(MODULES-11700) module_ci: source Puppet 9 gem over Twingate for the spec lane#182
Open
imaqsood wants to merge 1 commit into
Open
(MODULES-11700) module_ci: source Puppet 9 gem over Twingate for the spec lane#182imaqsood wants to merge 1 commit into
imaqsood wants to merge 1 commit into
Conversation
…Puppet 9 spec lane Lets the Puppet 9 (8.99.x) spec lane fetch its gem from the internal rubygems repo: pass PUPPET_GEM_SOURCE (inherited from the caller's secret) into the spec job env so the module Gemfile can source it, and add the existing Twingate setup gated to the puppet9 lane + key presence so Puppet 7/8 lanes and repos without the key are unaffected. Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the reusable module_ci.yml workflow so the Puppet 9 spec-test lane can reach an internal Artifactory (via Twingate) to install the Puppet prerelease gem when a calling repository provides the necessary secrets.
Changes:
- Adds
PUPPET_GEM_SOURCEandTWINGATE_PUBLIC_REPO_KEYenvironment variables to the spec job (sourced from caller secrets). - Adds Twingate installation and DNS reconfiguration steps, gated to the Puppet 9 matrix lane and key presence.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+104
to
+108
| # Puppet 9 (8.99.x) prereleases live in an internal rubygems repo; the module Gemfile | ||
| # reads PUPPET_GEM_SOURCE to fetch them. Inherited from the calling repo's secret; empty | ||
| # for repos that don't set it, in which case the Gemfile falls back to puppetcore. | ||
| PUPPET_GEM_SOURCE: ${{ secrets.PUPPET_GEM_SOURCE }} | ||
| TWINGATE_PUBLIC_REPO_KEY: ${{ secrets.TWINGATE_PUBLIC_REPO_KEY }} |
skyamgarp
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Wire the reusable
module_cispec job so the Puppet 9 (8.99.x prerelease) lane can resolve its gem from the internal Artifactory:PUPPET_GEM_SOURCEandTWINGATE_PUBLIC_REPO_KEY(from the calling repo's secrets) into the spec job env. The consuming module's Gemfile readsPUPPET_GEM_SOURCEto fetch the 8.99.x prerelease.artifactory.delivery.puppetlabs.net.Why
Puppet 9 prereleases aren't on the public/puppetcore feeds yet — they live in an internal Artifactory reachable only over Twingate. This lets the Puppet 9 spec lane build against them.
Safety / blast radius
Both new steps are gated on
matrix.puppet_version == '~> 9.0'andenv.TWINGATE_PUBLIC_REPO_KEY != '':TWINGATE_PUBLIC_REPO_KEY/PUPPET_GEM_SOURCEsecrets are unaffected —PUPPET_GEM_SOURCEis empty and the module Gemfile falls back to puppetcore.Context
Unblocks the Puppet 9 support work in
puppetlabs-apache(MODULES-11700), which currently pins itsci.ymlSpec job at this branch.🤖 Generated with Claude Code