Emit worker runtime output artifacts#138
Merged
3 commits merged intoJun 18, 2026
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the worker image/runtime to (a) emit opt-in “runtime output” JSON artifacts/log lines with configured secret values omitted, and (b) simplify runtime configuration by removing built-in provider auth/login behavior and associated docs/examples. It also reorganizes container tests into a top-level test/ directory and adds CI automation for dependency pin upgrades.
Changes:
- Add opt-in runtime output emission (
WORKER_OUTPUT_FILE/WORKER_OUTPUT_LOG) with redaction of configured secret env names and secret-reference env names. - Refactor environment/config application flow to re-apply config+secret resolution via
worker env reload/worker config apply, removing auth/login/cleanup modules and docs. - Restructure tests/docs/examples and extend CI workflows (runtime-output artifact publication; Docker dependency updater workflow + prompts).
Reviewed changes
Copilot reviewed 66 out of 68 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
test/test_helpers.sh |
Adds shared test output helpers (colors/symbols + print helpers). |
test/modules/60_health.sh |
Updates helper path for new test/ location. |
test/modules/50_sbom.sh |
Updates helper path for new test/ location. |
test/modules/40_service.sh |
Updates helper path for new test/ location. |
test/modules/25_runtime_output.sh |
Adds tests validating runtime output redaction + structured log marker. |
test/modules/20_env.sh |
Updates helper path and adds worker env reload test coverage. |
test/modules/10_config.sh |
Updates helper path and adds worker config apply test coverage. |
test/main.sh |
Updates test root path to /home/udx/test. |
src/tests/modules/30_auth.sh |
Removes auth CLI test module (auth functionality removed). |
src/examples/simple-service/README.md |
Updates docs link to new services doc location. |
src/examples/README.md |
Removes deploy-image-override example section reference. |
src/examples/deploy-image-override/README.md |
Removes deploy-image-override example README. |
src/examples/deploy-image-override/deploy.template.yml |
Removes deploy-image-override template. |
src/configs/worker.yaml |
Adds built-in default worker runtime config (runtime output env defaults). |
src/configs/services.yaml |
Adds built-in default empty services config. |
README.md |
Rewrites top-level positioning, quickstart, and docs links to match new model (no built-in auth). |
Makefile |
Updates make test mounts/paths to use test/ instead of src/tests/. |
lib/worker_config.sh |
Simplifies config selection (user config preferred; else built-in), removes merge behavior. |
lib/secrets.sh |
Updates internal var skip list and continues env-var secret-ref resolution. |
lib/runtime_output.sh |
Implements runtime output JSON build + file/log emission with redaction. |
lib/process_manager.sh |
Adds built-in services config fallback + dependency checks + enabled-service detection. |
lib/environment.sh |
Removes legacy environment orchestration script (logic moved/centralized). |
lib/env_handler.sh |
Adds env file management helpers and central configure_environment path (config + secrets + reload). |
lib/cli/service.sh |
Adds built-in services config fallback and worker service init. |
lib/cli/env.sh |
Updates env show behavior (masking by config) and routes reload/apply through configure_environment. |
lib/cli/config.sh |
Updates “active config” reporting and makes config apply call configure_environment. |
lib/cli/auth.sh |
Removes auth CLI (auth model removed). |
lib/cli.sh |
Updates CLI help example away from removed auth command. |
lib/cleanup.sh |
Removes provider auth cleanup logic (auth model removed). |
lib/auth/gcp.sh |
Removes legacy GCP auth module (auth model removed). |
lib/auth/azure.sh |
Removes legacy Azure auth module (auth model removed). |
lib/auth/aws.sh |
Removes legacy AWS auth module (auth model removed). |
lib/auth.sh |
Removes legacy auth orchestrator (auth model removed). |
etc/configs/worker/default.yaml |
Removes old built-in config that defined actors/creds. |
docs/services.md |
