Skip to content

break-glass: sweep expired grants from on_call #141

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
lex00 wants to merge 2 commits into from
Closed

break-glass: sweep expired grants from on_call #141

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
882d46c
break-glass sweep: branch from the base, and never swallow a push fai…
lex00 Sep 12, 2026
8401be4
break-glass sweep: drop a stale branch rather than check one out
lex00 Sep 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions access/scripts/break-glass
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,19 @@ EOT
if [ "$do_open" = true ] && [ "$gh_ready" = true ]; then
(
cd "$repo_root" || exit 1
git switch -c "$branch" >/dev/null 2>&1 || git switch "$branch" >/dev/null 2>&1
# Drop any branch of this name left over from an earlier sweep,
# then branch from where we are. Reusing a stale one makes a
# pull request whose diff is the inverse of its title, because
# the base has moved on and the old branch reads as adding back
# the very grant this is retiring. It succeeds and it lies.
#
# Deleted rather than checked out from origin/main on purpose.
# A switch with a start point rewrites every file in the tree,
# including this script while bash is still reading it, and the
# edit below then runs against a file nobody chose.
git branch -q -D "$branch" >/dev/null 2>&1 || true
git switch -q -c "$branch" >/dev/null 2>&1 ||
git switch -q "$branch" >/dev/null 2>&1
local id
for id in $expired_ids; do
if blocks | awk -F'\t' -v id="$id" -v f="$f" '$1 == id && $2 == f { found = 1 } END { exit !found }'; then
Expand All @@ -311,7 +323,15 @@ EOT
git commit -q -m "break-glass: sweep expired grants from $principal" \
-m "The cloud already ended these at their expiry. This removes the artifact." \
-m "<!-- $marker file=$f -->"
git push -q -u origin "$branch"
# Forced, guarded by the prefix, for the same reason reconcile
# forces its own: the branch is this file's one current
# proposal rather than a history.
if ! push_err="$(git push -u --force origin "$branch" 2>&1)"; then
say " FAIL could not push $branch"
printf ' %s\n' "$push_err" | head -3
git switch - >/dev/null 2>&1
exit 1
fi
gh pr create --title "break-glass: sweep expired grants from $principal" \
--body "The cloud already ended these grants at their expiry (layer 1). This PR removes the artifacts (layer 2), and the drift watch stops reporting them once it merges (layer 3).

Expand Down
Loading