From 8a745d16af74f038051a55698c904207cf4d6a41 Mon Sep 17 00:00:00 2001 From: Ruk Doe Date: Sat, 31 Oct 2026 00:59:17 +0900 Subject: [PATCH 1/3] =?UTF-8?q?chore:=20oauth2-proxy=20=E3=82=92=20v7.15.5?= =?UTF-8?q?=20=E3=81=AB=E5=9B=BA=E5=AE=9A=E3=81=97=E3=80=81Pulumi=20?= =?UTF-8?q?=E3=81=AE=20CLI=20=E3=81=AE=E7=89=88=E3=82=82=20Renovate=20?= =?UTF-8?q?=E3=81=A7=E4=B8=8A=E3=81=92=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - apps/auth の 4 つの oauth2-proxy が :latest で、Renovate が拾えず (skip=invalid-value) 再起動で黙って版が変わりえた。 いま動いているもの (sha256:8498b0d0…) と同じ v7.15.5 にする - pulumi/.pulumi-version (CI の CLI) が 3.267.0 のまま SDK と tools の 3.273.0 から遅れていた。揃え、customManager で Renovate に拾わせる Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01T9PbUfqG4pPxus99UeLiJs --- apps/auth/adguard-proxy.yaml | 2 +- apps/auth/deployment.yaml | 2 +- apps/auth/hubble-proxy.yaml | 2 +- apps/auth/sub-proxy.yaml | 2 +- pulumi/.pulumi-version | 2 +- pulumi/README.md | 2 +- renovate.json | 13 +++++++++++++ 7 files changed, 19 insertions(+), 6 deletions(-) diff --git a/apps/auth/adguard-proxy.yaml b/apps/auth/adguard-proxy.yaml index 3de97ac0..9d4372e6 100644 --- a/apps/auth/adguard-proxy.yaml +++ b/apps/auth/adguard-proxy.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:latest + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5 args: - --http-address=0.0.0.0:4180 - --trusted-proxy-ip=10.42.0.0/16 diff --git a/apps/auth/deployment.yaml b/apps/auth/deployment.yaml index 4eba6cde..1f78ae18 100644 --- a/apps/auth/deployment.yaml +++ b/apps/auth/deployment.yaml @@ -15,7 +15,7 @@ spec: spec: containers: - name: auth - image: quay.io/oauth2-proxy/oauth2-proxy:latest + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5 args: - --http-address=0.0.0.0:4180 # X-Forwarded-* はクラスタ内(Gateway の Envoy)からだけ信じる diff --git a/apps/auth/hubble-proxy.yaml b/apps/auth/hubble-proxy.yaml index a5668856..eda8f258 100644 --- a/apps/auth/hubble-proxy.yaml +++ b/apps/auth/hubble-proxy.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:latest + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5 args: - --http-address=0.0.0.0:4180 - --trusted-proxy-ip=10.42.0.0/16 diff --git a/apps/auth/sub-proxy.yaml b/apps/auth/sub-proxy.yaml index 53d8b5bd..70396a61 100644 --- a/apps/auth/sub-proxy.yaml +++ b/apps/auth/sub-proxy.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:latest + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5 args: - --http-address=0.0.0.0:4180 - --trusted-proxy-ip=10.42.0.0/16 diff --git a/pulumi/.pulumi-version b/pulumi/.pulumi-version index 8fa42d56..da25a677 100644 --- a/pulumi/.pulumi-version +++ b/pulumi/.pulumi-version @@ -1 +1 @@ -3.267.0 +3.273.0 diff --git a/pulumi/README.md b/pulumi/README.md index 7debc989..1c4a2fba 100644 --- a/pulumi/README.md +++ b/pulumi/README.md @@ -149,7 +149,7 @@ node を探しに行く)。**`cf` の出力は API の封筒を外した `result | | どこで固定 | 追うもの | | --- | --- | --- | -| Pulumi の CLI | [.pulumi-version](.pulumi-version) | 手で上げる(SDK の `@pulumi/pulumi` と揃える) | +| Pulumi の CLI | [.pulumi-version](.pulumi-version) | Renovate(SDK の `@pulumi/pulumi`・tools の CLI と同じ pulumi/pulumi なので揃って上がる) | | SDK・provider・`cf` | [bun.lock](bun.lock) | Renovate | | NetBird の provider と包むプラグイン | [Pulumi.yaml](Pulumi.yaml) の `packages` | Renovate (自動マージしない) | | bun | [.bun-version](.bun-version) | Renovate | diff --git a/renovate.json b/renovate.json index c00d87f4..970f73eb 100644 --- a/renovate.json +++ b/renovate.json @@ -60,6 +60,19 @@ "datasourceTemplate": "github-releases", "depNameTemplate": "pulumi/pulumi-terraform-provider", "extractVersionTemplate": "^v(?.