Release v0.8.0 by github-actions[bot] · Pull Request #46 · overmindtech/actions

github-actions · 2026-03-13T08:34:44Z

Copybara Sync - Release v0.8.0

This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.

Original author: David Schmitt (david.schmitt@overmind.tech)

What happens when this PR is merged?

The tag-on-merge workflow will automatically create the v0.8.0 tag on main

Review Checklist

Changes look correct and match the expected monorepo sync
Tests pass (see CI checks below)

This is based on https://github.com/overmindtech/workspace/pull/3709 and combines all CLI changes from https://github.com/overmindtech/workspace/pull/3701 into a single commit. https://github.com/overmindtech/workspace/pull/3710 needs to be deployed before this can pass the e2e tests.  --- > [!NOTE] > **Medium Risk** > Changes behavior of change lifecycle operations (start/end) and modifies worker retry/terminal handling, which can affect state transitions and job/flag correctness if edge cases are missed. > > **Overview** > **CLI start/end-change now runs in the background by default.** `start-change` and `end-change` switch from streaming RPCs to `StartChangeSimple`/`EndChangeSimple`, returning immediately and optionally polling `GetChange` when `--wait-for-snapshot` is set. > > **End-change UUID resolution is made race-safe.** The CLI stops client-side status checking for end-change (adds `getChangeUUID`) and relies on server-side atomic validation/queuing. > > **Snapshot worker failure semantics are unified.** Start/end snapshot workers now use a shared `snapshotWorkerRun` wrapper that treats validation/snapshot/DB errors (and panics) as retryable until the final attempt, then force-completes the status transition and clears in-progress flags; start-change also best-effort consumes any queued end-change on force-complete. GitHub composite actions gain a `wait-for-snapshot` input that forwards to the CLI. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 450bb313724a2f4aea5aa14a8de609750c6b7a99. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).  GitOrigin-RevId: c82af9fd0a6ec952c94cfec93847ec58209f69a7

## Summary - Add a GitHub Actions CI workflow for `deploy/meta/` Terraform, enabling automated plan on PRs and apply on merge - Migrate AWS providers from SSO profiles to cross-account `assume_role` for CI compatibility - Add GCP Workload Identity Federation pool in `ovm-infra` with cross-project IAM bindings ## Linear Ticket - **Ticket**: [ENG-3049](https://linear.app/overmind/issue/ENG-3049) — Phase 1: CI workflow for deploy/meta - **Purpose**: Automate meta Terraform plan/apply via CI, unblocking Phase 2 (meta notifications via Chatbot) - **Related**: [ENG-2905](https://linear.app/overmind/issue/ENG-2905) (project plan), [ENG-2906](https://linear.app/overmind/issue/ENG-2906) (plan approval) ## Changes ### Terraform (requires manual bootstrap apply before CI works) - **`deploy/meta/main.tf`**: New `terraform-meta` IAM role (OIDC-assumable, `AdministratorAccess`), root-level Google provider for `ovm-infra`, WIF pool + provider + IAM binding for meta CI - **`deploy/meta/deployenv/aws.tf`**: Provider changed from `profile = "sso-..."` to `assume_role` targeting `terraform-deploy`; added `AllowMetaCIRole` trust statement so `terraform-meta` can chain into target accounts - **`deploy/meta/deployenv/gcp.tf`**: Cross-project IAM binding granting the `ovm-infra` WIF identity admin access in each deployenv project - **`deploy/meta/deployenv/variables.tf`**: New `meta_gcp_project_number` variable for cross-project references - **`deploy/meta/citest.tf`**: Provider changed from `profile = "sso-ci-test"` to `assume_role`; passes `meta_gcp_project_number` to module ### CI Configuration - **`.github/workflows/terraform-meta.yml`**: New workflow with brain + execute jobs. Triggers on `deploy/meta/**` path changes. Includes Overmind integration (submit-plan, start/end-change, custom signal) to prod only, GCP WIF auth, and Slack notifications (start, success, failure, cancelled, plan status) - **`deploy/.github/env/op.meta.env`**: Non-sensitive 1Password references (`TERRAFORM_DEPLOY_ROLE`, `GCP_PROJECT_ID`, `GCP_PROJECT_NUMBER`) - **`deploy/.github/env/op.meta.secret`**: Sensitive 1Password references (`OVM_API_KEY_PROD`, `ADMIN_GITHUB_TOKEN`, Slack webhooks) ### Documentation - **`deploy/meta/README.md`**: Added CI workflow section; simplified manual process to only require `AWS_PROFILE=sso-infra` ## Bootstrap Requirement > **Important**: The first CI run on this PR will fail. The `terraform-meta` IAM role and provider migrations must be applied manually once before CI can take over. 1. `AWS_PROFILE=sso-infra gcloud auth application-default login && cd deploy/meta && terraform init && terraform apply` (four-eyes) 2. Store role ARN in 1Password: global vault → "Meta Deploy Role" → field "text" 3. Store ovm-infra project ID/number in 1Password: global vault → "Meta GCP Project" → fields "project_id" and "project_number" 4. After bootstrap, merge this PR — subsequent PRs will use CI ## Deviations from Approved Plan Implementation matches the approved plan — no material deviations. Made with [Cursor](https://cursor.com)  --- > [!NOTE] > **High Risk** > Creates/changes CI-deploy IAM roles and trust relationships (including admin-level permissions) and enables automated Terraform `apply` on merge, so misconfiguration could impact production cloud resources. > > **Overview** > Adds a new `terraform-meta` GitHub Actions workflow that automatically runs Terraform `init/validate/plan` on PRs affecting `deploy/meta`, posts a sticky PR plan comment, uploads/downloads plan artifacts, and runs `apply` on merge (or via manual dispatch), with Slack and Overmind change notifications. > > Updates meta Terraform to support CI-based deployments by introducing a `terraform-meta` AWS IAM role (OIDC-assumable) and switching AWS providers from local SSO profiles to cross-account `assume_role`, including new trust allowing the meta CI role to assume target `terraform-deploy` roles. > > Adds/updates GCP Workload Identity Federation for the meta CI identity (new WIF pool/provider in `ovm-infra`, org-level IAM grants, and per-project cross-project admin bindings via a new `meta_gcp_project_number` input), bumps the Google provider lockfile, and adjusts the Drata module ref. Also extends `actions/submit-plan` to accept a configurable sticky comment header and adds 1Password-backed env/secret files for the workflow. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 63347e17fdeb5af8b5a008bc856fc553c8732074. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).  GitOrigin-RevId: 41226cc11e80d99ecdda0357f11c59dfe1ca798d

