panicboat · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026
@@ -7,7 +7,7 @@ You only read. Never modify files, push, approve, label, or comment yourself.
 ## How this repository deploys
 
 - Helm charts are never installed with `helm install` / `helm upgrade`.
-  `scripts/kubernetes-hydrate/hydrate-component.sh` renders `kubernetes/components/<service>/<environment>/` with `helmfile template --include-crds` (plus `kustomize build kustomization/`) into `kubernetes/manifests/<environment>/<service>/manifest.yaml`, and Flux applies them after merge (production only: the `flux-system` Kustomization syncs `kubernetes/clusters/production`, which includes `kubernetes/manifests/production`, with `prune: true`).
+  `.github/scripts/kubernetes-hydrate/hydrate-component.sh` renders `kubernetes/components/<service>/<environment>/` with `helmfile template --include-crds` (plus `kustomize build kustomization/`) into `kubernetes/manifests/<environment>/<service>/manifest.yaml`, and Flux applies them after merge (production only: the `flux-system` Kustomization syncs `kubernetes/clusters/production`, which includes `kubernetes/manifests/production`, with `prune: true`).
 - Consequences for upgrade guides written for `helm upgrade`:
   - CRDs rendered from the chart with this repository's values are applied by Flux with everything else, so "apply the CRDs manually before `helm upgrade`" steps are already satisfied for them; do not report them as manual work.
     CRDs the guide expects from another source (e.g. Gateway API CRDs managed by `kubernetes/components/gateway-api`) are not covered; report the needed change to that component as ⚠️.
@@ -27,7 +27,7 @@ You only read. Never modify files, push, approve, label, or comment yourself.
    - the files Renovate changed
 3. Ignore changes under `kubernetes/manifests/`; the hydrator generates them in parallel with this review, so they may be stale.
 4. Read `.render-diff/summary.md` (the rendered diff).
-   For every component directory the pull request changes, it compares the base and the head rendered with this repository's values (`scripts/kubernetes-hydrate/render-diff.sh`): image references, CRD versions, and added / removed resources.
+   For every component directory the pull request changes, it compares the base and the head rendered with this repository's values (`.github/scripts/kubernetes-hydrate/render-diff.sh`): image references, CRD versions, and added / removed resources.
    Its `Full diff` paths are relative to `.render-diff/`; the files can be large, so Grep them instead of reading them whole.
    A component marked `Rendering failed` or `Summarizing failed` is uncovered (for `Summarizing failed`, still Grep its full diff).
    A component marked `Not rendered` is not deployed by the hydrator; review it from its files only.

@@ -5,7 +5,7 @@ base_ref="${1:?base revision required}"
 out_dir="${2:?output directory required}"
 
 cd "$(git rev-parse --show-toplevel)"
-script_dir="$(pwd)/scripts/kubernetes-hydrate"
+script_dir="$(pwd)/.github/scripts/kubernetes-hydrate"
 mkdir -p "${out_dir}"
 out_dir="$(cd "${out_dir}" && pwd)"
 summary="${out_dir}/summary.md"

@@ -31,8 +31,8 @@ YAML
 }
 
 repo="${work}/repo"
-mkdir -p "${repo}/scripts/kubernetes-hydrate" "${repo}/aws/eks/production"
-cp "${scripts}"/hydrate-component.sh "${scripts}"/render-diff.sh "${scripts}"/summarize-manifest-diff.sh "${repo}/scripts/kubernetes-hydrate/"
+mkdir -p "${repo}/.github/scripts/kubernetes-hydrate" "${repo}/aws/eks/production"
+cp "${scripts}"/hydrate-component.sh "${scripts}"/render-diff.sh "${scripts}"/summarize-manifest-diff.sh "${repo}/.github/scripts/kubernetes-hydrate/"
 printf 'locals {\n  cluster_version = "1.33"\n}\n' > "${repo}/aws/eks/production/env.hcl"
 write_deployment "${repo}/kubernetes/components/demo/production" demo nginx:1.0
 write_deployment "${repo}/kubernetes/components/gone/production" gone busybox:1.36
@@ -52,7 +52,7 @@ git -C "${repo}" -c user.name=test -c user.email=test@example.com add -A
 git -C "${repo}" -c user.name=test -c user.email=test@example.com commit -q -m head
 
 out="${work}/out"
-(cd "${repo}" && bash scripts/kubernetes-hydrate/render-diff.sh HEAD^ "${out}") > "${work}/stdout" 2>&1 || { fail "render-diff exits 0"; sed 's/^/# /' "${work}/stdout"; }
+(cd "${repo}" && bash .github/scripts/kubernetes-hydrate/render-diff.sh HEAD^ "${out}") > "${work}/stdout" 2>&1 || { fail "render-diff exits 0"; sed 's/^/# /' "${work}/stdout"; }
 summary="${out}/summary.md"
 
