Repository navigation
fix(cloud): stop passing manage_artifact_dns to the relay root - #18442
Conversation
The relay root does not declare it (it belongs to the private apps root), and Terraform rejects an undeclared -var, so the first public Deploy Relay Staging run failed at the C4 image bind.
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
ℹ️ No critical issues — the flag removal is correct and complete across the workflows; one doc follow-up below.
Reviewed changes
manage_artifact_dnsflag dropped from relay workflows — removed-var manage_artifact_dns=falsefrom 20terraformcall sites across six relay workflows (cloud-deploy-relay-asia-topology,cloud-deploy-relay-production-capacity-job,cloud-deploy-relay-production-same-cap-job,cloud-deploy-relay-staging,cloud-prove-relay-staging-capacity,cloud-recover-relay-staging-c4-image), covering staging, production capacity, production same-cap, and Asia topology.- Tests now assert absence — three workflow contract tests swapped their occurrence-count assertions (
assert.equal(workflow.match(/manage_artifact_dns=false/g)?.length, N)) forassert.doesNotMatch(workflow, /manage_artifact_dns/); the staging refresh test additionally pins the surviving-var-file+-lock-timeout=5mline.
ℹ️ cloud/docs/relay-workflows.md still instructs operators to pass the removed flag
The fix updates the six workflows and the infra/terraform/README.md (already asserted clean), but four references remain in cloud/docs/relay-workflows.md that now describe the exact failure this PR removes: passing -var manage_artifact_dns=false against the relay root — which no longer declares that variable — makes Terraform exit 4.
Technical details
# Stale `manage_artifact_dns` documentation
## Affected sites
- cloud/docs/relay-workflows.md:120 — "`manage_artifact_dns=false` keeps the unimported Cloudflare records out"
- cloud/docs/relay-workflows.md:128 — production capacity identity bootstrap `terraform plan` still passes `-var manage_artifact_dns=false`
- cloud/docs/relay-workflows.md:153 — "Deploy Relay Asia Topology … It always passes `manage_artifact_dns=false`" (now contradicted by this PR)
- cloud/docs/relay-workflows.md:185 — staging-state apply "with `manage_artifact_dns=false`"
## Required outcome
- Remove or correct every `manage_artifact_dns` reference in `cloud/docs/relay-workflows.md` so no operator procedure tells a reader to pass a variable the relay root no longer declares.DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (9)
💤 Files with no reviewable changes (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughTerraform console and plan commands no longer pass Merge Risk: ⚪ Minimal · up to Relay deployment, capacity, topology, and recovery workflows no longer pass an undeclared artifact-DNS variable that caused Terraform failures, while retaining their existing environment and recovery arguments. No current merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the failure, the scope of the change, and the test results. However, it omits the required template sections, including the linked issue, visual proof or N/A statement, checklist, review notes, and AI disclosure. Resolution Use the repository template sections. Add a valid Linked Issue entry, provide Visual Proof or write N/A with a reason, complete the Testing and checklist items, address Review, Agent skill upstream boundary, Notes, and AI Disclosure as applicable. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3 files. (4 skipped: 4 unsupported.)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…yai#18442) The relay root does not declare it (it belongs to the private apps root), and Terraform rejects an undeclared -var, so the first public Deploy Relay Staging run failed at the C4 image bind.
First public
cloud-deploy-relay-stagingrun (33748078128) authenticated on the new identity and then failed at the C4 image bind:manage_artifact_dnsis not declared by the relay root (it lives in the private apps root) and Terraform rejects an undeclared-varwith exit 4. Drops the flag from 20 call sites in 6 workflows; the three tests that pinned it now assert its absence. Mirrors orca-cloud's same change.cd cloud && pnpm test: 148 + 495 pass.