Adding changeset sending support to a specified endpoint in new Publisher and other infrastructure updates. by rohit-joy · Pull Request #1058 · CredentialEngine/CredentialRegistry

rohit-joy · 2026-07-17T21:27:03Z

Removed all Argo workflow code, configuration, generated clients, and tests leading to removal of Argo from EKS.
Added full pre-delete content for deleted graphs, resources, and metadata in Changeset.
Restored in-process full envelope ZIP exports.
Replaced shell zip/unzip commands with RubyZip.
Kept changeset generation with a configurable debounce window.
Generated one changeset ZIP with upserts/ and deletes/ folders for graphs, resources, and metadata.
Kept S3 for the full export ZIP and changeset ZIP only.
Added optional POST delivery of the changeset ZIP to a configured external endpoint.
Made external endpoint delivery best-effort so failures do not block the next debounce window.
Added resource delete snapshots to EnvelopeResourceSyncEvent.
Made custom S3 endpoints optional while preserving standard AWS S3 behavior.
Fixed UBI 10, PostgreSQL, Bundler, Docker Compose, schema, and test-database issues.
Updated and expanded tests for ZIP generation, S3 upload, endpoint delivery, delete snapshots, and debounce completion.
Fixed JSON date/time normalization in delete payload assertions.

…ding_registry_changesets.rb Update docker-compose to include needed env variables

excelsior

The Argo removal part looks correct. I found some contractions between the docs and the actual behavior, as well as some regressions in the Docker environment.

Also, there are a few leftovers here and there. I can add a commit taking care of those or just list them in a comment—LMK what would be better.

excelsior · 2026-07-24T21:34:08Z

+- `X-Registry-Changeset-Key`: S3 object key for the ZIP.

-## Changeset Selection
+`REGISTRY_CHANGESET_SYNC_ENDPOINT_TIMEOUT_SECONDS` controls both the connection and response timeout and defaults to 30 seconds. A non-2xx response or network error fails the changeset run and does not advance the synced cutoffs, allowing the job to retry.


A non-2xx response or network error fails the changeset run and does not advance the synced cutoffs, allowing the job to retry.

These statements contradict the implemented behavior. Such failures get swollen here with no re-raise, while being logged and sent to the error tracker. Since that block exists normally, the window closes anyway.

Sending the changeset is not an “essential” functionality for Ruby Registry, but it is “necessary” for new Publisher to keep up to date. So we would rather have Alerts indicating that sending has failed. Hence, the logging without exceptions.

It’s OK when sending the changeset fails. You could perhaps retry sending it 2 more times with a 30-second interval, then give up.

The main thing is that the window should open up to submit new objects for publishing.

I added the suggested retry mechanism and updated the documentation.

Thank you!

@chuang-CE please stress test locally CRUD operations as before, prior to sign off.

excelsior · 2026-07-24T21:41:58Z

-  }
-end
-```
+Delete entries use the same complete JSON document shape as their corresponding upsert entries. Graph and metadata deletes are reconstructed from the pre-destroy envelope version. Resource deletes are snapshotted before resource rows are removed. Older queued resource delete events that predate the snapshot column may still use an identifier/deletion-time marker fallback.


Delete entries use the same complete JSON document shape as their corresponding upsert entries

This seems to contadict the above statement saying that

Delete files contain an identifier and deleted_at timestamp

Would anything break due to this change? We just need a copy of what is going to be deleted in the Changeset ZIP file.

If the full resource can't be recovered, the delete payload is reduced to an identifier+timestamp stub.

@chuang-CE Can you point me to the consumer code to verify whether both formats are supported?

@excelsior
The consumer of the changeset would be ceops:
https://github.com/CredentialEngine/ce-registry/blob/main/ceops/src/ceops/workflows/cli/changeset/apply.py
and
https://github.com/CredentialEngine/ce-registry/blob/main/ceops/src/ceops/workflows/cli/graphdb/repository/update.py

We don’t want to support both formats. Since the deletion is requested by CTID, just put the actual JSON blobs in the ZIP at that moment. Actual deletion time doesn't matter.

Can this not be done?

@chuang-CE Did this not work when you were stress testing deletions?

@rohit-joy I did not have issues with deletions when I was stress testing.

Thanks Cary! The consumer actually only derives the IDs from the paths and ignores the content of the files completely. So yes, both formats are supported. If you simplify the payload, nothing will break.

excelsior · 2026-07-24T21:50:15Z


 COPY . $APP_PATH

-ENTRYPOINT ["/bin/bash", "-c", "set -euo pipefail && \


Removing the migration step breaks the test intructions for the agents, since the commands there imply that the database already has the necessary schema.

Feel free to add it back. I found it more convenient and transparent to do it myself.

I updated the agents instructions instead because the CI runs the migrations explicitly too.

Great, then let’s leave it out.

excelsior · 2026-07-24T21:56:48Z

+  end
+
+  def s3_resource_options
+    options = { region: ENV.fetch('AWS_REGION') }


Making the AWS region lookup strict breaks docker compose which has an empty AWS_REGION variable.

Are changesets created and saved in S3 successfully? Would any thing break due to this change?

EKS is safe, because it injects AWS_REGION.

The problem only exists in the docker compose environment. It needs to be addressed only If you use it outside EKS.

Ok, go ahead and fix the docker compose and docker for testing.

rohit-joy · 2026-07-30T22:01:51Z

Thank you, @excelsior and @chuang-CE! Onwards to deployment. :)

rohit-joy and others added 3 commits July 15, 2026 10:00

Update to send changesets to external endpoint.

04f4327

Update def s3_resource to take in additional env variable in sync_pen…

fc9b736

…ding_registry_changesets.rb Update docker-compose to include needed env variables

Add deleted objects in the deletes folder instead of manifest.

ef62aaa

rohit-joy requested a review from chuang-CE July 17, 2026 21:31

edgarf requested a review from excelsior July 23, 2026 05:56

excelsior reviewed Jul 24, 2026

View reviewed changes

excelsior added 2 commits July 29, 2026 05:18

Retry failed changeset deliveries twice before advancing

c6ec0fd

Add migration step to AGENTS.md

b13a1f0

excelsior approved these changes Jul 29, 2026

View reviewed changes

Default AWS region to us-east-1 in docker compose

5b45118

chuang-CE approved these changes Jul 30, 2026

View reviewed changes

chuang-CE merged commit 32ffd06 into master Jul 30, 2026
12 checks passed

chuang-CE deleted the rjoy/test-registry-2 branch July 30, 2026 20:51


		COPY . $APP_PATH

		ENTRYPOINT ["/bin/bash", "-c", "set -euo pipefail && \

Uh oh!

Conversation

rohit-joy commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

excelsior left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rohit-joy Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chuang-CE Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rohit-joy Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rohit-joy commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rohit-joy commented Jul 17, 2026 •

edited

Loading

rohit-joy Jul 25, 2026 •

edited

Loading

chuang-CE Jul 29, 2026 •

edited

Loading

rohit-joy Jul 29, 2026 •

edited

Loading