alone	PASS	PASS	PASS	165 pass
all four batched	PASS	PASS	PASS	165 pass

No drift between the approved patch and the post-verification tree on any run. Scope note: clippy and tests were run as --package trusted-server-cli --target aarch64-apple-darwin rather than the full six-alias chain, because both Rust suggestions are assertion lines inside that crate's own #[cfg(test)] module and cannot reach an adapter target.