Skip to content

Add fly:bats rake task for running BATs from a local branch - #2753

Open
colins wants to merge 2 commits into
mainfrom
fly-bats-pipeline
Open

Add fly:bats rake task for running BATs from a local branch#2753
colins wants to merge 2 commits into
mainfrom
fly-bats-pipeline

Conversation

@colins

@colins colins commented Jun 26, 2026

Copy link
Copy Markdown
Member

Summary

Introduces bundle exec rake fly:bats (run from src/) so developers can test their local branch against the full BOSH Acceptance Test suite via the shared Concourse CI — without waiting for the main pipeline.

  • ci/fly-bats.yml — single self-contained Concourse pipeline (replaces the earlier pair of fly execute task files)
  • ci/tasks/run-bats-pipeline.sh — orchestrates the complete BATs lifecycle: terraform GCP provisioning → BOSH director deploy → BATs → teardown
  • src/tasks/fly.rake — adds the fly:bats task: pushes current branch, sets the pipeline, triggers and streams the job

How it works

bundle exec rake fly:bats          # from src/
  1. Pushes the current branch to origin so Concourse can check it out
  2. Runs fly set-pipeline -p bats-local -c ci/fly-bats.yml ... with branch/env vars
  3. Runs fly trigger-job -j bats-local/bats --watch to stream the run

The pipeline itself chains three tasks:

  1. make-candidate — builds a dev release tarball from the checked-out branch
  2. compile-bosh-release — compiles it via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml
  3. run-bats — provisions GCP with terraform, deploys the director, runs BATs, tears down

GCP credentials are resolved from the Concourse credential store (((gcp_json_key)) / ((gcp_project_id))).

Optional env-var overrides

Variable Default Description
BATS_ENV_NAME bats-local Terraform env name — must be unique per concurrent run
STEMCELL_NAME bosh-google-kvm-ubuntu-noble Override GCP stemcell
DEPLOY_ARGS -o bosh-deployment/external-ip-not-recommended.yml Extra ops-files for bosh create-env
BAT_RSPEC_FLAGS (empty) Extra RSpec flags, e.g. --tag wip
CONCOURSE_TARGET bosh fly target alias

Test plan

  • Run bundle exec rake fly:bats from src/ on a feature branch
  • Confirm pipeline bats-local appears on Concourse with correct branch vars
  • Confirm the job triggers, streams output, and completes (pass or fail)
  • Verify BATS_ENV_NAME override prevents terraform conflicts when running concurrently

Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)
@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown

Review Change Stack

Walkthrough

Adds a Concourse BATs pipeline with configurable repository, stemcell, environment, deployment, and test parameters. Adds a shell task that provisions GCP infrastructure with Terraform, deploys BOSH, runs BATs, collects diagnostics, and tears down resources. Adds a fly:bats Rake task to configure, unpause, and trigger the local pipeline.

Suggested reviewers: benjaminguttmann-avtq, ivaylogi98

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: adding a rake task to run BATs from a local branch.
Description check ✅ Passed The description covers the change summary, workflow, optional overrides, and test plan, so it is mostly complete.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fly-bats-pipeline

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci/fly-bats.yml`:
- Around line 43-46: The stemcell resource is still hardcoded to a fixed name,
so the pipeline override is not applied end-to-end. Update the stemcell resource
definition in the fly config to use the existing stemcell_name variable instead
of the literal bosh-google-kvm-ubuntu-noble value, and keep the task/job param
wiring consistent with the same variable so the fetched stemcell matches the
override.

In `@ci/tasks/run-bats-pipeline.sh`:
- Around line 34-40: The Terraform install path in run-bats-pipeline.sh
downloads and unpacks a release directly into /usr/local/bin without any
integrity check. Update the Terraform installation block to either use a
pre-baked image/tooling layer or verify the downloaded archive against the
official checksum/signature before calling unzip and chmod, using the existing
terraform install flow and TERRAFORM_VERSION lookup as the entry point.
- Around line 48-72: Move the EXIT cleanup setup so it is registered before any
Terraform work starts in run-bats-pipeline.sh; the current flow around terraform
init, terraform apply, and terraform output can fail before teardown is armed,
leaving partial GCP resources behind. Update the script so the trap that calls
teardown is installed before entering the Terraform provisioning block, while
keeping the existing teardown function and ENV_NAME/TERRAFORM_DIR flow intact.
- Around line 157-166: Preserve caller-supplied BAT_RSPEC_FLAGS in
run-bats-pipeline.sh by saving its current value before sourcing
bats-config/bats.env, since that file sets a default export which overwrites it.
Update the sourcing flow around the bats.env load so the existing
BAT_RSPEC_FLAGS is restored or appended afterward, keeping the behavior in the
BAT_RSPEC_FLAGS handling block and the bats-config/bats.env source step
consistent.
- Line 17: The shell script currently uses set -eu without pipefail, so failures
in piped commands can be masked. Update the script header to use set -euo
pipefail in the run-bats-pipeline.sh flow, so the terraform output -json | jq
... pipeline fails correctly instead of allowing an empty environment/metadata
file. Use the existing pipeline in this script as the place to apply the change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: aa46ba66-4144-4592-8494-bed921444c83

📥 Commits

Reviewing files that changed from the base of the PR and between e374eb2 and d13c35c.

📒 Files selected for processing (3)
  • ci/fly-bats.yml
  • ci/tasks/run-bats-pipeline.sh
  • src/tasks/fly.rake

Comment thread ci/fly-bats.yml Outdated
Comment thread ci/tasks/run-bats-pipeline.sh Outdated
Comment thread ci/tasks/run-bats-pipeline.sh
Comment thread ci/tasks/run-bats-pipeline.sh Outdated
Comment thread ci/tasks/run-bats-pipeline.sh
colins added a commit that referenced this pull request Jun 26, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
@github-project-automation github-project-automation Bot moved this from Inbox to Waiting for Changes | Open for Contribution in Foundational Infrastructure Working Group Jun 26, 2026
colins added a commit that referenced this pull request Jun 26, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
colins added a commit that referenced this pull request Jun 26, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
colins added a commit that referenced this pull request Jun 27, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
colins added a commit that referenced this pull request Jun 29, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jun 30, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jun 30, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 1, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 1, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
@rkoster
rkoster requested review from a team, Ivaylogi98 and benjaminguttmann-avtq and removed request for a team July 9, 2026 15:29
aramprice pushed a commit that referenced this pull request Jul 9, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 9, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 9, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 13, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 13, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 13, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 13, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 14, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 14, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a developer-facing workflow to run full BOSH Acceptance Tests (BATs) against a local feature branch by setting a dedicated Concourse pipeline and triggering a job from src/ via bundle exec rake fly:bats.

Changes:

  • Add fly:bats rake task that pushes the current branch, sets ci/fly-bats.yml, and triggers bats-local/bats.
  • Introduce a standalone Concourse pipeline (ci/fly-bats.yml) for building a candidate, compiling the release, and running BATs.
  • Add a single Concourse task script (ci/tasks/run-bats-pipeline.sh) that provisions infra, deploys a director, runs BATs, and tears down with diagnostics.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File Description
src/tasks/fly.rake Adds fly:bats rake task to set/unpause/trigger the Concourse pipeline for the current branch.
ci/tasks/run-bats-pipeline.sh New orchestration script to run the full BATs lifecycle (terraform → deploy → bats → teardown).
ci/fly-bats.yml New standalone pipeline wiring resources + tasks to run BATs for a specified repo/branch.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/tasks/fly.rake Outdated
Comment thread src/tasks/fly.rake
Comment on lines +32 to +33
branch = `git -C .. rev-parse --abbrev-ref HEAD`.strip
repo = `git -C .. remote get-url origin`.strip
Comment thread ci/tasks/run-bats-pipeline.sh Outdated
Comment thread ci/fly-bats.yml Outdated
Comment thread ci/fly-bats.yml
Comment on lines +69 to +71
- name: bats
serial: true
plan:
aramprice pushed a commit that referenced this pull request Jul 16, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 16, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 17, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 17, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 17, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).
aramprice pushed a commit that referenced this pull request Jul 17, 2026
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.

How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job.  The pipeline:

  1. Checks out the current branch from GitHub (branch is pushed
     automatically before set-pipeline).
  2. Runs make-candidate.yml to build a dev release tarball.
  3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
  4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
     with terraform, deploys the BOSH director, runs BATs, and tears down.

All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).

