Repository navigation
ci: call the shared workflows from panicboat/.github - #1120
Merged
Merged
Conversation
The reusable workflows and scripts now live in panicboat/.github v1.0.0, so each workflow here only calls the shared version and the local copies are removed. The kubernetes stack is renamed to helmfile to match the stack names the shared resolver dispatches on. The Renovate config extends the shared preset and keeps only the rules specific to this repository. Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
panicboat
added
deploy:coredns
Contributor
Plan Result (route53/master) |
Kustomize DiffService: No changes |
This was referenced Oct 25, 2026
panicboat
marked this pull request as ready for review
October 25, 2026 02:03
Contributor
✅ Apply Succeeded (route53/master)Details (Click me)Oct 25 02:04:48.943 INF download and unarchive the package program=aqua version=2.64.0 env=linux/amd64 exe_name=terragrunt package_name=gruntwork-io/terragrunt package_version=v1.0.2 registry=standard
Initializing the backend...
Successfully configured the backend "s3"! OpenTofu will automatically
use this backend unless the backend configuration changes.
Initializing modules...
- route53 in ../lookup
Initializing provider plugins...
- Finding hashicorp/aws versions matching ">= 6.0.0, 6.68.0"...
- Installing hashicorp/aws v6.68.0 to the shared cache directory...
- Installed hashicorp/aws v6.68.0 (signed, key ID 0C0AF313E5FD9F80)
- Using hashicorp/aws v6.68.0 from the shared cache directory
Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/
OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.
OpenTofu has been successfully initialized!
You may now begin working with OpenTofu. Try running "tofu plan" to see
any changes that are required for your infrastructure. All OpenTofu commands
should now work.
If you ever set or change modules or backend configuration for OpenTofu,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
Acquiring state lock. This may take a few moments...
module.route53.data.aws_route53_zone.dystopia_city: Reading...
data.aws_iam_policy_document.zone_access_assume: Reading...
module.route53.data.aws_route53_zone.panicboat_net: Reading...
data.aws_iam_policy_document.zone_access_assume: Read complete after 0s [id=1138465632]
aws_iam_role.zone_access: Refreshing state... [id=route53-zone-access]
module.route53.data.aws_route53_zone.dystopia_city: Read complete after 0s [id=Z03420722KS9MTSCUSIQZ]
module.route53.data.aws_route53_zone.panicboat_net: Read complete after 0s [id=Z07598371GKBU0WMF89MD]
aws_route53_record.dystopia_city_apex_txt: Refreshing state... [id=Z03420722KS9MTSCUSIQZ_dystopia.city_TXT]
aws_route53_record.panicboat_net_google_domainkey_txt: Refreshing state... [id=Z07598371GKBU0WMF89MD_google._domainkey.panicboat.net_TXT]
aws_route53_record.dystopia_city_apex_mx: Refreshing state... [id=Z03420722KS9MTSCUSIQZ_dystopia.city_MX]
aws_iam_role_policy.zone_access: Refreshing state... [id=route53-zone-access:route53-zone-access]
aws_route53_record.panicboat_net_apex_mx: Refreshing state... [id=Z07598371GKBU0WMF89MD_panicboat.net_MX]
aws_route53_record.dystopia_city_google_domainkey_txt: Refreshing state... [id=Z03420722KS9MTSCUSIQZ_google._domainkey.dystopia.city_TXT]
aws_route53_record.panicboat_net_apex_txt: Refreshing state... [id=Z07598371GKBU0WMF89MD_panicboat.net_TXT]
No changes. Your infrastructure matches the configuration.
OpenTofu has compared your real infrastructure against your configuration and
found no differences, so no changes are needed.
Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
platform の workflow を、
panicboat/.githubv1.0.0 の共通の workflow を呼ぶ形に切り替えます。platform にあった reusable workflow と
.github/scripts/は削除し、kubernetes の stack 名をhelmfileに変えます。Why
同じか酷似した workflow と scripts が monorepo と platform に並んでいて、片方だけ直し忘れたり、中身がずれたりしていました。
正本を
panicboat/.githubに集約したので、platform にはトリガー・concurrency・権限・入力だけを持つ呼び出し用の workflow を残します。stack 名を変えるのは、monorepo の
kubernetes（kustomize overlay の diff）と platform のkubernetes（helmfile の hydrate と diff）が別の処理を指していて、共通の resolver が stack 名で処理を選ぶためです。Before / After
.github/workflows/と.github/scripts/panicboat/.githubv1.0.0（Renovate が更新 PR を出す）kuberneteshelmfileCI Gatekeeperなど<呼び出し側の job> / <呼ばれた側の job>（例:ci-gatekeeper / CI Gatekeeper）flowchart LR subgraph platform["panicboat/platform"] C["呼び出し用 workflow<br/>on・concurrency・permissions・入力"] end subgraph shared["panicboat/.github v1.0.0"] R["reusable--*.yaml"] -->|"$/"| N["入れ子の reusable"] R -->|"self checkout"| S["scripts/"] end C -->|"uses @sha"| RDecisions
id-token: write・contents: write・pull-requests: write、renovate-major-review はcontents: read・pull-requests: write・id-token: writeです。panicboat/.githubの CI に移り、platform のTest Terragrunt Releaseは platform の設定の検証だけを行います。renovate.jsonは preset をextendsし、platform 固有の rule とcustomManagersだけを残しました。panicboat/.githubを platform の隣に clone した前提のパスにしました。Impact
Verification
actionlintは 10 個の呼び出し用 workflow で exit 0 でした。check-release-configs.sh・validate-apply-trigger.shは platform の作業ツリーで exit 0、find-configs.shは今までと同じ 12 件を返しました。renovate.jsonを合わせた設定は、今までの設定にpanicboat/.githubのminimumReleaseAgeの rule が 1 つ増えただけでした（jqで比較）。renovate@44.181.4の validator を通りました。deploy:coredns（helmfile）とdeploy:vpc（terragrunt）のラベルを付け、hydrate・diff・plan が共通版で動くことを確認します。Relations
🤖 Generated with Claude Code
https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7