From 4e019df23bce97097094282bbdeb50e45d03cad0 Mon Sep 17 00:00:00 2001 From: jgrusewski Date: Tue, 21 Apr 2026 00:25:40 +0200 Subject: [PATCH] =?UTF-8?q?infra(argo):=20disable=20push-triggered=20ci-pi?= =?UTF-8?q?peline=20=E2=80=94=20manual-only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per user directive: pushes to main must not trigger any Argo compute (not even the CPU-heavy test-gate). Changed the sensor's body.ref filter value from "refs/heads/main" to a never-matching sentinel. The eventsource still receives GitLab push webhooks; the sensor evaluates them and rejects every one. To re-enable: restore the value to "refs/heads/main" and `kubectl apply -f infra/k8s/argo/events/ci-pipeline-sensor.yaml`. Manual trigger paths (unchanged): - ci-pipeline: argo submit --from=wftmpl/ci-pipeline -p commit-sha= - compile-and-deploy: curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \ -H 'Content-Type: application/json' -d '{"commit_sha": ""}' --- infra/k8s/argo/events/ci-pipeline-sensor.yaml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/infra/k8s/argo/events/ci-pipeline-sensor.yaml b/infra/k8s/argo/events/ci-pipeline-sensor.yaml index c01bcf8ea..d51a61d5b 100644 --- a/infra/k8s/argo/events/ci-pipeline-sensor.yaml +++ b/infra/k8s/argo/events/ci-pipeline-sensor.yaml @@ -18,17 +18,24 @@ spec: eventName: gitlab-push filters: data: + # DISABLED per user directive: pushes must not trigger any compute. + # Filter requires a ref value that no real webhook will ever emit, + # so the sensor evaluates but always rejects. Ci-pipeline (including + # the expensive test-gate) now runs via manual `argo submit` only. + # + # To re-enable push-triggered CI: change the value back to + # "refs/heads/main" AND re-apply the sensor + # (`kubectl apply -f infra/k8s/argo/events/ci-pipeline-sensor.yaml`). - path: body.ref type: string value: - - "refs/heads/main" - # Auto-compile (compile-and-deploy) is available via the manual webhook: - # curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \ - # -H 'Content-Type: application/json' -d '{"commit_sha": ""}' - # To enable auto-compile on every push to main, add a second trigger here - # that submits compile-and-deploy with the same checkout_sha. - # Toggle: kubectl -n foxhunt patch configmap auto-compile-config \ - # -p '{"data":{"enabled":"true"}}' + - "refs/heads/__push_ci_disabled_by_policy__" + # Manual triggers still work: + # - ci-pipeline: argo submit --from=wftmpl/ci-pipeline -p commit-sha= + # - compile-and-deploy: curl -X POST http://workflow-trigger-eventsource-svc.foxhunt:12001/compile-deploy \ + # -H 'Content-Type: application/json' -d '{"commit_sha": ""}' + # The auto-compile-config ConfigMap is a separate toggle for auto-compile on + # push to main; leave it at "false" to keep deploy manual as well. triggers: - template: