From 3354abec654542ed62f46acd55960328f2802156 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Bauer?= Date: Wed, 28 Oct 2026 16:11:36 +0100 Subject: [PATCH 1/2] docs(FU-40): flux-deployment-reporter reads OCI labels, not annotations Co-Authored-By: Claude Opus 5.5 --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 99463f1..fcb3e8d 100644 --- a/README.md +++ b/README.md @@ -138,7 +138,7 @@ By default (`deployment-annotations: 'true'`), whenever the action updates a Git | `deploy.staffbase.com/commitSha` | The commit SHA being deployed (`$GITHUB_SHA`) | | `deploy.staffbase.com/version` | The image tag written to the GitOps repo — always the **non-timestamped** tag: `dev-` on `dev`, `main-` on `main`, `master-` on `master`, the version without the leading `v` on `v*` tag pushes, and the tag name on other tag pushes. See [GitOps tag](#gitops-tag) below | -These keys mirror the [Swarmia Deployment API](https://help.swarmia.com/settings/organization/configuring-deployments-in-swarmia) field names and are read by `flux-deployment-reporter` to report deployments to Swarmia once Flux finishes reconciling. Set `deployment-annotations: 'false'` to skip them. The `deploy.staffbase.com` namespace is configurable via [`deployment-domain`](#inputs). +These keys mirror the [Swarmia Deployment API](https://help.swarmia.com/settings/organization/configuring-deployments-in-swarmia) field names. `flux-deployment-reporter` no longer reads them: it takes the commit and repository from the image's [deployment tracking labels](#deployment-tracking-labels) instead. Set `deployment-annotations: 'false'` to skip them. The `deploy.staffbase.com` namespace is configurable via [`deployment-domain`](#inputs). ### Deployment tracking labels @@ -150,6 +150,8 @@ Enabled by default (`deployment-labels: 'true'`). The same three values are stam | `com.staffbase.deploy.commitSha` | The commit SHA being deployed (`$GITHUB_SHA`) | | `com.staffbase.deploy.version` | The **non-timestamped** GitOps tag (same value as the `deploy.staffbase.com/version` annotation) | +`flux-deployment-reporter` reads `commitSha` and `repositoryFullName` from these labels to report deployments to Swarmia, for workloads labelled `deploy.staffbase.com/report: "true"`. It reports the image tag the workload runs as the version, not the `version` label. + > **Note:** labels are baked in at **build time**, so they are only applied on builds. Release (`v*`) and custom-tag runs that **retag** an existing image instead of rebuilding (see [Image tags](#image-tags--flux-image-automation)) do not get fresh labels — the retagged image keeps the labels from the branch build it was promoted from. This feature is independent of the annotations above; enable either, both, or neither. ### Fresh builds From 9d4b3e91661709dec5f99534c911e5a07fb08fff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Bauer?= Date: Wed, 28 Oct 2026 18:09:57 +0100 Subject: [PATCH 2/2] feat(FU-40): disable deployment annotations by default flux-deployment-reporter reads the image's OCI labels, not the GitOps annotations. With Flux image automation updating tags, the annotations would describe old deployments. Callers can still opt in with deployment-annotations: 'true'. Co-Authored-By: Claude Opus 5.5 --- README.md | 6 +++--- action.yml | 4 ++-- scripts/lib/gitops-functions.sh | 4 ++-- tests/lib-gitops-functions.bats | 5 +++-- 4 files changed, 10 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index fcb3e8d..401bc8b 100644 --- a/README.md +++ b/README.md @@ -130,7 +130,7 @@ jobs: ### Deployment tracking annotations -By default (`deployment-annotations: 'true'`), whenever the action updates a GitOps file it stamps the following annotations onto the manifest's `metadata.annotations`: +Disabled by default. With `deployment-annotations: 'true'`, whenever the action updates a GitOps file it stamps the following annotations onto the manifest's `metadata.annotations`: | Annotation | Value | |------------|-------| @@ -138,7 +138,7 @@ By default (`deployment-annotations: 'true'`), whenever the action updates a Git | `deploy.staffbase.com/commitSha` | The commit SHA being deployed (`$GITHUB_SHA`) | | `deploy.staffbase.com/version` | The image tag written to the GitOps repo — always the **non-timestamped** tag: `dev-` on `dev`, `main-` on `main`, `master-` on `master`, the version without the leading `v` on `v*` tag pushes, and the tag name on other tag pushes. See [GitOps tag](#gitops-tag) below | -These keys mirror the [Swarmia Deployment API](https://help.swarmia.com/settings/organization/configuring-deployments-in-swarmia) field names. `flux-deployment-reporter` no longer reads them: it takes the commit and repository from the image's [deployment tracking labels](#deployment-tracking-labels) instead. Set `deployment-annotations: 'false'` to skip them. The `deploy.staffbase.com` namespace is configurable via [`deployment-domain`](#inputs). +These keys mirror the [Swarmia