Updates services doc wording/links to new doc layout. |
docs/secrets.md |
Adds new secrets doc describing secret references + external auth boundary. |
docs/runtime/config.md |
Removes old runtime config doc (replaced by new layout). |
docs/references/README.md |
Adds references index for stable lookup docs. |
docs/references/container-structure.md |
Updates links to new doc locations. |
docs/references/cloud-providers-auth.md |
Adds guidance matrix for provider auth being external to worker. |
docs/index.md |
Removes old docs index (replaced by new doc structure). |
docs/development.md |
Updates links/terminology for new doc layout. |
docs/deployment.md |
Adds consolidated deployment doc (Docker/K8s/CI positioning). |
docs/deploy/worker-deployment.md |
Removes worker-deployment CLI doc (de-emphasized/removed). |
docs/deploy/README.md |
Removes old deploy docs index (replaced by docs/deployment.md). |
docs/deploy/kubernetes.md |
Removes old Kubernetes deploy doc (folded into new deployment guidance). |
docs/deploy/image-override.md |
Removes old image override doc (example removed). |
docs/core-image.md |
Updates test path references to new test/ structure. |
docs/config.md |
Adds consolidated worker config doc including runtime output section. |
docs/cli.md |
Updates CLI doc to match current command set and reload/apply behavior. |
docs/child-images.md |
Updates child image guidance away from removed generator/deploy.yml model. |
docs/authorization.md |
Removes old authorization doc (auth model removed). |
docs/auth/README.md |
Removes auth docs index (auth model removed). |
docs/auth/gcp.md |
Removes detailed GCP auth doc (auth model removed). |
docs/auth/azure.md |
Removes Azure auth placeholder doc. |
docs/auth/aws.md |
Removes AWS auth placeholder doc. |
Dockerfile |
Updates dependency pins, tightens env file permissions, and copies built-in configs from src/configs/. |
deploy.yml |
Removes old deploy.yml example (worker-deployment model removed). |
deploy-gcp.yml |
Removes old deploy-gcp.yml example (worker-deployment model removed). |
ci/prompts/docker-dependency-output.md |
Adds output template for dependency updater workflow. |
ci/prompts/docker-dependency-nonapt.md |
Adds non-apt dependency update rules for Copilot-driven updates. |
ci/prompts/docker-dependency-guardrails.md |
Adds guardrails for automated Dockerfile-only dependency updates. |
ci/prompts/docker-dependency-apt.md |
Adds apt pin update rules keyed off probe report JSON. |
bin/entrypoint.sh |
Switches entrypoint to configure_environment + runtime output emission before starting process manager. |
.rabbit/context.yaml |
Adds generated repo context manifest (dev.kit). |
.github/workflows/docker-ops.yml |
Adds runtime-output follow-up job emitting artifact + step summary. |
.github/workflows/docker-dependency-updater.yml |
Adds scheduled/dispatchable Docker dependency upgrade workflow using Copilot CLI + no-pin apt probe. |
.dockerignore |
Tightens build context (exclude docs/tests/etc; include src/configs). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+87
to
90
| local value | ||
| value=$(format_env_value_for_output "$name" "$include_secrets") | ||
| json=$(echo "$json" | jq --arg key "$name" --arg value "$value" '. + {($key): $value}') | ||
| fi |
Comment on lines
+97
to
+99
| if [[ -n "$name" && ( -z "$filter" || "$name" == $filter ) ]]; then | ||
| printf '%s=%s\n' "$name" "$(format_env_value_for_output "$name" "$include_secrets")" | ||
| fi |
fqjony
force-pushed
the
cleanup-worker-runtime-docs
branch
from
bca1614 to
527a546
Compare
fqjony
force-pushed
the
cleanup-worker-runtime-docs
branch
from
527a546 to
33d9bf2
Compare
Comment on lines
+42
to
+45
| if echo "$RUNTIME_OUTPUT" | jq -e '.env.CONFIG_SECRET or .env.CONFIG_REF' >/dev/null; then | ||
| print_error "runtime output leaked a redacted env value" | ||
| exit 1 | ||
| fi |
Comment on lines
+59
to
+60
| names=$(grep "^export " "$WORKER_ENV_FILE" | cut -d'=' -f1 | cut -d' ' -f2) | ||
| json="{}" |
Comment on lines
+82
to
+83
| names=$(grep "^export " "$WORKER_ENV_FILE" | cut -d'=' -f1 | cut -d' ' -f2) | ||
| json="[]" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Notes