## Summary - Add `--comment` flag to CLI (`submit-plan`, `start-analysis`) and `--wait` flag to `get-change` to enable GitHub App PR commenting and control analysis polling - Add `comment` and `wait` inputs to the `submit-plan` composite action, with backward-compatible `fetch-change` deprecation - Migrate internal workflows (`terraform.yml`, `terraform-meta.yml`) to use the new inputs and disable legacy Slack plan notifications ## Linear Ticket - **Ticket**: [ENG-3123](https://linear.app/overmind/issue/ENG-3123/phase-4-cli-action-wire-comment-flag-auto-detect-and-skip-wait) — Phase 4: CLI + Action — Wire Comment Flag, Auto-Detect, and Skip Wait - **Project**: Multi-Plan Submission & GitHub App PR Commenting (Phase 4 of 5) ## Changes ### CLI (`cli/cmd/`) - `flags.go`: New `--comment` bool flag on `addAnalysisFlags`, requesting the GitHub App to post PR comments - `changes_submit_plan.go`: When `--comment` is set, outputs eval-able `CHANGE_URL` and `GITHUB_APP_ACTIVE` assignments instead of bare URL; passes `PostGithubComment` to `StartChangeAnalysis` RPC - `changes_start_analysis.go`: Same `--comment` behavior and `PostGithubComment` plumbing for the standalone `start-analysis` command - `changes_get_change.go`: Adds `--wait` flag (default `true`); skips `waitForChangeAnalysis` when `--wait=false`. Also fixes `MarkDeprecated` referencing wrong command (`submitPlanCmd` → `getChangeCmd`) - Housekeeping: replace `_ = MarkDeprecated`/`MarkHidden` with `cobra.CheckErr(...)` across 7 call sites ### Action (`actions/submit-plan/action.yml`) - New `comment` (default `"true"`) and `wait` (default `"false"`) inputs - `fetch-change` marked deprecated with backward-compatible shim - New `github-app-active` output; fixes `message` output (was incorrectly mapped to `change-url`) - When `comment=true`: tries `--comment` flag, falls back gracefully if CLI is older (`unknown flag` detection), and only fetches/posts sticky comment when the GitHub App is not active - Stderr isolation: redirects stderr to temp files (`submit-stderr.log`, `get-stderr.log`) instead of `2>&1` to prevent logrus output from polluting eval'd shell assignments or PR comment content ### Workflows (`.github/workflows/`) - `terraform.yml` and `terraform-meta.yml`: migrate from `fetch-change` to `comment`, add push-event guard, disable Slack plan notifications (GitHub App replaces them) ## Deviations from Approved Plan ### Additions not in the plan 1. **Stderr isolation in action shell logic** (`actions/submit-plan/action.yml`): The plan uses `eval "$(cli ...)"` directly. The implementation captures stdout to a variable with stderr redirected to temp files (`2>./overmindtech/submit-stderr.log`, `2>./overmindtech/get-stderr.log`), then evals the variable. This prevents logrus stderr lines (containing invalid bash identifiers like `change-url`) from breaking `eval`, and prevents log noise from leaking into PR comment content. 2. **Backward compatibility fallback for older CLIs** (`actions/submit-plan/action.yml`): The plan assumes the CLI supports `--comment` and `--wait`. The implementation adds fallback: if the CLI returns "unknown flag" (detected via the stderr temp file), it falls back to the legacy code path and logs a `::notice::`. This enables rolling out the action change before all CLI versions support the new flags. 3. **Push-event guard in workflows** (`.github/workflows/terraform.yml`, `terraform-meta.yml`): The plan removes `fetch-change` without adding an equivalent guard. The implementation passes `comment: ${{ github.event.number != '' }}` instead of unconditional `comment: true`, preventing comment logic from running on push events where there's no PR number. ### Minor approach changes 4. **Sticky comment condition**: The plan checks `inputs.comment != 'false'`. The implementation checks `steps.submit-plan.outputs.message != ''` — more robust since `message` is only populated when the change was actually fetched. 5. **`fetch-change` deprecation mapping**: The plan maps both `true` → `comment: true` and `false` → `comment: false`. The implementation only remaps the `false` case (setting `OVM_COMMENT='false'`), since `comment` already defaults to `"true"`. ### Omissions from the plan 6. **Part 8 — Linear issue for Slack notification feature**: The plan calls for creating a Linear issue titled "Investigate Slack notification feature for change analysis results". This was **not created** and should be filed separately. ## Test Plan - [x] Flag registration tests for `--comment` on `submit-plan` and `start-analysis` - [x] Flag registration test for `--wait` on `get-change` (default `true`) - [ ] Verify `submit-plan` action with `comment: true` on a PR event (GitHub App active path) - [ ] Verify `submit-plan` action with `comment: true` when GitHub App is not installed (sticky comment fallback) - [ ] Verify `submit-plan` action with older CLI that doesn't support `--comment` (graceful fallback) - [ ] Verify `comment: false` skips all PR commenting logic - [ ] Verify `wait: true` blocks until analysis completes and populates `message` output  > [!NOTE] > **Medium Risk** > Changes GitHub Actions and CLI behavior around when to wait for Overmind analysis and where results are posted; misconfiguration could lead to missing plan feedback or altered CI timing. Touches deployment workflows but not Terraform execution logic itself. > > **Overview** > Routes Terraform plan reporting away from Slack and toward PR comments, wiring workflows to pass a new `comment` input to `actions/submit-plan` (and disabling the plan-to-Slack steps). > > Updates the `submit-plan` composite action and Overmind CLI to support `comment`/`wait` controls (deprecating `fetch-change`), including conditional fetching of analysis results, GitHub App vs sticky-comment handling, and new CLI flags/outputs (`--comment`, `get-change --wait`). Also tightens flag handling by checking errors when hiding/deprecating Cobra flags and adds targeted tests for the new flags. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 1690417e01470b73fe9bd371b2eb1f878895d32d. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).  GitOrigin-RevId: a0fb20e395e0f0ffb62e32a3970c48dff980e184