+)$" + }, + { + "description": "CI の Pulumi CLI (pulumi.yml の pulumi-version-file)。中身は版だけ。SDK (package.json) と tools の CLI と同じ pulumi/pulumi なので、同じ PR で揃って上がる。", + "customType": "regex", + "managerFilePatterns": [ + "/^pulumi/\\.pulumi-version$/" + ], + "matchStrings": [ + "^(?\\d+\\.\\d+\\.\\d+)\\s*$" + ], + "datasourceTemplate": "github-releases", + "depNameTemplate": "pulumi/pulumi", + "extractVersionTemplate": "^v(?.+)$" } ], "packageRules": [ From 7566de8c0261fbad72b9c5a7d8a24f9287f0b033 Mon Sep 17 00:00:00 2001 From: Ruk Doe Date: Sat, 31 Oct 2026 01:00:28 +0900 Subject: [PATCH 2/3] =?UTF-8?q?docs:=20inline=20=E3=81=AB=E5=85=A5?= =?UTF-8?q?=E3=82=8B=E3=82=B3=E3=83=A1=E3=83=B3=E3=83=88=E3=81=AE=E7=9B=B4?= =?UTF-8?q?=E3=81=97=E3=82=92=20ROADMAP=20=E3=81=AB=E3=83=BBForgejo=2017.0?= =?UTF-8?q?.1=20=E3=81=A7=E3=82=82=E8=AA=8D=E5=8F=AF=E6=B8=88=E3=81=BF?= =?UTF-8?q?=E9=80=A3=E6=90=BA=E3=81=AE=E4=B8=80=E8=A6=A7=E3=81=A8=E5=89=8A?= =?UTF-8?q?=E9=99=A4=E3=81=AF=E7=84=A1=E3=81=84?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01T9PbUfqG4pPxus99UeLiJs --- ROADMAP.md | 3 +++ apps/forgejo/README.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ROADMAP.md b/ROADMAP.md index 791ecc02..d85dc46c 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -27,6 +27,9 @@ bond0 の MAC は設定で固定してあるのでルーターは触らない。 ## Phase 3 — Talos 定常運用 - [ ] **Talos 1.15.0 の正式版が出たら乗り換える**(Renovate の PR) +- [ ] **次に machine config を当てるときに、inline に入るコメントを直す。** `infisical-values.sops.yaml` の 2 つ目のドキュメント + (英語のまま、`../../.sops.yaml` は `../.sops.yaml`)、`apiserver-rbac.yaml` の古い `bootstrap-apply.yml` の話、`local-path.yaml`。 + コメントも inlineManifests にそのまま入るので、直すと描いたものが変わる(当てるついでにやる) ## 済んだこと(記録) diff --git a/apps/forgejo/README.md b/apps/forgejo/README.md index 9c3ac0af..0e4c05e8 100644 --- a/apps/forgejo/README.md +++ b/apps/forgejo/README.md @@ -129,7 +129,7 @@ CI から Forgejo の API・git・レジストリに**長く生きる秘密な **forgejo-bot の 2 つは見送った。**forgejo-bot のものは 16.0.5 では画面にも CLI・API にも一覧・変更・削除の手段が無く (forgejo-bot は画面にログインできない。`ENABLE_INTERNAL_SIGNIN: "false"`)、止めるには DB の `authorized_integration` の行を触ることになる。 -v17 以降で管理の手段が揃ったら、表のルールで `forgejo admin user create-authorized-integration --username forgejo-bot …` を本番で打ち、 +17.0.1 でも CLI は `create-authorized-integration` だけで、一覧・削除は無い(2026-10-31 に確かめた)。管理の手段が揃ったら、表のルールで `forgejo admin user create-authorized-integration --username forgejo-bot …` を本番で打ち、 出力の `audience`(`u:<ユーザー ID>:`。秘密ではない)を表の変数に入れて、ワークフローの PR (doa/tamasagashi#106・doa/todoroku#368・doa/worklog-cloud#148。閉じてある)を出し直す。急いで止めるなら forgejo-bot を bots チームから外す (`prohibit_login` はレジストリを止めない)。doa の ID は 2、リポジトリ ID は todoroku 1・tamasagashi 3・worklog-cloud 4(変更の CLI が無いので、足すときは作り直し)。 From 1a8e24224d2bd35757deb4a7edd6dd3bec00b481 Mon Sep 17 00:00:00 2001 From: Ruk Doe Date: Sat, 31 Oct 2026 01:05:30 +0900 Subject: [PATCH 3/3] =?UTF-8?q?fix:=20Pulumi=20=E3=81=AE=20CLI=20=E3=82=92?= =?UTF-8?q?=E4=B8=8A=E3=81=92=E3=81=9F=E5=88=86=E3=81=AE=20bun.lock?= =?UTF-8?q?=E3=80=81.pulumi-version=20=E3=82=92=20pulumi=20=E3=81=AE?= =?UTF-8?q?=E3=81=BE=E3=81=A8=E3=82=81=E3=81=AB=E5=85=A5=E3=82=8C=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CLI 3.273 の pulumi install で sdks/netbird の行が変わり、preview の差分チェックで落ちた。 .pulumi-version を pulumi のまとめ (postUpgradeTasks で pulumi install) に入れ、SDK と同じ PR で上がるようにする。 