Repository navigation
Align Fastly staging store selectors with EdgeZero PR 381 - #1175
Conversation
Move the EdgeZero pin from 8efad3c8 to 657bfdcb. The branch head replaces the edgezero_runtime_env selector store with logical-ID resource links and removes runtime_env_config, so the Fastly entry point now opens trusted_server_config and trusted_server_secrets by logical ID and derives the config key from Fastly's staging signal through EdgeZero's target key rule. Expose the local Viceroy secret store under trusted_server_secrets, drop the runtime selector store from fastly.toml and the integration template, and regress that shape in the config test. Update the Fastly and CLI guides for deterministic config keys, logical-ID links, and the application release that managed deploys now require.
Move the EdgeZero pin from 657bfdcb to 74207863. Upstream fixed the Fastly config key to the logical store ID for production, staging, and local Viceroy alike, removing the `_staging` suffix and `store_key_for_target`. Staging isolation now comes only from the physical Config Store the staging environment selects. Replace `RuntimeStoreConfig::for_target(staging)` with `logical()`, drop the staging signal from both entry points, and update the CLI guide, spec, and plan to describe the fixed key.
The only upstream change since 74207863 hardens immutable release publication in the Fastly CLI deploy path. No public API or runtime contract changed, so this is a lockfile-only update.
The only upstream change since dbb95018 aligns the immutable release verifier with the complete set of adapter-manifest references in edgezero.toml. No public API or runtime contract changed, so this is a lockfile-only update.
The only upstream change since fba2076a scopes the Fastly release verifier and the config push preflight to the selected adapter. A Fastly config push no longer reads the Spin or Cloudflare manifests. No public API or runtime contract changed, so this is a lockfile-only update.
Upstream now parses the live Fastly resource-link types (`config`, `kv-store`, `secret-store`), documents the custom entry point migration, and moves the release verifier into edgezero-adapter, which adds serde, serde_json, sha2, and walkdir edges under its cli feature. No public API used by Trusted Server changed, so this is a lockfile-only update.
The two upstream commits since 4531aeec touch only the deploy action script and a demo lockfile. No crate source changed, so this is a lockfile-only update.
The two upstream commits since 7162b7e2 only reorganize the EdgeZero CI test workflows. No crate source changed, so this is a lockfile-only update.
Upstream replaces the Compute-unsupported version diff snapshot with per-collection reads and drops the parent service ID comparison from the staged-source guard and staging rollback. No public API used by Trusted Server changed, so this is a lockfile-only update.
The only upstream change since fd45db1f corrects the Google Pub/Sub logging snapshot path to the Fastly API's `logging/pubsub` and adds `logentries` to the swept endpoint kinds. No public API used by Trusted Server changed, so this is a lockfile-only update.
The only upstream change since 6258b6b2 switches the Fastly deploy to the current `service resource-link` and `service version` command spellings, removing the CLI deprecation notices. No public API used by Trusted Server changed, so this is a lockfile-only update.
# Conflicts: # crates/trusted-server-adapter-fastly/src/app.rs # crates/trusted-server-adapter-fastly/src/main.rs # crates/trusted-server-integration-tests/fixtures/configs/viceroy-template.toml # fastly.toml
The only crate change since bb4e0040 canonicalizes the Fastly configuration snapshot by sorting object keys before ordering rows, so the drift check no longer fails on Fastly's random JSON key order. No public API used by Trusted Server changed, so this is a lockfile-only update.
The only upstream commit since cf9a96a0 adds a Cargo target cache to EdgeZero's CI. No crate source changed, so this is a lockfile-only update.
The build script asked Cargo to rerun on every file under lib/, including node_modules, which emitted 33,932 rerun-if-changed directives in a 2.8 MB output that Cargo re-checked on every build and invalidated the crate after any npm install. Watch the TypeScript sources, package manifests, and bundler configuration explicitly instead. Measured on an Apple Silicon host with a warm cache: a no-op `cargo check -p trusted-server-js` drops from 1.1s to 0.15s, the script emits 7 directives, touching a node_modules file no longer reruns it, and touching lib/src or package-lock.json still does.
