Repository navigation
Conversation
hotfix::start branches from the newest release line and commits the chart bump first, hotfix::check fails unless a release branch is ready for a patch release, hotfix::to-main brings a fix back without main inheriting the release line's numbers. version::bump runs the check itself on release/* and refuses minor and major there.
Wipe Postgres and Keycloak, sync deps, start, seed, and restart so the backend loads the seeded roles. Needed after switching between main and a release branch, whose schemas differ: migrations only ever add. schema-change now regenerates code and then runs fresh, which gives it the dependency sync it lacked.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A protocol for hotfixes, and tooling that enforces it
Whoever has to fix production in a hurry during a hackathon can now follow one page, and three commands stop them before the steps that are easy to get wrong.
Before the first hotfix on a release branch (v0.12.2) worked, but only with a lot of back and forth. The fix's pull request left out the chart bump. Bumping the version first was tempting, because on main that's the right order, but on a release branch it would have published images with no chart pointing at them. A local release branch had silently diverged from GitHub. A one-off CI failure looked like "the images weren't built". And it wasn't obvious that prod needs a chart install and dev needs a restart before anyone sees the fix.
Now: HOTFIX.md walks through it from start to cleanup, with the commands to copy and a table of what can go wrong. just hotfix::start creates the branch with the chart bump already committed. just version::bump refuses to release a release branch that isn't ready, and says why. just hotfix::to-main brings the fix back to main without the release's version numbers.
The step-by-step hotfix section moves from RELEASING.md to HOTFIX.md, so the steps are kept in one place.
Left out: a status command for "are the images and chart published, and is prod on it". It would need registry logins and cluster access. Deploying through cloud-infra also stays a manual step.
Follow-up: the tooling also needs to go into release/0.12, because just reads recipes from the branch you're on. That's a separate PR into release/0.12 with only the tooling commit, and it needs no release.
Verified: every recipe was run against a throwaway clone and remote in good and bad states: not ready, diverged, ready, a second fix in the same release, a conflicting cherry-pick, and a fix already on main. The formatter check passes. Nothing was run against GitHub.