Deployment API](https://help.swarmia.com/settings/organization/configuring-deployments-in-swarmia) field names. `flux-deployment-reporter` no longer reads them: it takes the commit and repository from the image's [deployment tracking labels](#deployment-tracking-labels) instead. With Flux image automation updating the tags, the action no longer touches most manifests, so the annotations would describe old deployments. That is why they are off by default. The `deploy.staffbase.com` namespace is configurable via [`deployment-domain`](#inputs). ### Deployment tracking labels @@ -282,7 +282,7 @@ Notes: | `docker-build-provenance` | Generate [provenance](https://docs.docker.com/build/attestations/slsa-provenance/) attestation for the build | `false` | | `docker-build-no-cache` | Re-execute Dockerfile steps and skip external cache import/export. Base images are always checked for updates. | `false` | | `docker-disable-retagging` | Disables retagging of existing images and run a new build instead | `false` | -| `deployment-annotations` | Stamp deployment-tracking annotations (`deploy.staffbase.com/*`) onto updated GitOps manifests. See [Deployment tracking annotations](#deployment-tracking-annotations) | `true` | +| `deployment-annotations` | Stamp deployment-tracking annotations (`deploy.staffbase.com/*`) onto updated GitOps manifests. See [Deployment tracking annotations](#deployment-tracking-annotations) | `false` | | `deployment-domain` | Key namespace for deployment-tracking metadata. Used verbatim for annotation keys (`/...`) and reversed to reverse-DNS for label keys (`com.staffbase.deploy.*`) | `deploy.staffbase.com` | | `deployment-labels` | Stamp deployment-tracking labels (`com.staffbase.deploy.*`) onto the built image. Only applied on builds, not on release/custom retags. See [Deployment tracking labels](#deployment-tracking-labels) | `true` | | `gitops-organization` | GitHub Organization for GitOps | `Staffbase` | diff --git a/action.yml b/action.yml index b1716dc..7dbc010 100644 --- a/action.yml +++ b/action.yml @@ -79,9 +79,9 @@ inputs: required: false default: 'false' deployment-annotations: - description: 'Stamp deployment-tracking annotations (deploy.staffbase.com/repositoryFullName, /commitSha, /version) onto the updated GitOps manifests. Enabled by default; set to ''false'' to skip.' + description: 'Stamp deployment-tracking annotations (deploy.staffbase.com/repositoryFullName, /commitSha, /version) onto the updated GitOps manifests. Disabled by default; set to ''true'' to enable.' required: false - default: 'true' + default: 'false' deployment-domain: description: 'Domain used as the key namespace for deployment-tracking metadata. Applied verbatim to GitOps annotation keys (/repositoryFullName) and reversed to reverse-DNS for image label keys (deploy.staffbase.com -> com.staffbase.deploy.repositoryFullName).' required: false diff --git a/scripts/lib/gitops-functions.sh b/scripts/lib/gitops-functions.sh index d39a473..7cd9910 100755 --- a/scripts/lib/gitops-functions.sh +++ b/scripts/lib/gitops-functions.sh @@ -6,7 +6,7 @@ # INPUT_DOCKER_REGISTRY, INPUT_DOCKER_IMAGE, INPUT_TAG, INPUT_PUSH, # INPUT_GITOPS_USER, INPUT_GITOPS_TOKEN, # INPUT_GITOPS_ORGANIZATION, INPUT_GITOPS_REPOSITORY, -# INPUT_DEPLOYMENT_ANNOTATIONS (optional, defaults to "true"), +# INPUT_DEPLOYMENT_ANNOTATIONS (optional, defaults to "false"), # INPUT_DEPLOYMENT_DOMAIN (optional, defaults to "deploy.staffbase.com"), # GITHUB_REPOSITORY, GITHUB_SHA, IMAGE @@ -50,7 +50,7 @@ update_file() { fi fi - if [[ "${INPUT_DEPLOYMENT_ANNOTATIONS:-true}" == "true" ]]; then + if [[ "${INPUT_DEPLOYMENT_ANNOTATIONS:-false}" == "true" ]]; then local domain="${INPUT_DEPLOYMENT_DOMAIN:-deploy.staffbase.com}" echo "Writing deployment annotations to ${file}" yq -i '.metadata.annotations["'"${domain}"'/repositoryFullName"] = "'"${GITHUB_REPOSITORY}"'"' "${file}" diff --git a/tests/lib-gitops-functions.bats b/tests/lib-gitops-functions.bats index f402c1d..78a0b74 100644 --- a/tests/lib-gitops-functions.bats +++ b/tests/lib-gitops-functions.bats @@ -18,6 +18,7 @@ setup() { export INPUT_GITOPS_ORGANIZATION="Staffbase" export INPUT_GITOPS_REPOSITORY="mops" export IMAGE="registry.staffbase.com/my-service:main-abcdef12" + export INPUT_DEPLOYMENT_ANNOTATIONS="true" # Create mock yq mkdir -p "${TEST_TEMP_DIR}/mocks" @@ -147,10 +148,10 @@ EOF ! grep -qE 'deploy\.staffbase\.com/(repo|sha)"' "${TEST_TEMP_DIR}/yq_calls.log" } -@test "update_file writes annotations when INPUT_DEPLOYMENT_ANNOTATIONS is unset (default on)" { +@test "update_file skips annotations when INPUT_DEPLOYMENT_ANNOTATIONS is unset (default off)" { unset INPUT_DEPLOYMENT_ANNOTATIONS update_file "deployment.yaml" "spec.image" "$IMAGE" - grep -q 'deploy.staffbase.com/repositoryFullName' "${TEST_TEMP_DIR}/yq_calls.log" + ! grep -q 'deploy.staffbase.com/' "${TEST_TEMP_DIR}/yq_calls.log" } @test "update_file skips annotations when INPUT_DEPLOYMENT_ANNOTATIONS is false" {