opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-16 14:48:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: remove dogfood template provisioning from CI (#29400)

Browse Source 
Removes the remains of the dogfood template provisioning pipeline from
this repository. Template versions for the dogfood deployment are now
pushed from the infrastructure repository, so this repo no longer needs
Coder admin or template API-key secrets.

## Changes

- Delete `dogfood/main.tf`, the `coderd_template` root module used only
by the removed `deploy_template` job
- Refresh comments and a docs reference that pointed at the removed
pipeline

The `deploy_template` job removal itself moved to #29468, where it is
required to keep CI green. This branch predates that, so its diff still
contains the same deletion; merge #29468 first and the overlap resolves
cleanly.

Image builds and publishing (`codercom/oss-dogfood`,
`codercom/oss-dogfood-vscode-coder`) are unchanged.

## Follow-up

These repository secrets and variables become unused and can be
deleted/rotated: `CODER_SESSION_TOKEN`, `CODER_TEMPLATE_NAME`,
`CODER_DOGFOOD_ANTHROPIC_API_KEY`, `CODER_DOGFOOD_OPENAI_API_KEY`, and
the GCP workload identity provider/service account used for the
Terraform state bucket.

---

Generated by Coder Agents on behalf of @jdomeracki-coder.
This commit is contained in:
Jakub Domeracki
2026-09-18 09:19:08 +02:00
committed by GitHub
parent 77479408b4
commit 0ea777a341
6 changed files with 6 additions and 291 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/dogfood.yaml
+1 -82
View File
@@ -17,8 +17,6 @@ on:
# `github.ref == 'refs/heads/main'`. Fork PRs skip the entire
# base+mise-oci pipeline since GITHUB_TOKEN is read-only for
# packages.
# `deploy_template` runs `terraform init` + `validate` only; the
# apply step and SHA/title gathering are gated on main.
#
# Pushes to main: `build_image` retags rolling tags on
# `codercom/oss-dogfood` (`:latest`, `:26.04`) and
@@ -26,10 +24,6 @@ on:
# per-branch tag on each. The image-tooling validation runs as
# above before any push, so a broken image never reaches Docker
# Hub.
# `deploy_template` runs `terraform apply` and creates new
# `coderd_template` versions on dogfood.cdr.dev whose `name` is the
# commit short SHA. Content is unchanged when `dogfood/**` is
# unchanged, so the new versions are cosmetic.
push:
branches:
- main
@@ -226,79 +220,4 @@ jobs:
save: true
push: ${{ github.ref == 'refs/heads/main' }}
tags: "codercom/oss-dogfood-vscode-coder:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood-vscode-coder:latest"
if: matrix.image-version == '26.04'
deploy_template:
needs: build_image
runs-on: ubuntu-latest
permissions:
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
id-token: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up mise tools
uses: ./.github/actions/setup-mise
with:
install-args: "terraform"
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
workload_identity_provider: ${{ vars.GCP_WORKLOAD_ID_PROVIDER }}
service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
- name: Terraform init and validate
run: |
pushd dogfood/
terraform init
terraform validate
popd
pushd dogfood/coder
terraform init
terraform validate
popd
pushd dogfood/coder-envbuilder
terraform init
terraform validate
popd
pushd dogfood/vscode-coder
terraform init
terraform validate
popd
- name: Get short commit SHA
if: github.ref == 'refs/heads/main'
id: vars
run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
- name: Get latest commit title
if: github.ref == 'refs/heads/main'
id: message
run: echo "pr_title=$(git log --format=%s -n 1 ${{ github.sha }})" >> "$GITHUB_OUTPUT"