The only upstream commit since 119fbf80 fixes a shellcheck finding in EdgeZero's CI cache action. No crate source changed, so this is a lockfile-only update.
prk-Jr
left a comment
prk-Jr
left a comment
There was a problem hiding this comment.
Summary
The runtime change is small and correct. RuntimeStoreConfig::logical() opens trusted_server_config / trusted_server_secrets by logical ID and reads the config entry under the logical key. That matches what c2e862f links and what validate_fastly_config_key enforces, and local Viceroy plus the integration fixtures now take the same path. One new blocking item is in the upgrade docs. I also agree with the open blocking finding on configuration.md from the earlier review of this head, and I don't repeat it here.
1 of the inline comments below carries a one-click GitHub
suggestion. Use Commit suggestion to apply it.
Blocking
🔧 wrench
- Upgrade checklist doesn't move store selectors into the deploy environment — see inline at
docs/guide/fastly.md:349-351
Cross-cutting / body-level findings
- 📝 Agreeing with existing open items on this head (not repeated inline): the stale
docs/guide/configuration.md"Fastly Runtime Config Store" section (blocking), the stalesettings_data.rsdoc comments, the__KEYrationale atfastly.md:352-354, theEDGEZERO_MANIFESTomission atfastly.md:346-348, and the PR description still naming pin12c3215cwhileCargo.toml/Cargo.lockpinc2e862f4. When you rewriteconfiguration.md, its "Local development" paragraph needs updating too. Atc2e862f,push_config_entries_localwrites[local_server.config_stores.<logical>]regardless of__NAME, so the<resolved-name>wording and the "service-scoped runtime selectors" sentence are both stale.
Local verification (head 870135e8)
cargo fmt --all -- --check: PASScargo clippy-fastly,cargo clippy-cli,cargo clippy-axum: PASScargo test-fastly: PASS (adapter 194 passed, includingruntime_store_config_opens_logical_store_ids_and_key; core 2887 passed)cargo test -p trusted-server-cli --target aarch64-apple-darwin: PASS (includingconfig_push_writes_the_runtime_key_override_without_the_key_flag)cargo test-axum,cargo check-cloudflare,cargo check-spin: PASS- Integration crate
common::configtests (3): PASS - I traced deploy link reconciliation in the pinned EdgeZero source. I did not run it against a live Fastly service.
CI Status
- integration tests: PASS
- browser integration tests: PASS
- integration tests (Fastly EC lifecycle): PASS
- CodeQL: PASS
- cargo test (ts CLI, native): PASS
- format-docs: PASS
- Analyze (javascript-typescript): PASS
- cargo test (cross-adapter parity): PASS
- cargo fmt: PASS
- cargo test (axum native): PASS
- Analyze (actions): PASS
- format-typescript: PASS
- cargo check (cloudflare native + wasm32-unknown-unknown): PASS
- cargo test: PASS
- prepare integration artifacts: PASS
- cargo check/build/test (spin native + wasm32-wasip1): PASS
- Analyze (rust): PASS
- CLAUDE.md symlink guard: PASS
- vitest: PASS
…-381 # Conflicts: # Cargo.lock # Cargo.toml # crates/trusted-server-adapter-fastly/src/main.rs
Correct the upgrade checklist: on Fastly the CLI rejects any config key other than the logical store ID, so a leftover `__KEY` selector makes `ts config push` and `ts deploy` fail rather than writing to a key the runtime ignores. My earlier note had this backwards. Add the selector-migration steps the checklist was missing. Service-scoped `EDGEZERO__SERVICES__<SERVICE_ID>__STORES__…__NAME` entries must move to the unscoped variables in the deploy environment, because an unset selector falls back to the logical ID and links whichever account-level store carries that name, possibly another service's. Also call out `trusted_server_kv`, which the managed deploy links even though the Fastly runtime never opens it. Name `EDGEZERO_MANIFEST` in the managed-deploy step, matching the CLI and getting-started guides. Replace the stale "Fastly Runtime Config Store" section in the configuration guide. It still described the removed `edgezero_runtime_env` selector model, `fastly compute publish`, and `--key` overrides. Its local development paragraph also claimed `--local` writes under the resolved `__NAME`; it writes under the logical ID. Update the matching doc comments in settings_data.rs. Read the sandbox reuse bounds from the application's own config store under its logical ID. They previously came from `edgezero_runtime_env`, which is deprecated and which this branch's pin no longer exposes a constant for. The service-scoped key prefix goes with it, since it only existed to namespace entries inside that shared store.