Files added
-----------
- ci/fly-bats.yml            — standalone Concourse pipeline (replaces the
                               two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP

Env-var overrides (all optional)
---------------------------------
  BATS_ENV_NAME     terraform env name (default: bats-local)
  STEMCELL_NAME     override GCP stemcell
  DEPLOY_ARGS       extra ops-files for bosh create-env
  BAT_RSPEC_FLAGS   extra RSpec flags (e.g. "--tag wip")
  CONCOURSE_TARGET  target alias (default: bosh)

Cherry-picked from fly-bats-pipeline branch (PR #2753).

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ci/tasks/run-bats-pipeline.sh`:
- Around line 113-123: Update the terraform destroy invocation in teardown to
stop passing GCP_JSON_KEY through the gcp_credentials_json -var argument.
Provide the value via Terraform’s TF_VAR_gcp_credentials_json
environment-variable convention, while preserving the existing project_id and
name arguments and destroy behavior.
- Around line 34-50: Fix checksum verification in the Terraform installation
block so the checksum entry’s filename matches the downloaded archive
`${TMP_TF_DIR}/terraform.zip`. Preserve verification with both `sha256sum` and
`shasum` implementations, ensuring each checker validates the actual local file
before unzipping.

In `@src/tasks/fly.rake`:
- Around line 37-39: Remove the no-op trailing `.git` substitution from the
repository URL normalization chain in the `repo` assignment, or replace it with
the intended suffix normalization; preserve the existing SSH-to-HTTPS
conversion.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4b65204a-ff95-4312-9e1d-b14204c19f85

📥 Commits

Reviewing files that changed from the base of the PR and between d13c35c and 67d7b23.

📒 Files selected for processing (3)
  • ci/fly-bats.yml
  • ci/tasks/run-bats-pipeline.sh
  • src/tasks/fly.rake

Comment on lines +34 to +50
if ! command -v terraform &>/dev/null; then
echo "--- Installing terraform ${TERRAFORM_VERSION} ---"
TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
-o "${TMP_TF_DIR}/terraform.zip"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \
-o "${TMP_TF_DIR}/SHA256SUMS"
if command -v sha256sum &>/dev/null; then
(cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c -)
elif command -v shasum &>/dev/null; then
(cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | shasum -a 256 -c -)
fi
unzip -qo "${TMP_TF_DIR}/terraform.zip" -d /usr/local/bin terraform
chmod +x /usr/local/bin/terraform
rm -rf "${TMP_TF_DIR}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win

Checksum verification will always fail — filename mismatch breaks every run.

The zip is downloaded to ${TMP_TF_DIR}/terraform.zip (line 39), but the verification step greps the SHA256SUMS line for terraform_${TERRAFORM_VERSION}_linux_amd64.zip and pipes it to sha256sum -c -/shasum -c - from inside TMP_TF_DIR. That checker looks for a file with that exact name relative to cwd, which never exists (only terraform.zip does). With set -euo pipefail, this failure aborts the whole task on every fresh container run — the new checksum step (added to fix the prior "unverified Terraform download" finding) now breaks Terraform installation entirely.

🐛 Proposed fix
   echo "--- Installing terraform ${TERRAFORM_VERSION} ---"
   TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)"
+  TF_ZIP="terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
   curl -sSL \
     "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
-    -o "${TMP_TF_DIR}/terraform.zip"
+    -o "${TMP_TF_DIR}/${TF_ZIP}"
   curl -sSL \
     "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \
     -o "${TMP_TF_DIR}/SHA256SUMS"
   if command -v sha256sum &>/dev/null; then
-    (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c -)
+    (cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | sha256sum -c -)
   elif command -v shasum &>/dev/null; then
-    (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | shasum -a 256 -c -)
+    (cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | shasum -a 256 -c -)
   fi
-  unzip -qo "${TMP_TF_DIR}/terraform.zip" -d /usr/local/bin terraform
+  unzip -qo "${TMP_TF_DIR}/${TF_ZIP}" -d /usr/local/bin terraform
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if ! command -v terraform &>/dev/null; then
echo "--- Installing terraform ${TERRAFORM_VERSION} ---"
TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
-o "${TMP_TF_DIR}/terraform.zip"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \
-o "${TMP_TF_DIR}/SHA256SUMS"
if command -v sha256sum &>/dev/null; then
(cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c -)
elif command -v shasum &>/dev/null; then
(cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | shasum -a 256 -c -)
fi
unzip -qo "${TMP_TF_DIR}/terraform.zip" -d /usr/local/bin terraform
chmod +x /usr/local/bin/terraform
rm -rf "${TMP_TF_DIR}"
if ! command -v terraform &>/dev/null; then
echo "--- Installing terraform ${TERRAFORM_VERSION} ---"
TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)"
TF_ZIP="terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
-o "${TMP_TF_DIR}/${TF_ZIP}"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \
-o "${TMP_TF_DIR}/SHA256SUMS"
if command -v sha256sum &>/dev/null; then
(cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | sha256sum -c -)
elif command -v shasum &>/dev/null; then
(cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | shasum -a 256 -c -)
fi
unzip -qo "${TMP_TF_DIR}/${TF_ZIP}" -d /usr/local/bin terraform
chmod +x /usr/local/bin/terraform
rm -rf "${TMP_TF_DIR}"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ci/tasks/run-bats-pipeline.sh` around lines 34 - 50, Fix checksum
verification in the Terraform installation block so the checksum entry’s
filename matches the downloaded archive `${TMP_TF_DIR}/terraform.zip`. Preserve
verification with both `sha256sum` and `shasum` implementations, ensuring each
checker validates the actual local file before unzipping.

