From b571a34d34d5d0e21080eabf680ef5132401c00f Mon Sep 17 00:00:00 2001 From: Simon van Lierde Date: Mon, 7 Sep 2026 04:23:50 +0000 Subject: [PATCH 1/4] build(deps): bump the hub, spoke, and demo images - grafana 13.1.4 -> 13.2.1, prometheus v3.13.2 -> v3.14.0, otel-collector-contrib 0.156.0 -> 0.160.0 (hub) - alloy v1.18.1 -> v1.19.2 (spoke) - curl 8.21.0 -> 8.22.0 (demo) --- compose.demo.yml | 2 +- compose.yml | 6 +++--- templates/compose.telemetry.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/compose.demo.yml b/compose.demo.yml index 2ce0fd9..390a020 100644 --- a/compose.demo.yml +++ b/compose.demo.yml @@ -31,7 +31,7 @@ services: logging: *demo-logging demo-load: - image: curlimages/curl:8.21.0@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13 + image: curlimages/curl:8.22.0@sha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777 restart: on-failure depends_on: [demo-api] command: diff --git a/compose.yml b/compose.yml index f9a1cff..2ddf38f 100644 --- a/compose.yml +++ b/compose.yml @@ -58,7 +58,7 @@ services: logging: *default-logging otel-collector: - image: otel/opentelemetry-collector-contrib:0.156.0@sha256:125bdbeb7590cc1952c5b3430ecf14063568980c2c93d5b38676cc0446ed8108 + image: otel/opentelemetry-collector-contrib:0.160.0@sha256:799dc6cf12c96192af37b5bdba804da8c10b3bc563b43cb90c3f3c58d9572ad6 restart: unless-stopped depends_on: otel-queue-init: @@ -111,7 +111,7 @@ services: networks: [backend] prometheus: - image: prom/prometheus:v3.13.2@sha256:508729e0e2d18e11fd742a5a5ca70e557b940a93948c3c95fd0123a6fd538b69 + image: prom/prometheus:v3.14.0@sha256:5ce7540c3c00ef4ab0c9d2c995c6a5b9c421f44b4a115d97a2c7af3b1c21cbb0 restart: unless-stopped volumes: - ./config/prometheus.yaml:/etc/prometheus/prometheus.yaml:ro @@ -163,7 +163,7 @@ services: networks: [backend] grafana: - image: grafana/grafana:13.1.4@sha256:9be3a3ccdb06bcbb127f888b0c4c1d151837443e478887897a63a27d7b348043 + image: grafana/grafana:13.2.1@sha256:f772d434e8fab0049deb2b1b30abd43342bcfca1537614aa8d36080232cf4283 restart: unless-stopped depends_on: loki: diff --git a/templates/compose.telemetry.yml b/templates/compose.telemetry.yml index 003d408..4d3dc65 100644 --- a/templates/compose.telemetry.yml +++ b/templates/compose.telemetry.yml @@ -38,7 +38,7 @@ services: logging: *default-logging alloy: - image: grafana/alloy:v1.18.1@sha256:0f4434c92b3e6cdac38bb129b344e1790c246f7b6e2eaffcc16a5fa363240e33 + image: grafana/alloy:v1.19.2@sha256:b8ec653c44235fbe910879145dac3597d66b0aaecf60bcbbe82580767771a839 restart: unless-stopped # Root to read root-only files under the host mounts below. The Docker API is # behind the proxy, so root here does not imply control of the daemon. From 8cfa1423e67e344b4274341526abf1043a211835 Mon Sep 17 00:00:00 2001 From: Simon van Lierde Date: Mon, 7 Sep 2026 04:31:18 +0000 Subject: [PATCH 2/4] ci(release): cut the github release from a pushed tag - the tag's CHANGELOG.md section is the body; no section fails the run - just check runs first, since bootstrap.sh vendors templates from the tag --- .github/workflows/release.yml | 40 +++++++++++++++++++++++++++++++++++ CHANGELOG.md | 8 +++++++ 2 files changed, 48 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..5e588cb --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,40 @@ +# A tag is the deployable unit: bootstrap.sh pins every spoke's vendored +# templates to the latest one. So a tag must carry release notes and pass the +# same checks as a PR before it becomes a release. +# +# To release: add a `## [x.y.z] - date` section to CHANGELOG.md, merge, then +# git tag vx.y.z && git push origin vx.y.z +name: Release + +on: + push: + tags: ["v*"] + +permissions: + contents: write + +jobs: + release: + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # gitleaks scans git history; a shallow clone would pass vacuously. + with: + fetch-depth: 0 + - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0 + # The tag's section of CHANGELOG.md is the release body. No section, no + # release: the tag stays, so fix the changelog on main and