Skip to content
NutsNews chestnut logoNutsNews Wiki

Simple guide · Overview

Page status: HistoricalHistory group: Updates

Staging Bundle Marker Refresh Update

The VPS staging deploy bundle now stays tied to the infra commit that production

Visual overview

Primary diagram

System map

The VPS staging deploy bundle now stays tied to the infra commit that production

Render the repository-owned system map when you need it.

Diagram is not rendered yet.

View as text
Staging Bundle Marker Refresh Update

The VPS staging deploy bundle now stays tied to the infra commit that production

flowchart TB
  accTitle: Staging Bundle Marker Refresh Update
  accDescr {
    The VPS staging deploy bundle now stays tied to the infra commit that production
  }
  A["Staging Bundle Marker Refresh Update"] --> B["updates/README_STAGING_BUNDLE_MARKER_REFRESH_UPDATE.md"]
  B --> C["Auto-generated placeholder diagram"]

Staging Bundle Marker Refresh Update

Fullscreen diagram view.

Staging Bundle Marker Refresh Update

Section titled “Staging Bundle Marker Refresh Update”

Simple Summary

Section titled “Simple Summary”

The VPS staging deploy bundle now stays tied to the infra commit that production automation just reviewed. This prevents valid staging deployments from being rejected because the server still remembers an older infra commit.

Intermediate Summary

Section titled “Intermediate Summary”

The staging fixed command compares the incoming infra workflow commit with the root-owned marker in /opt/nutsnews/staging-deploy-bundle/infra-commit. After a production release path updated infra without refreshing that bundle marker, staging refused the next app candidate with unreviewed_infra_commit.

The targeted infra fix updates automated production release, pre-merge production, and fixed rollback dispatches to call Protected Ansible Apply with enable_staging_access=true. A follow-up guard correction keeps /healthz aligned with the shared VPS image build identity, vps, while runtime readiness and public config continue to report the production VPS runtime identity, production-vps.

Expert Summary

Section titled “Expert Summary”

Protected Ansible Apply already owns the reviewed path that can refresh staging-access material on the VPS. Enabling enable_staging_access in the automated app-release callers avoids a split-brain state where the reviewed infra manifest is current but the root-owned staging bundle remains pinned to an older commit. Staging deploys should continue to fail closed if the marker does not match the workflow commit; the recovery path is to rerun reviewed Protected Ansible Apply, not to edit the marker manually.

This update also documents that VPS public app identity checks use vps for /healthz and production-vps for /readyz and /api/runtime-config.

Validation Evidence

Section titled “Validation Evidence”
  • Related blocker: https://github.com/ramideltoro/nutsnews-infra/issues/314
  • Local infra validation:
    • python3 ansible/tests/validate_release_promotion.py
    • python3 ansible/tests/validate_production_eligibility.py
    • python3 ansible/tests/validate_gate_rehearsal.py
    • python3 ansible/tests/validate_app_deployment.py
    • python3 ansible/tests/validate_staging_deployment.py
    • /tmp/nutsnews-infra-314-venv/bin/python ansible/tests/validate_staging_access_boundary.py