Skip to content

chore: remove deploy config#24

Open
JoshTheWanderer wants to merge 1 commit into
mainfrom
chore/split-deploy-config
Open

chore: remove deploy config#24
JoshTheWanderer wants to merge 1 commit into
mainfrom
chore/split-deploy-config

Conversation

@JoshTheWanderer

@JoshTheWanderer JoshTheWanderer commented Jul 17, 2026

Copy link
Copy Markdown
Member

Removes deployment from this repository

Deployment config now lives in the private etchteam/deploys repo
(firepit/ subfolder). This public repo only builds and publishes the
image to GHCR; it holds no deploy credentials. The deploys repo polls
GHCR for a new :main image and deploys it.

- Remove deploy.yml workflow and config/deploy.yml (moved to deploys)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@JoshTheWanderer
JoshTheWanderer force-pushed the chore/split-deploy-config branch from e3c819f to 5b68d37 Compare July 17, 2026 11:04
@JoshTheWanderer JoshTheWanderer changed the title chore: move deploy config to private deploys repo chore: remove deploy config (moved to private deploys repo) Jul 17, 2026
@sonarqubecloud

Copy link
Copy Markdown

@JoshTheWanderer JoshTheWanderer changed the title chore: remove deploy config (moved to private deploys repo) chore: remove deploy config Jul 17, 2026
@DanWebb

DanWebb commented Jul 22, 2026

Copy link
Copy Markdown
Member

Root cause
The failing step in the CI job is:

Workflow: scan job in .github/workflows/ci.yml
Step: run: bin/brakeman at .github/workflows/ci.yml:23-24
The log shows:

Brakeman 8.0.4 is not the latest version 8.0.5
Process completed with exit code 5
Your lockfile currently pins:

brakeman (7.1.2) in Gemfile.lock
So the executable being run is enforcing an up-to-date Brakeman install, and the CI environment ends up failing because the installed version is behind the latest release.

Solution
Update the Brakeman gem and commit the refreshed lockfile.

Recommended change
In your Gemfile, pin or bump Brakeman to the current release, for example:

Ruby
gem "brakeman", "~> 8.0", require: false
Then update the lockfile:

bash
bundle update brakeman
That should move Gemfile.lock from:

Diff

  • brakeman (7.1.2)
  • brakeman (8.0.5)
    Why this is the right fix
    The workflow itself is fine:

YAML

  • name: Scan for security vulnerabilities
    run: bin/brakeman
    The failure is specifically version-related, so the clean fix is to align the project dependency with the version Brakeman expects.

If you want CI to stop failing on version drift
If the project does not want scans to fail purely because a newer Brakeman patch release exists, you can change the scan command to avoid the strict “latest version” check. For example, replace the script invocation with an explicit bundle execution that uses the locked gem version:

YAML

  • name: Scan for security vulnerabilities
    run: bundle exec brakeman
    That makes CI use the version in Gemfile.lock consistently.

Best practical fix
Use both of these together:

Update Brakeman in the bundle
Run it in CI with bundle exec
Suggested workflow change in .github/workflows/ci.yml:

Diff

  •  - name: Scan for security vulnerabilities
    
  •    run: bin/brakeman
    
  •  - name: Scan for security vulnerabilities
    
  •    run: bundle exec brakeman
    

And refresh Gemfile.lock so it includes Brakeman 8.0.5.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants