Add fly:bats rake task for running BATs from a local branch - #2753
Add fly:bats rake task for running BATs from a local branch#2753colins wants to merge 2 commits into
Conversation
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
WalkthroughAdds a Concourse BATs pipeline with configurable repository, stemcell, environment, deployment, and test parameters. Adds a shell task that provisions GCP infrastructure with Terraform, deploys BOSH, runs BATs, collects diagnostics, and tears down resources. Adds a Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci/fly-bats.yml`:
- Around line 43-46: The stemcell resource is still hardcoded to a fixed name,
so the pipeline override is not applied end-to-end. Update the stemcell resource
definition in the fly config to use the existing stemcell_name variable instead
of the literal bosh-google-kvm-ubuntu-noble value, and keep the task/job param
wiring consistent with the same variable so the fetched stemcell matches the
override.
In `@ci/tasks/run-bats-pipeline.sh`:
- Around line 34-40: The Terraform install path in run-bats-pipeline.sh
downloads and unpacks a release directly into /usr/local/bin without any
integrity check. Update the Terraform installation block to either use a
pre-baked image/tooling layer or verify the downloaded archive against the
official checksum/signature before calling unzip and chmod, using the existing
terraform install flow and TERRAFORM_VERSION lookup as the entry point.
- Around line 48-72: Move the EXIT cleanup setup so it is registered before any
Terraform work starts in run-bats-pipeline.sh; the current flow around terraform
init, terraform apply, and terraform output can fail before teardown is armed,
leaving partial GCP resources behind. Update the script so the trap that calls
teardown is installed before entering the Terraform provisioning block, while
keeping the existing teardown function and ENV_NAME/TERRAFORM_DIR flow intact.
- Around line 157-166: Preserve caller-supplied BAT_RSPEC_FLAGS in
run-bats-pipeline.sh by saving its current value before sourcing
bats-config/bats.env, since that file sets a default export which overwrites it.
Update the sourcing flow around the bats.env load so the existing
BAT_RSPEC_FLAGS is restored or appended afterward, keeping the behavior in the
BAT_RSPEC_FLAGS handling block and the bats-config/bats.env source step
consistent.
- Line 17: The shell script currently uses set -eu without pipefail, so failures
in piped commands can be masked. Update the script header to use set -euo
pipefail in the run-bats-pipeline.sh flow, so the terraform output -json | jq
... pipeline fails correctly instead of allowing an empty environment/metadata
file. Use the existing pipeline in this script as the place to apply the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: aa46ba66-4144-4592-8494-bed921444c83
📒 Files selected for processing (3)
ci/fly-bats.ymlci/tasks/run-bats-pipeline.shsrc/tasks/fly.rake
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
There was a problem hiding this comment.
Pull request overview
Adds a developer-facing workflow to run full BOSH Acceptance Tests (BATs) against a local feature branch by setting a dedicated Concourse pipeline and triggering a job from src/ via bundle exec rake fly:bats.
Changes:
- Add
fly:batsrake task that pushes the current branch, setsci/fly-bats.yml, and triggersbats-local/bats. - Introduce a standalone Concourse pipeline (
ci/fly-bats.yml) for building a candidate, compiling the release, and running BATs. - Add a single Concourse task script (
ci/tasks/run-bats-pipeline.sh) that provisions infra, deploys a director, runs BATs, and tears down with diagnostics.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| src/tasks/fly.rake | Adds fly:bats rake task to set/unpause/trigger the Concourse pipeline for the current branch. |
| ci/tasks/run-bats-pipeline.sh | New orchestration script to run the full BATs lifecycle (terraform → deploy → bats → teardown). |
| ci/fly-bats.yml | New standalone pipeline wiring resources + tasks to run BATs for a specified repo/branch. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| branch = `git -C .. rev-parse --abbrev-ref HEAD`.strip | ||
| repo = `git -C .. remote get-url origin`.strip |
| - name: bats | ||
| serial: true | ||
| plan: |
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
Introduces `bundle exec rake fly:bats` (from src/) so developers can run
the full BOSH Acceptance Test suite against their local branch without
waiting for the shared CI pipeline.