- name: "Push template"
if: github.ref == 'refs/heads/main'
run: |
cd dogfood
terraform apply -auto-approve
env:
# Consumed by coderd provider
CODER_URL: https://dogfood.cdr.dev
CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
# Template source & details
TF_VAR_CODER_DOGFOOD_ANTHROPIC_API_KEY: ${{ secrets.CODER_DOGFOOD_ANTHROPIC_API_KEY }}
TF_VAR_CODER_DOGFOOD_OPENAI_API_KEY: ${{ secrets.CODER_DOGFOOD_OPENAI_API_KEY }}
TF_VAR_CODER_TEMPLATE_NAME: ${{ secrets.CODER_TEMPLATE_NAME }}
TF_VAR_CODER_TEMPLATE_VERSION: ${{ steps.vars.outputs.sha_short }}
TF_VAR_CODER_TEMPLATE_DIR: ./coder
TF_VAR_CODER_TEMPLATE_MESSAGE: ${{ steps.message.outputs.pr_title }}
TF_LOG: info
if: matrix.image-version == '22.04'
docs/admin/templates/managing-templates/change-management.md
+1 -1
View File
@@ -59,7 +59,7 @@ resource "coderd_template" "kubernetes" {
}
```
For an example, see how we push our development image and template
For an example, see how we push our development image
[with GitHub actions](../../../../.github/workflows/dogfood.yaml).
## Coder CLI
dogfood/coder-envbuilder/main.tf
+1 -1
View File
@@ -16,7 +16,7 @@ terraform {
locals {
// These are cluster service addresses mapped to Tailscale nodes.
// Ask #dogfood-admins for help.
// NOTE: keep these up to date with those in ../dogfood/main.tf!
// NOTE: keep these up to date with those in ../coder/main.tf!
docker_host = {
"" = "tcp://rubinsky-pit-cdr-dev.tailscale.svc.cluster.local:2375"
"us-pittsburgh" = "tcp://rubinsky-pit-cdr-dev.tailscale.svc.cluster.local:2375"
dogfood/coder/main.tf
+1 -2
View File
@@ -199,8 +199,7 @@ data "coder_parameter" "enable_kvm" {
mutable = true
}
# dogfood/main.tf injects this value from a GH Actions secret;
# `coderd_template.dogfood` passes the value injected by .github/workflows/dogfood.yaml in `TF_VAR_CODER_DOGFOOD_ANTHROPIC_API_KEY` and `TF_VAR_CODER_DOGFOOD_OPENAI_API_KEY`.
# Injected by the pipeline that pushes this template.
# Currently unused since AI Gateway is always enabled, but kept for emergency fallback.
variable "anthropic_api_key" {
type = string
dogfood/main.tf
-203
View File
@@ -1,203 +0,0 @@
terraform {
required_providers {
coderd = {
source = "coder/coderd"
version = ">= 0.0.13"
}
}
backend "gcs" {
bucket = "coder-dogfood-tf-state"
}
}
import {
to = coderd_template.envbuilder_dogfood
id = "e75f1212-834c-4183-8bed-d6817cac60a5"
}
import {
to = coderd_template.vscode_coder
id = "2d5caceb-c6a3-4c46-a81d-005d92b83ffd"
}
data "coderd_organization" "default" {
is_default = true
}
data "coderd_user" "machine" {
username = "machine"
}
variable "CODER_TEMPLATE_NAME" {
type = string
}
variable "CODER_TEMPLATE_VERSION" {
type = string
}
variable "CODER_TEMPLATE_DIR" {
type = string
}
variable "CODER_TEMPLATE_MESSAGE" {
type = string
}
variable "CODER_DOGFOOD_ANTHROPIC_API_KEY" {
type = string
description = "The API key that workspaces will use to authenticate with the Anthropic API."
default = ""
sensitive = true
}
variable "CODER_DOGFOOD_OPENAI_API_KEY" {
type = string
description = "The API key that workspaces will use to authenticate with the OpenAI API."
default = ""
sensitive = true
}
resource "coderd_template" "dogfood" {
name = var.CODER_TEMPLATE_NAME
display_name = "Write Coder on Coder"
description = "The template to use when developing Coder on Coder!"
icon = "/emojis/1f3c5.png"
organization_id = data.coderd_organization.default.id
versions = [
{
name = var.CODER_TEMPLATE_VERSION
message = var.CODER_TEMPLATE_MESSAGE
directory = var.CODER_TEMPLATE_DIR
active = true
tf_vars = [
{
name = "anthropic_api_key"
value = var.CODER_DOGFOOD_ANTHROPIC_API_KEY