|
Addressed both reviews in fa0353b and resolved the conflict in c0dc08c. The conflict was a genuine fork, not a textual one
Sandbox bounds moved off the deprecated store
FindingsAll three applied with your wording. On the Verification
To be precise about that last one: |
The skill's guardrails told operators to always pass `--service-id` to `fastly compute publish`. That command now strands a service: it clones the active version's resource links, so the new version lacks the logical links the runtime opens, app config fails to load, and every publisher route returns 500 while `/health` still answers 200. Point the guardrail at the managed deploy instead, and keep the `--service-id` advice for whichever deploy command is used, since a checked-in `fastly.toml` can still pin a dead service.
prk-Jr
left a comment
prk-Jr
left a comment
There was a problem hiding this comment.
Summary
The Fastly runtime bindings match the pinned EdgeZero logical-resource-link and config-key contracts. No runtime correctness regression was found in this review, and all 22 reported GitHub checks pass. The two documentation observations below are nonblocking follow-ups.
Non-blocking
- 🤔 Document the managed-deploy token prerequisite — see inline at
docs/guide/cli.md:224. - 🤔 Preserve config used by legacy staged versions — see inline at
docs/guide/fastly.md:369–371.
Validation
Reviewed the changed files and exact EdgeZero revision 0645339d1848332f4805259d29e3b4b881fccad3. Both proposed documentation replacements pass Prettier; both changed shell scripts pass bash -n. Rust and JS suites were not rerun locally because the remote checks passed. The isolated review worktree is clean.
CI Status
- integration tests: PASS
- browser integration tests: PASS
- integration tests (Fastly EC lifecycle): PASS
- CodeQL: PASS
- cargo test (ts CLI, native) (macos-latest): PASS
- cargo test (axum native): PASS
- CLAUDE.md symlink guard: PASS
- cargo test: PASS (required)
- format-typescript: PASS (required)
- Analyze (rust): PASS
- format-docs: PASS (required)
- cargo fmt: PASS (required)
- Analyze (javascript-typescript): PASS
- cargo check (cloudflare native + wasm32-unknown-unknown): PASS
- cargo check/build/test (spin native + wasm32-wasip1): PASS
- cargo test (cross-adapter parity): PASS
- cargo test (ts CLI, native) (ubuntu-latest): PASS
- prepare integration artifacts: PASS
- vitest: PASS
- Analyze (actions): PASS
- Analyze (python): PASS
- Analyze (javascript-typescript): PASS
dhruv8sh
left a comment
dhruv8sh
left a comment
There was a problem hiding this comment.
Summary
Moves the Fastly runtime to open its config and secret stores by logical ID, with deploy-time resource links replacing the edgezero_runtime_env selector store. It also narrows the trusted-server-js build-script watch set. The runtime change is clean and the EdgeZero claims check out at the pinned rev: validate_fastly_config_key rejects non-logical keys, and managed deploys require --application-release. One operator-safety gap in the upgrade docs needs to close before merge.