How it works
------------
The rake task sets a standalone Concourse pipeline (ci/fly-bats.yml),
then triggers and streams the single `bats` job. The pipeline:
1. Checks out the current branch from GitHub (branch is pushed
automatically before set-pipeline).
2. Runs make-candidate.yml to build a dev release tarball.
3. Compiles the tarball via bosh-deployment/ci/tasks/shared/bosh-agent-compile.yml.
4. Runs ci/tasks/run-bats-pipeline.sh which provisions a GCP environment
with terraform, deploys the BOSH director, runs BATs, and tears down.
All GCP credentials are resolved from the shared Concourse credential
store (((gcp_json_key)) / ((gcp_project_id))).
Files added
-----------
- ci/fly-bats.yml — standalone Concourse pipeline (replaces the
two separate fly-execute task files)
- ci/tasks/run-bats-pipeline.sh — orchestrates the full BATs lifecycle in GCP
Env-var overrides (all optional)
---------------------------------
BATS_ENV_NAME terraform env name (default: bats-local)
STEMCELL_NAME override GCP stemcell
DEPLOY_ARGS extra ops-files for bosh create-env
BAT_RSPEC_FLAGS extra RSpec flags (e.g. "--tag wip")
CONCOURSE_TARGET target alias (default: bosh)
Cherry-picked from fly-bats-pipeline branch (PR #2753).
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci/tasks/run-bats-pipeline.sh`:
- Around line 113-123: Update the terraform destroy invocation in teardown to
stop passing GCP_JSON_KEY through the gcp_credentials_json -var argument.
Provide the value via Terraform’s TF_VAR_gcp_credentials_json
environment-variable convention, while preserving the existing project_id and
name arguments and destroy behavior.
- Around line 34-50: Fix checksum verification in the Terraform installation
block so the checksum entry’s filename matches the downloaded archive
`${TMP_TF_DIR}/terraform.zip`. Preserve verification with both `sha256sum` and
`shasum` implementations, ensuring each checker validates the actual local file
before unzipping.
In `@src/tasks/fly.rake`:
- Around line 37-39: Remove the no-op trailing `.git` substitution from the
repository URL normalization chain in the `repo` assignment, or replace it with
the intended suffix normalization; preserve the existing SSH-to-HTTPS
conversion.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4b65204a-ff95-4312-9e1d-b14204c19f85
📒 Files selected for processing (3)
ci/fly-bats.ymlci/tasks/run-bats-pipeline.shsrc/tasks/fly.rake
| if ! command -v terraform &>/dev/null; then | ||
| echo "--- Installing terraform ${TERRAFORM_VERSION} ---" | ||
| TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)" | ||
| curl -sSL \ | ||
| "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \ | ||
| -o "${TMP_TF_DIR}/terraform.zip" | ||
| curl -sSL \ | ||
| "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \ | ||
| -o "${TMP_TF_DIR}/SHA256SUMS" | ||
| if command -v sha256sum &>/dev/null; then | ||
| (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c -) | ||
| elif command -v shasum &>/dev/null; then | ||
| (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | shasum -a 256 -c -) | ||
| fi | ||
| unzip -qo "${TMP_TF_DIR}/terraform.zip" -d /usr/local/bin terraform | ||
| chmod +x /usr/local/bin/terraform | ||
| rm -rf "${TMP_TF_DIR}" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
Checksum verification will always fail — filename mismatch breaks every run.
The zip is downloaded to ${TMP_TF_DIR}/terraform.zip (line 39), but the verification step greps the SHA256SUMS line for terraform_${TERRAFORM_VERSION}_linux_amd64.zip and pipes it to sha256sum -c -/shasum -c - from inside TMP_TF_DIR. That checker looks for a file with that exact name relative to cwd, which never exists (only terraform.zip does). With set -euo pipefail, this failure aborts the whole task on every fresh container run — the new checksum step (added to fix the prior "unverified Terraform download" finding) now breaks Terraform installation entirely.
