feat(sms-bridge): add PII-safe lifecycle telemetry - #32
Merged
Conversation
Image CI passedPre-commit validation passed. View the workflow run. |
15 tasks
xnoto
added a commit
to makeitworkcloud/kustomize-cluster
that referenced
this pull request
Sep 5, 2026
## Summary Selects the published PII-safe SMS bridge telemetry image `fe2c1cb435ca5f2f2c657f7b73a5d15c1ba95070` in the existing `opencode-sms-bridge` Application. Fixes # None — owner-approved deployment of the published telemetry image. ## Type of change - [ ] Bug fix - [x] Feature / enhancement - [ ] Documentation - [ ] Infrastructure (OpenTofu root or module) - [x] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets) - [ ] Container image - [ ] CI / reusable workflow - [ ] Refactor / cleanup - [ ] Breaking change ## Validation - [x] Required pull-request checks pass — [`test` run 33942414686](https://github.com/makeitworkcloud/kustomize-cluster/actions/runs/33942414686) passed repository pre-commit validation. - [x] Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed. - [x] Diff manually verified: exactly one immutable image-tag replacement in the existing Application; chart version, route, Secret references, sender allowlist, and number-to-agent routing are unchanged. No local Kubernetes, Kustomize, SOPS, OpenTofu, or image operation was run or claimed. CI is the validation authority. ## Impact and rollout **Producer:** [`images` PR #32](makeitworkcloud/images#32) is merged at [`fe2c1cb4`](makeitworkcloud/images@fe2c1cb), and its successful [`main buildah run 33942142243`](https://github.com/makeitworkcloud/images/actions/runs/33942142243) published the exact immutable image selected here. **Consumer:** `workloads/apps/opencode-sms-bridge-app.yaml` changes the Helm image tag only. The current bridge chart `0.1.2`, `opencode` namespace, Service, PVC, TunnelBinding, encrypted Secrets, sender allowlist, fixed agent mapping, and Twilio webhook configuration are unchanged. **Authorized delivery path:** after merge, `main` test must pass; then the repository sync workflow requests reconciliation of `gitops-workloads` at the tested Git revision. The workload root must update this child Application, and the child automated policy must reconcile the selected image. Verify root/child revisions, sync, health, resource tree, Deployment rollout, and both container statuses before repeating the authorized SMS test. This PR itself does not prove any of those stages. **Rollback:** select the previous known-good immutable image tag `8fbb926ea958fff53edff11238891ac84c4da305` through a reviewed GitOps change; never retag published images or patch the live Deployment. ## Safety and secrets - [x] Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints. - [x] No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks. - [x] Breaking or irreversible effects are described above with rollback notes. GitHub Advanced Security secret scanning is unavailable for this repository; the one-line diff was manually reviewed. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the exact immutable image tag and retained ownership boundaries before merging.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds concise, structured lifecycle logs for the SMS bridge without logging phone numbers, message SIDs, message bodies, media URLs, sender hashes, session IDs, credentials, or provider exception details. The change makes it possible to distinguish ingress rejection/ignore/queue/duplicate outcomes and worker claim/process/send outcomes from container logs.
Fixes #
None — owner-requested observability improvement after initial SMS functional-test triage.
Type of change
Validation
buildahrun 33941998353 passed checks, image detection, and the non-publishing bridge image build.No local tests, container builds, OpenTofu, SOPS, state, or live-system operation were run or claimed. CI is the validation authority.
Impact and rollout
Producer changed:
makeitworkcloud/images/opencode-sms-bridgeis the canonical bridge-image source. A merge publishes a new immutable GHCR image tag; the current workload remains pinned to8fbb926ea958fff53edff11238891ac84c4da305until a separate reviewedkustomize-clusterconsumer PR selects the published tag.Runtime behavior: the current bridge continues to suppress Uvicorn access logs. New application events contain only a fixed channel, media count, bounded reason, and processing stage. The queue/state schema, request handling semantics, Twilio credentials, SOPS ciphertext, routing mapping, sender allowlist, chart, Service, TunnelBinding, and OpenCode integration are unchanged.
Delivery stages: this PR authors and validates image-source changes only. Image publication is automatic after an approved merge; GitOps selection, Argo reconciliation, health, and an SMS functional test remain separate and unverified. Do not merge or publish without explicit owner confirmation. If selected later, roll back by selecting the prior immutable image tag through the canonical GitOps workflow; never overwrite an existing image tag.
Safety and secrets
GitHub Advanced Security secret scanning is unavailable for this repository; the complete three-file diff was manually reviewed. AI-assisted change: an OpenCode agent materially produced this change; reviewers should verify the event taxonomy, PII exclusions, and tests before merging.