2 of the inline comments below carry a one-click GitHub
suggestion. Use Commit suggestion (or Add suggestion to batch for both) to apply them as commits on the PR branch. The remaining comments describe the change in prose because they are questions or judgement calls for the author.
Blocking
🔧 wrench
- A
--stagingconfig push now overwrites the production config when__NAMEis unset (see inline atdocs/guide/fastly.md:363)
Non-blocking
⛏ nitpick / 🤔 thinking
- CLI test comment understates the Fastly behaviour (see inline at
crates/trusted-server-cli/tests/config_store_defaults.rs:139) limit_keys_are_unscoped_app_config_keysonly asserts constants (see inline atcrates/trusted-server-adapter-fastly/src/sandbox.rs:361)deploy = "fastly compute publish"is kept but documented as unused (see inline atedgezero.toml:56)
👍 praise
- Narrowed
rerun-if-changedset inbuild.rs(see inline atcrates/trusted-server-js/build.rs:22)
CI Status
- Analyze (javascript-typescript): PASS
- Analyze (rust): PASS
- Analyze (python): PASS
- Analyze (actions): PASS
- CodeQL: PASS
- CLAUDE.md symlink guard: PASS
- browser integration tests: PASS
- cargo check (cloudflare native + wasm32-unknown-unknown): PASS
- cargo check/build/test (spin native + wasm32-wasip1): PASS
- cargo fmt: PASS (required)
- cargo test: PASS (required)
- cargo test (axum native): PASS
- cargo test (cross-adapter parity): PASS
- cargo test (ts CLI, native) (ubuntu-latest): PASS
- cargo test (ts CLI, native) (macos-latest): PASS
- format-docs: PASS (required)
- format-typescript: PASS (required)
- integration tests: PASS
- integration tests (Fastly EC lifecycle): PASS
- prepare integration artifacts: PASS
- vitest: PASS
|
@aram356 to update to use edgezero 0.0.9 |
Replace the interim `rev =` pin on the unmerged upstream branch with `tag = "v0.0.9"`, the release carrying the merged PR 381 that binds Fastly stores per deployment environment. This closes issue #1195. Verified the tag contains every API this branch depends on (`validate_fastly_config_key`, `resolve_config_store_and_key`, `desired_resource_links`, `store_name_checked`, `owns_managed_deploy`, `require_token`) and the `package-application-release-fastly` action. Review feedback: - Warn that an unchanged `ts config push --adapter fastly --staging` runbook now writes the production entry when the `__NAME` selector is unset, since `--staging` no longer selects a separate key. - Correct the `__KEY` test comment: the Fastly CLI rejects any value other than the logical ID, and the test exercises the Axum adapter, which is why the override applies there. - Replace the sandbox key-shape test with one that captures the keys `collect_raw_limits` actually requests. The previous assertions only compared string constants and could not fail without an edit to the test itself; the sibling tests match on `ends_with`, so a service-scoped lookup slipped past them. - Drop the unused `deploy` command from the Fastly adapter manifest. The schema has it optional and this app always takes the managed path, so leaving it invited a copy into a runbook.
…-381-local # Conflicts: # crates/trusted-server-js/build.rs
|
Pushed EdgeZero
|
Address two review follow-ups on the upgrade and deployment guides. Managed deployment reads a nonempty `FASTLY_API_TOKEN` straight from the process environment through EdgeZero's `require_token`, which a Fastly CLI profile alone does not supply, so the deploy examples now name that prerequisite. The stale-entry cleanup said to delete `*_staging` config entries once no active version reads them, but an older staged version keeps a version-linked selector pointing at `<logical-store-id>_staging`. Deleting the entry while that version is deployed makes its publisher routes return 500, so the checklist now covers active, staged, and rollback versions.