🐛 Proposed fix
echo "--- Installing terraform ${TERRAFORM_VERSION} ---"
TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)"
+ TF_ZIP="terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
- -o "${TMP_TF_DIR}/terraform.zip"
+ -o "${TMP_TF_DIR}/${TF_ZIP}"
curl -sSL \
"https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \
-o "${TMP_TF_DIR}/SHA256SUMS"
if command -v sha256sum &>/dev/null; then
- (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c -)
+ (cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | sha256sum -c -)
elif command -v shasum &>/dev/null; then
- (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | shasum -a 256 -c -)
+ (cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | shasum -a 256 -c -)
fi
- unzip -qo "${TMP_TF_DIR}/terraform.zip" -d /usr/local/bin terraform
+ unzip -qo "${TMP_TF_DIR}/${TF_ZIP}" -d /usr/local/bin terraform📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if ! command -v terraform &>/dev/null; then | |
| echo "--- Installing terraform ${TERRAFORM_VERSION} ---" | |
| TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)" | |
| curl -sSL \ | |
| "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \ | |
| -o "${TMP_TF_DIR}/terraform.zip" | |
| curl -sSL \ | |
| "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \ | |
| -o "${TMP_TF_DIR}/SHA256SUMS" | |
| if command -v sha256sum &>/dev/null; then | |
| (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | sha256sum -c -) | |
| elif command -v shasum &>/dev/null; then | |
| (cd "${TMP_TF_DIR}" && grep "terraform_${TERRAFORM_VERSION}_linux_amd64.zip" SHA256SUMS | shasum -a 256 -c -) | |
| fi | |
| unzip -qo "${TMP_TF_DIR}/terraform.zip" -d /usr/local/bin terraform | |
| chmod +x /usr/local/bin/terraform | |
| rm -rf "${TMP_TF_DIR}" | |
| if ! command -v terraform &>/dev/null; then | |
| echo "--- Installing terraform ${TERRAFORM_VERSION} ---" | |
| TMP_TF_DIR="$(mktemp -d /tmp/terraform-install-XXXXXX)" | |
| TF_ZIP="terraform_${TERRAFORM_VERSION}_linux_amd64.zip" | |
| curl -sSL \ | |
| "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \ | |
| -o "${TMP_TF_DIR}/${TF_ZIP}" | |
| curl -sSL \ | |
| "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_SHA256SUMS" \ | |
| -o "${TMP_TF_DIR}/SHA256SUMS" | |
| if command -v sha256sum &>/dev/null; then | |
| (cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | sha256sum -c -) | |
| elif command -v shasum &>/dev/null; then | |
| (cd "${TMP_TF_DIR}" && grep "${TF_ZIP}" SHA256SUMS | shasum -a 256 -c -) | |
| fi | |
| unzip -qo "${TMP_TF_DIR}/${TF_ZIP}" -d /usr/local/bin terraform | |
| chmod +x /usr/local/bin/terraform | |
| rm -rf "${TMP_TF_DIR}" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci/tasks/run-bats-pipeline.sh` around lines 34 - 50, Fix checksum
verification in the Terraform installation block so the checksum entry’s
filename matches the downloaded archive `${TMP_TF_DIR}/terraform.zip`. Preserve
verification with both `sha256sum` and `shasum` implementations, ensuring each
checker validates the actual local file before unzipping.
| if [[ -n "${TERRAFORM_DIR:-}" ]] && [[ -d "${TERRAFORM_DIR}" ]]; then | ||
| echo "--- Destroying GCP environment (env: ${ENV_NAME}) ---" | ||
| pushd "${TERRAFORM_DIR}" >/dev/null | ||
| terraform destroy \ | ||
| -input=false \ | ||
| -auto-approve \ | ||
| -var "project_id=${GCP_PROJECT_ID}" \ | ||
| -var "gcp_credentials_json=${GCP_JSON_KEY}" \ | ||
| -var "name=${ENV_NAME}" || true | ||
| popd >/dev/null | ||
| fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
Avoid passing the GCP service-account key via -var on the command line.
terraform apply/terraform destroy receive gcp_credentials_json (the full service-account JSON) as a CLI argument. That puts the secret into the process argv, readable via /proc/<pid>/cmdline by anything else in the container. Prefer Terraform's TF_VAR_<name> environment-variable convention for secret inputs, which the CLI reads directly without exposing them as arguments.
♻️ Proposed fix
+TF_VAR_project_id="${GCP_PROJECT_ID}" \
+TF_VAR_gcp_credentials_json="${GCP_JSON_KEY}" \
+TF_VAR_name="${ENV_NAME}" \
terraform apply \
-input=false \
- -auto-approve \
- -var "project_id=${GCP_PROJECT_ID}" \
- -var "gcp_credentials_json=${GCP_JSON_KEY}" \
- -var "name=${ENV_NAME}"
+ -auto-approveApply the same pattern to the terraform destroy call in teardown.
Also applies to: 144-149
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci/tasks/run-bats-pipeline.sh` around lines 113 - 123, Update the terraform
destroy invocation in teardown to stop passing GCP_JSON_KEY through the
gcp_credentials_json -var argument. Provide the value via Terraform’s
TF_VAR_gcp_credentials_json environment-variable convention, while preserving
the existing project_id and name arguments and destroy behavior.
| repo = `git -C .. remote get-url origin`.strip | ||
| .sub(/\Agit@github\.com:/, 'https://github.com/') | ||
| .sub(/\.git\z/, '.git') |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
No-op regex substitution.
.sub(/\.git\z/, '.git') replaces a trailing .git with the identical string .git, so it never changes the value — this line has no effect regardless of input. If the intent was to normalize the URL (e.g. strip or guarantee a .git suffix), this doesn't do it and should be fixed or removed to avoid misleading future readers.
♻️ Proposed fix (strip `.git` suffix)
repo = `git -C .. remote get-url origin`.strip
.sub(/\Agit@github\.com:/, 'https://github.com/')
- .sub(/\.git\z/, '.git')
+ .sub(/\.git\z/, '')📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| repo = `git -C .. remote get-url origin`.strip | |
| .sub(/\Agit@github\.com:/, 'https://github.com/') | |
| .sub(/\.git\z/, '.git') | |
| repo = `git -C .. remote get-url origin`.strip | |
| .sub(/\Agit@github\.com:/, 'https://github.com/') | |
| .sub(/\.git\z/, '') |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/tasks/fly.rake` around lines 37 - 39, Remove the no-op trailing `.git`
substitution from the repository URL normalization chain in the `repo`
assignment, or replace it with the intended suffix normalization; preserve the
existing SSH-to-HTTPS conversion.
Summary
Introduces
bundle exec rake fly:bats(run fromsrc/) so developers can test their local branch against the full BOSH Acceptance Test suite via the shared Concourse CI — without waiting for the main pipeline.ci/fly-bats.yml— single self-contained Concourse pipeline (replaces the earlier pair offly executetask files)ci/tasks/run-bats-pipeline.sh— orchestrates the complete BATs lifecycle: terraform GCP provisioning → BOSH director deploy → BATs → teardownsrc/tasks/fly.rake— adds thefly:batstask: pushes current branch, sets the pipeline, triggers and streams the jobHow it works
originso Concourse can check it outfly set-pipeline -p bats-local -c ci/fly-bats.yml ...with branch/env varsfly trigger-job -j bats-local/bats --watchto stream the runThe pipeline itself chains three tasks:
bosh-deployment/ci/tasks/shared/bosh-agent-compile.ymlGCP credentials are resolved from the Concourse credential store (
((gcp_json_key))/((gcp_project_id))).Optional env-var overrides
BATS_ENV_NAMEbats-localSTEMCELL_NAMEbosh-google-kvm-ubuntu-nobleDEPLOY_ARGS-o bosh-deployment/external-ip-not-recommended.ymlbosh create-envBAT_RSPEC_FLAGS--tag wipCONCOURSE_TARGETboshflytarget aliasTest plan
bundle exec rake fly:batsfromsrc/on a feature branchbats-localappears on Concourse with correct branch varsBATS_ENV_NAMEoverride prevents terraform conflicts when running concurrently