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01T9PbUfqG4pPxus99UeLiJs --- pulumi/README.md | 2 +- pulumi/bun.lock | 2 +- renovate.json | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/pulumi/README.md b/pulumi/README.md index 1c4a2fba..ab4583e8 100644 --- a/pulumi/README.md +++ b/pulumi/README.md @@ -149,7 +149,7 @@ node を探しに行く)。**`cf` の出力は API の封筒を外した `result | | どこで固定 | 追うもの | | --- | --- | --- | -| Pulumi の CLI | [.pulumi-version](.pulumi-version) | Renovate(SDK の `@pulumi/pulumi`・tools の CLI と同じ pulumi/pulumi なので揃って上がる) | +| Pulumi の CLI | [.pulumi-version](.pulumi-version) | Renovate(pulumi のまとめで SDK の `@pulumi/pulumi` と同じ PR。CLI を上げると `pulumi install` で bun.lock も変わる) | | SDK・provider・`cf` | [bun.lock](bun.lock) | Renovate | | NetBird の provider と包むプラグイン | [Pulumi.yaml](Pulumi.yaml) の `packages` | Renovate (自動マージしない) | | bun | [.bun-version](.bun-version) | Renovate | diff --git a/pulumi/bun.lock b/pulumi/bun.lock index 523e49ef..bc00f781 100644 --- a/pulumi/bun.lock +++ b/pulumi/bun.lock @@ -207,7 +207,7 @@ "@pulumi/cloudflare": ["@pulumi/cloudflare@6.23.2", "", { "dependencies": { "@pulumi/pulumi": "^3.142.0" } }, "sha512-0pkVCTydiMJD9vQmRt0V50cMFeWW8AinAaY/PjKPbC7X5aSYKooZ0F30oVVY/Ewi7o5/utBO+5ciqzz1/hYREA=="], - "@pulumi/netbird": ["@pulumi/netbird@file:sdks/netbird", { "dependencies": { "@pulumi/pulumi": "^3.238.0", "@types/node": "^20", "typescript": "^4.7.0" } }], + "@pulumi/netbird": ["@pulumi/netbird@file:sdks/netbird", { "dependencies": { "@pulumi/pulumi": "^3.269.0", "@types/node": "^20", "typescript": "^4.7.0" }, "hasInstallScript": true }], "@pulumi/pulumi": ["@pulumi/pulumi@3.273.0", "", { "dependencies": { "@grpc/grpc-js": "^1.10.1", "@logdna/tail-file": "^2.0.6", "@npmcli/arborist": "^9.0.0", "@opentelemetry/api": "^1.9", "@opentelemetry/core": "^2.9", "@opentelemetry/exporter-trace-otlp-grpc": "^0.220", "@opentelemetry/exporter-zipkin": "^2.9", "@opentelemetry/instrumentation": "^0.220", "@opentelemetry/instrumentation-grpc": "^0.220", "@opentelemetry/resources": "^2.9", "@opentelemetry/sdk-trace-base": "^2.9", "@opentelemetry/sdk-trace-node": "^2.9", "@opentelemetry/semantic-conventions": "^1.42", "@types/google-protobuf": "^3.15.5", "@types/semver": "^7.5.6", "execa": "^5.1.0", "google-protobuf": "^3.21.4", "ini": "^2.0.0", "js-yaml": "^4.3.2", "minimist": "^1.2.6", "normalize-package-data": "^6.0.0", "require-from-string": "^2.0.1", "semver": "^7.5.2", "source-map-support": "^0.5.6", "upath": "^1.1.0" }, "peerDependencies": { "ts-node": ">= 7.0.1 < 12", "typescript": ">= 3.8.3 < 7" }, "optionalPeers": ["ts-node", "typescript"] }, "sha512-Yh2k0Kry4u5LM730KUO5HZFnqHdlW9ypoQ8zgO0Tqam1G6urFXjIUTUaLxvWrdsm6gKCoyVS6CPdeOGcV+Msvg=="], diff --git a/renovate.json b/renovate.json index 970f73eb..99de1bc0 100644 --- a/renovate.json +++ b/renovate.json @@ -62,7 +62,7 @@ "extractVersionTemplate": "^v(?.+)$" }, { - "description": "CI の Pulumi CLI (pulumi.yml の pulumi-version-file)。中身は版だけ。SDK (package.json) と tools の CLI と同じ pulumi/pulumi なので、同じ PR で揃って上がる。", + "description": "CI の Pulumi CLI (pulumi.yml の pulumi-version-file)。中身は版だけ。下の pulumi のまとめに入れて SDK (@pulumi/pulumi) と同じ PR にし、pulumi install も流す (CLI を上げると bun.lock の sdks/netbird の行が変わる)。", "customType": "regex", "managerFilePatterns": [ "/^pulumi/\\.pulumi-version$/" @@ -81,7 +81,8 @@ "matchFileNames": [ "pulumi/package.json", "pulumi/bun.lock", - "pulumi/Pulumi.yaml" + "pulumi/Pulumi.yaml", + "pulumi/.pulumi-version" ], "skipArtifactsUpdate": true, "groupName": "pulumi",