Repository navigation
fix: deploy.yml permissions, template self-skip, and current app.yaml options - #2
Merged
Merged
Conversation
Without a permissions block the platform's expand step cannot push generated Terraform, and OIDC is unavailable where org defaults are read-only. Document onboarding (repo in the app.yaml team), drop the unsupported budget_alert_nok and auth: both, and drop secrets: inherit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…tform The template's own Deploy run failed in expand: team `my-team` is invalid (lowercase letters only). Use `myteam`, and skip the javabin job when the repository is javaBin/app-template so the template never deploys while repos created from it do. Document current app.yaml options (auth client/groups/env/localhost callbacks, compute user/readonly_root_filesystem, strict validation, per-team budgets) and the secrets flow via `javabin aws setup` and `javabin secret set`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Alexanderamiri
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
deploy.yml:permissions:block (id-token: write,contents: write,pull-requests: write), nosecrets: inherit, triggers push tomain/pull_request/workflow_dispatch. Thejavabinjob hasif: github.repository != 'javaBin/app-template', so the template repo never deploys. Repos created from it have a different name, so the job runs there.app.yaml:team: myteam. The oldmy-teambrokeexpandin the template's own run (team names are lowercase letters only). Commented examples now covercompute.user/readonly_root_filesystem, RDS, the secrets flow, and authclient: confidential|public|none,groups,envaliases and localhost callbacks. Also notes that validation is strict and budgets are set per team.app.yamlteam's GitHub team, SSO permission setjavabin-team-<team>, secrets viabrew install javaBin/tap/javabin,javabin aws setupandjavabin secret set.Verification
generate-modules.py(platform main) passes on the shippedapp.yaml, and on a copy with every example uncommented.actionlintis clean.🤖 Generated with Claude Code