recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Policy: prefer upstream env-parameterization over cc-ci compose overlays

Browse Source 
Operator (2026-05-30): a cc-ci-authored compose overlay risks silent drift from
the recipe users actually run — avoid it wherever possible.

- plan.md §9 guardrail: when a recipe needs a cc-ci-env-tuned value (e.g. a longer
  healthcheck start_period for the slow single node), the preferred fix is an
  UPSTREAM recipe PR exposing it as an env var (e.g. APP_START_PERIOD) with the
  current value as the default in env.sample — CI sets the env, no new compose.
  For making the upgrade tier work from an older base version, prefer DECLARING
  that version not-testable under this CI env over crafting a custom compose.
  Overlay = last resort, Adversary-confirmed non-drifting + paired with the env PR.
- plan-prefer-env-over-compose-overlay.md: migrates the existing debt —
  ghost/discourse compose.ccci-health.yml start_period -> APP_START_PERIOD recipe
  PRs (default=current) then drop the overlays; discourse image re-pin + mumble
  old-base host-ports copy -> declare those old versions untestable instead of
  forking compose. No test weakened; untestable-version is an honest outcome.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
notplants
2026-05-30 15:17:42 +01:00
co-authored by Claude Opus 4.8
parent a89b082240
commit 7a1f7f75aa
2 changed files with 91 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/plan.md
+15
View File
@@ -830,5 +830,20 @@ Each default stands until the Adversary or reality forces a change; record the c
a real app-level check — that **RAISES on actual non-readiness**, never a no-op that masks a failed
deploy. **Prove it has teeth** (a negative test that fails on stuck convergence, e.g. F2-12's
P7-negative). The Adversary treats a custom probe as a potential test-weakening until cold-verified.
- **Don't fork the recipe's compose — parameterize upstream, tune via env.** A cc-ci-authored compose
file/overlay (an extra `compose.*.yml` layered via `COMPOSE_FILE`) is **avoided wherever possible**:
it risks **silent drift** from the recipe actually shipped, so you'd no longer be testing what users
get. When a recipe needs a value tuned for cc-ci's environment (e.g. a longer healthcheck
`start_period` for the slower single node), the **preferred fix is an upstream recipe PR** that
exposes it as an **env var** (e.g. `APP_START_PERIOD`) with the **current value as the default in
`env.sample`** — then CI just sets that env in the app `.env`, no new compose. The env knob also
helps real operators on slow hosts. **Old-version testability:** if making the **upgrade tier** work
from an older base version would need a custom compose (a since-removed image tag, or an overlay the
old version predates), **prefer DECLARING that older version not-testable under this CI env** (note
it + skip that crossover) over authoring a custom compose for it. A cc-ci compose overlay is a
**last resort** only when neither path is possible — Adversary-confirmed non-drifting and paired with
the upstream-env PR that will obsolete it. (The existing ghost/discourse `compose.ccci-health.yml`
start_period overlays + discourse's image re-pin are exactly this debt — migrate per
`plan-prefer-env-over-compose-overlay.md`.)
- **Honest reporting.** If a stage is skipped or a check failed, say so in `STATUS.md`/`JOURNAL.md`
with the output. The loop's value depends entirely on the ledgers being true.