… PR commenting (#4248) ## Summary - New CLI command reference page covering all `overmind changes` subcommands (`submit-plan`, `start-analysis`, `get-change`, `start-change`, `end-change`) - Updated integration docs (Atlantis, GitHub Actions, GitHub App, custom integrations) with multi-plan workflow examples and GitHub App PR commenting capability - Updated `actions/README.md` with inputs/outputs tables and multi-plan CLI examples ## Changes Phase 5 (documentation) of the [Multi-Plan Submission + GitHub App PR Commenting](https://www.notion.so/overmindtech/Project-Plan-Multi-Plan-Submission-GitHub-App-PR-Commenting-320fb60360db8182a2c1dbd74cb5dfc5) project. All docs are customer-facing and follow terminology from `docs/domain-glossary.md`. - **New: `docs.overmind.tech/docs/cli/commands.md`** — Full CLI command reference for the `overmind changes` command group with flag tables, usage examples for single-plan and multi-plan workflows, and deployment lifecycle commands - **`docs.overmind.tech/docs/integrations/atlantis.md`** — Added "Parallel Planning (Multi-Project)" section with `atlantis.yaml` and `repos.yaml` post-workflow hook examples; updated "Waiting for Analysis Results" with GitHub App `--comment` as Option 1 - **`docs.overmind.tech/docs/integrations/github_app.md`** — New "PR Commenting" section covering async behavior, Actions/Atlantis integration, and `pull_requests:write` permissions; updated frontmatter, intro, and requirements - **`docs.overmind.tech/docs/integrations/github_actions.md`** — Expanded "Enhanced with GitHub App" with auto-detection behavior; added "Action Inputs" and "Action Outputs" tables with `fetch-change` deprecation notice - **`docs.overmind.tech/docs/integrations/build_your_own.md`** — Expanded from a 35-line stub to a full guide with single-plan, multi-plan, fetching results, and deployment lifecycle sections - **`actions/README.md`** — Added inputs/outputs tables, updated "Not using GitHub?" with `--comment` and multi-plan CLI examples, added GitHub App auto-detection note ## Deviations from Approved Plan Comparing against [Phase 5 plan](https://github.com/overmindtech/workspace/blob/dev/docs/plans/phase_5_documentation_5d9f3d95.plan.md): - **Part 2 — Atlantis basic setup not updated inline**: The plan calls for adding `--comment` directly to the basic setup YAML block. Instead, `--comment` is introduced as "Option 1: GitHub App (recommended)" in the "Waiting for Analysis Results" subsection. Same information, different structural placement — arguably clearer since it keeps the basic setup simple and presents `--comment` where users are deciding how to get results. - **Part 4 — "Complete Example Workflow" not updated**: The plan asks to add `comment` and `wait` inputs to the example workflow in `github_actions.md`. The existing complete example was left as-is; the new inputs are documented in the "Action Inputs" table and demonstrated in the "Using outputs in subsequent steps" snippet instead. - **Part 7 — Quality checks**: The plan calls for running `markdownlint`, `cspell`, and `lychee` on all changed files. It is not evident from the commit that these were run. Reviewer should verify or request a follow-up pass. All other parts (1, 3, 5, 6) match the approved plan with no material deviations. Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: 6e39e8a8fb83f108365f0c70f33de254d5f66a8b