re-tag. + - name: Extract release notes + run: | + v="${GITHUB_REF_NAME#v}" + awk -v v="$v" '/^## \[/{p=($0 ~ "^## \\[" v "\\]")} p' CHANGELOG.md \ + | tail -n +2 > notes.md + grep -q '[^[:space:]]' notes.md \ + || { echo "error: CHANGELOG.md has no '## [$v]' section" >&2; exit 1; } + # 600, or the exposure guards refuse it as world-readable. + - run: install -m 600 .env.example .env + - run: just check + - run: gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --notes-file notes.md + env: + GH_TOKEN: ${{ github.token }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 0019082..927d7e4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,14 @@ Notable changes to this stack. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [SemVer](https://semver.org/). +## [Unreleased] + +### Added + +- Pushing a `v*` tag now cuts the GitHub release. The workflow takes the + tag's section of this file as the body and refuses a tag without one, or + one that fails `just check`. + ## [0.3.1] - 2026-09-07 ### Fixed From 0a653ff456afd837c199ff566a304d0d344ed566 Mon Sep 17 00:00:00 2001 From: Simon van Lierde Date: Mon, 7 Sep 2026 04:33:31 +0000 Subject: [PATCH 3/4] ci(dependabot): group terraform, catch action advisories - one PR for all /infra provider bumps, not one per provider - `actions-security` so advisories on actions land in one PR too --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c0f21d6..18143d2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -48,6 +48,9 @@ updates: directory: "/infra" schedule: interval: "monthly" + groups: + infra: + patterns: ["*"] - package-ecosystem: "github-actions" directory: "/" @@ -56,3 +59,7 @@ updates: groups: actions: patterns: ["*"] + # As with pip above, advisories ignore the version-update group. + actions-security: + applies-to: security-updates + patterns: ["*"] From de643d9e02cdd7121c012aea779bcc8df2400c71 Mon Sep 17 00:00:00 2001 From: Simon van Lierde Date: Mon, 7 Sep 2026 04:37:32 +0000 Subject: [PATCH 4/4] docs(changelog): fold the release workflow and image bumps into 0.3.1 --- CHANGELOG.md | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 927d7e4..a923e2a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,15 +4,29 @@ Notable changes to this stack. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [SemVer](https://semver.org/). -## [Unreleased] +## [0.3.1] - 2026-09-07 + +### Upgrade + +- Re-vendor `compose.telemetry.yml` on each spoke at `v0.3.1` for Alloy + v1.19.2. ### Added -- Pushing a `v*` tag now cuts the GitHub release. The workflow takes the - tag's section of this file as the body and refuses a tag without one, or - one that fails `just check`. +- Pushing a `v*` tag cuts the GitHub release. The workflow takes the tag's + section of this file as the body and refuses a tag without one, or one that + fails `just check`. -## [0.3.1] - 2026-09-07 +### Changed + +- **`PrometheusCardinalityHigh` fires at 30k active series, not 100k.** 100k + would have put Prometheus near its 2g `mem_limit` before the warning + arrived; 30k is ~18 spokes of room. +- **New `PrometheusCardinalitySpike`**, on 5,000 new series in 30 minutes: a + label that explodes, which a ceiling cannot catch. One spoke onboarding adds + ~1,400. +- Hub images: Grafana 13.2.1, Prometheus v3.14.0, otel-collector-contrib + 0.160.0. Dependabot groups the `/infra` provider bumps and action advisories. ### Fixed @@ -31,15 +45,6 @@ Notable changes to this stack. Format follows - `ProjectsUncovered` no longer fires for `demo/demo`, the pair `just demo` sets. A real project named `demo` is still caught. -### Changed - -- **`PrometheusCardinalityHigh` fires at 30k active series, not 100k.** 100k - would have put Prometheus near its 2g `mem_limit` before the warning - arrived; 30k is ~18 spokes of room. -- **New `PrometheusCardinalitySpike`**, on 5,000 new series in 30 minutes: a - label that explodes, which a ceiling cannot catch. One spoke onboarding adds - ~1,400. - ## [0.3.0] - 2026-09-06 The hub runs the department's telemetry in production, with one spoke on the