[P16] Decouple provision step from deploy success #108

New Issue

kert · 2026-03-22T17:12:52Z

kert commented

2026-03-22 17:12:52 +00:00

Problem

Provision depends on deploy, which depends on scan uploads, which depend on scans, which depend on buildx. Any failure in this chain causes provision to be skipped. Provision has been skipped in every pipeline since the buildx plugin migration (pipelines #112–#122+).

Credential rotation hasn't happened since before the migration.

Root cause

- name: provision
  depends_on:
    - deploy  # ← if deploy skips, provision skips

Fix

Remove depends_on: deploy — provision should run after builds complete, regardless of deploy status
Add depends_on on the build steps directly (not scans/uploads)
Add failure: ignore so provision failures don't mask build status
Provision must still access the host Docker socket and /home/kert/stack

Acceptance criteria

Provision runs even when upload or scan steps fail
Provision runs even when deploy step fails
.env is updated with rotated credentials
Services restart with new credentials after compose up

## Problem Provision depends on deploy, which depends on scan uploads, which depend on scans, which depend on buildx. Any failure in this chain causes provision to be `skipped`. Provision has been skipped in **every pipeline** since the buildx plugin migration (pipelines #112–#122+). Credential rotation hasn't happened since before the migration. ## Root cause ```yaml - name: provision depends_on: - deploy # ← if deploy skips, provision skips ``` ## Fix 1. Remove `depends_on: deploy` — provision should run after builds complete, regardless of deploy status 2. Add `depends_on` on the build steps directly (not scans/uploads) 3. Add `failure: ignore` so provision failures don't mask build status 4. Provision must still access the host Docker socket and `/home/kert/stack` ## Acceptance criteria - [ ] Provision runs even when upload or scan steps fail - [ ] Provision runs even when deploy step fails - [ ] .env is updated with rotated credentials - [ ] Services restart with new credentials after compose up

kert added this to the P16: Provision Hardening — resilient credential rotation milestone 2026-03-22 17:12:52 +00:00

kert added the ci label 2026-03-22 17:12:52 +00:00

kert referenced this issue from a commit

2026-03-22 17:15:24 +00:00

decouple provision from deploy step fix #108

kert closed this issue

2026-03-22 17:15:24 +00:00

Sign in to join this conversation.