…… (#4249) …uth docs - Restore inline comments on submit-plan usage snippet in actions/README - Replace pipe-to-stdin examples with file path arguments (submit-plan does not support - for stdin) - Fix CLI commands page auth statement to mention interactive OAuth alongside API key auth  --- > [!NOTE] > **Low Risk** > Documentation-only changes that update examples and wording; no runtime or API behavior is modified. > > **Overview** > Updates docs to match actual `submit-plan` usage: examples now pass JSON plan file paths (and show generating `tfplan.json`) instead of piping to stdin, including in Atlantis and custom integration guides. > > Clarifies authentication guidance by distinguishing CI `OVM_API_KEY` usage from interactive OAuth, and restores/expands inline comments in the GitHub Actions `submit-plan` snippet for input descriptions. > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit f4fcd63e31f759487e7c8bd1fe57301742f20544. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).  Co-authored-by: Cursor Agent <cursoragent@cursor.com> GitOrigin-RevId: 2c6a55541c494a3396bb0c99ead85f4537f518a0

DavidS-ovm and others added 6 commits March 13, 2026 08:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release v0.8.0#46

Release v0.8.0#46
github-actions[bot] wants to merge 6 commits intomainfrom
copybara/v0.8.0

github-actions bot commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

github-actions bot commented Mar 13, 2026

Copybara Sync - Release v0.8.0

What happens when this PR is merged?

Review Checklist

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant