titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity

WIP: jenkins: give hermes-webui-image its own build-trigger token #54

Draft
hermes-automation wants to merge 1 commits from feature/t_39cf1905-webui-build-token into main
pull from: feature/t_39cf1905-webui-build-token
merge into: titan:main
Conversation 0 Commits 1 Files Changed 14 +642 -13
hermes-automation commented 2026-08-23 16:42:53 +00:00
Member
Copy Link

For t_39cf1905. hermes-webui-image (added in #48) has no authenticationToken
in JCasC, so there is no supported non-interactive route to trigger it --
only an interactively-authenticated Jenkins UI build works today. This adds
an independently-scoped, create-only Vault token
(kv/atlas/hermes/developer-jenkins-webui, seeded by a dedicated
hermes-jenkins-webui-token-seed identity/policy) mirroring the proven
hermes-agent-image lane byte-for-byte, and never sharing state or capability
with the agent token (verified by test coverage that the two Vault paths,
seed identities, and runtime-access files stay disjoint).

Adds services/hermes/scripts/jenkins_webui_image_build_trigger.py as the
coordinator's supported trigger route for future approved WebUI releases,
matching jenkins_image_build_trigger.py's exact shape (fixed job name, fixed
CONFIRM_PUBLISH text, job-scoped buildByToken endpoint only).

Does not add any automatic Jenkins trigger (no pipelineTriggers) and does not
touch Flux image automation -- triggering remains an explicit, reviewed,
one-shot action per revision.

Test plan:

  • testing/tests/test_hermes_webui_release.py (JCasC authenticationToken wiring)
  • testing/tests/test_hermes_image_builder_vault.py (Vault policy exactness,
    seed script CAS/fail-closed behavior for both the existing and new seeder,
    webui seed Job/Kustomization wiring, runtime-access staging)
  • kustomize build services/jenkins, services/hermes,
    services/vault-hermes-jenkins-token-seed all render cleanly
For t_39cf1905. hermes-webui-image (added in #48) has no authenticationToken in JCasC, so there is no supported non-interactive route to trigger it -- only an interactively-authenticated Jenkins UI build works today. This adds an independently-scoped, create-only Vault token (kv/atlas/hermes/developer-jenkins-webui, seeded by a dedicated hermes-jenkins-webui-token-seed identity/policy) mirroring the proven hermes-agent-image lane byte-for-byte, and never sharing state or capability with the agent token (verified by test coverage that the two Vault paths, seed identities, and runtime-access files stay disjoint). Adds services/hermes/scripts/jenkins_webui_image_build_trigger.py as the coordinator's supported trigger route for future approved WebUI releases, matching jenkins_image_build_trigger.py's exact shape (fixed job name, fixed CONFIRM_PUBLISH text, job-scoped buildByToken endpoint only). Does not add any automatic Jenkins trigger (no pipelineTriggers) and does not touch Flux image automation -- triggering remains an explicit, reviewed, one-shot action per revision. Test plan: - testing/tests/test_hermes_webui_release.py (JCasC authenticationToken wiring) - testing/tests/test_hermes_image_builder_vault.py (Vault policy exactness, seed script CAS/fail-closed behavior for both the existing and new seeder, webui seed Job/Kustomization wiring, runtime-access staging) - kustomize build services/jenkins, services/hermes, services/vault-hermes-jenkins-token-seed all render cleanly
hermes-automation added 1 commit 2026-08-23 16:42:54 +00:00 
hermes-webui-image had no authenticationToken, so there was no supported
non-interactive route to trigger it -- only an interactively-authenticated
Jenkins UI build worked. Give it an independently-scoped, create-only Vault
token (kv/atlas/hermes/developer-jenkins-webui, seeded by a dedicated
hermes-jenkins-webui-token-seed identity) mirroring the proven
hermes-agent-image lane exactly, never sharing state or capability with the
agent token. Adds jenkins_webui_image_build_trigger.py as the coordinator's
supported trigger route for future approved releases.
This pull request has changes conflicting with the target branch.
  • services/jenkins/configmap-jcasc.yaml
  • services/jenkins/deployment.yaml
  • testing/tests/test_hermes_webui_release.py
View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feature/t_39cf1905-webui-build-token:feature/t_39cf1905-webui-build-token
git checkout feature/t_39cf1905-webui-build-token
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
atlas-reconciler bstein hermes-automation
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: titan/atlas-iac#54
No description provided.
Delete Branch "feature/t_39cf1905-webui-build-token"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?