 expect_contains "lists a changed component" "## demo (production)" "${summary}"
@@ -76,13 +76,13 @@ failing_bin="${work}/failing-bin"
 mkdir -p "${failing_bin}"
 printf '#!/bin/sh\nexit 1\n' > "${failing_bin}/yq"
 chmod +x "${failing_bin}/yq"
-(cd "${repo}" && PATH="${failing_bin}:${PATH}" bash scripts/kubernetes-hydrate/render-diff.sh HEAD^ "${work}/out-failing") > /dev/null 2>&1 || fail "render-diff exits 0 when summarizing fails"
+(cd "${repo}" && PATH="${failing_bin}:${PATH}" bash .github/scripts/kubernetes-hydrate/render-diff.sh HEAD^ "${work}/out-failing") > /dev/null 2>&1 || fail "render-diff exits 0 when summarizing fails"
 expect_contains "reports a summarizing failure instead of aborting" "Summarizing failed" "${work}/out-failing/summary.md"
 
 echo "# changed" >> "${repo}/README.md"
 git -C "${repo}" -c user.name=test -c user.email=test@example.com add -A
 git -C "${repo}" -c user.name=test -c user.email=test@example.com commit -q -m docs
-(cd "${repo}" && bash scripts/kubernetes-hydrate/render-diff.sh HEAD^ "${work}/out-none") > /dev/null 2>&1 || fail "render-diff exits 0 without components"
+(cd "${repo}" && bash .github/scripts/kubernetes-hydrate/render-diff.sh HEAD^ "${work}/out-none") > /dev/null 2>&1 || fail "render-diff exits 0 without components"
 expect_contains "reports when no component changed" "No Kubernetes components changed." "${work}/out-none/summary.md"
 
 exit "${failures}"
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate apply_trigger
-        run: bash scripts/terragrunt-release/validate-apply-trigger.sh
+        run: bash .github/scripts/terragrunt-release/validate-apply-trigger.sh
 
       - name: Generate GitHub App token
         id: app-token

@@ -32,8 +32,8 @@ jobs:
           HEAD_REF: ${{ github.head_ref }}
         run: |
           set -euo pipefail
-          service=$(bash scripts/terragrunt-release/release-service.sh --branch "$HEAD_REF")
-          targets=$(bash scripts/terragrunt-release/release-targets.sh "$service")
+          service=$(bash .github/scripts/terragrunt-release/release-service.sh --branch "$HEAD_REF")
+          targets=$(bash .github/scripts/terragrunt-release/release-targets.sh "$service")
           echo "targets=$targets" >> "$GITHUB_OUTPUT"
 
   plan:

@@ -40,8 +40,8 @@ jobs:
         id: resolve
         run: |
           set -euo pipefail
-          service=$(bash scripts/terragrunt-release/release-service.sh --tag "$TAG")
-          targets=$(bash scripts/terragrunt-release/release-targets.sh "$service")
+          service=$(bash .github/scripts/terragrunt-release/release-service.sh --tag "$TAG")
+          targets=$(bash .github/scripts/terragrunt-release/release-targets.sh "$service")
           echo "targets=$targets" >> "$GITHUB_OUTPUT"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 

@@ -34,7 +34,7 @@ jobs:
 
       - name: Render manifest diff
         # HEAD is the PR merge commit, so its first parent is the base it merges into.
-        run: bash scripts/kubernetes-hydrate/render-diff.sh HEAD^1 "${RUNNER_TEMP}/render-diff"
+        run: bash .github/scripts/kubernetes-hydrate/render-diff.sh HEAD^1 "${RUNNER_TEMP}/render-diff"
 
       - name: Upload manifest diff
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

@@ -67,11 +67,11 @@ jobs:
         run: |
           set -euo pipefail
           for svc in $(echo "$SERVICES_JSON" | jq -r '.[]'); do
-            bash scripts/kubernetes-hydrate/hydrate-component.sh "$svc" "${{ inputs.environment }}"
+            bash .github/scripts/kubernetes-hydrate/hydrate-component.sh "$svc" "${{ inputs.environment }}"
           done
 
       - name: Hydrate index
-        run: bash scripts/kubernetes-hydrate/hydrate-index.sh "${{ inputs.environment }}"
+        run: bash .github/scripts/kubernetes-hydrate/hydrate-index.sh "${{ inputs.environment }}"
 
       - name: Commit and push hydrated manifests
         id: auto-commit

@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - run: bash scripts/terragrunt-release/test.sh
-      - run: bash scripts/terragrunt-release/validate-apply-trigger.sh
-      - run: bash scripts/terragrunt-release/check-release-configs.sh
+      - run: bash .github/scripts/terragrunt-release/test.sh
+      - run: bash .github/scripts/terragrunt-release/validate-apply-trigger.sh
+      - run: bash .github/scripts/terragrunt-release/check-release-configs.sh