},
{
name = "openai_api_key"
value = var.CODER_DOGFOOD_OPENAI_API_KEY
}
]
}
]
acl = {
groups = [{
id = data.coderd_organization.default.id
role = "use"
}]
users = [{
id = data.coderd_user.machine.id
role = "admin"
}]
}
activity_bump_ms = 10800000
allow_user_auto_start = true
allow_user_auto_stop = true
allow_user_cancel_workspace_jobs = false
auto_start_permitted_days_of_week = ["friday", "monday", "saturday", "sunday", "thursday", "tuesday", "wednesday"]
auto_stop_requirement = {
days_of_week = ["sunday"]
weeks = 1
}
default_ttl_ms = 28800000
deprecation_message = null
failure_ttl_ms = 604800000
require_active_version = true
time_til_dormant_autodelete_ms = 2592000000 # 30 days
time_til_dormant_ms = 2592000000 # 30 days
}
resource "coderd_template" "vscode_coder" {
name = "vscode-coder"
display_name = "Write Coder VS Code Extension on Coder"
description = "Develop the coder/vscode-coder VS Code extension on Coder."
icon = "/icon/code.svg"
organization_id = data.coderd_organization.default.id
versions = [
{
name = var.CODER_TEMPLATE_VERSION
message = var.CODER_TEMPLATE_MESSAGE
directory = "./vscode-coder"
active = true
tf_vars = [
{
name = "anthropic_api_key"
value = var.CODER_DOGFOOD_ANTHROPIC_API_KEY
}
]
}
]
acl = {
groups = [{
id = data.coderd_organization.default.id
role = "use"
}]
users = [{
id = data.coderd_user.machine.id
role = "admin"
}]
}
activity_bump_ms = 10800000
allow_user_auto_start = true
allow_user_auto_stop = true
allow_user_cancel_workspace_jobs = false
auto_start_permitted_days_of_week = ["friday", "monday", "saturday", "sunday", "thursday", "tuesday", "wednesday"]
auto_stop_requirement = {
days_of_week = ["sunday"]
weeks = 1
}
default_ttl_ms = 28800000
deprecation_message = null
failure_ttl_ms = 604800000
require_active_version = true
time_til_dormant_autodelete_ms = 2592000000 # 30 days
time_til_dormant_ms = 2592000000 # 30 days
}
resource "coderd_template" "envbuilder_dogfood" {
name = "coder-envbuilder"
display_name = "Write Coder on Coder using Envbuilder"
description = "Write Coder on Coder using a workspace built by Envbuilder."
icon = "/emojis/1f3d7.png" # 🏗️
organization_id = data.coderd_organization.default.id
versions = [
{
name = var.CODER_TEMPLATE_VERSION
message = var.CODER_TEMPLATE_MESSAGE
directory = "./coder-envbuilder"
active = true
tf_vars = [{
# clusters/dogfood-v2/coder/provisioner/configs/values.yaml#L191-L194
name = "envbuilder_cache_dockerconfigjson_path"
value = "/home/coder/envbuilder-cache-dockerconfig.json"
}]
}
]
acl = {
groups = [{
id = data.coderd_organization.default.id
role = "use"
}]
users = [{
id = data.coderd_user.machine.id
role = "admin"
}]
}
activity_bump_ms = 10800000
allow_user_auto_start = true
allow_user_auto_stop = true
allow_user_cancel_workspace_jobs = false
auto_start_permitted_days_of_week = ["friday", "monday", "saturday", "sunday", "thursday", "tuesday", "wednesday"]
auto_stop_requirement = {
days_of_week = ["sunday"]
weeks = 1
}
default_ttl_ms = 28800000
deprecation_message = null
failure_ttl_ms = 604800000
require_active_version = true
time_til_dormant_autodelete_ms = 2592000000 # 30 days
time_til_dormant_ms = 2592000000 # 30 days
}
dogfood/vscode-coder/main.tf
+2 -2
View File
@@ -123,8 +123,8 @@ data "coder_parameter" "use_ai_gateway" {
mutable = true
}
# Fallback when AI Gateway is disabled. Injected by dogfood/main.tf
# from the CODER_DOGFOOD_ANTHROPIC_API_KEY secret.
# Fallback when AI Gateway is disabled. Injected by the pipeline that
# pushes this template.
variable "anthropic_api_key" {
type = string
description = "Anthropic API key, used when AI Gateway is disabled."