Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Always set ignored_safeties when emergency mode is enabled #1036

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

actgardner
Copy link

We're looking for ways to work Binary Authorization breakglass into the existing deploy workflow. One proposal was to trigger breakglass on an emergency deploy (see https://github.com/Shopify/production-registry/pull/245)

A deploy blocked by Binary Authorization may have a green CI status. For this reason, we need to either:

  • always set ignored_safeties when the Emergency Deploy mode is enabled, even if CI is passing
  • create a new database field and environment variable which is similar to ignored_safeties, but which is always set when Emergency Deploy mode is enabled

This PR takes the first approach and changes the behaviour of the existing field.

@DazWorrall
Copy link
Member

Hmm, I worry this would create false positives in github-certification, @casperisfine wdyt?

@casperisfine
Copy link
Contributor

I worry this would create false positives in github-certification

Yeah, I had the same worry.

I think overall this would be better handled with a boolean deploy variable. I also wonder if that makes sense as an open source feature.

@actgardner
Copy link
Author

I think overall this would be better handled with a boolean deploy variable. I also wonder if that makes sense as an open source feature.

Like this? https://github.com/Shopify/shipit/pull/1037

@casperisfine
Copy link
Contributor

Yes, exactly what I had in mind.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants