tegwick
ac21accd7a
The API validates repo classification against the-custodian canon allowed values. A container has no such checkout, so every classification write failed with a 500 and classification could only ever be written from a workstation. Mounts the vocabulary as a ConfigMap and points REPO_CLASSIFICATION_ALLOWED_PATH at it. The copy is the risk, so it is owned rather than trusted: scripts/sync_classification_allowed.py regenerates it from canon and --check fails on drift. make check-classification-allowed and make railiance-state-hub-render both refuse to proceed when the copy diverges, so a release cannot silently validate against a stale vocabulary. The container volumeMounts and env blocks are merged rather than appended — a second pair would have produced duplicate YAML keys as soon as sweep was re-enabled. Refs CUST-WP-0067-T09 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
12 lines
483 B
YAML
12 lines
483 B
YAML
{{- if .Values.classificationAllowed.enabled }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Values.classificationAllowed.name | quote }}
|
|
labels: {{- include "statehub.labels" . | nindent 4 }}
|
|
data:
|
|
# Generated copy of the-custodian canon allowed-values. Kept in sync by
|
|
# scripts/sync_classification_allowed.py; `--check` fails the release on drift.
|
|
repo-classification.allowed.yaml: |
|
|
{{ .Files.Get "files/repo-classification.allowed.yaml" | indent 4 }}
|
|
{{- end }}
|