Skip to content

acc: stop asserting app job permissions after the first deploy #6961

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
denik merged 3 commits into from
Oct 7, 2026
Merged

acc: stop asserting app job permissions after the first deploy #6961

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9f4c9b7
acc: stop asserting app job permissions after the first deploy
denik Oct 7, 2026
d2e1180
Keep the original explanation of the deploy orders
denik Oct 7, 2026
588cb30
Keep the original comment wording
denik Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion acceptance/bundle/apps/job_permissions/out.after_first_deploy.txt
View file
Open in desktop

This file was deleted.

3 changes: 0 additions & 3 deletions acceptance/bundle/apps/job_permissions/output.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,6 @@ Add the following section to the jobs permissions:



=== After first deploy
>>> has_manage_run

=== After second deploy
>>> [CLI] bundle deploy -qq
Warning: app "my_app" references jobs "my_job" which has permissions set. To prevent permission override after deploying the app, please add the app service principal to the jobs permissions
Expand Down
4 changes: 0 additions & 4 deletions acceptance/bundle/apps/job_permissions/script
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,6 @@ has_manage_run() {
| jq 'any(.access_control_list[].all_permissions[]; .permission_level == "CAN_MANAGE_RUN")'
}

title "After first deploy"
trace has_manage_run > out.after_first_deploy.txt
# This is flaky on direct, because there are (at least) two ways to complete deployment:
# sequence 1:
# job is deployed
Expand All @@ -23,8 +21,6 @@ trace has_manage_run > out.after_first_deploy.txt
# job is deployed
# app is deployed, updates job permissions
# job permissions are deployed
# (It does not appear flaky on TF, maybe there is enough delay in one of the resources)
rm -f out.after_first_deploy.direct.txt

title "After second deploy"
trace $CLI bundle deploy -qq
Expand Down
Loading