diff --git a/.gitmodules b/.gitmodules index d396e03..27c0cee 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,4 +1,4 @@ [submodule "vendor/sluiceway"] path = vendor/sluiceway url = https://github.com/sluiceway/sluiceway.git - branch = v0.46.0 + branch = v0.47.0 diff --git a/src/content/docs/hosted-app/install.mdx b/src/content/docs/hosted-app/install.mdx index 583f8f8..c142589 100644 --- a/src/content/docs/hosted-app/install.mdx +++ b/src/content/docs/hosted-app/install.mdx @@ -64,6 +64,7 @@ These are the permissions the app asks for, and what each one is used for. | Deployments | Read and write | Reading the deployment records. Opening a record for a tick that goes through the app. | | Actions | Read and write | Reading workflow runs. Starting your Sluiceway workflow for a tick or a rescan that goes through the app. | | Contents | Read and write | Reading the repo for the onboarding pull request, and `sluiceway.yaml` at a commit. Writing one branch with one commit for a pull request the app opens. | +| Checks | Read | Reading a stack's preview page when `sluiceway preview` asks for it, to hand it on. Until an org accepts it, `preview` fails there and says so. | | Pull requests | Read and write | Opening the onboarding pull request and the pull requests of edit mode. Reading when a merged pull request was merged, for Insights. | | Members (organization) | Read | Checking that a person is an admin of the org before they change the plan. | diff --git a/src/content/docs/hosted-app/what-the-app-keeps.mdx b/src/content/docs/hosted-app/what-the-app-keeps.mdx index 625bcaf..336c1e8 100644 --- a/src/content/docs/hosted-app/what-the-app-keeps.mdx +++ b/src/content/docs/hosted-app/what-the-app-keeps.mdx @@ -38,6 +38,9 @@ for that shape. - **No resource name, property path, diff or value.** Not in its database, not in its pages, not in the pull requests it opens. A row in the app shows counts, and the changes are on GitHub. + When `sluiceway preview` asks for a stack's + changes, the app reads its preview page from GitHub at that moment, hands it on, and keeps + none of it. - **No text of a row, an issue title or a status description**, and of a merged pull request nothing but its commit and time: no number, title, description, branch or author. - **None of your repo's files.** For the onboarding pull request and to explain a failed first diff --git a/src/lib/command-line.ts b/src/lib/command-line.ts index af2a3e7..520c1c7 100644 --- a/src/lib/command-line.ts +++ b/src/lib/command-line.ts @@ -197,6 +197,93 @@ export const EXAMPLES: ExampleGroup[] = [ }, ], }, + { + heading: "`sluiceway preview`", + intro: + "Every change of the stack's preview, read from its preview page on GitHub through the app: the policies, the changes with each path whole and the values `dashboard.showValues` shows, and the drift. A destroy is in capitals. With `--json`, the app's answer as it came.", + examples: [ + { + command: "sluiceway preview infra apps/api:prod", + words: [ + "apps/api:prod in acme/infra: 1 update, 1 replace", + "Preview page: https://github.com/acme/infra/runs/48213301, of 0a1b2c3, written at 2026-09-26T08:00:00.000Z", + "", + "Policies", + " warning tags · the queue has no team tag", + "", + "Changes", + " REPLACE aws:rds/instance:Instance main · forced by engineVersion · also changes tags.team", + " update aws:lambda/function:Function api · memorySize 128 → 256, timeout nothing → 30", + " create + import aws:sqs/queue:Queue jobs", + "", + "Outside the code", + " changed aws:ec2/securityGroup:SecurityGroup web · ingress[0].cidrBlocks[0]", + ].join("\n"), + exit: 0, + }, + { + command: "sluiceway preview infra apps/api:prod --json", + schema: "Preview", + json: { + stack: "apps/api:prod", + repo: "acme/infra", + page: { + name: "sluiceway / apps/api:prod", + url: "https://github.com/acme/infra/runs/48213301", + sha: "0a1b2c3d4e5f60718293a4b5c6d7e8f901234567", + at: "2026-09-26T08:00:00.000Z", + }, + title: "apps/api:prod: 1 update, 1 replace", + policies: [ + { result: "warning", namespace: "tags", message: "the queue has no team tag" }, + ], + changes: [ + { + action: "replace", + tracking: null, + type: "aws:rds/instance:Instance", + name: "main", + properties: ["engineVersion", "tags.team"], + forcedBy: ["engineVersion"], + values: [], + }, + { + action: "update", + tracking: null, + type: "aws:lambda/function:Function", + name: "api", + properties: ["memorySize", "timeout"], + forcedBy: [], + values: [ + { path: "memorySize", old: "128", new: "256" }, + { path: "timeout", old: null, new: "30" }, + ], + }, + { + action: "create", + tracking: "import", + type: "aws:sqs/queue:Queue", + name: "jobs", + properties: [], + forcedBy: [], + values: [], + }, + ], + drift: [ + { + action: "changed", + type: "aws:ec2/securityGroup:SecurityGroup", + name: "web", + properties: ["ingress[0].cidrBlocks[0]"], + }, + ], + unlisted: 0, + unread: 0, + }, + exit: 0, + }, + ], + }, { heading: "`sluiceway tick`", intro: diff --git a/src/lib/pages.ts b/src/lib/pages.ts index 8270ff6..577214a 100644 --- a/src/lib/pages.ts +++ b/src/lib/pages.ts @@ -658,7 +658,7 @@ export function pages(repoUrl: string, base: string): Page[] { title: titleOf("docs/command-line.md"), sidebarLabel: "Command line", description: - "Install the sluiceway command, sign in with a token from the app, then check status, tick, rescan and change settings, with --json and exit codes for agents.", + "Install the sluiceway command, sign in with an app token, then read status and previews, tick, rescan and change settings, with --json and exit codes.", source: "docs/command-line.md", headerPicture: { picture: "deploying-2", diff --git a/vendor/sluiceway b/vendor/sluiceway index 25ac88c..088bd49 160000 --- a/vendor/sluiceway +++ b/vendor/sluiceway @@ -1 +1 @@ -Subproject commit 25ac88cbea47e23d0e0ce618fbdbd01cce7168b9 +Subproject commit 088bd497c52d3e65b9e5478d3394206cff2c4e0e