Comment on lines +113 to +123
if [[ -n "${TERRAFORM_DIR:-}" ]] && [[ -d "${TERRAFORM_DIR}" ]]; then
echo "--- Destroying GCP environment (env: ${ENV_NAME}) ---"
pushd "${TERRAFORM_DIR}" >/dev/null
terraform destroy \
-input=false \
-auto-approve \
-var "project_id=${GCP_PROJECT_ID}" \
-var "gcp_credentials_json=${GCP_JSON_KEY}" \
-var "name=${ENV_NAME}" || true
popd >/dev/null
fi

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Avoid passing the GCP service-account key via -var on the command line.

terraform apply/terraform destroy receive gcp_credentials_json (the full service-account JSON) as a CLI argument. That puts the secret into the process argv, readable via /proc/<pid>/cmdline by anything else in the container. Prefer Terraform's TF_VAR_<name> environment-variable convention for secret inputs, which the CLI reads directly without exposing them as arguments.

♻️ Proposed fix
+TF_VAR_project_id="${GCP_PROJECT_ID}" \
+TF_VAR_gcp_credentials_json="${GCP_JSON_KEY}" \
+TF_VAR_name="${ENV_NAME}" \
 terraform apply \
   -input=false \
-  -auto-approve \
-  -var "project_id=${GCP_PROJECT_ID}" \
-  -var "gcp_credentials_json=${GCP_JSON_KEY}" \
-  -var "name=${ENV_NAME}"
+  -auto-approve

Apply the same pattern to the terraform destroy call in teardown.

Also applies to: 144-149

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ci/tasks/run-bats-pipeline.sh` around lines 113 - 123, Update the terraform
destroy invocation in teardown to stop passing GCP_JSON_KEY through the
gcp_credentials_json -var argument. Provide the value via Terraform’s
TF_VAR_gcp_credentials_json environment-variable convention, while preserving
the existing project_id and name arguments and destroy behavior.

Comment thread src/tasks/fly.rake
Comment on lines +37 to +39
repo = `git -C .. remote get-url origin`.strip
.sub(/\Agit@github\.com:/, 'https://github.com/')
.sub(/\.git\z/, '.git')

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

No-op regex substitution.

.sub(/\.git\z/, '.git') replaces a trailing .git with the identical string .git, so it never changes the value — this line has no effect regardless of input. If the intent was to normalize the URL (e.g. strip or guarantee a .git suffix), this doesn't do it and should be fixed or removed to avoid misleading future readers.

♻️ Proposed fix (strip `.git` suffix)
     repo   = `git -C .. remote get-url origin`.strip
                 .sub(/\Agit@github\.com:/, 'https://github.com/')
-                .sub(/\.git\z/, '.git')
+                .sub(/\.git\z/, '')
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
repo = `git -C .. remote get-url origin`.strip
.sub(/\Agit@github\.com:/, 'https://github.com/')
.sub(/\.git\z/, '.git')
repo = `git -C .. remote get-url origin`.strip
.sub(/\Agit@github\.com:/, 'https://github.com/')
.sub(/\.git\z/, '')
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/tasks/fly.rake` around lines 37 - 39, Remove the no-op trailing `.git`
substitution from the repository URL normalization chain in the `repo`
assignment, or replace it with the intended suffix normalization; preserve the
existing SSH-to-HTTPS conversion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Waiting for Changes | Open for Contribution

Development

Successfully merging this pull request may close these issues.

2 participants