Brings #1175 to 3add18d, which carries main through 5319594 and repins EdgeZero to v0.0.9. Conflict resolutions: - Fastly and Axum entry points keep the RC's request-timing stack and adopt main's reusable sandbox (#1179) and RUST_LOG handling (#1227). Sandbox counters are threaded through send_edgezero_response alongside SendContext, following the shape used in #1261. - tester_cookie.rs takes main's final #1137. - #1175's own docs, CLI test and Viceroy fixture take its new revision. - browser.rs drops the RC-only launch timeout const that main's #1256 now defines.
Brings #1107 to b4a20f4, its first revision in this RC that carries the trace implementation rather than only the spec. Integration decisions: - EdgeZero moves to 78439fd4 on spec/pre-dispatch-request-fidelity. It contains v0.0.9 (#1175) and the pre-dispatch ingress hooks #1107 and #1251 pin at 965d482f; no released tag carries both. - scheduleInitialAdInit takes (bids, slots, auctionDiagnostics, traceAuctionTransport). One builder emits both payloads, so the RC's diagnostics-only scripts are unchanged and trace moves to the fourth argument. recordTrustedServerOpportunity likewise takes auctionFacts then traceIdentity; #1107's positional tests and the bootstrap fallback were shifted to match. - The Fastly trace terminal path sends through the timed delivery function without Server-Timing, sandbox counters or access telemetry. - build.rs embeds trace assets from #1214's private bundle directory. The viewer rebuilds byte-identical; the pinned source digest changes only because build-all.mjs gained --out-dir. - The trace projection does not copy the RC's auction evidence fields, so the classification test marks them excluded. - The retained diagnostics toolbar resyncs its filter select after selectRequest. - Shim size guard raised to 55.5 KB for diagnostics plus trace.
Conflict resolutions: - Fastly imports keep the RC's timing, telemetry and trace imports alongside the version-header imports. - CHANGELOG keeps both sides' entries. - getting-started keeps #1175's managed ts deploy command. ts deploy consumes a prebuilt release, so TRUSTED_SERVER__GIT_VERSION is documented as a build input for the release package rather than a prefix on the deploy command.
Brings in the squash-merged #1213 (9cf3055), replacing the RC's earlier #1213 branch revision. Conflict resolutions: - #1213's own code (middleware Fastly version header, core build.rs, design spec) takes main's final form. - CHANGELOG keeps #1107's entries beside main's. - Fastly main.rs keeps the RC's timing, telemetry and trace imports. - getting-started keeps #1175's managed ts deploy command and the build-input wording for TRUSTED_SERVER__GIT_VERSION.
…-381-merge # Conflicts: # docs/guide/getting-started.md
|
Resolved the This one was semantic rather than cosmetic, so it needed combining rather than taking a side. The two versions of the "Deploy to Fastly" block said different things, and main's contradicted this PR:
Keeping main's command would have reinstated exactly the deploy path this PR removes, and dropping main's paragraph would have lost the version-header guidance. The resolved block sets the variable on the managed I left Also confirmed nothing of this PR was lost in the auto-merged files: the VerificationFull CI gate list re-run on the merge result, not just before it:
|
Brings in the squash-merged #1175 (a0b00c7), #1239 (d2f0d8c) and #1226 (3e85161), replacing the RC's earlier branch revisions. Conflict resolutions: - EdgeZero stays pinned to 78439fd4. Main pins v0.0.9, which 78439fd4 contains; #1107 and #1251 still need its pre-dispatch hooks, and no released tag carries them yet. The lockfile needed no changes. - Fastly main.rs keeps #1107's ingress-capturing signatures, which already carry #1175's logical store selection. - proxy.rs takes #1239's final redirect-limit passthrough test. - AGENTS.md keeps the RC's gate list, which already includes main's wasm clock lint. - getting-started takes main's final #1175/#1213 deploy wording. - Integration-test config.rs and cloudflare.rs keep the RC's trace-aware envelope and readiness-probe helpers, which carry #1226's spawn_with_config_json.
