Merge branch 'main' into fix/pg-backup-mc-config

review
feat(auth-sidecar): inject AUTH_OIDC_COOKIE_DOMAIN (#24 )
2026-07-02 12:43:03 +00:00 · 2026-07-02 12:25:11 +02:00 · 2026-06-30 06:59:37 +00:00 · 2026-06-29 17:02:50 +02:00 · 2026-06-11 13:18:20 +02:00
4 changed files with 13 additions and 0 deletions
@@ -36,6 +36,9 @@ jobs:
        fetch-depth: 0
        token: ${{ secrets.AI_REVIEW_TOKEN }}

+    - name: Update submodules to remote
+      run: git submodule update --remote --merge
+
    - name: Run inline review
      uses: docker://nikitafilonov/ai-review:v0.64.0
      with:
@@ -1,3 +1,5 @@
 [submodule "shared-prompts"]
 	path = shared-prompts
 	url = https://git.forteapps.net/Forte/ai-review-prompts.git
+	branch = main
+
@@ -77,6 +77,12 @@ spec:
              mc rm --recursive --force --older-than 30d "obj/${S3_BUCKET}/_pgbackups/" || true
              echo "backup retention pass complete"
            env:
+            # mc writes its config under $MC_CONFIG_DIR; point it at the shared
+            # emptyDir (writable by uid 65532 via fsGroup). Without this it tries
+            # to mkdir /.mc on the read-only-to-nonroot root fs -> "mkdir /.mc:
+            # permission denied" and every run fails before uploading.
+            - name: MC_CONFIG_DIR
+              value: "/work/.mc"
            - name: S3_ENDPOINT
              valueFrom:
                secretKeyRef: { name: forte-drop-secrets, key: S3_ENDPOINT }
@@ -233,6 +233,8 @@ spec:
              value: "{{ regex_replace_all('https?://[^/]*', request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-callback-path\", '') }}"
            - name: AUTH_OIDC_SCOPES
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-scopes\" || 'openid,profile,email'  }}"
+            - name: AUTH_OIDC_COOKIE_DOMAIN
+              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-oidc-cookie-domain\" || '' }}"
            - name: AUTH_PUBLIC_PATHS
              value: "{{ request.object.metadata.annotations.\"policies.forteapps.io/auth-public-paths\" || '/healthz' }}"
            - name: AUTH_OIDC_COOKIE_SECRET
Author	SHA1	Message	Date
danijel.simeunovic	ff2b8fc0f5	Merge branch 'main' into fix/pg-backup-mc-config AI Code Review / ai-review (pull_request) Has been skipped Details / test (pull_request) Successful in 9s Details	2026-07-02 12:43:03 +00:00
danijel.simeunovic	af1e94d85d	review / test (push) Successful in 9s Details	2026-07-02 12:25:11 +02:00
jorgen.stensrud	df35cd0630	feat(auth-sidecar): inject AUTH_OIDC_COOKIE_DOMAIN (#24 ) / test (push) Successful in 10s Details Adds AUTH_OIDC_COOKIE_DOMAIN to the injected OIDC sidecar, from the `policies.forteapps.io/auth-oidc-cookie-domain` annotation. Empty when unset = host-only = unchanged for every app. Pairs with forte-helm + auth-sidecar#23. Safe to merge anytime (opt-in). --------- Co-authored-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com> Reviewed-on: #24 Reviewed-by: Danijel Simeunovic <danijel.simeunovic@fortedigital.com>	2026-06-30 06:59:37 +00:00
danijel.simeunovic	04b3a210fe	shared-prompts / test (push) Successful in 8s Details	2026-06-29 17:02:50 +02:00
Sten	df30877b5e	fix(forte-drop-pg-backup): set MC_CONFIG_DIR so mc can write its config / test (pull_request) Successful in 8s Details The backup CronJob runs as uid 65532 (runAsNonRoot). mc defaulted its config dir to $HOME/.mc = /.mc and failed with "mkdir /.mc: permission denied" on the non-writable root fs — every nightly run died before uploading, so there are currently no backups in s3://drops/_pgbackups/. Point MC_CONFIG_DIR at the shared /work emptyDir (writable via fsGroup). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-11 13:18:20 +02:00