This brings Tech Lab main at fa9837f into the row through split/5. The EdgeZero store selector change (IABTechLab#1175) edited the Fastly entry point in main.rs, which this row moved into lib.rs, so the change is made in lib.rs. edgezero_main now opens the stores by logical ID through RuntimeStoreConfig::logical(), and the runtime_env_config and Hooks imports go with the selector store. main.rs stays the thin binary. The Sourcepoint rewrite (IABTechLab#1183) edited the integration in core, which this row moved into crates/cmp/sourcepoint. Every change it makes is carried into crates/cmp/sourcepoint/src/lib.rs. - Upstream responses stay streaming where the HTTP client supports it, and JavaScript and HTML bodies without Content-Length are rewritten after a bounded collection of at most 5 MiB. - A declared Content-Length over the limit passes through unread, and a body that overflows during collection returns 502 with a warning. - Only bodies whose Content-Encoding is absent or identity are collected, and any other encoding passes through with its bytes and headers unchanged. - /mms/v2/get_site_data asks for identity encoding, and rewritten JavaScript takes the fixed public cache policy only on static bundle paths, while other paths keep the upstream or cookie-aware policy. - The new handler tests come across using the crate's test config, which has no enabled flag, and futures becomes a dev-dependency of the crate for them. The Sourcepoint guide merged without conflict and keeps this row's [cmp] module wording beside the new sections.
4 participants
Summary
EDGEZERO__STORES__<KIND>__<ID>__NAMEdeployment selector to the target version under its logical ID, and the runtime opens stores by that ID.trusted_server_configandtrusted_server_secretsby logical ID in the Fastly entry point and read the config entry undertrusted_server_configfor every target. The upstream branch removedruntime_env_configand theedgezero_runtime_envConfig Store it read, and fixed the Fastly config key to the logical ID; staging isolation comes from the physical store the staging environment selects.trusted_server_secretsand drop theedgezero_runtime_envselector store, so local runs exercise the same store-opening path as a deployed version.ts deploy --adapter fastlypasses a verified application release.trusted-server-jsbuild script. It previously emitted a rerun directive for every file underlib/, includingnode_modules, so any npm install invalidated the crate and Cargo re-checked 33,932 paths on every build.The EdgeZero dependencies pin the immutable commit
0645339d1848332f4805259d29e3b4b881fccad3on the unmerged upstream branch withrev =, somainstays reproducible andcargo updatecannot move it. Issue #1195 tracks replacing the rev with the release tag after the upstream PR merges.Changes
Cargo.toml,Cargo.lock0645339dwithrev =.main.rs,app.rsRuntimeStoreConfig::from_envwithlogical(): logical store IDs and the logical config key for every target. A unit test covers the bindings.fastly.toml, Viceroy integration fixture, template-cache scripttrusted_server_secrets; remove theedgezero_runtime_envmapping.--application-releaserequirement for managed deploys.crates/trusted-server-js/build.rslib/walk with explicitrerun-if-changeddirectives forlib/src, the package manifests, and the bundler configuration. No-opcargo check -p trusted-server-jsdrops from 1.1s to 0.15s and the script emits 7 directives instead of 33,932.Closes
Closes #1174
Test plan
cargo test-fastly && cargo test-axumcargo test-cloudflare && cargo test-spincargo clippy-fastly && cargo clippy-axumcargo clippy-cloudflare && cargo clippy-cloudflare-wasmcargo clippy-spin-native && cargo clippy-spin-wasmcargo check-fastly && cargo check-axum && cargo check-cloudflare && cargo check-spincargo fmt --all -- --check./scripts/test-cli.shcargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test integration local_fastly --target aarch64-apple-darwincargo test --manifest-path crates/trusted-server-integration-tests/Cargo.toml --test parity --target aarch64-apple-darwincd crates/trusted-server-js/lib && npm run buildcd crates/trusted-server-js/lib && npm testcd crates/trusted-server-js/lib && npm run formatcd docs && npm run formatcargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1fastly compute serveChecklist
unwrap()added in production code